Transportation Infrastructure Security Utilizing Intelligent Transportation Systems

E1E1FFIRS_1

09/18/2008

1

TRANSPORTATION INFRASTRUCTURE SECURITY UTILIZING INTELLIGENT TRANSPORTATION SYSTEMS

Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

E1E1FFIRS_1

09/18/2008

3

TRANSPORTATION INFRASTRUCTURE SECURITY UTILIZING INTELLIGENT TRANSPORTATION SYSTEMS RYAN FRIES MASHRUR CHOWDHURY JEFFREY BRUMMOND

JOHN WILEY & SONS, INC.

E1E1FFIRS_1

09/18/2008

4

1 This book is printed on acid-free paper. 

Copyright # 2009 by John Wiley & Sons, Inc. All rights reserved Published by John Wiley & Sons, Inc., Hoboken, New Jersey Published simultaneously in Canada No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at www.wiley.com/go/permissions. Limit of Liability/Disclaimer of Warranty: While the publisher and the author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor the author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information about our other products and services, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. For more information about Wiley products, visit our web site at www.wiley.com. Library of Congress Cataloging-in-Publication Data: Fries, Ryan. Transportation infrastructure security utilizing intelligent transportation systems / Ryan Fries, Mashrur Chowdhury, Jeffrey Brummond. p. cm. Includes index. ISBN 978-0-470-28629-6 (cloth) 1. Intelligent Vehicle Highway Systems–Security measures. 2. Information technology– Security measures. 3. Highway communications–Security measures. I. Brummond, Jeff. II. Title. TE228.3.F74 2008 338.3012–dc22 2008022805

Printed in the United States of America 10 9 8 7 6 5 4 3 2 1

E1E1FFIRS_1

09/18/2008

5

To Sydney, Celeste, Jane, Nick, and Danielle Fries To Manzur, Setara, Farzana, Aniqa, and Adeeba Chowdhury, and A.S.M. Ilias To Melissa, Jacob, and Jenna Brummond

E1E1FFIRS_1

09/18/2008

7

CONTENTS Preface

xiii

Acknowledgments

xvii

1 INTRODUCTION

1

1.1 1.2 1.3 1.4 1.5

Concept of Security / 1 Transportation and Security / 4 Security in the ITS Context / 6 Scope and Audience of the Book / 10 Content and Organization / 11 References / 12 Review Questions / 13

2 NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY 2.1 2.2 2.3

14

Vulnerabilities / 14 Common Characteristics of Surface Transportation Systems / 16 Common Threats to Surface Transportation Systems / 17 2.3.1 Earthquakes / 17 2.3.2 Fires / 18 2.3.3 Terrorist Attacks / 18 2.3.4 HAZMAT / 19 2.3.5 Blackouts / 20

vii

E1E1FFIRS_1

09/18/2008

viii

8

CONTENTS

Hurricanes / 20 Floods / 21 Biological and Chemical Attacks / 22 Derailment / 23 Cyber Attacks / 23 Defending against Threats Both External and Internal / 24 Why Transportation Infrastructure Security Is Important / 26 Focus Areas / 27 Summary / 28 References / 28 Review Questions / 30

2.3.6 2.3.7 2.3.8 2.3.9 2.3.10 2.4 2.5 2.6 2.7

3 LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10

Introduction / 31 Disaster Response and Evacuation / 35 Freight and Commercial Vehicle Security / 40 HAZMAT Security / 44 ITS Wide Area Alert / 47 Rail Security / 49 Transit Security / 50 Transportation Infrastructure Security / 54 Traveler Security / 57 Conclusions / 58 References / 59 Review Questions / 59

4 RISK ASSESSMENT FRAMEWORK 4.1

4.2 4.3

31

Risk Assessment Framework / 61 4.1.1 Critical Assets / 64 4.1.2 Risks Assessment Methods / 64 4.1.3 Mitigation and Countermeasures / 70 4.1.4 Selection of Options / 71 Opportunities and Challenges / 72 Application of the Framework / 72 References / 72 Review Questions / 73

60

E1E1FFIRS_1

09/18/2008

9

CONTENTS

5 APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS 5.1

ix

74

Application of Risk Assessment Methods / 74 Blue Ribbon Panel Method / 74 Fault-Tree Analysis / 84 Weibull Hazards Model Example / 93 Application of Evacuation Models and Traffic Models for Response Planning / 94 Application of Other Methods / 99 References / 99 Review Questions / 100

5.1.1 5.1.2 5.1.3 5.2 5.3

6 FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS 6.1 6.2 6.3 6.4

6.5 6.6

6.7

Introduction / 102 Elements of Computer Network Security / 103 Importance of Computer Network Security / 104 Approach to Computer Network Security / 104 6.4.1 Policy / 105 6.4.2 Current State / 106 6.4.3 Security Requirements / 106 6.4.4 Recommended Controls / 106 6.4.5 Accountability / 107 6.4.6 Timetable / 107 6.4.7 Continuing Attention / 108 Computer Network Security in ITS / 108 Network Security Objectives / 108 6.6.1 Confidentiality / 109 6.6.2 Authentication / 112 6.6.3 Message Integrity and Nonrepudiation / 113 6.6.4 Availability / 114 6.6.5 Access Control / 116 Future of Network Security and Its Impacts on Securing ITS Network / 117 References / 117 Review Questions / 118

102

E1E1FFIRS_1

09/18/2008

x

10

CONTENTS

7 SECURING ITS 7.1 7.2

7.3

7.4

7.5 7.6 7.7

7.8

Introduction / 120 Security Objectives / 123 7.2.1 Confidentiality / 123 7.2.2 Integrity / 123 7.2.3 Availability / 123 Security Threats / 124 7.3.1 Deception / 124 7.3.2 Disruption / 124 7.3.3 Usurpation / 124 7.3.4 (Unauthorized) Disclosure / 124 Security Services / 125 7.4.1 Information Security / 125 7.4.2 ITS Personnel Security / 125 7.4.3 Operational Security / 126 7.4.4 Security Management / 126 Securing ITS Subsystems / 127 Securing Communications between Subsystems / 128 Security and ITS Standards / 133 7.7.1 National Transportation Communications for ITS Protocol / 133 7.7.2 Traffic Management Data Dictionary and Message Sets / 137 7.7.3 Commercial Vehicle Information Systems and Networks / 137 7.7.4 Archived Data / 139 7.7.5 Dedicated Short Range Communications / 139 7.7.6 Incident Management / 140 7.7.7 Transit Communications Interface Profiles / 140 7.7.8 Advanced Traveler Information Systems / 142 Conclusions / 143 References / 143 Review Questions / 144

8 ITS SECURITY AREAS AND MULTIMODAL TRANSPORTATION SECURITY 8.1

120

Protecting People / 146 8.1.1 Airports / 146 8.1.2 Public Transit / 149

146

E1E1FFIRS_1

09/18/2008

11

xi

CONTENTS

Perception of Security / 153 Protecting Vehicles and Infrastructure / 154 8.2.1 Airports / 154 8.2.2 Public Transit / 156 8.2.3 Rail Vehicles and Infrastructure / 159 8.2.4 Ships and Ports / 160 Protecting Freight / 162 8.3.1 Containers / 162 8.3.2 HAZMAT / 164 8.3.3 Liquids / 165 8.3.4 Military Freight / 165 The Future / 166 References / 167 Review Questions / 169 8.1.3

8.2

8.3

8.4

9 PROCESS FOR DEVELOPING A REGIONAL TRANSPORTATION SECURITY PLAN 9.1 9.2

9.3 9.4

Introduction / 171 Developing a Regional Transportation Security Architecture / 173 9.2.1 Security in a Regional ITS Architecture Development Process / 174 9.2.2 Developing a Regional Transportation Security Architecture / 181 Developing a Project Security Plan / 183 Conclusion / 186 References / 186 Review Questions / 187

10 ISSUES AND OPPORTUNITIES FOR TRANSPORTATION INFRASTRUCTURE SECURITY 10.1 10.2 10.3

10.4 10.5

171

ITS Security versus Privacy / 188 Public and Private Roles / 189 Stakeholder Cooperation and Coordination Requirements / 192 10.3.1 Information Sharing / 193 10.3.2 Resource Sharing Agreements / 194 Funding Sources and Constraints / 195 Human Resources / 195

188

E1E1FFIRS_1

09/18/2008

xii

12

CONTENTS

10.6

Future Directions and Opportunities / 196 References / 197 Review Questions / 198

APPENDIX A NATIONAL ITS ARCHITECTURE SUBSYSTEM SECURITY DESCRIPTIONS

199

APPENDIX B SECURING ARCHITECTURE FLOWS

211

APPENDIX C USDOT FHWA FINAL RULE

237

APPENDIX D USDOT FTA POLICY ON TRANSIT PROJECTS

261

APPENDIX E WEIBULL DISTRIBUTION SUPPORT

274

Index

277

E1E1FFIRS_1

09/18/2008

13

PREFACE ‘‘Security’’ has suddenly become an important parameter in determining international, national, regional, and even local policy. It is even a substantial consideration in the planning, design, and operations of new and existing infrastructures. To detect and thwart deliberate attacks against infrastructure that cause harm to both life and property, determining the appropriate response to such attacks has become a public policy issue of great importance. It has been necessary to create manuals and perform drills on how to respond to such attacks and thus minimize their impact. The lives of millions of citizens are disrupted and threatened when the various infrastructures supporting the nation’s transportation system are deliberately attacked. Ensuring infrastructure security and enhancing the public’s perception of security are not only important for protecting life and property; they also are intimately tied to the social and economic well-being of the United States. Recent terrorist attacks such as the London Underground and bus bombings of 2005, the Madrid commuter rail bombings of 2004, and the events of September 11, 2001 in the United States have changed the environment in which transportation systems are operated worldwide. Although mobility and safety are the primary objectives for any good transportation system, security has become an equally important parameter in their design and operation. As security measures become ever more vulnerable, attacks against smaller targets using less conventional weapons have become much more effective. Further, natural disasters, such as the Indian Ocean tidal wave in 2004 and Hurricane Katrina in 2005 have further emphasized the vulnerabilities of our transportation systems. Transportation practitioners and researchers must recognize the role of these systems as emergency management tools while simultaneously considering their use as either targets and/or weapons.

xiii

E1E1FFIRS_1

09/18/2008

xiv

14

PREFACE

Besides the ever-changing security environment, increasing traffic congestion, the reduced ability to procure highway and rail rights-of-way, increasing fuel costs, and improving technological abilities are also shaping the transportation industry worldwide. Reacting to these issues, transportation practitioners have increasingly turned to technological solutions for traffic, transit, and maritime challenges. Because computing abilities continue to improve, there is every indication that technologies will continue to play a major role in the development and operations of new and existing transportation industry infrastructures. Intelligent transportation systems (ITS), which integrate different computing, control, and communication technologies, were first deployed to combat traffic congestion and improve transportation efficiency; their dual use for security represents a valuable opportunity to address two issues with a single scheme. While closed circuit traffic cameras and variable message signs are now commonplace, experience shows that they may not always remain so. Instead, new tools with new capabilities will have to interact with older systems. ITS Architectures support system interoperability and interchangeability; which are also the underlying themes of using ITS architectures for security purposes. Adoption of security areas in the development of regional architectures has recently become easier within the United States due to the addition of security-related emphasis areas in the National ITS Architecture. The National ITS Architecture developed in the United States provides a general framework for defining and planning ITS services and functions, as well as integrating intelligent transportation systems components. However, ITS also represents an inherent security risk since individuals with malevolent intentions could attempt to use these systems against the public. The ever-increasing amount of control that system managers wield over the deployed environment—specifically through reversible lanes, automated evacuation gates, signal system control, and variable message signs—has the potential to cause devastating harm if commandeered for nefarious purposes. The future is unpredictable. New technologies will provide new mechanisms for managing security risks to transportation infrastructure, and technological advances may initiate new threats. A strategic security planning process must be developed in which security objectives and tools adjust to exploit new opportunities while averting continuous threats. It is our expectation that this book will help educate both students and transportation professionals. This book is intended for upper-level undergraduate and graduate courses as well as the self-taught professional. The text is also meant to highlight the need to contemplate, consider, and develop strategies for enhancing the security dimension of ITS. Within the field of transportation engineering, this book fills a gap in the practical application of security by leveraging ITS for use in that role. It also offers valuable insight into the new security challenges encountered with the use of computerized transportation systems.

E1E1FFIRS_1

09/18/2008

15

PREFACE

xv

One of the challenges for today’s transportation engineer is the breadth of knowledge needed beyond that of a typical civil engineering degree. It is now necessary to understand not only civil engineering principles but also those of computer science, systems engineering, communications engineering, and the security-related ramifications of those domains. Because of this multidisciplinary perspective, this book covers such diverse topics as computer systems, risk analysis, and multimodal transportation systems, which are necessary for securing ITS as well as providing security to our transportation systems through ITS.

E1E1FFIRS_1

09/18/2008

17

ACKNOWLEDGMENTS Many individuals contributed to the preparation of this manuscript through both review efforts and encouragement. We would like to acknowledge the contributions of Dr. Anne Dunning, member of the faculty in Transportation Planning at Clemson University, for providing valuable input on multimodal transportation security; Dr. Richard Brooks and Dr. Samuel Sander, both faculty members of the Electrical and Computer Engineering department at Clemson University, for providing feedback on computer systems security; Steve Ernst, a senior engineer at the Office of Bridge Technology at the Federal Highway Administration, for his feedback on bridge and tunnel security as presented by the Blue Ribbon Panel; Lieutenant Colonel Theodore D. Mauro, PhD (SCSG-CA), for his feedback on military transport security; and to our U.S. National ITS Architecture Team colleagues. Our sincere thanks go to Godfrey Kimball of Clemson University for his help with the review of several chapters of the book. We would also like to thank Yan Zhou and Dr. Yongchang Ma for their support in the preparation of the manuscript.

xvii

E1E1C01_1

09/18/2008

1

CHAPTER 1

INTRODUCTION

S

ecurity is an expectation of surface transportation users. Tools like intelligent transportation systems (ITS), which provide services such as surveillance, control, communication, and information collection and dissemination in real time, can support safeguards against threats. This chapter introduces the concepts of security within the context of ITS, then concludes with a description of the anticipated audience and scope of this book.

1.1 CONCEPT OF SECURITY

The world is full of natural and man-made risks, often characterized in terms of their likelihood of occurrence and their subsequent impacts to both life and property. Natural events, such as floods, hurricanes, tornados, and earthquakes, as well as involuntary events, such as machine or system malfunctions, can be quantified in terms of probability of occurrence and severity of their impacts. Similarly, human-induced events, such as deliberate attacks or errors, can cause similarly devastating affects. These deliberate or unintentional acts also can be expressed in terms of risks of their occurring and possible impacts of these events once they occur. Table 1.1. shows similarities and dissimilarities between deliberate threats, such as terrorist attacks and natural disasters such as hurricanes. The perception of security has far-reaching effects. A secure environment provides an atmosphere where innovations and economic growth flourishes. Even the perception of security can benefit society and improve social and economical fabrics of life through new investments. Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

1

E1E1C01_1

09/18/2008

2

2

INTRODUCTION

TABLE 1.1 Possible Similarities and Dissimilarities of Terrorist Attacks with Natural Disasters Similarities Mass casualties Damage to infrastructure Occur with or without warning Evacuation or displacement of citizens

Dissimilarities Caused by people on purpose May target specific security vulnerabilities Affected areas will be treated as crime scenes May not be immediately recognizable as terrorist events May not be single events Place responders at higher risk May result in widespread contamination of critical equipment and facilities May expand geometrically in scope May cause strong public reaction

Source: Parsons Brinckerhoff and Science Applications International Corporation, 2002.

Several factors contribute to the perception of security. One such factor is a possible in-place system that can identify threats before they occur. This forward-thinking concept is most desirable, but often it is the most difficult to accomplish. Therefore, having an appropriate response plan for any deliberate attack is also important for an overall security plan. This plan may include coordination between first responders, resource sharing, providing immediate care to those most affected, and evacuating those most at risk. Thus, security planning against deliberate threats encompasses different facets of tasks between multiple agencies involved in different activities, whose coordination is a must for identifying and managing any security threats. Conversely, a security breach, resulting in either man-made or natural catastrophes, both impedes innovation and stifles economic creativity and the vitality of areas affected by such events. Within a very short time—in a matter of days, in fact—the sense of security shared in the public’s collective perception, which has evolved over a long period, is shattered. In addition to public loss of confidence in security measures, the loss of human life, injuries, and, the economic costs of a terrorist attack on any region are overwhelming. A study conducted by the RAND Corporation reported that the initial costs of a terrorist attack involving a nuclear event near the port of Long Beach, California, could exceed $1 trillion. (Meade and Molander 2006). These staggering costs, which would cause untold harm to the U.S. and global economies, would be driven by demands for a massive medical response to such a disaster, subsequent insurance claims, compensation for lost jobs, and economic devastation to the greater Los Angeles area, not to mention the overwhelming cost of evacuation and reconstruction, including radioactive cleanup. Table 1.2 shows the wide range of terrorist threats and their possible impacts on infrastructure and other targets.

E1E1C01_1

09/18/2008

3

1.1 CONCEPT OF SECURITY

3

TABLE 1.2 Terrorist Threats and Effects on Infrastructure and Other Targets Weapons of Mass Destruction Conventional explosives (detonation of military-type or commercial bombs, such as fuel oil–fertilizer, etc.)

Possible Distinguishing Signs  Explosions  Casualties  Various types of localized blast damage

up to structural collapse  Exposure to dust and hazardous building

materials (e.g., asbestos)  May be used to spread harmful radiological

or chemical materials Chemical (dispersion of pesticides, mustard gas, chlorine gas, cyanide, tear gas, etc.)

Biological (dispersion of viruses, bacteria, toxins, fungi, etc.)

