RITICAL NFRASTRUCTURE 

ROTECTION TRATEGIC 

IMULATION EPORT

This report was prepared for the President’s Commission on Critical Infrastructure Protection. 

The report represents the opinions and conclusions solely of its developer, Booz-Allen & 

Hamilton. The Commission has not made a judgment on, nor should the publication of this 

document be taken to represent an endorsement by the Commission for the content of the 

material contained herein.

Report to the 

President’s Commission 

on Critical Infrastructure Protection

1997
 TABLE OF CONTENTS 

I. STRATEGIC SIMULATION FOR THE PRESIDENT’S 

 COMMISSION ON CRITICAL INFRASTRUCTURE PROT (PCCIP)

II. INDUSTRY CONCERNS AND RECOMMENDATIONS III. INSIGHTS AND OVERVIEW OF INDUSTRY SECTORS 

 IV. GOVERNMENT TEAM INSIGHTS  V. SIMULATION OBSERVATIONS  VI. NEXT STEPS 
I-1 

 Strategic Simulation ... 

THE PCCIP STRATEGIC SIMULATION PROVIDED AN OPPORTUNITY FOR THE COGOVERNMENT AND INDUSTRY PARTICIPANTS TO EXAMINE THE EFFECTIVENEPROPOSED POLICIES AND PROCESSES TO PROTECT THE NATION’S CRITICAL INFRASTRUCTURES AND PROMOTE ECONOMIC OBJECTIVES 

• PCCIP SPONSORED THIS SIMULATION–WITH PARTICIPATION BY BOTH 

GOVERNMENT AND INDUSTRY LEADERS–TO CRITICALLY ASSESS THE COMMISSION’S POTENTIAL RECOMMENDATIONS 

• THE OBJECTIVES OF THE SIMULATION WERE TO ASSESS ALTERNATIV

APPROACHES TO TWO KEY QUESTIONS:– How can national security, economic competition and societal benefit be p

through U.S. policy regarding the critical infrastructures? 

– How should the relationship between Government and business be establ

promote mutual objectives? 
I-2 

PCCIP Recommendations ... 

THE COMMISSION PROVIDED DRAFT RECOMMENDATIONS FOR CRITICAL INFRPROTECTION TO REDUCE VULNERABILITIES AND TO BE ABLE TO ADDRESS POTHREATS 

• Develop a new, streamlined Federal Agency which would be responsible for al

owners, operators, and users of critical infrastructures to existing or potential th

• Set standards for security (in concert with Industry) and negotiate agreements 

countries dealing with security standards 

• Define increased liability requirements of critical infrastructure owners and ope

service failure when standards have not been met 

• Provide Federal assistance in enhancing information and communications sec

promoting the development of private sector initiative 

• With Industry advice, identify technology needs to assure critical infrastructure

transfer existing technology already in Federal hands to Industry and fund needevelopment 

• Support a private sector organization to certify products and accredit practition

infrastructure assurance 
I-3 

PCCIP Recommendations ... 

THE COMMISSION PROVIDED DRAFT RECOMMENDATIONS FOR CRITICAL INFRPROTECTION (CONTINUED) 

• Administer a series of direct incentive programs, consisting of technology trans

guarantees, etc., designed to motivate business investment in infrastructure pr

• Expand the Federal role in enforcing laws designed to protect critical infrastruc

negotiate international agreements to facilitate the investigation and prosecutiocrime 

• Promote the awareness of the general public and Industry’s awareness of the 

increase attention to critical infrastructure security 

• Increase training opportunities for owners, operators and users of critical infras

detecting and countering intrusions and in mitigating their effects 
I-4 

Strategic Simulation ... 

TEAMS REPRESENTING CONGRESS, THE EXECUTIVE BRANCH, STATE GOVERN“REPRESENTATIVE” COMPANIES – REPRESENTING THE SIX SECTORS OF TRATELECOMMUNICATIONS, UTILITIES, HEALTHCARE, WATER, BANKING AND FINAINTERACTED OVER 3 DAYS 

Control

State and Local

Rapid Transit

Vitesse ICS

OASIS

Pioneer

Olympus Edison

Kleingeld

Executive

Congressional

PCCIP

• Facilitated simulation teams • Played  – The President  – Companies not in simulation  – Threats  – International Issues  – Intelligence functions• Developed policy initiatives and 

recommended courses of action 

• Identified and categorized threats to economic  and national security 

• Assessed current and future operating 

 environment 

• Assessed government policies and regulations • Developed future investment and operating  strategy  – Considered current level of “threat” and...  – Determined vulnerabilities  – Determined investment strategy • Lobbied Congress, State and Local and  Executive

• Developed regulatory processes for local commerce • Provided for emergency response and recovery • Interacted with federal government 

• Developed legislation • Assessed budget and de impacts • Considered legal and reg initiatives • Assessed Industry and s
I-5 

Strategic Simulation ... 

THE SIX INDUSTRY TEAMS WERE REPRESENTATIVE OF KEY NATIONAL INFRASSECTORS 

COMPANY DESCRIPTION 

OASIS OASIS provides water services to the City of Los Angeles. Services are provided to over 640,000 customers in 

water comes from the watershed areas of the Eastern Sierra Mountains. 15% of the water comes from ground Valley and the remaining 10% is purchased from the Metropolitan Water District of Southern California. OASIS gallons of water per day to the city of Los Angeles to satisfy the daily 188 gallon per person demand. To tap thEastern Sierra mountains an aqueduct system was developed in 1940. Today that system has extended to oveof moving 430 million gallons of water per day. 

Vitesse ICS Vitesse ICS owns, operates, and maintains wireline and wireless communications networks for the local and lo

data, and video. Devises markets, and provides electronic communications products and services for a diverse international residential, Government, and business clients. Products and services offered include POTS, enhaservices, personal communications services, paging and specialty mobile services, Internet access, interactive 

Pioneer Pioneer Inc., is the nation's largest provider of healthcare services with facilities in 38 states, as well as, recent 

facilities in England, Switzerland, and Spain. Pioneer's network includes 331 hospitals, 129 surgery centers, mlocations, and a nationwide pharmacy benefit management company. One of Pioneer’s key assets, is the elecPioneer maintains the largest database of inpatient and outpatient electronic patient records. During the last yetargeted toward the initialization of an intranet “telemedicine” network. 

