Edit Project: Managing Cybersecurity and Privacy Risk for Smart Public Safety IoT Devices and Systems

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

Image: Upload a jpg or png image representing some aspect of your project. The image should be 600x200 pixels, other images will be accepted but not look as good.

Upload file

Image caption: Describe the image

Team Organisations: List of organisations working on the project separated by commas

Point of Contact: Person to contact - add this person (Add a Person) if they are not already in the knowledge base.

Location: List of locations where this project is deployed or planed to be deployed (e.g Portland OR, Paris France). A comma seperates places so a comma between city and state will indicate two places.

Status:

Sectors: select one or more sectors to which this project is relevant

Data Buildings Cybersecurity and Privacy Education Public Safety Rural Smart Region Transportation Utility Wellbeing Wireless Agriculture Broadband Resilience Introduction Informational Cybersecurity Privacy Energy Waste Water Smart Buildings

Chapters: Add the chapters where this project should be linked

Description: Description of the project

This use case provides a notional approach to address cybersecurity and privacy risks related to incorporating IoT in smart public safety applications. This use case posits some of the major activities, key stakeholders, and potential resources for each step of the cybersecurity and privacy risk management process.

Free text:

A key element of Smart Cities is smart public safety. Smart public safety starts with traditional public safety agencies - namely fire, law enforcement, emergency medical services, and 911 call centers - that would like to add IoT devices as another means of communication between first responders and between the first responders and the 911 dispatch centers. Public safety agencies are already starting to use body-worn devices (e.g., cameras and biometric sensors). During the incident operations, IoT data from sensors and other real-time devices can increase situational awareness and aid in incident command and control. =Step 0: Prepare= In smart public safety, public safety agencies themselves could be responsible for cybersecurity and privacy; alternatively, they could be partnering with IT or information security organizations (e.g., Department of Information Technology). In most states in the U.S., the state legislature authorizes and appropriates funds based on an authorized scope. The IT organization will often have a cybersecurity and privacy strategy that includes using one or more of the risk management frameworks, or elements thereof. For this use case we are assuming that we are using the NIST RMF, which has been detailed in this Guidebook. There are also existing statewide security policies; but they do not allow connected IoT devices until risk management security capabilities have been defined, and devices provide the necessary capabilities to support the requisite cybersecurity and privacy controls. It is the intention of this support for implementation of IoT cybersecurity and privacy to be funded by further State legislature appropriating funds for extending the risk management program for Smart Cities and smart public safety which includes usage of body worn devices and supporting vendor upgrades. Step 1: Categorize The information types collected, processed, and transmitted by the wearable IoT devices are real-time video and sensor data. The systems and system components are categorized as critical information data, and that mandates that the systems and networks be of a public safety grade mission critical mode of operation. Public Safety Grade cybersecurity and privacy policies and standards have been described for normal mobile devices, but corresponding policies and standards for IoT-based devices still need to be defined. Step 2: Select NIST RMF-based cybersecurity and privacy controls have been selected for IT systems security controls. Additional cybersecurity and privacy controls for IoT would follow the NISTIR 8196 and NISTIR 8228 and the new, example (12) security controls and (4) privacy controls. [[File:NIST.IR.8196.pdf|300px|NISTIR 8196: Security Analysis of First Responder Mobile and Wearable Devices]] [[File:NIST.IR.8228.pdf|300px|NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks]] No additional controls beyond those proposed in NISTIR 8196 and NISTIR 8228 have been identified. No tailoring of controls has been done as the IT Department wants to identify and implement a standardized and consistent (i.e., baseline) set of security control. This may change as the implementation of IoT devices is better defined. =Step 3: Implement= Cybersecurity and privacy requirements from NIST SP 800-37 Rev. 2, NIST SP 800-39, NIST SP 800-53 Rev. 4, NISTIR 8196, NISTIR 8228, and other documents were used to generate specific device security capabilities requirements that support and enable the selected cybersecurity and privacy controls. The chosen vendor solution supports a shared operational model for the operational Security Operation Center (SOC) using security information and event management (SIEM) and security orchestration, automation, and response (SOAR) capabilities. Many of the RMF functions supported by IT Department are used in support of these new IoT devices, networks, and applications. It is anticipated that the security operations center (SOC) will implement the tools and capabilities necessary to ensure that the IoT device security capabilities are leveraged to implement the selected security controls from NIST SP 800-53 and NISTIR 8228. =Step 4: Assess = The Security Operations Center mitigation and monitoring personnel have the responsibility for proper implementation and operation of the selected cybersecurity and privacy controls. The SOC is staffed by IT/IoT cybersecurity analysts and then vendor specialists. There is an agreement in place that clarifies the shared or dedicated tasks. =Step 5: Authorize= N/A =Step 6: Monitor = The Chief Risk Officer (CRO) and team are responsible to work with the SOC to understand how well the risk management program is working. __NOTOC__

Summary:

This is a minor edit

Watch this page

Cancel updated=6-10-2024

Edit Project: Managing Cybersecurity and Privacy Risk for Smart Public Safety IoT Devices and Systems

Navigation menu

Search