Radiological (dispersion of radioactive material by nonnuclear explosion or pressurized gas)

Nuclear (nuclear detonation with radioactive fallout)

Novel concepts (unusual delivery systems—aircraft, boats; combinations of weapons and attack modes; unexpected targets with secondary consequences)

 Initial unexplained deaths and illnesses  Effects mostly localized to release site but

may be distributed farther by wind and contamination  Area may be marked by unusual clouds, haze, mist, odors, tastes, droplets, etc.  May be persistent in environment  Initial unexplained deaths and illnesses, possibly beginning a day or more after an incident  Immediate effects mostly localized to release area, but distribution may be expanded through human transmittal  Possible persistence in environment  Possible geographic contamination  Unexplained deaths and illnesses  Effects mostly localized to release but may be some distribution via wind and other means beyond release site  Persistence in environment  Geographic contamination  Conventional explosives used for dispersal may cause additional effects and explosions  Large-scale infrastructure destruction  Extensive radioactive fallout  Long-term persistence in environment  Geographic contamination  Radioactive poisoning of foodstuffs, water sources, and long-term illnesses  Unknown

Source: Parsons Brinckerhoff and Science Applications International Corporation, 2002.

E1E1C01_1

09/18/2008

4

4

INTRODUCTION

TABLE 1.3 Security Issues Key Topics in Infrastructure Security 1. Foundations for Policy 2. Planning, Design, and Engineering

3. Management and Operational Practices

4. Information Security 5. Mobilization (‘‘Notice’’) and Response (‘‘Trans-event’’)

6. Recovery (Post-event)

Specific Issues Criteria establishing investment priorities Institutional continuity Design review for secure structures Research and development (R&D) needed to support ‘‘design for security’’ Design criteria Design specifications Best practices Practice review Institutional relationships Preparedness Personal and vehicle security Communication/outreach Procurement practices Information security Threat warning Early response Initial response Damage assessment Functional continuity

Source: Blue Ribbon Panel, 2003.

Table 1.3 outlines the major topics concerning infrastructure security and related issues. Although this table was developed for bridge and tunnel security by the Blue Ribbon Panel on Bridge and Tunnel Security, it can apply to other transportation infrastructure. The table provides important considerations for infrastructure security in six different phases: policy, planning, design and engineering, operations and management, information security, response, and recovery. 1.2 TRANSPORTATION AND SECURITY

Transportation has always been strongly tied to economic development and sustainability; and regional, national or international economies have come to depend increasingly on efficient and secure transportation systems. Transportation systems connect vital regional economic components (e.g., businesses and employee housing) to ensure that employees can use these systems to get to work while also ensuring that businesses can use them to provide and receive various supporting services and/or supplies. Nationally, the U.S. system of interstate roadways plays an indispensable role in economic vitality, connecting the goods of one region with the demands of another. Interstate travel also plays

E1E1C01_1

09/18/2008

5

1.2

TRANSPORTATION AND SECURITY

5

a significant role in national defense; indeed, our system of interstate highways was built with just this purpose in mind. The overriding objective of the Eisenhower Interstate Highway System in the United States, begun in the 1950s, was the strategic, efficient, and quick movement of troops, weapons, and supplies in time of war. While successful in scope, it is interesting to note that the major benefit of the Interstate Highway System has been one of commerce rather than for the military, becoming the great enabler of moving goods and people efficiently via surface transportation. Transport services are provided through air (including space), water, and surface vehicles. Airplanes and ships mainly accommodate air and water travel, respectively, whereas railroads, private automobiles, commercial trucks, and public transit comprise the surface transportation system. Many times these different transportation modes serve independent travels, and these modes often complement each other in serving overlapping travel requirements. For example, delivering cargo from Paris, France to Santa Fe, New Mexico, United States, necessitates that goods be freighted through a complex web of surface, water, and in some cases air travel to reach their destination. These transportation choices are not simply relegated to the movement and reception of cargo. Residents around Seattle, Washington, may use private automobiles, public transit, or ferry transportation to commute to work. Similar complementary services exist within modes; travelers in the Boston area may use either private automobile or the Massachusetts Bay Transit Authority light rail to reach their destinations. There have been numerous terrorist attacks on such large-scale transportation systems. The September 11, 2001, terrorist attacks by means of the U.S. airline industry revealed the risks of the transportation system being used as a weapon. We realized that not just aircraft but surface transportation systems (trucks, containers, transit cars, barges) and the bridges and tunnels that facilitate their use could be weaponized (Kulash 2002). Critical transportation infrastructures, such as bridges, tunnels, and intermodal faculties, were seen to be particularly vulnerable to terrorist attacks. Other bombings—coordinated bombings in 2004 against the commuter train system of Madrid, Spain, which killed 191 people and wounded 2,050, and the July 7, 2005, bombings against London’s public transport system, in which 52 commuters were killed and 700 were injured—illustrate these vulnerabilities (U.S. Department of State 2004). Since 2000, terrorist attacks on transportation systems worldwide have more than doubled as compared to the previous decade, with attacks being conducted against smaller targets and in smaller cities. (U.S. Department of State 2004). Security incidents can have an impact on the transportation system. For example, the September 11 terrorist attacks in the United States affected all modes of transportation for the entire region and the I-95 corridor and necessitated significant road repair. Threats near a transportation facility can result in closures or travel restrictions (Federal Highway Administration 2004). In the United States, the Federal Highway Administration (FHWA) is

E1E1C01_1

09/18/2008

6

6

INTRODUCTION

supporting the development of new technologies and training programs to assist regional and state transportation agencies in upgrading operational tools and processes for providing enhanced security (Federal Highway Administration 2008). The focus of this effort related to ITS includes:   





Model emergency scenarios Integrate ITS with State Emergency Operations Centers, Implement voice and data interoperability between transportation and public safety agencies Train transportation agency personnel in Incident Command/Unified Command (ICS/UC). ICS/UC is a tool, jointly developed by stakeholder agencies called the National Response Team (NRT) to protect the public against threats from land, air and water by efficiently responding and managing emergency events. NRT includes stakeholder agencies such as U.S. Department of Commerce, U.S. Department of Defense, and U.S. Department of Transportation (NRT 2008). Apply ITS to support and improve homeland security efforts.

These efforts, along with state and local planning, are improving the future security landscape of the United States. Both developing and developed nations have initiated their own transportation security strategies. In the United States, transportation security is an integral part of homeland security. In fact, transportation is listed as one of the 17 critical infrastructure sectors in the strategies for homeland security (Office of Homeland Security 2005). Because most of the European initiatives parallel efforts in the United States, many opportunities exist for international collaboration through communications and information sharing. This sharing is expected to result in efficient management of international security efforts to minimize security threats worldwide, which is an increasingly important task.

1.3 SECURITY IN THE ITS CONTEXT

This book focuses on the ability of intelligent transportation systems to improve security. ITS systems combine traffic engineering, computer technologies, and communications systems that complement and integrate these services provided by various agencies to improve traffic flow and safety in the surface transportation system (Chowdhury and Sadek 2003). The surface transportation system includes roads, bike paths and pedestrian corridors, mass transit systems, and railroads. Surface transportation infrastructure includes the fixed assets of the surface transportation system, such as highways and streets, train stations, public transit terminals, and bridges (U.S. General Accounting Office 2004). Although the concept of intelligent vehicle highway systems, which was later renamed ITS, was introduced in the 1980s, it has recently received much

E1E1C01_1

09/18/2008

7

1.3

SECURITY IN THE ITS CONTEXT

7

attention and has proceeded through several evolutionary milestones. Today ITS is a recognized field of research in the transportation community that provides a viable means to help meet future transportation demands. The systems are also increasingly viewed as alternatives to additional road infrastructure construction to meet future travel demands. ITS applications primarily focus on the surface transportation infrastructure, but they also are applicable to air and water transportation systems (e.g., airports and seaports) that have the potential to be interdependent. Through government-sponsored field evaluations in which ITS was shown to minimize crashes while reducing travel times, the collective transportation community has come to see the inherent value of such systems. Studies conducted by the U.S. Department of Transportation (DOT) determined that the deployment of ITS in major U.S. metropolitan areas resulted in considerable savings in travel time, an increase in safety, improvement in air quality, higher customer satisfaction, and lower fuel consumption (U.S. DOT 2005). These applications, encompassing various areas, are briefly described next along with some primary security risks. 







Arterial management systems. Arterial management systems include computer and sensor systems to control traffic flow on arterial roadways based on demand. Because operating agencies often control such systems from remote locations, they are vulnerable to unauthorized usage. For example, depending on the signal preemption security settings, individuals have been able to acquire devices that cause unintended signal preemption. Freeway management systems. A freeway management system includes such functions as surveillance, control, guidance, warning, and information dissemination (FHWA, Freeway Management Handbook, 2003). These functions, provided in limited-access highways to improve traffic flow, are also vulnerable to security disruptions, which can be potentially catastrophic during mass evacuations. Incident management systems. Incident management systems are used to reduce the impact of unusual or abnormal occurrences, such as crashes, stalled vehicles, work zone lane closures, or special events. Such systems potentially can minimize the duration of an incident, minimize the risks of secondary crashes, and support re-routing traffic. Any disruption to the incident management system can accentuate the response to incidents. Transit management systems. Transit management systems are designed to improve the efficiency, security, and safety of public transit, including subways, light rail and buses. The public expects that these systems provide a safe and secure environment. Location identification technologies, operations software, real-time information, and electronic fare payment are some of the primary tools used to improve the efficiency, safety, and security of the transit systems. Knowing the real-time location

E1E1C01_1

09/18/2008

8

8

INTRODUCTION





of the transit system elements and having transit drivers communicate with the dispatch and operations center ensures that the transit system is alerted of potential incidents on routes, so that drivers can take alternate routes. By implementing video and sensor surveillance in the transit terminals and area outside the vehicles, security of the system can be enhanced. Electronic toll collection (ETC). ETC systems permit automatic toll payment, where motorists need not stop to pay tolls. Vehicle-mounted units record payments from individual motorists, lessening toll plaza backups of vehicles and permitting more efficient and safer travel. Similar to ETC technology, security-related detection and surveillance devices in automated toll booths and at critical locations are also under development for monitoring suspicious activities. Regional multimodal traveler information systems. Multimodal traveler information systems provide travel-related information for use in highway, transit, ferry, and airway systems. The fusion of historical and current data makes it possible to create real-time information that can be passed on to travelers to rerout and avoid an incident scene, thus increasing safety and efficiency. Providing similar information on evacuation routes, routes to avoid, emergency transit services, and the transportation situation during emergencies can be valuable during and after an emergency event.

Field evaluations have been mostly positive regarding the effectiveness of these applications. This positive experience has been the major motivating factor for widespread deployment of ITS. Previous studies and field evaluations found positive gains in safety by implementing various ITS services. It is expected that the deployment of ITS will increase nationwide, expanding new opportunities to improve the transportation infrastructure and its associated regional and national security concerns. Because using ITS to improve security can simultaneously attain other mobility and safety objectives, ITS can prove to be an efficient endeavor for both public and private agencies. Integrating ITS with other non-transportation infrastructure, such as surveillance cameras for businesses, can further mitigate safety and security risks. Large trucks carrying unauthorized hazardous materials are of major concern. The technology that can be applied to scan and check the carrier credentials and truck contents from a roadway checkpoint while the truck is in transit is a potentially beneficial way to improve security. In addition, ITS can minimize the impact after a security breach has occurred through the use of preestablished routes for evacuating people during emergencies. In both cases, providing motorists with real-time traffic assignment based on the traffic demands on designated routes and alternate evacuation routes can minimize the impact of any security breach within the infrastructure of the U.S. surface transportation system.

E1E1C01_1

09/18/2008

9

1.3

SECURITY IN THE ITS CONTEXT

9

The primary benefits of ITS, including efficiency, safety, and security, are illustrated in Figure 1.1. Also shown are the security-related services provided by ITS, which potentially can prevent the tampering of both highway and transit infrastructures, including surveillance of traffic conducted through sensors, videos, and freeway service patrols. In addition, the use of ITS to regularly monitor commercial vehicles can support constant surveillance to prevent their use as terrorist weapons. Moreover, because ITS can minimize the impacts of highway incidents through traffic control and management at and near the incident-impacted area, the same concepts and technologies, such as use of dynamic message signs to inform motorists, the use of lane access control signs, and gates, can be used adjacent to the site of a terrorist attack to reroute traffic and track the location of vehicles carrying hazardous material close to the crisis area. Additionally, ITS can help first responders and subsequent public safety assets dispatched by various law enforcement or rescue agencies increase their effectiveness by maintaining secure communications links. ITS can also support evacuation by providing information and control regarding lane reversal. Through ITS deployment in one or more of these areas—detection, surveillance, control, information, and coordination—some of the surface transportation safety and security risks can be minimized.

Efficiency

Intelligent

Transportation

Surveillance Safety Detection

Systems

Security

Scene Management

Response Coordination

Evacuation

Figure 1.1 ITS Functions and Security.

E1E1C01_1

09/18/2008

10

10

INTRODUCTION

The security-related services presented in Figure 1.1 may also provide ‘‘safety’’ and ‘‘efficiency’’ benefits; which means that investment of ITS and any other transportation infrastructure to strengthen security is likely to provide benefits in other areas as well. For example, ITS-related security features for bridges over navigable waterways, such as surveillance systems, will also support traffic management during a crash or evacuations due to natural or man-made emergencies, thus supporting safer and efficient traffic operations. Other security measures on bridges, such as lighting and pier strengthening, will contribute to its overall safety. Similarly, having an integrated and interoperable communication system between different stakeholder agencies for accelerated security response will benefit non-security related emergency events, such as supporting hurricane or flood related evacuations of at-risk population from an affected region (Parsons Brinckerhoff and Science Applications International Corporation, 2002). The multiple non-security related benefits that may be derived from a transportation security investment will make it more cost-effective and thus more justifiable. 1.4 SCOPE AND AUDIENCE OF THE BOOK

The focus of this book is on the infrastructure-based transportation technology that will contribute to the regional and national security against deliberate attacks on the transportation system. Although the book concentrates on technology related to the surface transportation infrastructure, modes of transport, such as personal transportation, public transit, and freight, are presented in terms of their relationship with the surface transportation infrastructure as identified in the National ITS Architecture (RITA, National ITS Architecture 6.0) including the Security Document (RITA, National ITS Architecture Security Document). This book discusses different objective measures to identify and quantify risks and develop mitigating measures using ITS while concentrating on different vulnerable links in transportation where ITS can contribute to security. This book is intended to serve as a reference for transportation engineers, planners, and service providers in the public and private sectors involved in transportation or infrastructure security and will be useful to personnel involved in homeland security. It is also designed to serve as a college textbook for a graduate-level course or as a supplement to an undergraduate course. This book covers theories behind many risk analysis tools and provides real-world examples of transportation security plans and implementation guidelines of these plans. It concentrates on infrastructure planning and the system architecture that binds it with various surface transportation modes: personal vehicle, public transit (paratransit, buses, ferries, and rail), and commercial vehicle operations. The surface transportation system faces the challenges of meeting the demand of increasing congestion with increased risks in safety and security

E1E1C01_1

09/18/2008

11

1.5

CONTENT AND ORGANIZATION

11

breach. We need to educate and train our future transportation professionals to meet these challenges. As ITS is expected to be a dominant element of future transportation systems, transportation professionals should know how to minimize the greatest risks to surface transportation systems through an understanding of security. By presenting academic background as well as projectoriented examples, this book provides fundamental knowledge to prepare professionals and students to improve the safety and security of transportation systems. Review questions are available at the end of each chapter in addition to exercises to help the reader apply the material.

1.5 CONTENT AND ORGANIZATION

The initial chapters of this book discuss how ITS can contribute to security, followed by approaches on using ITS for security and concluding with issues and opportunities to providing security through ITS and concepts of security. This book is organized into ten chapters: 











Chapter 1 introduced the concept of security and its contributions to positive social and economic growth. This chapter also discussed transportation security and how ITS can contribute to it. Additionally, the scope of this book and intended audience are also identified. Chapter 2 presents the case for having a comprehensive security framework for surface transportation infrastructure to minimize the risk of occurrence of a deliberate attack and to minimize impact after such an event has occurred. The chapter presents several case studies from around the world on transportation security programs. Chapter 3 introduces how the systems engineering approach of the National ITS Architecture can facilitate effective and systematic deployment of transportation technologies. This chapter focuses on the security aspects of the National ITS Architecture and presents examples of how these tools have been applied. Chapter 4 presents the process for identifying infrastructure security risks and associated factors with example problems and solutions. This will be the foundation for identifying the qualitative and quantitative relationship between risk and associated factors using state-of-the-art tools as presented in Chapter 5. Chapter 5 illustrates different concepts of risk modeling, including the data requirements and assumptions. In addition to detailing processes for evaluating the threats, this chapter discusses potential measures for mitigating these threats. Chapter 6 explains the fundamentals of computer network security as it pertains to ITS. It provides a background on the elements of computer network security followed by a general approach to securing these

E1E1C01_1

09/18/2008

12

12

INTRODUCTION









networks. The objective of this chapter is to prepare the reader for Chapter 7 which is entitled Securing ITS. Chapter 7 discusses how ITS itself can be protected from deliberate attacks. The chapter presents different areas of ITS that need security considerations: information security, personnel security, and operational security. The chapter also discusses how security programs could be built on safety initiatives. Chapter 8 discusses the relationship between ITS security areas and other modes of transportation. It presents a framework of how ITS security areas can contribute to the security of air, maritime, rail, and military transportation. Chapter 9 presents the process for developing an integrated program in surface transportation security using ITS. This chapter also discusses how security can be integrated into the transportation planning and asset management processes. Chapter 10 discusses the issues and challenges for implementing security programs in the surface transportation system and discusses practical ways to meet these challenges.