Kleingeld Kleingeld Bank, headquartered in New York City, is the nations largest bank company with over $300 billion in 

and wholesale services, but has since expanded into a wider range of financial services to include private bankequity underwriting, foreign underwriting, mortgage banking, credit cards, U.S. corporate and international bankorder to offer this range of financial services, Kleingeld is a member of Industry utility organizations, to include Reserve, Depository Trust Company and the major exchanges . 

Rapid Transit Rapid Transit is the largest fully integrated transportation company in the United States servicing 45,000 comm

in Chicago, Illinois, Rapid Transit has an extensive fleet of aircraft, trucks, and ships to transport cargo to more 

globe. Rapid Transit has made extensive use of advanced computer and communication technologies includinline communications, and EDI capabilities for tracing, tracking, documentation and billing. This extensive relianenabled Rapid Transit to provide more comprehensive and faster service with a greater reliability. 

Olympus Edison Olympus Edison is one of the nation’s largest investor-owned electric utilities. It generates, transmits and distr

residential and commercial customers in the Atlanta, Georgia, area. In addition, it offers wholesale power sales and operates a system of nuclear, coal, oil, natural gas and hydroelectric power stations. The distribution of thcoal, 20% nuclear, 15% gas, 8% hydroelectric, 3% oil and 3% purchased power. The variety of power stations system reliability, and service to customers, in case of a major problem in one of these areas. In 1996, Olympuof 52.4 billion kwh, with 17.7 billion kwh in residential sales. Olympus Edison is regulated by the Public Service Nuclear Regulatory Commission; and the Federal Energy Regulatory Commission. 
I-6 

Strategic Simulation ... 

INDUSTRIES BELIEVE THEIR ABILITY TO PROTECT THEMSELVES AGAINST TODIS ADEQUATE. HOWEVER EMERGING TECHNOLOGY AND INDUSTRY DEREGULPROVIDES AN INTERDEPENDENT SYSTEM WITH NEW POINTS OF VULNERABILTIME WHEN NEW THREATS ENTER THE INFORMATION AGE 

• Industry teams were presented with a series of escalating threats designed to 

Commissions recommendations and challenge industry decision makers to invseek assistance in infrastructure protection 

Government Policies Move 1

Information Sharing 

Technical Assistance 

Threat Environment

Hacker Intrusion 

Indications of bigger threa

Government Policies Move 2

Technical Assistance 

Liability 

Emergency Response 

Threat Environment

Inside-Outside Threat 

An increased “Cyber” Thre

Physical Terrorism 

Government Policies Move 3

Information Sharing 

Technical Assistance 

International Agreements 

Threat Environment

Increased Inside-Outside Th

Offshore cyber crime 

Government Policies Move 4

Technical Assistance 

Emergency Response 

Reconstitution 

Threat Environment

State Sponsored Threat 

Offshore origin of thefts 

Chem/Bio terrorism 
I-7 

Strategic Simulation ... 

THE SIMULATION WAS PLANNED IN A SERIES OF 2 MOVES OVER 3 DAYS–EACH REPRESENTED 1 TIME PERIOD 

• Move 1 examined commission recommendations with current infrastructure thr

Real Time Monday Tuesday

SIMULATION TIME HORIZON

1998 2000.6

MOVE 1

1997 1999

MOVE 2

Simulation Time

• Teams reviewed policy  and Initiatives • Recommended changes • Considered industry  strategies and investment

• Threat heightened • Investment strategies  challenged • Policy, regulation • Government tensions  and actions

• Move 2 examined globally connected infrastructure, deregulated energy netwo

new Air Traffic Control system against more organized, technically capable thr
I-8 

Strategic Simulation ... 

INDUSTRY TEAMS WERE TASKED TO ASSESS STRATEGIES FOR PROTECTING INFRASTRUCTURE. THE INDUSTRY TEAMS’ FINDINGS WERE EVALUATED AGA

• The current environment of the Industry (as well as trends and issues curren

Industry e.g., deregulation, international competition, downsizing, etc.) 

• The vulnerabilities and threats which serve as plausible scenarios with opera

economic impacts, and can effect public confidence for the Industry 

• Competing financial demands of the companies, including the costs of increa

protective levels in the infrastructure, as well as the costs associated with loss confidence, and assessed vulnerabilities 

• The emergency response and recovery capability of the critical infrastructure 

together with federal, state, and local government agencies 
THE FOLLOWING IS A COMPILATION OF THE INDUSTRY PLAYER’S OVERALL 

THE SIMULATION AND DURING THE POST GAME INTERVIEWS WITH SELECTED IN RELATION TO THREATS ON THE CRITICAL INFRASTRUCTURE ASUGGESTIONS ON HOW TO IMPROVE THE CRITICAL INFRASTRUCTURE
II-1 

Industry Concerns and Recommendations ... 

INDUSTRY IS CURRENTLY FACED WITH THE OPTION OF PROTECTING THEIR OINFRASTRUCTURE OR ACCEPTING GOVERNMENT REGULATIONS AIMED AT MAPROTECTIVE MEASURES. BOTH OPTIONS HAVE INDUSTRY CONCERNED 

• Government does not currently provide Industry with adequate information on t• Information sharing deficiencies highlight need for new processes as the curre

inadequate 

− Information flows from Industry to Government (e.g., security problems) 

− Very little information in a form usable to management flows from Governm

(e.g., early warnings about possible terrorist activities, and forecast threat 

• Industry feels that the traditional DoD and Intelligence agencies are not 

structured/equipped to share threat data with Industry 

– Representatives from the six industries shared numerous instances of law 

enforcement agencies withholding potentially relevant threat data or collecdata from the organizations in question and not sharing results/outcomes 

• Industry is concerned that increased regulation will lead to increased operating 

– Reporting requirements – Increased investment in technology – Increased security measures 

• Regulatory requirements cause problems: 

– Regulation may result in increased costs for Industry – Regulations are slow to respond to the changing environment – Regulations can produce proprietary problems 
II-2 

Industry Concerns and Recommendations ... 

INDUSTRY RECOMMENDATIONS TO THE PCCIP WERE MORE CLEARLY DEVELOTHE UNDERSTANDING OF A REAL THREAT WAS HEIGHTENED. INFORMATION EDUCATION, AND INCREASED RESEARCH AND DEVELOPMENT WERE AT THE FTHOSE RECOMMENDATIONS 

• Information sharing is essential and must be conducted on a voluntary basis to 

existing vulnerabilities and potential threats 

– There is a perception that Government is not divulging all they know about 

threat 

– Industry is reluctant to share proprietary data with Government agencies 

• Government’s proposed process for Industry to participate in “information shar

to be better defined 

– A feedback mechanism needs to be established for information sharing – Government must establish mechanisms to ensure proprietary data is not 

released and it is non-attribution (no company names provided) 

– Ensure a level playing field - all competitors must provide the same level o

information, and small businesses must be included 

– Clarify which agency or committee will have overall responsibility for the 

information 

• Industry prefers to build on existing mechanisms and organizations. If this is n

Industry would like to provide input into, and play an active role, in the developregulations 

– If a new agency is needed, the Industry wants to actively participate in the 

development and ongoing activities of the new agency 
II-3 

Industry Concerns and Recommendations ... 

GOVERNMENT MUST GAIN THE TRUST OF INDUSTRY THROUGH A OPEN, HONEINFORMATION SHARING EFFORT 

• Develop a shared information mechanism between Government and Industry r

transportation, water, power, telecommunications, banking, healthcare sectors agencies like NSA, FBI, CIA etc. This Industry/Government partnership must bbased on trust. This trust is fostered through free and open communication 

– The ultimate goal is stability and continuity of critical infrastructures via edu

and awareness in these areas: ·· Development and maintenance of current “day to day” Industry securi·· Long range planning ·· Response to escalation of crisis mode 

– The mechanism should serve as a single point of contact for Industry to ob

vulnerability and threat information. Its mandate would be to focus on critiinfrastructure issues and interdependencies between these industries 

– Provide early warning on critical threat data to Industry for risk manageme

develop emergency response capabilities 

– Structure of mechanism: 

·· Associations have a “seat” and are represented by certain companies 

rotating basis. Selection is based on a set criteria per each Industry se

·· Participation should be inclusive not exclusive and all participants sho

sign non-disclosure agreements among each other 

·· Participants make an investment of time and money to ensure Industr

− Conduct analysis and risk assessments and transfer this information to Ind− Coordinate data transfer among Government agencies and Industry assoc
II-4 

Industry Concerns and Recommendations ... 

RESEARCH AND DEVELOPMENT HAS BEEN A CONCERN FOR INDUSTRY FOR MAND THE FEDERAL GOVERNMENT SHOULD TAKE A MORE ACTIVE AND INVOLV

• Government should assist in R&D efforts for interdependent Industry issues 

− Industry needs as much information from Government, in a usable form, a

as possible to mitigate any threats or vulnerabilities and to identify trends 

− Incentives must be provided from Government (e.g., tax credits) if Governm

requires higher levels of protection than is required for normal business pr

• The Industry teams felt that the Government possesses the best technical exp

information security and that expertise needed to be made accessible to IndusGovernment should: 

– Provide assistance in developing Industry led security standards – Transfer existing security technology – Sponsor R&D to develop protective technologies 

• Government could expand the role of NSA penetration testing in key infrastruc

– Should also consider a role for NSA in supporting test and certification of I

standards 

• Government should conduct a credible analytical process of the vulnerabilities 

– Need specific numbers: probability of occurrence and cost prevention estim

for identified threats 

– Industry needs this information before they commit resources – Identify points-of-entry for attacks on the infrastructure 
II-5 

Industry Concerns and Recommendations ... 

RESEARCH AND DEVELOPMENT HAS BEEN A CONCERN FOR INDUSTRY FOR MAND THE FEDERAL GOVERNMENT SHOULD TAKE A MORE ACTIVE AND INVOLV(CONTINUED) 

• In the long term, government needs to develop improved security measures 

– Conduct security audits, sponsor testing and verification studies – Offset Industry costs to improve security by providing incentives which rea

defined “best-in-class”, security level 

• Structures do not need to be changed or adapted; however, intra-agency com

within the Government needs to be increased and made more efficient 

− All industries need to incorporate cross-Industry risks into their strategic pl
II-6 

Industry Concerns and Recommendations ... 

TO MAINTAIN INFRASTRUCTURE SECURITY THE FEDERAL GOVERNMENT HAS AN INFORMATION SHARING MECHANISM. INDUSTRY, THOUGH INITIALLY SKEPPROVIDED A SERIES OF CONCRETE SUGGESTIONS 

• Industry felt that the primary Government role should include information shari

coordination, information exchange and education 

– In doing so, Government should attempt to work through existing Industry 

organizations/associations 

• Government should share threat/intrusion/vulnerability data with Industry to as

existing risk management process 

• Industry representatives felt that there would be benefit to sharing information 

among the critical infrastructures 

– The team proposed a three tier structure with Industry voluntarily feeding s

data into an Industry organization/association who in turn feeds data into ninformation coordinating activity 

– Industry must see benefit from this activity i.e., a two-way information flow 

participation 

– Due to the speed of these events this mechanism must happen at near rea

• Lack of appropriate threat information from the Government results in an inabi

develop appropriate risk assessment model and countermeasures 
II-7 

Industry Concerns and Recommendations ... 