REFERENCES Blue Ribbon Panel on Bridge and Tunnel Security. 2003. ‘‘Recommendations for Bridge and Tunnel Security.’’ Prepared for the American Association of State Highway and Transportation Officials Transportation Security Task Force. September. Chowdhury, Mashrur, and Adel Sadek. 2003. Fundamentals of ITS Planning. Artech House. Federal Highway Administration (FHWA.) 2003, Freeway Management and Operations Handbook, FHWA Report No.: FHWA-OP-04–003, Washington, D.C. Federal Highway Administration (2004), http://ops.fhwa.dot.gov/aboutus/one_pagers/ emerg_response.htm (accessed in June 6, 2008). Federal Highway Administration (2008), http://ops.fhwa.dot.gov/opssecurity/docs/pub_safety_ sec_bro.pdf, 2008). Meade, Charles, and Roger C. Molander. 2006. ‘‘Considering the Effects of a Catastrophic Terrorist Attack.’’ RAND Center for Terrorism Risk Management Policy. National Response Team (NRT), Unified Command Technical Assistance Document, 2007. www.nrt.org. Parsons Brinckerhoff and Science Applications International Corporation. 2002. ‘‘National Needs Assessment for Ensuring Transportation Infrastructure Security.’’ Prepared for the American Association of State Highway and Transportation Officials Transportation Security Task Force. October. Research and Innovative Technology Administration (RITA). May 2007. National ITS Architecture, Version 6.0. www.its.dot.gov/arch/index.htm. Research and Innovative Technology Administration (RITA), National ITS Architecture Security Document. May 2007. www.its.dot.gov/arch/index.htm.

E1E1C01_1

09/18/2008

13

REVIEW QUESTIONS

13

U.S. Department of Homeland Security. 2005. State and Urban Area Homeland Security Strategy. ‘‘Guidance on Aligning Strategies with the National Preparedness Goal.’’ July. U.S. Department of State. (2004). Significant Terrorist Incidents, 1961–2003: A Brief Chronology. Office of the Historian, Bureau of Public Affairs, U.S. Department of State. Available at: http://www.state.gov/r/pa/ho/pubs/fs/5902.htm (assessed June 2007). U.S. Department of Transportation (U.S. DOT), Federal Highway Administration (FHWA.) 2005, Intelligent Transportation Systems Benefits, Costs and Lessons Learned: 2005 Update, Report Number FHWA-OP-05-002, Washington, D.C. U.S. General Accounting Office. 2004. Report to the Ranking Minority Member, Committee on Commerce, Science, and Transportation, U.S. Senate. ‘‘Many Factors Affect Transportation Investment Decisions.’’ June.

REVIEW QUESTIONS

1. Differentiate between natural hazards and terrorist threats in terms of protection and impacts. 2. Why is the perception of security so important for a society? 3. Provide a summary of attacks on transportation infrastructure around the world and their impacts. 4. Provide two scenarios where transportation security concerns will impact a highway engineer. 5. What is ITS? How can risks to our transportation system be minimized with ITS infrastructure? 6. Identify the stakeholders who are responsible for providing transportation security in your region and their roles in this capacity.

E1E1C02_1

09/18/2008

14

CHAPTER 2

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

T

his chapter presents the vulnerabilities of the surface transportation system and provides examples of situations when these vulnerabilities have been exploited by natural or man-made disasters. Through these examples and the lessons learned from them, we explain why surface transportation infrastructure security is necessary.

2.1 VULNERABILITIES

Vulnerabilities will always exist in surface transportation systems because of their characteristically open nature. Controlling access to freeways, transit systems, and other surface transportation facilities can significantly impact the way we travel, our quality of life, our economies, and our prosperity. Therefore, it is more tangible to mitigate these vulnerabilities while keeping our access to surface transportation systems open. A level of interdependence frequently exists within our transportation system that can either reduce or spread the impact of regionally significant incidents. The prevalence of alternate routes adjacent to freeways can lessen the impact of incidents on such roads, allowing travelers to reroute in the event of such an incident. Further, the multiple routes that often serve most major metropolitan areas also provide redundancy against security incidents. Interconnected traffic management centers (TMCs), however, Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

14

E1E1C02_1

09/18/2008

15

2.1

VULNERABILITIES

15

could allow one computer virus to partially or completely disable the functionality of the TMC and the traffic controls at multiple intersections. This vulnerability is of particular concern for agencies connected to other agency’s systems. Similar systems exist to control transit systems, freight operations, and ports. Although identifying vulnerabilities is an important part of managing security needs, a one-time assessment is not enough. Because security threats constantly evolve to circumvent prevention initiatives and because new technologies keep changing the face of transportation infrastructure, vulnerabilities must be reassessed in an ongoing process. Many tools exist to help practitioners and researchers identify and rank these vulnerabilities, including planning and analysis guidance, such as the National Infrastructure Protection Plan of the U.S. Department of Homeland Security (DHS) (U.S. DHS 2006) and the Guide to Highway Vulnerability Assessment for Critical Asset Identification and Protection by the American Association of State Highway Transportation Officials (AASHTO 2002). Other more infrastructure-or location-specific works, although not as universally adopted, can provide insight to those seeking to identify and address specific vulnerabilities. Recent works have offered methods for vulnerability assessments, highway risk assessments, funding allocation, and traffic management center risk assessment. 







Hood et al. present a methodology for transportation vulnerability assessment that weighs the vulnerability of an infrastructure element against the criticality of that element, considering vehicle, user, infrastructure, social setting, and environment as elements. This approach requires a large amount of data but uses workshops that stakeholders can use to identify these elements and their associated vulnerabilities (Hood et al. 2003). Xia et al. also present a methodology for risk assessment of highway networks. This model dynamically assesses vulnerability based on three indices: static vulnerability, dynamic vulnerability, and attack potential. Although this model can dynamically identify when key segments of highway are at their highest risk—for example, during rush hour—it requires a large amount of qualitative data (Xia et al. 2005). King et al. developed a method to optimally allocate funding and other resources to address vulnerabilities in transportation facilities. This work identified the similarities and differences between vulnerability assessments conducted for earthquakes and that conducted to prevent or manage terrorist attacks. Overall, impacts to key infrastructure are the same for man-made and natural disasters because they share the same need for an objective vulnerability assessment (King et al. 2003). Roshan et al. applied risk assessment and vulnerability identification to traffic management centers (TMCs). Initially this methodology was applied to three different centers as a field test. Findings from these

E1E1C02_1

09/18/2008

16

16

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

implementations can help identify vulnerabilities at other TMCs (Roshan et al. 2005). 2.2 COMMON CHARACTERISTICS OF SURFACE TRANSPORTATION SYSTEMS

Current travel networks are at or nearing capacity across the country; therefore, incidents on one facility can affect several other nearby facilities and modes. Similarly, as transportation technologies become increasingly interdependent, problems in one system, such as a computer virus, have the potential to impact several other systems. To address these issues, the National Infrastructure Protection Plan (NIPP) seeks to protect the nation’s critical infrastructure and key resources. Although not focusing solely on transportation systems, this plan emphasizes the need for infrastructure security and seeks to manage risks by deterring threats, mitigating vulnerabilities, and minimizing consequences (U.S. DHS 2006). More important, the NIPP provides a common framework for agencies across the United States to identify and rank transportation infrastructure vulnerabilities in a consistent manner. Because today’s freight and traveler transportation systems are highly interconnected, security boundaries need to be defined. Although freight can change modes multiple times before reaching its final destination, security inspections are not, and should not be, conducted on each change. Consistent security coordination between agencies and between modes reduces the need for security inspections when freight changes modes or vehicles. Similarly, providing surveillance at one transit station and not others merely shifts the vulnerability rather than addressing it. After the 2001 terrorist attacks, airline travelers were subjected to the regular security checkpoint and then a further security screening at the gate. Today the security area has been expanded so that security checks at the gate are no longer necessary. Funding is commonly the constraint to securing all locations, but it does not obviate the need for consistent security coordination. Security scenarios appear in many forms, including natural and man-made disasters. These scenarios could affect populated areas of any size, transportation systems for any mode, and take many forms. The possibilities may be endless, but the responses are usually similar. To rehearse these responses, agencies across the United States and abroad conduct full-scale drills to simulate disaster response and to identify problems. Common scenarios that agencies have simulated include bombings on buses and in subway stations, hurricane evacuations, and most recently dirty bombs. These drills have helped agencies identify their weaknesses. For example, a drill testing the security of a transit system in Miami-Dade County, Florida, illustrated how easily uniformed personnel, even without name badges, could access their facility and prompted several security changes (Tarr et al. 2005).

E1E1C02_1

09/18/2008

17

2.3

COMMON THREATS TO SURFACE TRANSPORTATION SYSTEMS

17

2.3 COMMON THREATS TO SURFACE TRANSPORTATION SYSTEMS

Common threats to surface transportation systems take many forms and impact various pieces of transportation as we know it. These threats include earthquakes, fires, terrorist attacks, hazardous material (HAZMAT) spills, blackouts, hurricanes and tornadoes, floods, and train derailments. Some of these disasters, such as hurricanes, are not preventable, and authorities must focus on management; for other disasters, such as train derailments, the focus can be shared between prevention and management. After September 11, 2001, AASHTO created the transportation security task force, which determined that security planning was needed in three areas, including protecting critical mobility assets, improving state Department of Transportation emergency response capabilities, and enhancing traffic management capabilities. This task force also identified explosive attacks on key links as the most significant threat to highway infrastructure (Field 2004) and initially identified approximately 50 tunnels and 450 bridges as critical assets (AASHTO 2002). To protect these assets, AASHTO recommended four key countermeasures: 1. Maximize the distance between possible explosive placements and important structures and mechanical systems using barriers. 2. Use locks, caging, and fencing to prevent access to locations where explosives would significantly impact structural integrity. 3. Limit time of intruders by using detection and surveillance systems for secured areas. 4. Use blast shielding and other methods to enforce key members of infrastructure. 2.3.1 Earthquakes

Earthquakes can damage highways, bridges, tunnels, and traffic signals. The Loma Prieta 1989 earthquake in California caused unprecedented transportation chaos. In particular, the top level of the two-level raised Cypress freeway in Oakland, California, collapsed. Other earthquake impacts can include buckling, cracking, and sinking of pavement due to liquefaction and movement of the underlying soils. Pavement discontinuities can shut down freeways, airports, and parking facilities. Since many surface transportation technologies require electricity and because earthquakes commonly disrupt power supplies, traffic sensors, aside from possibly being damaged from the earthquake itself, may not be able to provide traffic managers with needed information about the status of transportation facilities. When transportation infrastructure is damaged during earthquakes, the impact is twofold. Not only are motorists and injured victims stranded, but emergency responders are unable to use that road to access emergency

E1E1C02_1

09/18/2008

18

18

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

locations. This fact could make the postearthquake recovery period more devastating than the initial impacts. 2.3.2 Fires

Fires impacting surface transportation systems are most significant in tunnels. A tunnel fire could relate to freeway, freight rail, or passenger rail. While tunnel fires damage the infrastructure and disrupt transportation flows, their more important effect is that they cause injuries and fatalities to travelers. Ventilation and egress remain the two key concerns from such disasters. Much work has been done to mitigate these issues, such as the Memorial Tunnel Fire Ventilation Test Program conducted by the Federal Highway Administration (Luchian 1997) and others (Carvel 2005; Jojo and Chow 2003). Security systems to detect and manage such disasters are important, particularly as many cities with limited surface-level space have relocated freeways to underground. For example, the Boston, Massachusetts, Big Dig Project replaced a 6-lane elevated freeway through its downtown with an 8- to 10-lane expressway directly underneath its previous location. Although this project opened up green space, created room for modest development in downtown, and reconnected parts of the city separated for over half a century, there were significant challenges, including security. Surface roads also can be closed due to fires and their smoke. Fires on surface transportation systems have traditionally been nonmalevolent, caused by fuel spills after vehicular crashes and by forest fires. Fuel spills have the potential not only to damage the pavement but to cause fires to start beside and under the road as drainage systems carry fuels downhill. Smoke closes roads due to visibility problems like those experienced during wildfires in California. 2.3.3 Terrorist Attacks

In today’s age of information technology, terrorists can not only attack our surface transportation system with bombs and hijackings, they can attack from within by hacking our transportation control computer systems. Both attack types can carry significant risks if not prevented. Bombs on surface transportation systems have usually focused on public transit, including trains, buses, and ferries, because of the density of travelers and the open access that is necessary for such systems to maintain ridership. The Paris Metro bombings and the Tokyo subway sarin gas attacks in 1995, the events of September 11, the Moscow Metro and the Madrid commuter rail bombings in 2004, and the London Underground bombings in 2005 have ignited worldwide focus on these systems and their undisputed vulnerabilities. While less publicized, hijackings of trains, buses, and trucks are also significant. Perhaps the most noteworthy train hijackings were those in Holland in 1975 and again in 1977. Although few train hijackings since have generated such worldwide attention, vulnerabilities still exist on rail systems.

E1E1C02_1

09/18/2008

19

2.3

COMMON THREATS TO SURFACE TRANSPORTATION SYSTEMS

19

Because of their ability to change routes easily, buses and trucks are more frequent hijacking targets than trains. Of these two, buses are particularly at risk because of their open access to the public and the value of their riders. For example, school buses have been hijacked many times in the United States, including 1976 in Chowchilla, California, 1995 in Miami, Florida, and 2000 in Las Vegas, Nevada. The increasing size of vehicles in the United States also fuels security risks for vehicles used as weapons. Although trucks and buses cannot increase their future size significantly due to the geometry of existing road infrastructure, the average size of personal vehicles can change. The popularity of certain vehicle types, such as sport utility vehicles, and the uncertainty of future fuel types and prices will continue to play a significant role in defining the vulnerability that vehicles pose to infrastructure if used malevolently.

2.3.4 HAZMAT

The Hazardous Materials Transportation Uniform Safety Act (1990) was the foundation of today’s safety procedures concerning HAZMATs. This legislation required that HAZMAT carriers obtain permits prior to transporting hazardous materials and provide specific information about that material. Regulations since, particularly after the events of September 11, have become increasingly intensive. Table 2.1 displays a list of materials considered as potential HAZMAT weapons; on the table, ‘‘bulk’’ indicates quantities more than 119 gallons (450 liters). Regulations have greatly improved the safety of the public and environment from HAZMAT, but because over 800,000 HAZMAT shipments depart each

TABLE 2.1 Potential HAZMAT Weapons Material Explosives Flammable liquids (e.g., gasoline) Flammable gases (e.g., propane) Flammable solids Hazardous wastes and substances Infectious substances (e.g., anthrax) Nonflammable gases (e.g., anhydrous ammonia) Organic peroxides Oxidizers (e.g., oxygen generators) Pesticides Poisonous gases (e.g., chlorine) Poisonous liquids Radioactive materials Source: USDOT/FMCSA, 2002.

Quantity Any quantity Bulk Bulk Bulk Bulk Any quantity Bulk Bulk Any quantity Bulk Any quantity Any quantity Any quantity

E1E1C02_1

09/18/2008

20

20

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

day in the United States (Stock et al. 2004), risks still exist. Comprehensive and collaborative safety and security systems still are necessary to ensure that each shipment arrives safely at its destination.

2.3.5 Blackouts

Due to an increasing reliance on technology in transportation, power outages have the potential to disrupt or even stop transportation networks. Major blackouts have occurred in the United States in 1965, 1977, 1996, and 2003, illustrating how the increasing use of powered technology deepens the impact of a power outage. The blackout in 2003 affected New Jersey, New York, Pennsylvania, Michigan, Ohio, Connecticut, Vermont, and Massachusetts. In New York City alone, 11,600 traffic signals were darkened and 413 subway trains were stopped (DeBlasio 2004). Even if traffic management centers operated on backup power, they were mostly without data to monitor the transportation network because most video cameras and sensors required a working power source. 2.3.6 Hurricanes

Hurricanes, because of their high wind speeds and tidal surges, cause the evacuation of large numbers of people. These evacuations almost exclusively use roadway networks, placing a high demand on freeway capacity. To use the existing capacity effectively, authorities in multiple jurisdictions and at multiple levels of government must coordinate to, for example, issue evacuation instructions, reverse freeway lanes, and transport those without personal vehicles. Intelligent transportation systems (ITS) are commonly used to manage evacuations and lane reversals. Permanent infrastructure, such as traffic cameras and dynamic message signs (DMS), are preferred, but they are not always economical due to the rarity of evacuations. Therefore, agencies such as the South Carolina Department of Transportation operate mobile units that include traffic cameras and DMS which can be deployed during such emergencies (Ballard 2007). Further, agencies must establish a backup source of power for their permanent and portable ITS infrastructure during hurricane evacuations. After hurricanes, significant efforts must be made to coordinate recovery. Hurricane Katrina caused an estimated $3 billion in highway damages alone (Burton and Hicks 2005), destroyed almost half of the transit streetcars that operated in New Orleans (Luczak 2007), and damaged or destroyed six key railroad bridges along the Gulf Coast Main Trunk of CSXT (SimmonsBoardman 2005). These impacts, shown in part in Figure 2.1, affect all modes of transportation. Extensive financial efforts and leadership are required to rebuild not only the infrastructure but the communities.

E1E1C02_1

09/18/2008

21

2.3

COMMON THREATS TO SURFACE TRANSPORTATION SYSTEMS

21

Figure 2.1 U.S. Route 90 after Hurricane Katrina (2005).

2.3.7 Floods

Closely related to hurricanes, floods can merit evacuations and sever transportation links simultaneously. While interstate freeways are built to remain functional in the event of a 100-year flood, state and local roads are usually built with more focus on budget. Floods can occur with little-to-no warning and break transportation links, requiring emergency and transportation management to reduce the threat to lives, infrastructure, and reduce delay. Flooding can also block waterways with debris. Figure 2.2 shows the results of flooding in Gulfport, Mississippi after Hurricane Katrina in 2005. To manage the impacts of flooding, departments of transportation often use environmental monitoring systems. Combined with traffic cameras for verification, these monitoring systems can provide an effective way of identifying water on roadways. Based on the severity of flooding, traffic management officials can select a response by activating flashing lights on signs stating, ‘‘Watch for Water on Road,’’ as used by the Houston, Transtar traffic management system, by activating dynamic message signs, or by closing bridges or roads. The United States Geological Survey and the National Weather Service’s flash flood monitoring and prediction initiative as well as transportation researchers are striving to warn travelers of possible floods with increasing speed and accuracy.

E1E1C02_1

09/18/2008

22

22

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

Figure 2.2 Flooding in Gulfport, Mississippi (2005).