THE ONE COMMON THREAD BETWEEN INDUSTRIES IS THE NEED TO SUSTAIN CONFIDENCE IN THE CRITICAL INFRASTRUCTURE. BOTH INDUSTRY AND THE PUBLIC MUST BE EDUCATED ABOUT THE THREATS TO THE INFRASTRUCTUREIS ONE VEHICLE THAT CAN ACTIVELY PROMOTE THE INFRASTRUCTURE SECUPROTECTION 

• Use trade associations as a vehicle to educate the public on infrastructure thre

as sources for information to the Government 

• Promote seminars and classes through the education system to develop a wor

will not be susceptible to foreign or domestic intruders to the infrastructure and instinct of public service (i.e. bankers and engineers, like other professional seproviders, should have codes of conduct) 

• Provide grants to education systems for the development of infrastructure prot

systems 
III-1 

Insights and Overview of Industry sectors ... 

THE INDUSTRY TEAMS VOICED COMMON CONCERNS AND SOLUTIONS IN RELAINFRASTRUCTURE PROTECTION, BOTH DURING THE GAME AND AT THE FOLLOINTERVIEWS 

• Common concerns 

– Who pays for the increase in infrastructure protection? – Liability for attacks on the infrastructure – The creation of another government regulatory agency in an environment 

perceived as already over-regulated 

– The desire for Industry based standards vs. government requirements or 

standards 

– The issue of law enforcement reaction to infrastructure attacks 

• Common solutions 

– Increased, government sponsored, education on infrastructure threats – Increased Government funding for R&D technology to protect infrastructur– Government-funded incentives for Industry led initiatives to protect their 

infrastructure 

– Increased two way communication on threat specifics – The formation, or expansion of a National Infrastructure Coordination Cent

(NICC) or equivalent agency that contains Government (Federal, State anas well as Industry representation 

THE FOLLOWING SECTION CONTAINS AN INDUSTRY SPECIFIC PERCEPTION ON INFRASTRUCTURE THREATS AND SPECIFIC SOLUTIONS TO SAID THREATS 
III-2 

Water Team Insights ... Oasis 

THE OASIS TEAM WAS CONFIDENT OF THEIR ABILITY TO USE THE EXISTING RPLANS IN CONJUNCTION WITH STATE AUTHORITIES 

• The infrastructures which support the water supply Industry are largely indepen

therefore less susceptible to direct nation wide threats. The greatest current thpresented by a physical attack on a specific data system and cyber threats direagainst other elements of the infrastructure 

• While a particular threat with cascading effects across the country is highly unl

affects of an attack on the water Industry present serious consequences which public confidence 

• Due to the expansive watershed areas from which water supply companies dra

water, it is virtually impossible to actively protect all suppliers from a terrorist at

• The water resources are protected from many biological or chemical threats by 

contaminants providing the water flows into and through the processing and filtsystem 

• The water supply Industry is now adequately regulated by federal and state leg

protect the water supply, mandate water quality, and oversee discharge proces
III-3 

Water Team Insights ... Oasis 

WATER SUPPLY COMPANIES OPERATE INDEPENDENT INFRASTRUCTURES IN A MONOPOLISTIC ENVIRONMENT, THUS CREATING AN INDUSTRY WITH SPECIFIC 

• The water Industry is more concerned with how an attack on other infrastructu

banking, telecommunications and power, will effect the water supply 

• Existing government agencies effectively regulate water supplies. Governmen

utilize existing agencies and legislation to protect the infrastructure 

• Government sponsored R&D can improve detection and treatment processes f

Industry 
III-4 

Water Team Insights ... Oasis 

OASIS IS INTERESTED IN DEVELOPING BETTER AVENUES FOR EMERGENCY RBETWEEN INDUSTRY AND STATE GOVERNMENT. THE FEDERAL GOVERNMENT HAVE A LIMITED ROLE IN REACTION TO A SITUATION, THEY CAN HOWEVER PRSERVICES TO THE WATER SUPPLY INDUSTRY 

• The government should provide Industry information concerning the real threat

vulnerabilities to the infrastructure 

– Grant clearances to Industry security personnel so they can know the thre

which face their companies 

– Develop interchange between military agencies, the creators of viruses an

chemicals, and let water Industry know what agents pose threats to the wa

• The water Industry believes that the need to replace the aging infrastructure is 

critical current problem 

• Sponsor technology transfer and research into rapid detection, investigation an

responsiveness to biological, toxic, or cyber threats 
III-5 

Water Team Insights ... Oasis 

THE WATER INDUSTRY CONSIDERED THE AGING INFRASTRUCTURE THE GREATO THE INDUSTRY. THEREFORE, THE FOLLOW-UP CONCENTRATED ON WAYS THE SYSTEM REPAIR AS WELL AS WAYS TO RESPOND TO EMERGENCIES OR A

• Sequester 5% from the budget for infrastructure improvement on a regular bas

maintenance and repair; process should remain constant 

• Creation of more State Revolving Funds (SRF’s) to pay for infrastructure repai

currently used in large cities but should be expanded to include smaller commu

• Further development in Standardized Emergency Management Systems to de

natural emergencies, telecommunications and power 

• Support and increase the use of volunteer systems in response to attacks, this 

awareness and accrues costs only when used 

THOUGH THE WATER INDUSTRY AND ITS INFRASTRUCTURE IS LARGELY REGIFEDERAL GOVERNMENT COULD PROVIDE SERVICE IN THE AREAS OF R&D, INFSHARING AND EDUCATION 

• Sponsor technology transfer and research into rapid detection, investigation an

responsiveness to biological, toxic or cyber threats 
III-6 

Water Team Insights ... Oasis 

THE WATER INDUSTRY CONSIDERED THE AGING INFRASTRUCTURE THE GREATO THE INDUSTRY. THEREFORE, THE FOLLOW-UP CONCENTRATED ON WAYS THE SYSTEM REPAIR AS WELL AS WAYS TO RESPOND TO EMERGENCY ATTACACCIDENTS...(CONTINUED) 

• Grant clearances to Industry security personnel so they can access data on In

threats from Federal sources and develop interchange between security agencwater industries 

• Use trade associations (i.e. American Water Works Association) as a vehicle t

the public on infrastructure threats as well as sources for information to the gov
III-7 