2.3.8 Biological and Chemical Attacks

Although biological and chemical attacks seemingly carry similar threats, they are significantly different. A biological attack disperses living organisms, including bacteria and viruses, which can incubate for days or weeks. After this incubation period, those exposed have the potential to infect others, thus making it difficult for medical and public health personnel to isolate victims and stop the spread. It is also difficult to identify the time and location of such an attack. A chemical attack, however, can disperse toxic synthetic- or biologically based chemicals that have more immediate effects than biological agents. Victims need not be isolated, but they must be decontaminated. Therefore, the spread of chemical attacks is more easily prevented than that of a biological attack (Henderson 1999). One of the better-known chemical attacks was the 1995 sarin gas attacks on the Tokyo subway. Sarin, a nerve agent similar to some insecticides, was released on several lines of the Tokyo subway during a morning rush hour by domestic terrorists. This attack killed 12, severely injured 50, and caused shortterm vision problems for approximately 1,000 others. Review of this incident suggested that agencies coordinate their efforts through disaster drills, that poison control centers play an increased role and stressed the need for real-time communication availability and redundancy (Okumura et al. 1998).

E1E1C02_1

09/18/2008

23

2.3

COMMON THREATS TO SURFACE TRANSPORTATION SYSTEMS

23

2.3.9 Derailment

Because railroads represent a vast network of tracks, bridges, and crossing gates, they are as difficult to secure as a nation’s highways. Train derailments represent a significant risk because of their likelihood and their significant impact. In January 2005, a train derailment in Graniteville, South Carolina, sent a plume of chlorine gas into the air as a 90-ton tank car was ruptured. The spilled gas killed 9 residents and injured 550 (National Transportation Safety Board 2005). Figure 2.3 shows 90-ton tank cars on a comparable South Carolina railway. Similarly, a train collision in Bexar County, Texas, in June 2004 spilled chlorine gas and anhydrous ammonia, killing 3 people and injuring 41 (Mitchell et al. 2005). High-speed passenger rail is at greater risk for damage from derailment than freight because the train cars are lighter and faster (Zaworski and HunterZaworksi 2004). To limit derailment risks for both freight and passenger lines, agencies can use many monitoring systems to help identify obstacles on tracks, particularly at rail-grade crossings. Advances in optical sensors have shown promise for monitoring these locations. 2.3.10 Cyber Attacks

Because many traffic management centers are linked to the Internet to provide travelers with real-time information, the risk of cyber attacks is higher than ever before. Firewalls prevent many attacks from gaining control of ITS systems, but programmers with inside knowledge of such systems still pose a threat. The end result of such a threat can range from a full computer system crash, to opening dual access, to contra-flow systems (NMAB et al. 1999). Most recent cyber risks have come in the form of stolen computers, particularly laptops. After two

Figure 2.3 90-ton Chlorine Rail Cars.

E1E1C02_1

09/18/2008

24

24

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

laptops containing the personal information of over 3,000 HAZMAT truckers were lost/stolen from the U.S. Transportation Security Administration (TSA) in 2007, data encryption became mandatory on all computers used by the TSA and its contractors. 2.4 DEFENDING AGAINST THREATS BOTH EXTERNAL AND INTERNAL

To defend against threats, transportation agencies, both public and private, use various tools. These tools can be categorized by their use in prevention, management, or recovery. Prevention tools include surveillance systems, data encryption, and even padlocks. Management also can include surveillance systems and data encryption, plus additional tools, such as fire and water containment systems and information dissemination systems. The recovery category uses information dissemination to inform motorists of available routes, surveillance to help inspect facilities for debris, and various other tools, depending on the type of incident. This section focuses on defending against threats and reviews tools aimed at prevention. One of the most popular tools used in surveillance is closed circuit television (CCTV), as shown in Figure 2.4. Many public transportation agencies have installed CCTV for use as traffic cameras to detect and verify traffic incidents on freeways, such as crashes. As security emphasis increases, these devices can serve a dual purpose, which further increases their value to the public. Data encryption, while commonplace in the computing world, has just begun to be applied to transportation management. Public agencies generally overlook the need for data encryption for communication between traffic signals, to and from traffic cameras, and to and from remote access gates. Vulnerability assessments, as discussed in later chapters, can help identify which of these communications links are at risk and which can cause the most significant impact if disabled, disrupted, or commandeered. Lock-and-key is arguably the oldest forms of security and still is used to security vital parts of our surface transportation infrastructure. Traffic signal equipment cabinets, rail crossing gate controls, and traffic camera control cabinets are all frequently secured using locks. This security method is adequate to mitigate the risks for many of these devices, but facilities such as traffic or transit management centers, require more failsafe security measures. To identify potential weaknesses and communication problems, agencies across the United States and abroad conduct security drills. During these drills, a full-scale event, such as a bus bombing, is simulated, and emergency agencies (fire, police, medical responders, and transportation management agencies) respond accordingly. Drills normally measure evacuation efficiency, time required and transportation methods use to transport victims to local hospitals, and communication latency between public safety responders. Findings from drills and other security-related research suggest that redundancy is one of the best existing defenses against most transportation security

E1E1C02_1

09/18/2008

25

2.4 DEFENDING AGAINST THREATS BOTH EXTERNAL AND INTERNAL

25

Figure 2.4 Traffic Camera for Security and Traffic Management.

incidents. Due to the massive size of transportation infrastructure systems in and around most cities, there exist many routes and more than one way to complete most journeys. EXERCISE

Form a group of three to five members and answer these questions about your local area. 1. What security-related tools exist in the area (even if they are not currently being used for that purpose)?

E1E1C02_1

09/18/2008

26

26

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

2. Could these tools be used for prevention, management, or recovery of security incidents? (More than one may apply.) 3. Based on the size of your community and the amount of infrastructure to protect, name two security-related projects you would recommend in the next five years. Be sure to state why it is important and which agency should lead the initiative. 2.5 WHY TRANSPORTATION INFRASTRUCTURE SECURITY IS IMPORTANT

Effective transportation infrastructure security can mean the difference between repeating the mistakes of the past and preventing or properly managing disasters in the future (Fries et al. 2008). Loss of life is a relatively immediate potential impact of a security incident, but long-term impacts can propagate like shockwaves to affect individuals, travelers, and businesses far and wide, further underscoring the need for such security. Globalization and just-in-time shipping can cause an incident in one region or country to propagate and impact several others. For example, the loss of a key highway bridge will delay both travelers and freight and may cause them to reroute or change travel modes to reach their final destination, or postpone the trip entirely. The loss of the highway bridge represents a large cost, but the delay to travelers and goods while the link is cut is more significant. Depending on the size of the incident, this delay has the potential to cross political boundaries and impact neighboring states, countries, and regions. Developed countries have larger amounts of transportation infrastructure to protect than developing nations. In 2006 Europe accounted for 38.7 percent of the global transportation infrastructure industry, followed by the Asia-Pacific regions with 32.8 percent, and the United States with 20 percent. The rest of the world accounted for only 8.4 percent of the global transportation infrastructure industry. These industry distributions are a direct result of higher level of government spending on transportation infrastructure in developed countries (Data Monitor 2007). Despite the disparity in infrastructure quantity in different countries, it is important to maintain consistent security while trading worldwide. Because of political differences, level of development, and unique regional threats, security between countries will never be exactly the same. It is important, however, to recognize the different levels of security required by each country to maintain the flow of goods. To aid with the flow of goods between countries, carriers that have been certified by the U.S. Customs and Border Protection unit as secure are able to conduct prescreening of goods prior to leaving the country of origin. This helps inspections of goods at their destinations, but carriers must protect the goods from tampering during shipment. Tamper monitors, similar to those used for intranational shipping, can provide this verification.

E1E1C02_1

09/18/2008

27

2.6

FOCUS AREAS

27

2.6 FOCUS AREAS

Although recent focus in the United States has overwhelmingly been on air transportation security, attention has now shifted to surface transportation modes (USGAO 2007). In Europe and Japan, the focus traditionally has been on transit systems, due to the history of attacks on such targets. Unfortunately, due to the size of the transit systems and space and time constraints of agencies, most security initiatives are reactive, changing focus after an attack or attempted attack (Jenkins and Gersten 2001). Table 2.2 shows focus areas of the U.S. Transportation Security Administration on the surface transportation system and the general progress as of 2007. The often-limited budgets of transportation agencies often guide the security focus. For example, although the Tokyo sarin gas attack in 1995 undoubtedly changed the security in and around subway systems worldwide, detection systems for such chemical agents are not broadly used, except by the military, due to their cost (Jenkins and Gersten 2001). Focus also is guided by the need for public transportation systems to remain open, which reduces the ability of security authorities to limit access. Facilities such as freeways must remain open to serve the public, and in the case of public transit, a myriad of access points must remain open to maintain ridership, preserving this source of income. Due to these constraints, many current security investments focus on the management of threats rather than prevention. Because terrorists and natural hazards can strike any part of the transportation system at almost any time and because it is unreasonable to protect every part of the system all the time, agencies must identify and focus on the parts most vital to operation, the economy, and human life. TABLE 2.2 Performance Expectations and Progress Made in Surface Transportation Security Performance Expectation Develop and adopt a strategic approach for implementing surface transportation security functions Conduct threat, criticality, and vulnerability assessments of surface transportation assets Issue standards for securing surface transportation modes Conduct compliance inspections for surface transportation systems Administer grant programs for surface transportation security Total Source: USGAO 2007.

Generally achieved Generally not achieved H

H

H H H 3

2

E1E1C02_1

09/18/2008

28

28

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

Using existing transportation management tools offers a cost-effective way to prevent and manage security threats. Many tools applicable to both transportation management and infrastructure security can be categorized as ITS. ITS deployments are required to meet the FHWA Rule 940.11 entitled ‘‘Intelligent Transportation System (ITS) Architecture and Standards’’ and the FTA Policy entitled ‘‘National ITS Architecture Policy on Transit Projects’’ to ensure their interoperability with future systems, see Appendix C and D, respectively. These rules refer to tailoring regional ITS architectures based on the U.S. National ITS Architecture. The transportation infrastructure security areas as defined in the National ITS Architecture are discussed in Chapter 3. Chapter 7 discusses securing ITS as defined by the national architecture. Other tools practitioners can use for transportation security are under development by the Transportation Security Administration. Within the U.S. Department of Homeland Security, TSA is the primary agency responsible for the transportation area. Although TSA shares security responsibilities with federal, state, and local governments as well as with private transportation agencies, it is solely responsible for national policy making and security standards development (USGAO 2007). The National ITS Architecture specifies a framework and corresponding mappings to standards that are specific to ITS. Additional communications standards are under development by the TSA and other standards development organizations. It is hoped that the TSA standards and the ITS standards will interoperate with each other. 2.7 SUMMARY

A plethora of natural and man-made events threaten our surface transportation infrastructure every day. Because it is unreasonable to protect every part of our infrastructure from every threat at every moment, practitioners must identify and focus on critical elements with respect to functionality, economic and cultural value and human life. Further, due to the difficulties in preventing a security incident, initiatives also must focus on response and recovery from events. Many tools in the intelligent transportation systems domain exist to help protect our infrastructure and manage responses; surveillance is one of the more commonly used. The transportation industry continues to learn from past attacks, but it needs to become less reactive and more active in security planning. Effective transportation infrastructure security needs to be an ongoing process, with focus being revised continually and techniques being refined. REFERENCES American Association of State Highway and Transportation Officials (AASHTO). 2002. A Guide to Highway Vulnerability Assessment for Critical Asset Identification and Protection. Contractor’s Final Report.

E1E1C02_1

09/18/2008

29

REFERENCES

29

American Association of State Highway and Transportation Officials. 2002. ‘‘National Needs Assessment for Ensuring Transportation Infrastructure Security, Contractor’s Final Report.’’ Ballard, A. J. 2007. ‘‘Traffic Operations for Hurricane Evacuation.’’ Proceedings of the Transportation Research Board Annual Meeting, National Research Council. Burton, M. L., and M. J. Hicks, 2005. ‘‘Hurricane Katrina: Preliminary Estimates of Commercial and Public Sector Damages.’’ Center for Business and Economic Research, Marshall University. Carvel, R. O., et al. 2005. ‘‘Fire Size and Fire Spread in Tunnels with Longitudinal Ventilation Systems,’’ Journal of Fire Sciences 23, No. 6: 485–518. Data Monitor. 2007. ‘‘Global Transportation Infrastructure: Industry Profile. Transportation Infrastructure Industry Profile: Global,’’ March: 1. DeBlasio, A. J., Regan, T. J., Zirker, M. E., Fichter, K. S., Lovejoy, K. 2004. ‘‘Effects of Catastrophic Events on Transportation System Management and Operations: August 2003 Northeast Blackout New York City. DOT-VNTSC-FHWA-04-04#. Field, M. A. 2004. ‘‘Highway Security and Terrorism Review of Policy Research,’’ 21, No. 3: 317–328. Fries, R., M. Chowdhury, and A. Dunning. 2008. ‘‘Transportation Security Framework for a Medium-Sized City.’’ European Journal of Transportation and Infrastructure Research. In press. Henderson DA. The Looming Threat of Bioterrorism. Science. Feb 26, 1999; 283(5406): 1279-82. Hood, J. N., Olivas, T., Slocter, C. B., Howard, B., and Albright, D. P. 2003. Vulnerability Assessment Through Integrated Transportation Analysis. Transportation Research Record, No. 1922. Journal of the Transportation Research Board. Pp 18–23. Jenkins, B. M., and L. N. Gersten, 2001. ‘‘Protecting Public Surface Transportation Against Terrorism and Serious Crime: An Executive Overview.’’ Mineta Transportation Institute. FHWA/CA/OR-2001–29. Jojo, S. M. L., and W. K. Chow. 2003. ‘‘Numerical Studies on Performance Evaluation of Tunnel Ventilation Safety Systems,’’ Tunneling and Underground Space Technology Vol. 18, No. 5 (November): 435–452. King, S.A., Adib, H.R., Drobny, J. and Buchanan, J. (2003). Earthquake and Terrorism Risk Assessment: Similarities and Differences. Presented at the 6th U.S. Conference and Workshop on Lifeline Earthquake Engineering. August 2003, Long Beach, California, USA. Luchian, S. F. 1997. ‘‘Memorial Tunnel Fire Test Program,’’ TR News No. 190: 48–49. Luczak, M. 2007. ‘‘Road to Recovery: Nearly Two Years After Hurricane Katrina, New Orleans RTA is Slowly Building Back Infrastructure, Ridership, and the ‘Big Easy,’’’ Railway Age 208, No. 7: 34–38. Mitchell, J. T., A. S. Edmonds, S. L. Cutter, M. Schmidtlein, R. McCarn, M. E., Hodgson, and S. Duhe´. 2005. ‘‘Evacuation Behavior in Response to the Graniteville, South Carolina, Chlorine Spill,’’ Quick Response Research Report 178. Hazards Research Lab, University of South Carolina. National Materials Advisory Board (NMAB), Computer Science and Telecommunications Board (CSTB), and the Transportation Research Board (TRB). 1999. Improving Surface Transportation Security: A Research and Development Strategy. National Academy Press, Washington, D.C. National Transportation Safety Board. 2005. ‘‘Collision of Norfolk Southern Freight Train 192 with Standing Norfolk Southern Local Train P22 with Subsequent Hazardous Materials

E1E1C02_1

09/18/2008

30

30

NEED FOR SURFACE TRANSPORTATION INFRASTRUCTURE SECURITY

Release at Graniteville, South Carolina January 6, 2005.’’ Railroad Accident Report, NTSB/RAR-05/04. Okumura, T., K. Suzuki, A. Fukuda, A. Kohama, N. Takasu, A. Ishimatsu, and S. Hinohara 1998. ‘‘The Tokyo Subway Sarin Attack: Disaster Management, Part 1: Community Emergency Response,’’ Academic Emergency Medicine 5: 613–617. Rowshan, S., Sauntry, W.C., Wood, T.M., Churchill, B., and Levine, S.R. (2005). Reducing Security Risk for Transportation Management Centers. Paper presented at the 84th Annual Meeting of the Transportation Research Board, National Research Council, January 2005, Washington, DC. Simmons-Boardman Publishing Corporation. 2005. ‘‘Bridging to Recovery: A Massive Effort to Rebuild Six Major Bridges Following Hurricane Katrina’s Devastation in Now Under Way on CSXTs Gulf Coast Main Trunk,’’ Railway Age 206, No. 11: 46–47. Stock, D., M. Jensen, M. Carter, E. Wik, C. Louisell, and C. Mitchell. 2004. ‘‘Hazardous Materials Safety and Security Technology Field Operational Test Evaluation Final Report.’’ Report for the FMCSA, FHWA-OP-03-XXX. Tarr, R. W., V. McGurk, and C. Jones 2005. ‘‘Intermodal Transportation Safety and Security Issues: Training against Terrorism,’’ Journal of Public Transportation 8, No. 4. 87–102. U.S. Department of Homeland Security. 2006. National Infrastructure Protection Plan. U.S. Government Accountability Office. 2007. ‘‘Transportation Security: Efforts to Strengthen Aviation and Surface Transportation Security are Under Way, but Challenges Remain,’’ Testimony before the Committee on Commerce, Science, and Transportation, U.S. Senate, GAO-08–140T. Xia, J., Chen M., and Liu, R. (2005). A Framework for Risk Assessment of Highway Network. Paper presented at the 84th Annual Meeting of the Transportation Research Board, National Research Council, January, 2005. Washington, DC. Zaworski, J. R., and K. M. Hunter-Zaworksi, 2004. ‘‘Laboratory Detection Technologies for High-Speed Rail Grade Crossings,’’ Transportation Research Record No. 1862: 119–126.

REVIEW QUESTIONS

1. Name three tools that can aid in disaster response. 2. Name ten different threats to surface transportation infrastructure. 3. What events have most recently threatened the surface transportation infrastructure in your region? 4. As of 2008, what expectations were still to be met within the US transportation security administration? Have these expectations been met today and how? 5. Select a local route (arterial or highway) and find the HAZMAT restrictions for using it at the Federal Motor Carrier Safety Administration’s (FMCA) website http://hazmat.fmcsa.dot.gov/nhmrr/index.asp?page= route 6. In the nearest major metropolitan area, find out if any transportation agency has recently conducted a security drill and discuss two of their key findings.