Telecommunication Team Insights ... Vitesse 

THE TELECOMMUNICATION INDUSTRY IS HIGHLY COMPETITIVE AND IS CONCETHE PROSPECT OF HAVING TO SHARE VULNERABILITIES AND INTRUSIONS WIGOVERNMENT AND OTHER INDUSTRY PLAYERS 

• Vitesse was not initially convinced that the telecommunications infrastructure is 

to current and foreseeable threats 

• Users of telecommunication services are generally aware of a certain level of r

telecommunication Industry cannot provide absolute guarantees on system se

• Industry, or their association counterpart, should establish teams which try to in

disrupt their systems and work with the vendors and customers to reduce the ivulnerabilities 

• Industry remains convinced that they themselves can solve this problem and th

the most qualified to identify and remedy threats to their own system 
III-8 

Telecommunication Team Insights ... Vitesse 

THE TELECOM INDUSTRY IS OPPOSED TO MORE REGULATION AND BELIEVES HAS BEEN DONE BY THE INDUSTRY TO PROTECT ITS INFRASTRUCTURE. HOWGAME DID DEMONSTRATE POTENTIAL WEAKNESSES AND THE INDUSTRY PROSEVERAL SUGGESTIONS TOWARD IMPROVEMENT AS WELL AS STATE REQUIRTHEY BELIEVE THE COMMISSION MUST MEET TO ENSURE COOPERATION AND IMPROVEMENT IN INFORMATION SHARING 

• Industry and their association counterparts should establish teams which try to 

disrupt their systems, then work with the vendors and customers to reduce the vulnerabilities 

• Allow industries to improve their own security but allow them to recoup the cos

increased security from the government via State or Federal agencies such as Communications Commission (FCC) 

• Government should consider research in technological issues such as unbund

location difficulties 

• Liability issues 

– Users must be part of the liability negotiations – Other industries must report intrusions - currently few do – Federal agencies must pursue and prosecute violators 
III-9 

Telecommunication Team Insights ... Vitesse 

THE TELECOM INDUSTRY IS OPPOSED TO MORE GOVERNMENT AND BELIEVES HAS BEEN DONE BY THE INDUSTRY TO PROTECT ITS INFRASTRUCTURE. HOWGAME DID DEMONSTRATE POTENTIAL WEAKNESSES AND THE INDUSTRY PROSEVERAL SUGGESTIONS TOWARD IMPROVEMENT AS WELL AS STATE REQUIRTHEY BELIEVE THE COMMISSION MUST MEET TO ENSURE COOPERATION AND IMPROVEMENT IN INFORMATION SHARING (CONTINUED) 

• Any government agency dealing with information sharing and regulation must c

following issues: 

– Incorporate existing studies in their vulnerability estimates (i.e., SS-7, a sta

that defines the procedures and protocol by which network elements in the switched telephone network (PSTN) exchange information over a digital sinetwork to effect wireless (cellular)and wireline call setup, routing and con

– Government and Industry must conduct credible analyses of the vulnerabi

threat which includes types of threats, methods of prevention and costs of providing security 

– The system must have mechanisms for feedback that protect Industry pro

information 
III-10 

Vital Human Services Team Insights ... Pioneer 

THE HEALTHCARE INDUSTRY HAS HAD INCREASING DIFFICULTY IN PROVIDING MEASURES TO THEIR CUSTOMERS BECAUSE THEY HAVE BEEN CONSTRAINED FEDERAL GOVERNMENT ACTIONS 

• Projected costs of the increased security needs are at odds with mandated cut

spending 

– Cuts to Medicare/Medicaid have only decreased the ability for healthcare 

providers to increase their system security 

– The “Healthy Society” concept, with preventive care is more efficient but h

protect because of its centralization 

• Efforts to make patient care effective and efficient and increase dependency o

industries 

– Increased reliance on Telecommunications – Growing dependency on electronic patient record and pharmaceutical syst– Network downtime would cause a substantial loss of revenue, and impact 

confidence 
III-11 

Vital Human Services Team Insights ... Pioneer 

PIONEER PROVIDED A SERIES OF SUGGESTIONS TO THE FEDERAL GOVERNMTHEM IN HANDLING THE THREAT 

• An alternative to superagency could be the establishment of a multi-Industry co

solve Industry problems 

• Government would become responsible for the following areas: 

– Incentives – provide tax incentives and equipment write-offs for industries 

improve infrastructure security 

– Punitive Damages – make punishment for attacks (cyber and physical) sev

enough to deter 

– Share information in a timely manner 

·· Long term threats to be provided periodically ·· Make access to information easy to obtain without creating security ris

– Protect the medical Industry from risk management costs not of its own ma– Provide quick response to emergencies and improve preparation to coordi

with industries and state and local governments 
III-12 

Vital Human Services Team Insights ... Pioneer 

THE MEDICAL INDUSTRY AGREED WITH THE COMMON CONCERNS AND SOLUPOST GAME INTERVIEW STRESSED THE ISSUES OF LIABILITY AND DETERRENOF IMPROVING SECURITY AND EDUCATION 

• Protect the medical Industry from risk management costs not of its own making • Make punishment for cyber and physical attacks severe enough to deter threat• Remove technical disincentives like overseas security export controls • Create an inexpensive and easy reporting mechanism for Industry to retrieve in• Work with other agencies to improve strong cryptography and strong operating • Provide tax incentives to support funding for security 

THE MEDICAL INDUSTRY SEES A PRESIDENT’S NATIONAL SECURITY TELECOMADVISORY COMMITTEE (NSTAC) MODEL AS BEST FOR ANY NEW TYPE OF INTEINDUSTRY/GOVERNMENT AGENCY BUT STRESSED THE NEED TO INCLUDE SMAS LARGE BUSINESSES 
III-13 

Transportation Team Insights ... Rapid Transit 

THE TRANSPORTATION TEAM CONCENTRATED ON METHODS OF COMMUNICABETWEEN GOVERNMENT AND INDUSTRY IN RELATION TO INFORMATION SHARREGULATION. WHILE THEY DID NOT NECESSARILY SUPPORT MORE REGULATTHOUGHT AN ENTITY SHOULD BE FORMED TO SHARE INFORMATION AND IDEA