E1E1C03_1

09/18/2008

31

CHAPTER 3

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

S

ystems engineering is about partitioning complex systems into manageable and understandable parts with a precise definition of how those parts interact. Because transportation security is a complex undertaking, a systems engineering approach to implementation can facilitate effective and systematic deployment. In developing intelligent transportation systems (ITS) security areas, the U.S. National ITS Architecture Team analyzed the core areas of ITS using a systems engineering process similar to that applied to homeland security. This chapter presents each of the eight security areas and discusses their scope, National ITS Architecture representation, and real-world applicability.

3.1 INTRODUCTION

From a systems architecture viewpoint, intelligent transportation systems as a whole can be roughly divided into eight distinct security areas. These security areas are defined in version 6.0 of the National ITS Architecture. This chapter refers to the next definitions of National ITS Architecture elements throughout. Chowdhury and Sadek (2003) provide a detailed description of the National ITS Architecture and its elements, such as physical architecture and market packages. Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

31

E1E1C03_1

09/18/2008

32

32

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

Logical architecture Defines the processes required to provide the desired functions. Within the National ITS Architecture, these functions are defined as user services and are divided into 33 distinct categories. Physical architecture Developed from the logical architecture by assigning the functional processes and information flows to parts of systems and to communication links. National ITS Architecture developers define these parts of systems as subsystems and these communication links as architecture flows. The functional processes assigned to each subsystem are implemented through a combination of hardware and software to perform similar functions. Terminator An entity that forms the boundary of ITS architecture. ITS must interact with terminators in terms of information exchange, but cannot require logical architecture or functionality from these entities. Common terminators include the media, vehicles, and personnel, since these are elements whose actions are difficult to regulate. Equipment package A collection of similar functions within a particular subsystem that can be grouped together and implemented by a common combination of software and hardware capabilities. Market package A deployment-oriented ITS service. Each market package is defined by at least two subsystems, often one or more terminators, and architecture flows representing the flow of information both between subsystems and between subsystems and terminators. Market packages represent a user-friendly way for practitioners to use ITS architecture in their designs. As an example of how these systems relate, Figure 3.1 shows the Network Surveillance market package, which includes: Subsystems   

Traffic management Roadway Information service provider (secondary)

Equipment Packages    

Collect traffic surveillance Traffic maintenance Roadway basic surveillance Roadway equipment coordination

Terminators    

Traffic operations personnel Map update provider Other roadway Traffic

E1E1C03_1

09/18/2008

33

3.1

INTRODUCTION

33

ATMS01 – Network Surveillance

Information Service Provider

road network conditions

Traffic Management

Other Roadway roadway equipment coordination

traffic operator inputs Traffic Operations Personnel

Map Update Provider

traffic operator data

map update requests

Collect Traffic Surveillance

map updates

Traffic Maintenance

traffic flow + traffic images

Roadway

traffic sensor control + video surveillance control

Roadway Basic Surveillance Roadway Equipment Coordination

traffic characteristics Traffic

Figure 3.1 Network Surveillance Market Package and Architecture. [RITA (Research and Innovative Technology Administration), National ITS Architecture 6.0, 2007.]

Architecture Flows           

Map updates Roadway equipment coordination Traffic flow Traffic images Traffic characteristics Road network conditions Map update request Traffic sensor control Video surveillance control Traffic operator data Traffic operator inputs

The market package figures only show a subset of the architecture entities and flows. For a complete list of all entities and flows in a market package please consult the National ITS Architecture’s market package section. Although many market packages touch on security, some are inherently securityoriented. Some examples of market packages that are based on security principles include Transit Security (APTS05) and Disaster Response and Recovery (EM08). Each market package has a short market package ID, which identifies its family (i.e., APTS stands for advanced public transit system; EM is Emergency Management) along with a number identifier. Next we discuss market packages as they relate to particular security areas.

E1E1C03_1

09/18/2008

34

34

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

Due to the rich diversity of ITS functionality, the National ITS Architecture defines eight security areas: 1. 2. 3. 4. 5. 6. 7. 8.

Disaster Response and Evacuation. Freight and Commercial Vehicle Security. HAZMAT Security. ITS Wide Area Alert. Rail Security. Transit Security. Transportation Infrastructure Security. Traveler Security.

These eight security areas, displayed in Figure 3.2, are tied into the functional pieces of the National ITS Architecture and contain information flows both internal and external to the given area. Security elements were added to and enhanced in the National ITS Architecture as Version 4.0 changed into Version 5.0, recognizing security as a significant focus. In Version 4.0 of the architecture, the Traveler Security area was the focus of all security. The most recent version of the National ITS Architecture, Version 6.0 (RITA 2007), has been only slightly enhanced from Version 5.0 with respect to security. Version 6.0’s focus was modeling the major U.S. Department of Transportation initiatives, including Vehicle Infrastructure Integration (VII), Clarus (a nationwide weather observation and forecasting clearinghouse), and Emergency Management Operations (EMO). This chapter defines and discusses the eight security areas. Subsequent chapters will explore the relationship between

Figure 3.2 Security Areas from the National ITS Architecture. (Source: RITA, National ITS Architecture 6.0, May 2007.)

E1E1C03_1

09/18/2008

35

3.2

DISASTER RESPONSE AND EVACUATION

35

these areas and other modes of transportation (e.g., air). This chapter explores each security area by providing the overall definition from the National ITS Architecture as well as the key entities and interfaces. It is also important to note that the ITS itself must be secure in order for each security area to be effective. Chapter 7 discusses the threats, objectives and security services necessary for securing ITS.

3.2 DISASTER RESPONSE AND EVACUATION

In the wake of multiple natural disasters hitting the state of Florida as well as Hurricane Katrina hitting New Orleans, the Disaster Response and Evacuation Security Area provides insight and a model on how ITS can improve disaster response and evacuation as well as recovery. The Disaster Response and Evacuation (DRE) Security Area uses intelligent transportation systems to enhance the ability of the surface transportation system to respond to and recover from natural disasters, terrorist acts, and other catastrophic events. DRE improves access to the scene for response personnel and resources, provides better information about the transportation system in the vicinity of the disaster, supports resource coordination and sharing of current situation information, and provides more efficient, safer evacuation for the general public if needed. All types of disasters are considered including natural disasters (hurricanes, earthquakes, floods, winter storms, tsunamis, etc.) and technological and manmade disasters (hazardous materials incidents, nuclear power plant accidents, and national security emergencies such as terrorism, nuclear, chemical, biological, and radiological weapons attacks.) Broad inter-agency coordination is critical in all disaster scenarios, with transportation professionals performing well-defined roles in the larger context of the multi-agency response to the disaster. DRE defines how ITS can be used to coordinate and integrate the disaster response and evacuation activities within diverse organizations. This aims to improve the safety of the responders and the public at large, and improve the performance and effectiveness of the transportation system as a part of the overall disaster response (RITA, National ITS Architecture 6.0, May 2007).

DRE is central to the Emergency Management subsystem of the physical architecture view of the National ITS Architecture. It represents both the Emergency Operations Centers (EOCs) and the Incident Command Systems (ICSs) that are established before or when a disaster strikes and last through reentry into the affected area and recovery. DRE is comprised of the disaster response and evacuation interfaces to all levels of public safety, emergency management, and other allied response agencies. This security area focuses primarily on these interfaces, or the information flowing between the Emergency Management subsystem and other entities, both subsystems and terminators, that represent maintenance and construction management, traffic management,

E1E1C03_1

09/18/2008

36

36

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

transit management, information service providers of traveler information, rail operations, and so on. As previously discussed, the EM subsystem is one critical piece of the DRE security area. With other subsystems and terminators, it is found in four National ITS Architecture market packages: 1. 2. 3. 4.

Early Warning System (EM07). Disaster Response and Recovery (EM08). Evacuation and Reentry Management (EM09). Disaster Traveler Information (EM10).

The Early Warning System market package, displayed in Figure 3.3, contains the capability to monitor and detect potential and actual disasters including natural disasters, such as tornadoes, hurricanes, earthquakes, and winter storms, as well as technological and man-made disasters, such as hazardous material incidents, nuclear, biological, and chemical attacks or events. It receives alerts and advisories from such systems as the National Weather Service, National Hurricane Center, National Warning System, Information Sharing and Analysis

EM07 - Early Warning System transportation weather information request

Surface Transportation Weather Service

transportation weather information

Alerting and Advisory Systems

Field Secure Area Sensor Monitoring

secure area surveillance control + secure area sensor control secure area surveillance data + secure area sensor data

incident report + threat information coordination Other Emergency Management

incident report + threat information coordination

Traffic Management

TMC Incident Detection

alerts and advisories

incident information

secure area surveillance control + secure area sensor control

Security Monitoring

threat information incident information

secure area surveillance data + secure area sensor data

Remote Traveler Support

Field Secure Area Surveillance

Emergency Management

Transit Management

transit emergency data threat information

incident information Emergency Environmental Monitoring

threat information

Emergency Early Warning System

Transit Center Security

Maintenance and Construction Management MCM Incident Management

Center Secure Area Sensor Management

weather information Center Secure Area Surveillance

Weather Service

Figure 3.3 Early Warning System Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

E1E1C03_1

09/18/2008

37

3.2

DISASTER RESPONSE AND EVACUATION

37

Centers, the National Infrastructure Protection Center, and the Homeland Security Advisory System. It can be connected to field sensors and surveillance through the Security Monitoring subsystem. This market package contains the capability to determine which agencies should be notified of potential or actual threats with specific interfaces to other emergency management, traffic management, transit management and maintenance, and construction management agencies. The Disaster Response and Recovery market package illustrated in Figure 3.4, was created in part from other source material, including the 2001 Hampton Roads Hurricane Traffic Control Plan, needs from the ‘‘A Guide to Updating Highway Emergency Response Plans for Terrorist Incidents,’’ and a study of the hurricane evacuation performed by Florida DOT for Hurricane Floyd in 1999. The user needs identified in these documents were expanded and refined to cover all transportation agencies and all types of disasters. As expected, this market package is complex and deals with management of disasters through the phases of planning and preparation, detection, verification, initial response, resource management, system monitoring and management and critical service restoration. The Emergency Management subsystem is in the center of the market package and is responsible for incident command as well as emergency

EM08 - Disaster Response and Recovery emergency transit service request

Transit Management

Transit Center Security

emergency plan coordination

Emergency Management

resource coordination incident response coordination

incident response status +

emergency plan coordination

transportation system status

transportation system status

emergency transit service response

incident command information coordination

transit system status assessment +

rail system status assessment

emergency transit schedule information emergency transit schedule information

emergency plan coordination incident response status + transportation system status

Other Emergency Management

Rail Operations

resource request

Traffic Management

transportation information for operations

resource deployment status emergency plan coordination

Information Service Provider

emergency traffic control information road network status assessment road network conditions incident response status + transportation system status

TMC Incident Dispatch Coordination/ Communication

Incident Command

maint and constr resource response + road network status assessment

Emergency Response Management

Maintenance and Construction Management

emergency plan coordination

transportation system status + emergency traffic control request incident response status + maint and constr resource request maintenance and construction resource request maintenance and construction resource response road network status assessment

MCM Incident Management

MCM Roadway Maintenance and Construction

maintenance and construction resource coordination traffic information coordination + traffic control coordination

Other Traffic Management

Other MCM

Figure 3.4 Disaster Response and Recovery Market Package. (Source: RITA, National ITS Architecture, May 2007, www.its.dot.gov/arch/index.htm.)

E1E1C03_1

09/18/2008

38

38

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

response management. It works in concert with the Traffic Management, Transit Management, Information Service Provider, and Maintenance and Construction Management subsystems as well as the Rail Operations and public health system terminators. The Evacuation and Reentry Management market package, shown in Figure 3.5, deals with the movement of people out of and back into the area affected by the disaster. Again, the Emergency Management subsystem is in the center of the market package and is responsible for emergency evacuation support. It works in concert with the Traffic Management, Transit Management, Toll Administration, Information Service Provider, and Maintenance and Construction Management subsystems as well as the Rail Operations, Shelter Providers, and Public Health System terminators. One of the outcomes from the aftermath of Hurricane Katrina hitting the Gulf Coast in 2005 was recognition of the need for a robust recovery plan beyond the short time period after the disaster and including these critical issues (Willhite 2007):  

Traffic management plan Command and control EM09 - Evacuation and Reentry Management evacuation information Rail Operations

Toll Administration

Transit Management

emergency plan coordination

Emergency Management

toll service change request

Shelter Providers

Other EM

Maintenance and Construction evacuation information Management maint and constr resource request

toll service change response

maint and constr resource response

MCM Incident Management

evacuation information emergency transit service request

public health request public health response

emergency plan coordination Transit Evacuation Support

emergency plan coordination

emergency transit schedule information + emergency transit service response

emergency traffic control request evacuation information

shelter information

emergency traffic control information

evacuation information emergency plan coordination evacuation coordination

Public Health System

Traffic Management

TMC Evacuation Support

emergency plan coordination Emergency Evacuation Support

traffic information coordination

traffic control coordination

Other TM

Figure 3.5 Evacuation and Reentry Management Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

E1E1C03_1

09/18/2008

39

3.2

DISASTER RESPONSE AND EVACUATION

39

Figure 3.6 Hampton Roads Hurricane Gate. (Source: U.S. Coast Guard, www.virginiadot. org/travel/resources/hurricaneEvacuation1.pdf.)

 

Evacuating people with special needs Moving fuel

Both the Disaster Response and Recovery and the Evacuation and Reentry Management market packages contain the capabilities to help with these critical needs. For example, these market packages have been used to coordinate the traffic management plan for hurricane evacuation of the Hampton Roads area in Virginia. In the Hampton Roads Hurricane Traffic Control Plan, the primary evacuation route uses all lanes on Interstate 64, reversing the eastbound lanes to support the evacuating westbound demand. All lanes on I-64 will carry traffic westbound for about 75 miles from just before the Hampton Roads Bridge Tunnel to I-295 in Richmond, Virginia. To prevent motorists from driving the wrong way during a lane reversal, the Virginia Department of Transportation (2001) is installing hurricane gates along I-64 eastbound, as shown in Figure 3.6. The Disaster Traveler Information market package, shown in Figure 3.7, deals with information dissemination to the traveling public. The central subsystem is the Information Service Provider (ISP), an agency collecting data from the Emergency Management subsystem and to a lesser extent from the Traffic Management and Transit Management subsystems. In addition, information from the Care Facility, Shelter Providers, Yellow Pages Service Providers, Surface Transportation Weather Service, and the Weather Service terminators is integrated into disaster-related traveler information by the ISP. This traveler information is disseminated through the Personal Information Access, Remote Traveler Support, and Vehicle subsystems as well as the Telecommunications System for Traveler Information (511), and back to the shelter providers. At the same time, the Emergency Management subsystem is providing incident information to the Emergency Telecommunications System for the public and to the Media terminators. This market package provides information about the disaster area, including damage to the transportation system, detours and closures in effect, special traffic restrictions and allowances, special transit schedules, and real-time information on traffic conditions and transit system performance in and around the disaster. It also provides emergency information to assist the public with evacuations, including information on mandatory and voluntary evacuation zones, evacuation times, and instructions.

E1E1C03_1

09/18/2008

40

40

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

EM10 – Disaster Traveler Information Information Service Provider

Emergency Telecommunications System

incident information for public

Emergency Management

incident information for media

Personal Information Access*

emergency traveler information request emergency traveler information

Personal Basic Information Reception Personal Interactive Information Reception

Media

evacuation information Emergency Evacuation Support Emergency Response Management

Transit Management Care Facility

transportation system status incident information

Telecommunications System for Traveler Information

Yellow Pages travel service information Service Providers

transit information request

transportation weather information

care facility status

emergency traveler information voice based traveler request voice based traveler information

Traffic Management

travel service information request

transit and fare schedules

shelter information Shelter Providers

road network conditions

ISP Traveler Data Collection

transportation weather information request

Traveler Telephone Information

weather information

ISP Emergency Traveler Information

Surface Transportation Weather Service

Weather Service

* Identical interface for Remote Traveler Support and VS

Figure 3.7 Disaster Traveler Information Market Package. (Source: RITA, National ITS Architecture 6.0, May 2006.)

3.3

FREIGHT AND COMMERCIAL VEHICLE SECURITY

Fleet and freight management companies and agencies are increasingly monitoring their fleets and freight for security and economic reasons. As energy prices soar, commercial vehicle routing and assignments become increasingly important in a just-in-time economic environment. It is important to know exactly what is being tracked, including the driver, commercial vehicle, and freight equipment as defined in the next paragraph. It is also important to know if the commercial vehicle or freight equipment has had a breach or tamper attempt. The area of freight and commercial vehicle security considers the awareness aspect of security through the surveillance of either commercial vehicles or freight equipment. Freight equipment includes containers (with or without chassis), the chassis, or trailers. In addition, the interface with intermodal facilities is another aspect of this area. There are four major functions included as part of this security area. —RITA, National ITS Architecture 6.0, May 2007

E1E1C03_1

09/18/2008

41

3.3

FREIGHT AND COMMERCIAL VEHICLE SECURITY

41

The four major aspects of this security area include: 1. Tracking commercial vehicles and freight equipment location with a determination of a route deviation. 2. Monitoring the driver, commercial vehicle, and freight equipment identities. 3. Monitoring a freight equipment for a breach or tamper event. 4. Monitoring the commercial vehicle for a breach or tamper event. Version 6.0 of the National ITS Architecture allows for tracking of containers on a chassis but not the containers themselves. The capability to have particular container tracking may be added to the National ITS Architecture in a future version. There has also been a consensus effort to align the National ITS Architecture and Federal Motor Carrier Safety Administration’s (FMCSA) Commercial Vehicle Information Systems and Networks (CVISN) Architecture. The CVISN program is coordinating the nationwide deployment of specific new capabilities in three areas: 1. Safety Information Exchange. 2. Credentials Administration. 3. Electronic Screening. The carrier’s operation center (called, in terms of the National ITS Architecture, the Fleet and Freight Management Subsystem [FMS]) is responsible for tracking its fleet vehicles or freight equipment and monitoring their routes and location. Based on the location information obtained through tracking, the FMS makes a determination if an asset has deviated from its planned route or location. Another option is for the commercial vehicle’s onboard system to correlate its current location to the planned route and notify the operation center of a route deviation. If a route or location deviation exceeds the previously established boundaries, commonly called a geofence, the operation center would be responsible for formulating a response plan, which would most likely include notifying appropriate public safety agencies. By monitoring the identity of the driver, commercial vehicle, and freight equipment, the carrier’s operation center (i.e., the FMS) determines if an unauthorized change has occurred from the designated assignment. The FMS is responsible for implementing a response plan, which could include notifying appropriate public safety agencies. This security area also supports exchange of assignment information with intermodal facilities and shippers. The last two aspects of the Fleet and Commercial Vehicle Security involve the monitoring of freight equipment and commercial vehicles for a breach or tamper event. Information about a breach or tamper event includes the nature of event, time, location, identities (commercial vehicle, driver, and freight equipment),

E1E1C03_1

09/18/2008

42

42

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

and monitoring device status; for freight equipment, it also includes environmental threat sensor readings (nuclear, biological, chemical, etc.). The Freight and Commercial Vehicle Security area is, for the most part, comprised of four market packages in the Commercial Vehicle Operations (CVO) area: 1. 2. 3. 4.

Fleet Administration (CVO01). Freight Administration (CVO02). On-board CVO and Freight Safety and Security (CVO08). Freight Assignment Tracking (CVO13).

The Fleet Administration market package, displayed in Figure 3.8, includes the capability for the Fleet and Freight Management subsystem (i.e., the carrier’s operations center) to track the commercial vehicle routes and determine route deviations. The FMS also has the capability to have a contingency response plan, which could include notifying appropriate public safety agencies. The Freight Administration market package, illustrated in Figure 3.9, includes the capability for the Fleet and Freight Management subsystem to CVO01 - Fleet Administration on-board vehicle request

Information Service Provider

road network conditions Fleet and Freight

Management

on-board vehicle data route deviation alert

route request

Commercial Vehicle Subsystem

driver alert response route plan

trip log request trip log

fleet manager inquiry + alert response Fleet-Freight fleet status + Manager fleet and freight alerts

Fleet Administration

driver to fleet request fleet to driver update CVO driver initialization + alert response

route restrictions + Commercial credentials status information + Vehicle cvdriver record Administration

trip log information + alerts

cvdriver record request

map update request map updates alarm

Commercial Vehicle Driver

Emergency Management alerts and advisories Map Update Provider

On-board Trip Monitoring

vehicle location

Vehicle

Vehicle Location Determination

fleet and freight threat information

Alerting and Advisory Systems

Figure 3.8 Fleet Administration Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

E1E1C03_1

09/18/2008

43

3.3

FREIGHT AND COMMERCIAL VEHICLE SECURITY

43

CVO02 - Freight Administration

Intermodal Freight Shipper intermod CVO coord + breach response

intermod CVO coord + freight breach freight monitoring parameters Freight Equipment freight breach + freight equipment information

Alerting and Advisory Systems fleet and freight threat information alerts and advisories

Emergency Management

Fleet and Freight Management

alarm

Commercial Vehicle and Freight Security Freight Administration and Management Fleet Administration

map updates Map Update Provider

map update request

fleet and freight alerts

on-board vehicle request

on-board vehicle data freight equipment information

freight breach + freight equipment information

Commercial Vehicle Subsystem On-board CV Safety and Security

CVO driver initialization + alert response Commercial Vehicle alerts Driver

On-board Trip

Monitoring driver alert response + commercial vehicle On-board Cargo breach Monitoring alert intermod response CVO commercial commercial coord vehicle vehicle Intermodal Freight data data request Depot

Vehicle

Fleet-Freight Manager

Figure 3.9 Freight Administration Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

track freight equipment location and determine location deviations as well as breach and tamper events. The FMS monitors the freight equipment by obtaining location information directly from the freight equipment or via the commercial vehicle. In addition, the FMS monitors shipments to make sure that no tampering or breach of security occurs to the freight equipment. In the event of a security-related incident, the Fleet and Freight Management subsystem also has the capability to have a contingency response plan, for example, notifying appropriate public safety agencies. The On-board CVO and Freight Safety and Security market package, as shown in Figure 3.10, includes the capability for the FMS to monitor the security of the commercial vehicle along with the cargo, containers, trailers, and other equipment that are being hauled. It provides the capability to detect and respond to a commercial vehicle or freight equipment breach and tamper events which can be made available to the Commercial Vehicle Check subsystem. Figure 3.11 shows the Freight Assignment Tracking market package, which provides for the planning and tracking of commercial vehicle shipments where the commercial vehicle, the freight equipment, and the commercial vehicle driver are all monitored for consistency with the planned assignment. The FMS determines any unauthorized changes and also has the capability to have a

E1E1C03_1

09/18/2008

44

44

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

CVO08 - On-board CVO and Freight Safety and Security

Commercial Vehicle Check

CVO inspector information CVC override mode

CVO Inspector

freight breach + freight equipment information

Freight Equipment

Driver cv driver credential Identification Card

Fleet-Freight Manager

on-board safety request + safety inspection request + driver log request + pass/pull-in

Commercial Vehicle

Fleet and Freight Management on-board safety request driver alert response on-board safety data

commercial vehicle breach safety inspection record Citation and Accident Electronic Recording Roadside Safety and Security Inspection

CVO pass/pull-in message Commercial Vehicle Driver

commercial vehicle breach + freight equipment information + on-board safety data+ driver log + expected driver identity characteristics + tag data + commercial vehicle disable status

CVO pass/pull-in message + alerts alert response

alert response + fleet manager inquiry

fleet status + fleet and freight alerts

freight freight breach equipment information

commercial vehicle measures

Commercial Vehicle and Freight Security Fleet Maintenance Management

Basic Commercial Vehicle alarm

Emergency Management On-board Cargo Monitoring On-board CV Safety and Security

fleet and freight threat information

alerts and advisories

Alerting and Advisory Systems

Figure 3.10 On-board CVO and Freight Safety and Security Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

contingency response plan, which could include notifying appropriate public safety agencies. 3.4 HAZMAT SECURITY The HAZMAT Security area’s purpose is to reduce the likelihood of a successful hijacking of security sensitive HAZMAT cargo and its subsequent use as a weapon. —RITA, National ITS Architecture 6.0, May 2007

This security area is an extension of the previous Freight and Commercial Vehicle security area but with an emphasis on Hazardous Material. This security area includes the tracking of security-sensitive HAZMAT cargo-carrying commercial vehicles. If there is an unexpected and significant deviation from the assigned route or traversal on restricted roadways, the FMS can notify the appropriate public safety agency. The commercial carrier’s operations center (FMS) has autonomy to protect confidential operational information of their businesses, determining the significance of the route deviation and deciding whether to notify appropriate public safety agencies.

E1E1C03_1

09/18/2008

45

3.4

HAZMAT SECURITY

45

CVO13 – Freight Assignment Tracking Intermodal Freight Shipper freight transport booking

Intermodal Freight Depot

booking status

Freight Equipment

booking status

freight equipment information

Fleet and Freight Management Emergency Management

Commercial Vehicle Subsystem

alarm Commercial Vehicle and Freight Security Freight Administration and Management

On-board Driver Authentication

identities

Fleet Administration

fleet and freight alerts

On-board Cargo Monitoring

driver identity characteristics

On-board Trip Monitoring

alert response

commercial vehicle measures

Fleet-Freight Manager fleet and freight threat information

Commercial Vehicle Driver

alerts and advisories

Alerting and Advisory Systems

Basic Commercial Vehicle

cv driver credential

Driver Identification Card

Figure 3.11 Freight Assignment Tracking Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

As part of the extension from the Freight and Commercial Vehicle security area, this security area includes the detection of security-sensitive HAZMAT cargo on commercial vehicles by remote sensing and imaging from the roadside. In conjunction with reading electronic tag information (carrier ID, vehicle ID and driver ID) from a commercial vehicle (CV), any detected security-sensitive HAZMAT can be correlated with existing credentials to determine if the cargo being carried is a permitted operation. If not, the vehicle can be asked to pull in, and appropriate public safety agencies may be notified. Another aspect of this security area is the authentication of drivers and subsequent notification of appropriate public safety agencies if an unauthorized driver attempts to operate a vehicle carrying security-sensitive HAZMAT. Similar to the tracking of HAZMAT cargo, the carrier’s operations center acts to validate and verify any discrepancies prior to public safety agency notification. The HAZMAT Security area is primarily represented by four market packages in the National ITS Architecture: 1. Fleet Administration (CVO01). 2. CV Administrative Processes (CVO04).

E1E1C03_1

09/18/2008

46

46

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

3. Roadside HAZMAT Security Detection and Mitigation (CVO11). 4. CV Driver Security Authentication (CVO12). The previously discussed Fleet Administration market package, illustrated in Figure 3.8, includes the capability to track commercial vehicles, especially those carrying HAZMAT, by a carrier’s operations center. If the carrier’s operations center notices a significant discrepancy, it may notify appropriate public safety agencies. The CV Administrative Processes market package, shown in Figure 3.12, includes the distribution by the Commercial Vehicle Administration subsystem of possible local and national HAZMAT routes with associated administrative restrictions by date and time and for specific classes of HAZMAT cargoes. The Roadside HAZMAT Security Detection and Mitigation market package, as shown in Figure 3.13, is used to detect HAZMAT cargo using roadside sensors and correlate the detection with existing credentials to determine if a detected HAZMAT cargo is a permitted activity. If a nonpermitted activity is detected, the Commercial Vehicle Check station could signal the vehicle to pull off the road. The CV Driver Security Authentication market package authenticates a commercial vehicle driver based on information downloaded to the vehicle from the carrier’s operation center, as displayed CVO04 - CV Administrative Processes route restrictions +

Maintenance and current asset restrictions Construction Management

Financial Institution

Enforcement Agency

Commercial credentials information + Vehicle credentials status information + Administration compliance review report + safety status information + cv driver record

credential application + audit data + tax filing

payment request

Fleet and Freight Management Fleet Administration Fleet Credentials and Taxes Management and Reporting

transaction status

route restrictions

information on violators

route restrictions

safety status information + credentials information + credential fee coordination + Other CVAS credentials status information + route restrictions + citation + accident report + cv driver record Credentials and Taxes Administration CV Information Exchange

Information Service Provider

Map Update Provider

credentials information + safety status information + credentials status information + cv driver record CVO Information Requestor cv driver record request

Figure 3.12 CV Administrative Processes Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

E1E1C03_1

09/18/2008

47

3.5

ITS WIDE AREA ALERT

47

CVO11 – Roadside HAZMAT Security Detection and Mitigation Freight Equipment

Basic Commercial Vehicle CVO weight and presence + identification information

hazmat environmental factors

Commercial Vehicle Administration

Commercial Vehicle Check credentials information

Roadside HAZMAT detection

CVO pass/pull-in message

alarm

Emergency Management Emergency Commercial Vehicle Response

pass/pull-in

Commercial Vehicle Subsystem

Commercial Vehicle Driver

Figure 3.13 Roadside HAZMAT Security Detection and Mitigation Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

in Figure 3.14. If an unauthenticated driver is detected, a vehicle may be safely disabled by the carrier’s operation center. 3.5 ITS WIDE AREA ALERT The ITS Wide Area Alert security area notifies the traveling public in emergency situations such as child abductions, severe weather watches and warnings, natural and human-caused disasters, military operations, and civil emergencies where lives and/or property are at stake. It utilizes ITS driver and traveler information technologies to immediately provide information and instructions to the traveling public, improving public safety and enlisting the public’s help in some scenarios. The ITS technologies supplement and support other emergency and homeland security alert systems such as the Emergency Alert System (EAS). —RITA, National ITS Architecture 6.0, May 2007

Typically, when an emergency situation is reported and verified and the conditions for alert dissemination are satisfied, a designated agency broadcasts emergency information to traffic management and transit management

E1E1C03_1

09/18/2008

48

48

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

CVO12 – CV Driver Security Authentication Commercial Vehicle Driver

Emergency Management

driver identity characteristics Emergency Commercial Vehicle Response

Commercial Vehicle Subsystem

disable commercial vehicle expected driver identity characteristics

alarm

Fleet and Freight Management

identities

commercial vehicle disable

cv driver credential On-board Driver Authentication

Driver cv driver credential Identification Card

Manage CV Driver Identification

Figure 3.14 CV Driver Security Authentication Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

agencies, information service providers (traveler information), the media, and other ITS systems that involve driver or traveler information capabilities. These agencies, in turn, provide the alert information to the traveling public using ITS technologies such as variable message signs, highway advisory radios, in-vehicle displays, 511 call-in traveler information systems, and traveler information Web sites. The Emergency Management subsystem represents the agency/system that broadcasts the emergency information to the other ITS systems. As defined in the National ITS Architecture, the EM subsystem provides the alert information to the Traffic Management subsystem, Transit Management subsystem, Information Service Provider, Maintenance and Construction Management subsystem, and Toll Administration subsystem, which in turn provide the alert broadcast information to system operators and the traveling public. The ITS Wide Area Alert security area is characterized in the National ITS Architecture by the Wide Area Alert market package, as seen in Figure 3.15. The alert can include instructions for transportation system operators and

E1E1C03_1

09/18/2008

49

3.6

RAIL SECURITY

49

EM06 – Wide-Area Alert Information Telecommunications voice-based alert notification System for Service Provider voice-based traveler request Traveler Information

Personal Information Access

ISP Traveler Data Collection

ISP Emergency Traveler Information

Maintenance and Construction Management MCM Incident Management

Traveler Telephone Information

alert status

alert notification alert status

Other Emergency Management

alert notification

TMC Traffic Information Dissemination

alert status

Remote Basic Information Reception

Vehicle Basic Vehicle Reception

alerts and Alerting and Advisory Systems advisories

roadway information system status

Roadway Roadway Traffic Information Dissemination

Remote Traveler Support Remote Transit Information Services

alert notification

alert status

TMC Incident Dispatch Coordination/ Communication

roadway information system data

emergency traveler information

Emergency Management

alert notification coordination

Traffic Management

Personal Basic Information Reception

Emergency Early Warning System

alert notification

Toll Administration Toll Operator Alert

alert notification

alert status

Transit Management Transit Center Information Services Transit Center Security

transit traveler information

transit traveler information + transit vehicle operator information

Transit Vehicle

Figure 3.15 Wide Area Alert Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

information for the traveling public, thus improving public safety and possibly enlisting the public’s help, such as during amber alerts. The ITS technologies also supplement and support other emergency and homeland security alert systems, such as the Emergency Alert System.

3.6 RAIL SECURITY The general area of Rail Security includes ITS functionality to monitor and secure trains, rail cars, fixed assets (track, wayside equipment and highway-rail intersections) and personnel. Rail Security focuses on freight rail. The security aspects of passenger rail are covered under transit security. The current version of the National ITS Architecture addresses a subset of the overall area of rail security, specifically interfaces between rail entities and highway entities. These are the interfaces relating to highway rail intersections (HRI) and the interfaces from rail operations to traffic and emergency management functions of the architecture. —RITA, National ITS Architecture 6.0, May 2007

E1E1C03_1

09/18/2008

50

50

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

ATMS14 – Advanced Railroad Grade Crossing

Driver

driver information

Roadway

intersection blockage notification hri operational status track status

Traffic

Traffic Management

traffic characteristics

Wayside Equipment

arriving train information

intersection blockage notification hri status

crossing permission crossing call

Pedestrians

hri request HRI Traffic Management

hri control data

Advanced Rail Crossing

hri advisories Rail Operations

Figure 3.16 Advanced Railroad Grade Crossing Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

The focus of this security area is the surveillance of the HRIs, which is performed in the architecture by the Roadway subsystem. The market package that provides this function is the Advanced Railroad Grade Crossing as displayed in Figure 3.16. The interface between rail operations and the traffic management capabilities is expressed in the architecture as the HRI advisories architecture flow between the Rail Operations terminator and the Traffic Management subsystem and contains incident and advisory information. It is included in market packages Advanced Railroad Grade Crossing, Standard Railroad Grade Crossing, and Railroad Operations Coordination shown in Figures 3.16, 3.17, and 3.18, respectively. The communication interface between rail operations and the emergency management capabilities is expressed in the architecture as the ‘‘incident information’’ and ‘‘rail incident response status’’ architecture flows between the Rail Operations terminator and the Emergency Management subsystem. The market packages that address this interface are Traffic Incident Management System, shown in Figure 3.19, for normal incidents; Disaster Response and Recovery, shown earlier in Figure 3.4, for disaster response; and Evacuation and Reentry Management, also shown earlier in Figure 3.5, for coordination during evacuations and reentry. 3.7 TRANSIT SECURITY The area of transit security addresses passenger, facility, and asset security for passenger rail and bus transit systems. The area addresses surveillance and sensor

E1E1C03_1

09/18/2008

51

3.7

TRANSIT SECURITY

51

ATMS13 – Standard Railroad Grade Crossing Driver

driver information

Roadway

hri operational status track status

Traffic

traffic characteristics

Wayside Equipment

hri status

Traffic Management

crossing permission

hri request

crossing call

HRI Traffic Management

hri control data

Pedestrians

Standard Rail Crossing

hri advisories Rail Operations

Figure 3.17 Standard Railroad Grade Crossing Market. (Source: RITA, National ITS Architecture 6.0, May 2007.)