• The National Security Agency (NSA) was considered the key agency for inform

sharing 

• Small business must be involved, through associations, which they already bel

the formation of policy 

• The Commission drafts should go to Industry to ensure that the plan is feasible 

implemented effectively 

• Government should institute a tax incentive linked to Industry performance in t

infrastructure protection 

THE INDUSTRY SUPPORTS DEREGULATION AS A WHOLE BUT REALIZES THAT EXIST AND THAT AN ORGANIZATION MUST EXIST TO PROVIDE SECURITY ISSU
III-14 

Energy Team Insights ... Olympus Edison 

THE ENERGY INDUSTRY’S CURRENT SAFETY AND SECURITY REQUIREMENTS THE PROTECTION OF ITS INFRASTRUCTURE 

• To protect U.S. interests, the energy Industry needs to develop its own position 

conjunction with Government to facilitate: 

− The development of international agreements and in defining jurisdictional 

responsibilities 

• The Industry has already identified its critical infrastructures and developed red

systems to protect them 

• Additional measures, such as government regulation, will not provide an increa

level of protection 

• The largest threat facing the Industry is from an “insider,” a disgruntled employ

employee with intimate knowledge of the company’s operations 

− In this case, disruptions would be localized – Organized crime is perceived to be more of a threat than foreign terrorism 

• The power Industry will continue to conduct self-assessments to identify vulner• There is a need to identify and address cross-Industry vulnerabilities and liabili• The power Industry is more concerned with state and local government assista

infrastructure protection and would consider federal involvement only as a fina
III-15 

Energy Team Insights ... Olympus Edison 

THE ENERGY INDUSTRY REQUIRES LIMITED GOVERNMENT INVOLVEMENT, ANADDITIONAL GOVERNMENT REGULATION, FOR THE PROTECTION OF ITS INFRA

• The enery Industry regulatory agency, the North American Electric Reliability C

(NERC), currently has policies regarding the protection of the Industry’s infrast

− However, not all producers are part of NERC, and NERC cannot enforce 

compliance with its policies 

− The market system will drive the Industry to acceptable standards and leve

protection 

• The Industry will evaluate if “cyber” threats will require additional information, s

funding for research and development 

− A partnership with Government will ensure that the information is broader 

more cohesive 

− Industry traditionally has relied on private agencies to perform security ana

on its systems 
III-16 

Energy Team Insights ... Olympus Edison 

THE POWER INDUSTRY ALSO QUESTIONED THE NEED FOR MORE REGULATIOCURRENTLY ARE HEAVILY REGULATED. THEIR COMMENTS STRESSED THIS F

• The growing globalization of the Power Industry makes it difficult to protect the 

– A US plant exists in Argentina – A US plant provides power for 2 million people in the United Kingdom – Power is easy to transfer, if a problem occurs in one place, it is easy to ge

from somewhere else. However, the integrity of the power distribution gridmore important as deregulation takes effect 

THE POWER INDUSTRY’S MAIN CONCERN WAS THE LACK OF INFORMATION SHBETWEEN DIFFERENT AGENCIES AND INTERDEPENDENT INDUSTRIES. AN ORWOULD BE USEFUL IF IT PROVIDED THIS AS WELL AS GLOBAL INFORMATION AFFECT POWER INDUSTRIES OUTSIDE OF THE NERC SPHERE OF INFLUENCE 
III-17 

Banking Team Insights ... Kleingeld 

THE KLEINGELD TEAM FEELS THAT THE BANKING AND FINANCIAL SERVICES CURRENTLY TAKING THE STEPS NECESSARY TO SECURE THEIR INFRASTRUC

• The banking and finance Industry has a history of conservatism and risk mana

which has resulted in a robust operational environment for today’s threats and vulnerabilities 

– The Industry has a “security first” philosophy and is very conscious about 

managing market perceptions 

– Initially, the team did not like the concept of “non-market driven” recomme

because they felt that the Industry would make any investments necessary they understood the risk 

• The Industry would oppose additional regulations and/or mandated reporting re

– Industry feels that they are already reporting threat and intrusion data back 

government through the Suspicious Activities Report (SAR) and receives lfrom the government in return 
III-18 

Banking Team Insights ... Kleingeld 

THE TEAM RECOGNIZED THE NEW CHANGING ROLE OF THE NATIONAL INFRASAND BELIEVED THAT WHILE INDUSTRY SHOULD HAVE THE LEADERSHIP ROLE INFRASTRUCTURE SECURITY GOVERNMENT SHOULD PARTICIPATE 

• The team believed strongly that government should aggressively pursue comp

criminals and recommended improving/enhancing the ability of law enforcemenand prosecute computer criminals 

– The team cited their inability to collect accurate background data on prosp

employees from previous employers for fear of breech of privacy issues 

– Government regulatory requirements should include all financial services 

institutions and their service providers 

– The team clearly believed that government had a significant role in infrastr

protection/mitigation once events reached the nation-state level i.e. structuphysical/cyber attacks against the national infrastructure 

– The team was not opposed to penalties for Industry players who fail to me

certain minimum security standards 
III-19 

Banking Team Insights ... Kleingeld 

THE BANKING INDUSTRY WANTS A THREE-PRONGED STRATEGY TO PROTECT INFRASTRUCTURE. THEY INCLUDE: 

• Preventive protection: 

– An improved Demand Deposit Account - these are the monies that are at t

of the banking system - it is the funds that are on deposit with a financial institution, typically in a checking or savings account, and have access to demand" i.e. a check, going to a teller or an ATM 

– A better Account Information Security system – A method by which National Security Agency (NSA) shares its encryption 

capabilities 

– Expand the role of NSA in penetration testing in key infrastructures 

• Improve detection 

– Determine better ways to insert software code to find flaws in the system 

• Stronger reaction 

– Improve the response time between an attack and notification to the appro

law enforcement and regulatory agency 

THE BANKING INDUSTRY, LIKE OTHER INDUSTRIES, STRESSED THE NEED FOR SHARING, INDUSTRY STANDARDS AND OPERATIONAL CONTROL WITH GOVERPROVIDING INFORMATION AND FUNDING. HOWEVER, THEY HAD SPECIFIC OBMIND WHICH DIFFER SOMEWHAT FROM OTHER INDUSTRIES. THEY REQUESTEGOVERNMENT CAPABILITIES TO IMPROVE THEIR OWN SYSTEM AND ENSURE AEXISTING GOVERNMENT AGENCIES RATHER THAN CREATING A NEW REGULA
III-20 

Financial Issues ... 

INDUSTRY IS CURRENTLY FACED WITH PROTECTING THEIR OWN INFRASTRUCACCEPTING GOVERNMENT REGULATIONS AIMED AT MANDATING PROTECTIVE BOTH OPTIONS HAVE INDUSTRY CONCERNED 

• If the government wants a higher level of protection, companies expect the gov

provide incentives, regulatory relief or loan guarantees to facilitate this process 

• The early threats (levels one and two) were easily managed because of invest

already made to prevent or mitigate effects of threat, or that it was an acceptabcost of doing business 

• Possible loss of revenue due to loss in public confidence was a greater concer

more significant potential impacts than spending additional funds to correct a wproblem 

• With physical threats, confidence in and reliance on law enforcement’s ability t

reduce attacks, limit investment in physical protection and security. (Why pay fpolice force?) 

– Confidence in law enforcement is not as great against cyber threats, there

requires additional investment 

• Only when risk is clearly quantified can companies estimate the potential cost, 

the benefits of preventing the impact of a threat 

– Industry teams did not feel that threats were adequately defined and there

expenditures or capital outlays could not be assessed 
III-21 

Financial Issues ... 

INDUSTRY IS CURRENTLY FACED WITH PROTECTING THEIR OWN INFRASTRUCACCEPTING GOVERNMENT REGULATIONS AIMED AT MANDATING PROTECTIVE BOTH OPTIONS HAVE INDUSTRY CONCERNED (CONTINUED) 

• The economic impact of threats to utilities (power, gas, water) is not as great b

their monopoly position and inelasticity of demand 

• Liability issues change companies’ outlooks on impact of threats 

– Insurance coverage limits company’s capital outlays to recover from an ev– Outsourcing reduces the direct impact to companies by shifting the liability 

parties 
IV-1 

Government Team Insights ... 

THE GOVERNMENT TEAMS WERE ASKED TO ASSESS PCCIP RECOMMENDATIOSUGGESTIONS TO CHANGE THEM AND ULTIMATELY PROVIDE ALTERNATIVES 

• The Executive team initially used the recommendations to draft policy, identify 

responsibilities and recommend legislative programs 

• The Congressional team identified key issues that the federal government sho

enhance critical infrastructure protection and take into account the concerns of state and local governments 

• The State and Local team assessed the impact of the PCCIP “strawman” reco

on their constituents, make changes and provide alternatives according to thei

• In Move 2, all Government teams were tasked to assess the effectiveness and 

the program they produced in a changed environment of new threats 
IV-2 

Executive Branch Team Insights ... 

BASED ON THE PCCIP “STRAWMAN” RECOMMENDATIONS, THE EXECUTIVE TEDEVELOPED A POLICY (S.99, A FICTITIOUS BILL) TO ENHANCE INFRASTRUCTUPROTECTION WHICH CAUSED A STRONG INITIAL RESPONSE FROM BOTH CONSEVERAL INDUSTRY TEAMS CONCERNING THE NEED FOR CERTAIN ASPECTS INCLUDED IN THE PROGRAM 

• The policy/program, proposed the creation of a super-agency, for infrastructure 

based on the premises that: 

– Existing federal processes are inadequate to address critical infrastructure – Standards, procedures, research, and technology programs associated wi

critical infrastructure protection are inadequate to meet likely future threats 

– The level of awareness about the need for critical infrastructure protection 

inadequate in Industry and the nation as a whole 

• Industry and Congress felt a new federal agency was not needed, but rather a 

reorganization of existing federal resources and assignment of coordinated res

• A mechanism is needed for intelligence and law enforcement communities to c

disseminate information on threats and vulnerabilities to the appropriate group

– Appropriate communication with the private sector must be ensured – National consciousness and risk awareness must be raised – Formal training must be provided through higher education – Establishment of a central information clearinghouse – Will require change in laws, policy and regulations because of current limit

intelligence and law enforcement activities 
IV-3 

Executive Branch Team Insights ... 

THE FINAL RECOMMENDATIONS OF THE EXECUTIVE TEAM PROVIDED DIRECTICOMMISSION TO INCORPORATE INDUSTRY CONCERNS WITH GOVERNMENT RESPONSIBILITIES 

• The Federal role is to coordinate/orchestrate regional efforts into a seamless n

“Infrastructure Safety Net” by building on existing relationships 

– Encourage Regional, State & Local and business alliances to raise awaren

and promote information sharing 

– Ensure that sector-specific solutions and processes are coordinated – Determine how stakeholders are responding through existing relationships 

• Government should rely primarily on market forces for infrastructure developm

growth 

– Initial reliance on market-based strategies – Incentive based programs are necessary where shortfalls exist 

• Education, training and awareness programs must be developed for critical inf

protection 
IV-4 

Congressional Team Insights ... 

THE STOVEPIPING OF COMMUNICATION AND INFORMATION WITHIN THE FEDEGOVERNMENT WAS A FUNDAMENTAL CONCERN IDENTIFIED BY THE INDUSTRY 

• The Government must rely on market forces as the principal driver for infrastru

protection investments 

– Competitive and economic pressures currently drive secure and reliable sy– Infrastructures have been hardened by experience 

• Extensive reporting requirements already exist; however 

– Redundancy exists between multiple government agencies – Data is not coherently collected, analyzed, and distributed – Feedback mechanisms are inadequate 

• Cultural and legal impediments prevent the sharing of information between the 

and law enforcement communities 
IV-5 

Congressional Team Insights ... 

THE CONGRESSIONAL TEAM ALSO RECOGNIZES THAT INDUSTRY MUST PLAY ROLE IN PROTECTING ITS ASSETS 

• Education and awareness programs will significantly enhance infrastructure pr

– Needed at all levels of Industry, including CEO level – Undergraduate and graduate level programs 

• A mechanism must be developed that will gain the confidence of the private se

intrusion information can be shared with and protected by the federal governmthreat information can be responsibly disseminated to the private sector 

• The Federal Government should designate a focal point to act as a nexus for f

agencies and the private sector to share critical information. This focal point s

– Adequately funded – Assigned specific responsibilities – Held accountable 

• However, where the Government identifies shortfalls, incentives are appropriat

stimulate further investment and enhancement of the critical infrastructure asse
IV-6 

 State and Local Team Insights ... 

THE STATE AND LOCAL TEAM MAINTAINED A CLEAR CONCISE MESSAGE TO TCONCERNING THEIR RECOMMENDATIONS 

• Education should be the number one goal for the federal Government in order 

public and private acceptance of new measures 

• It is imperative that government gain the trust of Industry by providing them wit

information, “not just parts of it” 

– This can be done by creating a joint Industry/Government advisory council 

develop a clearinghouse for reporting confidential infrastructure breaches analyze and share threat assessments. The joint council would also advisIndustry on the development of standards and monitor Industry efforts in th·· Provide a team approach, or “partnership” as opposed to Government 

mandating new regulations on business 

·· Does not create additional bureaucracy merely improves coordination 

with existing entities 

·· Provides more aggressive technology transfer in research and develo

• We must not create additional bureaucracy 

– A superagency will impose a tremendous cost on state and local Governm

to providing Industry standards that will force many small businesses out o

– State and Local Government must be involved from the start in order to re

their constituents 

– Distribution of threat information must be extended to state and local agen

that they also have the opportunity to react and prepare for future threats 
IV-7 

State and Local Team Insights ... 

THE STATE AND LOCAL TEAM MAINTAINED A CLEAR CONCISE MESSAGE TO TCONCERNING THEIR RECOMMENDATIONS... (CONTINUED) 

• With the right training and information the state can provide technical expertise 

to the cyber threat 

• FEMA and the state and local agencies already exist to respond to emergency 

situations 
V-1

Simulation Observations ... 

THE SIMULATION PROMOTED IMPROVED AWARENESS IN THE FOLLOWING KE

• Threats to the infrastructure • The role of government in protecting the infrastructure • Industry initiatives and ideas • Costs and burdens associated with infrastructure protection • Obstacles to the implementation of Commission recommendations • Interrelationships/Interdependencies between infrastructures 
V-2

Simulation Observations ... 

THREATS TO THE INFRASTRUCTURE 

• Vulnerabilities: 

– The growing dependence of the critical infrastructure on information techn

creating new vulnerabilities 

– The extent of current and future threats are not fully recognized – Industry invests in security and protective mechanism to meet existing thre

does not have the information to reduce vulnerabilities to future threats 
V-3

Simulation Observations ... 

THE ROLE OF THE GOVERNMENT IN PROTECTING THE INFRASTRUCTURE 

• Industry is clearly concerned over increasing the burden of legislation and man

infrastructure 

• The state and local governments establish the criteria for safeguards against th

emergency response in the aftermath of an attack 

• Industry recognized the need for more information from the federal governmen

the threats. They believe the government should 

– Provide “real time” intelligence on imminent threats to specific segments o

infrastructure 

– Forecast long term threats so that Industry can develop protective mechan

• Government should provide increased funding in the following areas 

– Provide money for R&D for security needs – Increase education and awareness of the threats to the infrastructure 

• Law enforcement and intelligence agencies should increase their focus on cyb• Existing Government Agencies and organizations should be integrated to addr

issue of the cyber threat 

– A process for effective information sharing and protective technology 
V-4

Simulation Observations ... 

INDUSTRY INITIATIVES AND IDEAS 

• Industry and government must partner to combat the threat to the infrastructur

has suggested forming the National Infrastructure Coordination Council (NICCIndustry led consortium which shares information among Industry and with gov

• The NICC would also utilize methods which allows Industry to share infrastruct

protection 

– Should be a voluntary effort, based upon existing association membership– Should be based out of the White House – Needs of small business must be represented 

• Market competitiveness is an effective tool to motivate individual companies to 

themselves against current cyber, or physical threats 

• Trade organizations and Industry associations should be utilized to provide Ind

and or vulnerabilities to the government and should serve as the basis for dissgovernment threat information 

• Industry can provide the necessary safeguards against a viable threat. Incentiv

developed for Industry to make the necessary investments to infrastructure prowhen a threat is not clearly identified 
V-5

Simulation Observations ... 

COSTS AND BURDENS ASSOCIATED WITH INFRASTRUCTURE PROTECTION 

• Both the government and private Industry are concerned with the costs associa

effectively protecting the infrastructure 

– State and local governments are concerned with unfunded mandates on 

Infrastructure Protection being legislated from Washington 

– Congress is reluctant to expand the role and nature of government – Government agencies are also restricted by budget reductions 

• Government mandates for increased private funding of infrastructure protection 

companies out of state or offshore 
VI-I 

Next Steps ... ISSUES FOR CONSIDERATION 

• Recommendations by the Commission should be specific and include the proc

implementation and be shared with Industry 

• The Commission should share findings from the simulation with key members 

Department of Defense, Congress, Law Enforcement Agencies as well as the community 

• A process for increased cooperation and communication between government 

private sector must be developed 

• The roles and responsibilities of current government departments and agencie

specified for dealing with cyber threats and crimes 

• Liability and Industry linkages, interdependencies, vulnerabilities and responsib

be addressed 

• Continuing education on the nature of plausible current and future threats and 

vulnerabilities is necessary to build public and Industry support for implementacommission’s recommendations