ATMS15 – Railroad Operations Coordination Rail Operations railroad advisories

hri advisories

railroad schedules

Traffic Management Rail Operations Coordination

hri status hri request

Roadway

hri control data

road network conditions

Information Service Provider

Figure 3.18 Railroad Operations Coordination Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

E1E1C03_1

09/18/2008

52

52

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

ATMS08 – Traffic Incident Management System Emergency Vehicle On-board EV Incident Management Communication

Other Traffic Management

traffic information coordination

decision support information road network conditions + incident information +incident response status Emergency + resource deployment status + traffic images

incident status

Management

video surveillance control + traffic sensor control

Emergency Personnel

intermodal freight traffic confirmation

Rail

transportation logged incident information information for Information vehicle route + maint and constr TMC Incident operations Service road network Dispatch Coordination/ resource response incident Communication Provider conditions information

Event Promoter

event plans

Roadway Incident Detection

Intermodal Freight Depot

incident information + maint and constr resource request Maintenance

incident information + rail Operations incident response status

event plans

Roadway Roadway Equipment Coordination

+ remote surveillance control

incident information + incident response status

roadway equipment coordination traffic flow + traffic images

incident information + resource deployment status

incident command information presentation incident command inputs

Other Roadway

Traffic Management

and Construction Management

TMC Incident Detection

incident information + maint and constr resource request + incident response status incident information + maint and constr resource response Incident Command Emergency Response Management

incident response coordination + incident command information coordination incident response status +incident information

Other Emergency Management

Transit Management

MCM Incident Management

maint and constr resource coordination

Other MCM

Figure 3.19 Traffic Incident Management System Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.) monitoring of transit stations, stops, facilities, infrastructure, and vehicles. The surveillance includes both video and audio surveillance. The sensor monitoring includes threat sensors (e.g. chemical agent, toxic industrial chemical, biological, explosives, thermal, acoustic and radiological sensors), object detection sensors, motion or intrusion detection sensors, and infrastructure integrity sensors. —RITA, National ITS Architecture 6.0, May 2007

The Transit Security area includes buses and passenger rail. Sensors or surveillance data are examined by the Transit Management subsystem for potential threats or overall security of transit properties. Based on this analysis, notification can be made to the appropriate transit or public safety personnel. This security area has the capability for travelers or transit operators to send a mayday alarm that can be forwarded to central dispatch or the appropriate public safety agencies. In addition, this area also provides access control to transit vehicles, requiring positive operator identification before transit vehicles can be operated. Under the threat of a transit vehicle hijack, this security area allows the transit agency to take response measures, such as remote transit vehicle disabling. This security area can also provide

E1E1C03_1

09/18/2008

53

3.7

TRANSIT SECURITY

53

APTS05 - Transit Security Remote Traveler Support

Information Service Provider

Traveler Secure Area Surveillance Traveler Secure Area Sensor Monitoring Remote Traveler Security

transit incident information

Media

Transit Management

transit incidents for media alarm acknowledge + remote vehicle disable

threat support data Emergency Alerting and Advisory Systems threat data for analysis + threat Management information Rail threat information Operations alarm notification + secure area surveillance data + secure area sensor data alarm acknowledge + secure area sensor control + secure area surveillance control

Security Monitoring Subsystem Field Secure Area Surveillance Field Secure Area Sensor Monitoring

Transit Vehicle

transit vehicle operator authentication information

Transit Center Security

secure area surveillance control + secure area sensor control + infrastructure monitoring sensor control transit vehicle location data

alarm notification + secure area surveillance data + secure area sensor data

alarm notification + transit vehicle location data + transit vehicle conditions

transit vehicle operator authentication update

secure area surveillance data + secure area sensor data + infrastructure monitoring sensor data

On-board Transit Security

alarm acknowledge + secure area surveillance control + secure area sensor control

transit emergency data incident response status

Emergency Response Management Center Secure Area Surveillance Center Secure Area Sensor Management Center Secure Area Alarm Support

Figure 3.20 Transit Security Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

emergency information to travelers using the transit system equipment, either by visual signs or audio messages onboard the transit vehicle, at transit stops, or in transit facilities. The transit agency can also share pertinent information with appropriate security agencies to assist in analysis of threats and to report threats. The Transit Security area’s primary market package is aptly named Transit Security and is shown in Figure 3.20. This market package includes key interfaces between these architecture entities: 





Transit Vehicle and Transit Management subsystems: for vehicle operator or traveler–initiated alarms, vehicle operator authentication, and vehicle disabling Transit Management and Emergency Management subsystems: for coordinating incident response and sharing emergency information Transit Vehicle and Emergency Management subsystems (representing either the public safety entities of a transit agency, such as transit police, or a public safety agency): for vehicle operator or traveler-initiated alarms, sensor monitoring, and surveillance

E1E1C03_1

09/18/2008

54

54

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS







Remote Traveler Support (representing devices aiding travelers within public transit areas such as rail or bus stations) and Emergency Management subsystems: for surveillance, traveler-initiated alarms, and sensor monitoring Security Monitoring (including devices in nonpublic areas of a transit system, such as rail or bus yards) and Emergency Management subsystems: for sensor monitoring and surveillance Emergency Management subsystem (transit public safety entities or another local public safety agency) and the Alert and Advisory Systems terminator: for sharing of threat data or threat information for analysis (RITA, National ITS Architecture 6.0, May 2007)

3.8 TRANSPORTATION INFRASTRUCTURE SECURITY Transportation infrastructure can be monitored and protected by a broad array of ITS technologies. Transportation infrastructure security includes the monitoring of transportation infrastructure (e.g., bridges, tunnels and management centers) for potential threats using sensors and surveillance equipment. Threats to infrastructure can result from acts of nature (e.g., hurricanes, earthquakes), terrorist attacks or other incidents causing damage to the infrastructure (e.g., stray barge hitting a bridge support). Barrier and safeguard systems are used to preclude an incident, control access during and after an incident or mitigate impact of an incident. —RITA, National ITS Architecture, May 2007

As ITS capabilities become more important to the security of our transportation network, they can themselves be a target. As an example, an excerpt from September 11, 2001 involving the Virginia Department of Transportation (VDOT) traffic management center near the Pentagon is presented. Following, in chronological order, is a bulleted summary of events and actions that took place at the Smart Traffic Center (STC) on September 11, 2001, plus suggestions to make future responses more effective (VDOT 2002). 

Initially  







Notification of incident at NY Towers. (Through news media) Plane flies directly over smart traffic center (STC) and hits Pentagon. (Eyewitness & emergency scanner) Secured the STC facility (closed gates to keep citizens and news media out of facility so VDOT could mobilize its forces and act on planning strategies) Began monitoring traffic movements in and around the immediate DC area (Cameras, Computer Systems) and news (Radio, TV) Maintenance Groups and SSP (Safety Service Patrol) personnel were instructed to return to area headquarters. (Planning and Instructions)

E1E1C03_1

09/18/2008

55

3.8







TRANSPORTATION INFRASTRUCTURE SECURITY

Immediate VDOT Response  Notification through emergency scanners and news media that DC and Federal agencies had enacted a state of emergency and the Pentagon was being evacuated. (STC began intense monitoring of traffic flow out of DC and surrounding areas for implementation of incident plans)  Coordinated HOV (High Occupancy Vehicle) gates openings with State Police. (Maximum traffic flow out of city)  Programmed VMS (Variable Message Signs). (Traveler information to public)  SSP incident supervisors organized and mobilized crews and proceeded to accident scene.  STSS (Smart Traffic Signal System) contacted Arlington County signal department and City of Fairfax signal department to coordinate placement of signals into the p.m. plans (outgoing traffic) and execute special incident management plans to facilitate vehicle traffic movement down major corridors.  Because of news reports that other threatening planes were still in the air and heading towards DC, STSS moved control of signal systems computers and communications to back up system to VDOT’s Camp 30 facility in Fairfax. (security reasons) Mobilization  Unified Command Vehicle Mobilized—Initially set up at ramp 8B directly across and in front of the Pentagon, then relocated vehicle next to STC facility due to smoke and emergency vehicle traffic. (VDOT has permanent operational seat in vehicle)  Operational contacts for coordination made with Unified Command Vehicle, STC facility, State Police, Fairfax County Police, Arlington County, Fairfax City, TEOC (Transportation Emergency Operations Center) (Richmond, VA), and Maryland DOT.  Maintenance and SSP sections mobilized crash cushions, light towers, traffic cones, manpower, and other related equipment and coordinated with STC and Unified Command Vehicle for placement.  Other districts (Culpeper & Fredericksburg, VA) were contacted for available equipment and responded. Monitoring, Informational Process and Continued Mobilization  Communication process established for information updates to and from TEOC (Richmond) NOVA district, Fairfax County police, Virginia State Police and NOVA maintenance areas.  VDOT coordinated with and assisted United States Military from Naval Annex (Navy, Army) in setting up information command center in secured VDOT Columbia Pike (STC) facility. Secured for them access to phones, e-mail, news broadcasts, CCTV cameras, writing material, white boards, conference rooms and offices. Columbia Pikes Maintenance area headquarters facility was used as day care center for children of military personnel.  Work shifts were established for around the clock operations.  Conference call established between area agencies including the Council of Governments (COG) discussing and planning openings and closings of roads, public and private facilities and other relevant business decisions.

55

E1E1C03_1

09/18/2008

56

56

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS 

Situational Improvements/Lessons Learned  Within a minute of the plane hitting the Pentagon all Cellular phones, and some two-way radio communications, and pagers were periodically interrupted for approximately 3 hours. (Caused by circuit overloads, and military blackout). On that basis, for external communications VDOT will need to rely on the use of more specialized leased two-way and satellite type communication devices.  District’s teleconferencing equipment was brought to the STC; this proved to be an essential and useful tool. We need to have appropriate teleconferencing equipment exclusively dedicated for this sensitive traffic operation center.  STC evacuation procedure and active personnel verification guidelines and policy need to be established. (i.e., what if STC had been damaged, where should personnel go for instructions, relocation and who should personnel notify to establish list of the non-injured).  TEOC guidelines and procedures. This event’s activities demonstrated the need to review, tighten and make developmental improvements on procedures for communications between TEOC (Richmond), and all districts.  Within the framework of managing incidents and emergencies of this magnitude and nature, we need interoperability guidelines for contact and interaction with the military.  The existing STC facility is old, does not have adequate space, and is not adaptable for the existing and future traffic volume, congestion and high customer expectations. To realistically meet these demands a new facility is needed, and the necessary funding for design and construction should be allocated. A centralized unified district emergency command facility (information and command center) would encompass all VDOT sections (districtwide involved in incident management), police, fire and rescue, COG and others.  Aerial visual (helicopter type) link. Ability to see large area of district for traffic flow analysis. During emergencies visual verification of traffic flow and patterns to confirm proper incident management signal plans are adequate for the emergency. Also send STC video feed to command centers across state using communications lines. This would give these facilities instant visual informational feeds. This communications could also be used to feed local news broadcasts to these facilities about District specific emergencies.  Establish protocol for providing and obtaining additional resources (equipment, signs, light towers, or manpower) from within the District and from neighboring Districts. The protocol should include guidelines for maintaining communication with crews on route and after they arrive to the incident scene.

The role of the Emergency Management subsystem includes monitoring the transportation infrastructure. Information on threats is shared primarily with the Traffic Management, and the Maintenance and Construction Management subsystems but can also be shared with other subsystems. The traffic management center, as we saw in the 9/11 VDOT scenario, controls the barrier and

E1E1C03_1

09/18/2008

57

3.9

TRAVELER SECURITY

57

EM05 - Transportation Infrastructure Protection

Alerting and Advisory Systems

alerts and advisories + threat support data threat information + threat data for analysis

Rail Operations

Emergency Management

Barrier System Management Safeguard System Management

Field Secure Area Sensor Monitoring

security equipment maintenance status

incident report Other Emergency threat information Management coordination

threat information + transportation system status

secure area surveillance control + secure area sensor control

transportation system status+ emergency traffic control request + Center Secure Area threat information Surveillance

TMC Incident Dispatch Coordination /Communication

Field Secure Area Surveillance

secure area characteristics

Management

Traffic Management

Security Monitoring

secure area surveillance data + secure area sensor data + infrastructure monitoring sensor data

threat information

threat information + transportation system status + Maintenance and security field Construction equipment status

Transit Management

secure area sensor control + secure area surveillance control + infrastructure monitoring sensor control

emergency traffic control information

Center Secure Area Sensor Management

barrier system status + safeguard system status barrier system control + safeguard system control

secure area surveillance data + secure area sensor data

Secure Area Environment secure area characteristics

Remote Traveler Traveler Secure Area Sensor Monitoring Traveler Secure Area Surveillance

Roadway Field Barrier System Control Field Safeguard System Control

barrier system control barrier system status

Emergency Vehicle

On-Board EV Barrier System Control

Figure 3.21 Transportation Infrastructure Protection Market Package. (Source: RITA, National ITS Architecture 6.0, May 2007.)

safeguard equipment, although Emergency Management can request deployment. The security of transportation infrastructure is covered primarily in the Transportation Infrastructure Protection market package, illustrated by Figure 3.21. The Security Monitoring subsystem was added in Version 5.0 of the National ITS Architecture to handle surveillance equipment allocated solely for security purposes. 3.9 TRAVELER SECURITY The Traveler Security area is responsible for increasing the safety and security of travelers in public areas including public transit facilities, bridges, tunnels, parking facilities, (major) intersections, and other roadway features. —RITA, National ITS Architecture 6.0, May 2007

Four key market packages represent the Traveler Security area: 1. Transit Security (APTS05). 2. Transportation Infrastructure Protection (EM05).

E1E1C03_1

09/18/2008

58

58

LEVERAGING ITS TO REDUCE RISK AND EXPOSURE USING ITS SECURITY AREAS

3. Wide Area Alert (EM06). 4. Disaster Traveler Information (EM10). We have seen each of these market packages in the previous security areas. Their theme in this application is to provide security-related information to travelers with the goal of improving their safety. 3.10 CONCLUSIONS

This chapter discussed the various transportation-related security areas that can be addressed by ITS. By providing surveillance and detection capabilities, along with real-time agency-to-agency, agency-to-vehicle, and agency-to-field communications infrastructure, ITS can significantly minimize the security risks to our transportation infrastructure. Transportation security is a new undertaking for many public agencies. The U.S. National ITS Architecture provides excellent resources for these agencies to develop a comprehensive and systematic transportation security plan that will contribute to the homeland security efforts. ITS planning and execution of the national homeland security efforts will also improve if agencies across the country adopt a regional surface transportation security architecture that minimizes risks to surface transportation infrastructure. Agencies or regions may choose the areas for which they wish to develop a security plan. The application of disaster response, evacuation, and ITS widearea-alert security procedures could occur during other emergency events, such as a hurricane evacuation or highway incident. Comprehensive planning in these areas will allow public agencies to minimize risks in multiple scenarios, thereby increasing their return on investment. Commercial vehicle operators and public law enforcement agencies need to work together to safeguard commercial vehicle traffic, freight traffic, and hazardous materials freight traffic. A security breach in any of these areas could be a potentially severe risk to public safety. Interagency cooperation to detect and respond to any security breach in these areas is of paramount importance. ITS can definitely provide an opportunity to effectively perform these functions. ITS also has an effective methodology for providing rail security for passengers, freight, and personnel and for improving security and safety at highway–rail grade crossings. Surveillance, and sensor monitoring of transit stations and vehicles, can minimize the security vulnerabilities inherent in any transit system. Critical transportation infrastructures, such as bridges, tunnels, and management centers, can be potential terrorist targets or vulnerable to natural disasters. Continuous real-time monitoring of these infrastructures will identify any potential threats and initiate a prompt response with early identification of an event. These eight security areas namely, Disaster Response and Evacuation, Freight and Commercial Vehicle Security, HAZMAT Security, ITS Wide

E1E1C03_1

09/18/2008

59

REVIEW QUESTIONS

59

Area Alert, Rail Security, Transit Security, Transportation Infrastructure Security and Traveler Security provide a comprehensive view of how ITS can contribute to transportation security. The initial steps in developing such a plan would be to understand what functionalities the National ITS Architecture provides and then determine how they could be implemented. REFERENCES Chowdhury, Mashrur, and Adel Sadek. 2003. Fundamentals of Intelligent Transportation Systems Planning. Artech House. Farradyne, P.B. 2002. ‘‘A Guide to Updating Emergency Response Plans for Terrorist Incidents,’’ AASHTO, May. Post, Buckley, Schuh & Jernigan (PBS&J). 1999. ‘‘I-4 ITS Corridor Framework Phase II Working Paper #1: Evacuation Coordination User Service Development,’’ FDOT, December. Research and Innovative Technology Administration (RITA). May 2007. National ITS Architecture, Version 6.0, www.its.dot.gov/arch/index.htm. Virginia Department of Transportation (VDOT). 2001. Hampton Roads Hurricane Traffic Control Plan, July. Virginia Department of Transportation (VDOT). 2002. NOVA Centric ITS Architecture Outreach Report. Developed by Arinc, Inc., PB Farradyne, Inc., and Iteris, Inc., for the Virginia Department of Transportation, May. Whillhite, Christy D. 2007. ‘‘Hurricane Evacuation and Incorporating Safety and Security into Metropolitan Transportation Plans.’’ AMPO 2007 National Conference, October 4.

REVIEW QUESTIONS

1. Why are the ITS security areas dependent on securing ITS? 2. Name all eight ITS security areas. 3. Which ITS security area was best described prior to Version 5.0 of the National ITS Architecture? 4. What National ITS Architecture subsystem handles most of the security area functionality? 5. What functionality is necessary after an evacuation? 6. What new subsystem was added to Version 5.0 of the National ITS Architecture? 7. How many key interfaces are parts of the Transit Security area? 8. What were some of the lessons learned by VDOT in the aftermath of the September 11th terrorist attacks?

E1E1C04_1

09/18/2008

60

CHAPTER 4

RISK ASSESSMENT FRAMEWORK

I

dentifying factors that contribute to the risk of deliberate attacks and the overall probability of the occurrence of such events are the primary tasks in quantifying risks. Quantifying a risk is important for several reasons, including prioritizing security-related projects competing under budget constraints, identifying the threat level for taking precautionary measures such as informing at-risk populations, and designing a secure system. This chapter discusses a framework for assessing the risks of critical transportation infrastructure with the purpose of selecting the appropriate mitigating measures. It details the process for selecting mitigating options for any risks of deliberate attack and includes risk assessment tools for both qualitative and quantitative evaluations. Risk assessment is not unique to the transportation infrastructure. Most public transportation agencies responsible for building, operating, and maintaining infrastructure already have a risk management process in place to protect assets and minimize the potential for loss in the event of an incident. For example, many highway agencies have standard risk management policies to protect themselves from potential lawsuits. Agencies can build on prior risk management experience when focusing on infrastructure security. Before continuing into the background of risk management and assessment, it is important to review the definitions of a few key terms used in this book. Deliberate attack Caused by a person or persons for intentional damage to life and property in order to create terror among the public (Walker 2000).

Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

60

E1E1C04_1

09/18/2008

61

4.1

RISK ASSESSMENT FRAMEWORK

61

Risk The likelihood of a disruptive event occurring during the life of a key piece of infrastructure or the damage that can occur subsequent to a certain event. The first part of this definition is easily transferable to risk assessment; the second part applies to risk management. Both parts of the definition significantly influence the decision-making process for transportation infrastructure security while using intelligent transportation systems (ITS) (Bekiaris and Nakanishi 2004). Risk factors for highway elements can include structural stability, strategic importance, traffic conditions, and resources to mitigate risks and manage recovery efforts (Xia and Chen 2004). Risk assessment The process of identifying and gathering information about possible risks to a transportation system for use in ranking security and safety improvements. Risk management Refers to the overall effort of managing risks, including risk assessment, the selection of security projects, and the frequent updating of risks (Walker 2000). Uncertainty Arises from the need to make decisions about future events whose predictors could contain errors; thus it involves decision making without full knowledge (Walker 2000). 4.1 RISK ASSESSMENT FRAMEWORK

An analytical framework is necessary to formalize the risk assessment process under uncertainties, including the threat of deliberate attack, and to provide objectivity for enhancing public and political support, both of which are necessary for securing funds for implementation. This section presents a framework for managing risks against deliberate attacks to transportation infrastructure. Because the risk assessment process includes several tasks, it is important to develop a framework where different tasks are performed sequentially in an organized fashion to provide maximum benefits. The targets for deliberate attacks and hence the subjects for risk assessment are the critical assets, which, if attacked, will receive the highest attention from both the media and public. One important parameter in the risk assessment process is the use of appropriate risk assessment tools to quantify the vulnerability and implement appropriate countermeasures to minimize the risks. Data are important in the risk assessment process, and proper procedures must be in place for the timely collection of these data to support the process. Examples of static data can include:  

Regional or strategic importance* Stability of the structure*

*From Xia and Chen, 2004.

E1E1C04_1

09/18/2008

62

62

RISK ASSESSMENT FRAMEWORK

  



Functional Resilience* Route redundancy Response resources  Reversible lanes  Evacuation signage  Traffic management center redundancy Recovery ability

Dynamic data can include:        

Traffic volumes* Weather conditions* Road conditions (lane availability due to construction and maintenance)* Personnel availability Traffic control (reversible lane operations) Other special lane operations Signal timings plans in use Surveillance information

Many state agencies have developed a process for risk assessment and mitigation for coping with deliberate attacks, in addition to their ongoing efforts to protect their assets and mitigate potential losses. One such process, primarily based on the participation of the stakeholders in identification of possible scenarios and countermeasures, has been developed by the New Mexico state government. This process can be applied to address combined threats from highway incidents, environmental hazards, and deliberate threats from terrorists (Hood et al. 2003). The process defines five elements of the transportation system in terms of the potential for a terrorist attack: 1. User. The known or suspected terrorist or an individual committing an action that can lead to a terrorist act (e.g., someone highjacking a commercial vehicle carrying HAZMAT). 2. Vehicle. Any moving device used to transport travelers or cargo as either a weapon itself or a potential target of terrorists. 3. Infrastructure. Any permanent structure that may serve as a target or a means of attack or weapon. 4. Social setting. The way in which a society organizes its policy, system of justice, values, religious institutions, and investment strategies. The social setting establishes the policies and procedures that guide the society’s critical systems. 5. Environment. Any aspect of the physical environment that influences the start of the incident or affects the consequences of the incident.

E1E1C04_1

09/18/2008

63

4.1

RISK ASSESSMENT FRAMEWORK

Red/Blue Team Scenario

Response Planning

Critical Infrastructure Identification

Critical Infrastructure Hardening

63

Major Consequence Definition

Figure 4.1 Vulnerability Assessment Flow Diagram. (Source: Hood et al., 2003.)

This process recognizes that each of these elements can be a potential target, weapon, or consequence. Although it is more likely for the user and vehicles to be utilized as a weapon and the infrastructure, social setting, and environment to be the target, the other possibilities should not be ignored. Figure 4.1 shows the flow diagram for the vulnerability assessment process. The process goes through an iterative exercise of identifying the critical infrastructure and major consequences. Out of two teams, the Red Team develops potential scenarios for deliberate attacks and the Blue Team, develops operational plans to respond to the Red Team scenarios. The Blue Team’s response planning contributes in the adding security features/countermeasures, or ‘‘hardening,’’ of the critical infrastructure. This process assists response personnel and decision makers to create an operational plan in the event of a deliberate attack. Figure 4.2 shows the framework for assessing risks to transportation infrastructure either to minimize risks before they occur or to minimize the consequences when an undesirable event has taken place. The framework includes four sequential tasks: 1. 2. 3. 4.

Identification of critical assets. Assessment of risks. Identification of countermeasures/mitigating options. Selection of mitigating option(s).

As shown in the figure, some tasks are supported through additional work. For example, assessing risks involves the collection of several data and information types, such as access to and evacuation from the site and existing security conditions.

E1E1C04_1

09/18/2008

64

64

RISK ASSESSMENT FRAMEWORK

Gather Data/Information

Identify Critical Assets

Assess Risks

Identify Countermeasures and Mitigating Options

Select Mitigating Option(s)

Identify Costs and Benefits of Each Option

Figure 4.2 Framework for Risk Assessment.

4.1.1 Critical Assets

Qualitative identification of the long-term risks involved with transportation infrastructure comes primarily from governmental sources, such as national intelligence agencies, national security–related departments, and law enforcement agencies. These agencies use information from sources worldwide to identify any risks of deliberate attacks on the public and infrastructure. In the United States, the Department of Homeland Security coordinates the tasks of different agencies to identify these potential threats. This agency was formed after the terrorist attacks on September 11, 2001, to coordinate governmental agencies and to compile and analyze the information from each of these agencies. In coordination with national efforts on threat identification, regional and local authorities may identify potential targets in their jurisdiction and possible ways to protect life and property against deliberate attacks. Like the national efforts on coordinating different agencies to identify threats, the regional and local efforts also must be coordinated with stakeholder agencies. Otherwise, gaps in emphasis and/ or communication between agencies and government levels can allow potential threats to be missed and therefore not included in the risk assessment process. The public may detect immediate threats through observation of unusual or suspicious activities. Educating the public on the importance of alerting authorities and possible ways to detect activities related to terrorist threats is important. The media can be used effectively to educate the public on how to be more vigilant and how to report activities that may pose a deliberate threat. 4.1.2 Risk Assessment Methods

One of the most important tasks in the risk assessment framework is to evaluate risks to critical transportation infrastructure, qualitatively and/or

E1E1C04_1

09/18/2008

65

4.1

RISK ASSESSMENT FRAMEWORK

65

quantitatively. Although the various available methods may have different data needs, they can be classified generally as either dynamic or static data, as presented in Section 4.1. Several methods are available for qualitative and quantitative risk assessment of infrastructure. This section presents four methods. The first method has been developed specifically for bridges and tunnels and is used for estimating quantitative risks. The second, fault-tree analysis, is used for analyzing risks, both qualitatively and quantitatively (Chowdhury et al. 2000). It has been applied in many other areas, such as traffic safety, nuclear power plants, and water resource engineering, The last two methods are mathematical tools for determining the impact of changing influences quantitatively. 4.1.2.1 Blue Ribbon Panel Method. One of the methods proposed specifi-

cally for risk assessment of highway infrastructure, such as bridges and tunnels, provides for the consideration of interactions of different risk factors. The general expression of risk (Blue Ribbon Panel 2003) is: R¼OV I

ð4:1Þ

Where R ¼ risk of an infrastructure element. O ¼ occurrence, characterized by the likelihood of deliberate attacks on infrastructure. V ¼ vulnerability, which characterizes severity of a deliberate attack in terms of loss of life, injury, and property damage. It is a measure of expected casualties, injuries, fatalities, and damage to the infrastructure. I ¼ importance, which characterizes the importance of the infrastructure at the regional and national level. This importance can be estimated by analyzing the impacts on the region and country if the infrastructure is unavailable. The likelihood of the occurrence of such attacks will depend on several factors, including:    

Attractiveness of the target, in terms of visibility and publicity if attacked Prior threats Access to the sites Level of security in place

Table 4.1 shows the possible sources of data for O, V, and I. 4.1.2.2 Fault-Tree Analysis. A way to assess the risk, both qualitatively and quantitatively, is through modeling a system in terms of its failure. This assessment can be done through a method called fault-tree analysis, a risk

E1E1C04_1

09/18/2008

66

66

RISK ASSESSMENT FRAMEWORK

TABLE 4.1 Sources of Data for Equation 4.1 Factors

Examples of Required Data

Possible Sources of Data

Occurrence (O)

Target attractiveness, level of security, access to site, publicity if attacked, number of prior threats

Vulnerability (V )

Likely damage from various terrorist threats, including expected damage, outcome of event, expected casualties, and loss of use Effects on region or nation if facility is no longer available due to deliberate attack

Law enforcement and intelligence communities familiar with threat and operational security measures Engineering analysis and expertise

Importance (I )

Owners, operators, users, and beneficiaries of the facilities, governmental sources

Source: Blue Ribbon Panel 2003.

modeling and assessment tool, which can be used in qualitative and quantitative analysis of any risks of the infrastructure failure and the events leading to the failure due to a deliberate attack. Fault-tree analysis already has been applied in increasing the security of hardened structures such as nuclear power plants, in highway safety, and in water resource engineering (Chowdhury et al. 2000). Fault-tree analysis models a system by analyzing the failure (for our purposes a deliberate attack) and possible events leading to that catastrophic failure. An advantage of fault-tree analysis is that it may be applied even if all the data are not yet available, a fact that makes it particularly suitable to analyzing infrastructure vulnerability. The analytical technique of fault-tree modeling graphically represents the ways a system can fail (NRC 1981). The graphic includes gates and events in which parallel and sequential combinations of faults lead to the prespecified undesired state of events. Gates serve as decision points, indicating that if a failure can occur if either all or one of the previous events occurs, denoted by AND gates and OR gates, respectively. Fault-tree analysis also represents a graphical Boolean relationship between fault events causing the undesired state (e.g., failure due to a deliberate attack). Using Boolean algebra, a fault tree can be evaluated both qualitatively and quantitatively. Figure 4.3 shows a graphical representation of the relationship among the fault-tree symbols, particularly the events and gates. One of the Boolean expressions can be given for an Event Q, which occurs because either fault event A or B, or both A and B occur. This equation would be written as: PðQÞ ¼ Pð AÞ þ PðBÞ  Pð A \ BÞ

E1E1C04_1

09/18/2008

67

4.1

RISK ASSESSMENT FRAMEWORK

Figure 4.3 Fault-Tree Symbols. (Source: NRC 1981.)

67

E1E1C04_1

09/18/2008

68

68

RISK ASSESSMENT FRAMEWORK

OUTPUT Q

+

INPUT A

INPUT B

Figure 4.4 OR Gate.

An event Q occurs (say a failure of a bridge due to a deliberate attack) because of the occurrence of either fault A or B. Consequently, it can be represented by an OR gate. Figure 4.4 shows an example of a top-level event, which may represent the failure of a bridge due to deliberate attacks, that is due to an occurrence of one or more of the input events. In other words, Q occurs if A (failure of the foundation) occurs, or B (failure of the bridge deck) occurs, or both A and B occur. Event Q can also occur because both fault events C and D occur. This equation would be written as: PðQÞ ¼ PðC ÞPðC/ DÞ ¼ PðDÞPðD/ C Þ Figure 4.5 shows an example of the top-level event Q occurs (say the failure of a traffic management center communication system due to deliberate attacks) is due to the both of the input events C and D occur, and so can be represented by an AND gate. In other words, Q occurs only if both C (failure of the primary communication system) and D (failure of a redundant communication system) occur. 4.1.2.3 Simulation Analysis. Unfortunately, complete elimination of risk is not realistic even though all possible measures are taken. In addition to having a

OUTPUT Q

INPUT C

INPUT D

Figure 4.5 AND Gate.

E1E1C04_1

09/18/2008

69

4.1

RISK ASSESSMENT FRAMEWORK

69

plan to minimize the risk of an attack, a plan to respond quickly and effectively after an attack to minimize the impacts must be in place. Real world drills for response operations are good; however, most of these exercises are resource intensive. Computer simulations to evaluate different response plans are a costeffective alternative and also provide an opportunity to use an animation of the simulation to train first responders. Agencies that are responsible for responding to an emergency created by a deliberate attack must maintain communications (Chowdhury et al. 2003). These agencies must ensure that the emergency communications infrastructure and systems are fully operable under any catastrophic situations so that response is not impacted during critical periods. Communication reliability analysis through laboratory and field experiments as well as computer simulation can provide insight into the amount of delay and communication failure a given system can expect to experience under an anticipated emergency scenario. Different communication network simulators, such as Network Simulator 2 (ns-2) (The network simulator 2001) and Opnet (Opnet Technologies), could be used for simulation of the communication network. Traffic management, including rerouting and evacuation, is an important part of transportation security response plans. Numerous traffic models, including computer simulations, are available for planning for traffic management during a catastrophic event. Models that have been developed for evacuating at-risk populations prior to hurricanes and other natural disasters also can be applied for response planning after a deliberate attack. Chapter 5 presents an example of application of an evacuating model and simulation tool in evacuation planning. Different commercially available microscopic traffic simulation models can be utilized for this purpose. 4.1.2.4 Monte Carlo Analysis. Monte Carlo analysis is a valuable tool when it is difficult to determine a numerical solution because of the influence of several changing factors. This technique uses random numbers to create a statistical distribution based on the influences of multiple factors. Each of these factors, such as the structural integrity of a bridge over time, needs to be described by a mathematical function. The Monte Carlo analysis technique uses random numbers to iteratively identify a probability distribution of the multiple factors occurring simultaneously. Equation 4.2 provides the general form for a Monte Carlo analysis where three factors (x, y, and z) influence the overall outcome. Each of these factors stands for the mathematical equation associating risk. For example, x can stand for an equation relating a bridge’s foundation structural integrity over time, y can stand for a similar equation for the bridge’s deck, and z can relate the change of traffic volumes over time.

y ¼ f ðx; y; zÞ

ð4:2Þ

A simple application of this method is the estimation of pi. If a square is the sample space and a circle is drawn within the square, random Monte Carlo

E1E1C04_1

09/18/2008

70

70

RISK ASSESSMENT FRAMEWORK

sampling can provide an estimation of the area of the circle and therefore an estimation of pi. Imagine that each random number selected by the Monte Carlo method represents a grain of sand dropped randomly within the square. Selecting multiple random numbers from the sample, dropping multiple grains of sand within the square, and counting how many fall within and outside the circle will provide an estimate of the area and therefore of pi. The more random numbers or grains used, the better the estimate will be. Monte Carlo analysis helps estimate risk when significant uncertainty exists with the contributing factors (x, y, and z). Because this approach often requires a large amount of input data, it is better suited for research applications. Computer tools generally are used to analyze the large number of calculations involved. 4.1.2.5 Weibull Hazard Models. Based on the Weibull distribution; a statistical distribution influenced by shape, scale, and location variables; Weibull hazard models often are applied for estimating the changing hazards of a system over time. Equation 4.3 presents a Weibull hazard model:

f ðx; k; lÞ ¼

k  x k1 ðxlÞk e l l

ð4:3Þ

Where x ¼ time k ¼ shape of the function l ¼ scale parameter (all are nonzero) This model is suited for applications that estimate the life span of systems where the failure rates are well documented. Although this approach does not individually account for the multiple factors that affect the life span of infrastructure, it is a valuable tool when historical failure rate information is available. A plethora of other tools exist to predict risk, including compartmental flow models, stochastic transition models, and discrete event simulation models, but their applications to the transportation field have been rather limited due to the amount of input data required and the complexity of calculations. Chapter 5 discusses these risk assessment methods in more depth. 4.1.3 Mitigation and Countermeasures

This step identifies potential mitigating options to different vulnerabilities identified in the risk assessment process discussed in the last section. Reducing the number and level of vulnerabilities will contribute to the reduction of risks to critical transportation infrastructure. For each of the vulnerabilities, several mitigating options may be identified. For example, a specific vulnerability to a critical bridge may be personnel access to the bridge piers. Unnoticed access to

E1E1C04_1

09/18/2008

71

4.1

RISK ASSESSMENT FRAMEWORK

71

these locations, via either water or land, poses a significant threat if trespassers have ill intentions. Mitigating options to this scenario may include video surveillance of the bridge piers and key access locations, restricting access to the piers through the river, and periodic manual surveillance by law enforcement agencies. One or more of these options may be selected to minimize risks to the bridge based on the cost benefit analysis discussed in the next section. Resiliency is a key property that infrastructure systems must possess in order to withstand the multiple events that often follow an incident. For example, while a hurricane may weaken transportation infrastructure from wind and water damage, key infrastructure must be resilient enough to withstand the evacuation loadings. In addition to incorporating resiliency in the planning and design of the infrastructure, appropriate countermeasures must be provided to reduce those factors identified through the risk assessment process that contribute to the failure of a system. 4.1.4 Selection of Options

Data generated from the risk assessment process may provide relative benefits and costs of identified countermeasures or mitigating options. One of the most common techniques used in quantitative comparison is benefit-cost analysis. Transportation systems, as public assets, require justification for large expenditures, particularly those relating to security. Benefit-cost analysis provides a rating that allows simple comparison between diverse countermeasures, but it must be applied properly and account for the often-complex impacts that surround security countermeasures. Using a decision matrix can also aid in ranking security countermeasures, particularly when values are difficult to assign to some or all of the impacts. Traditionally these tables have been used to select the best alignment for a new section of roadway, but they readily apply to the selection of transportation security countermeasures. Table 4.2 presents an example of a decision matrix where countermeasures are rated on a qualitative scale based on several criteria. The criteria and scale should be carefully selected by a panel intimately involved with the identification of countermeasures. After rating the options according to TABLE 4.2 Security Countermeasure Decision Matrix Impact Rating (1–5, where 5 is the worst)

Countermeasure Option 1 Option 2 Option 3 Option 4 Option 5

Passenger Environmental Travel Nonsecurity Security Friendliness Delay related Financial Appeal Impact value Total 3 2 5 1 4

4 5 2 3 5

1 1 1 2 2

4 5 4 3 3

2 3 4 3 3

14 16 16 12 17

E1E1C04_1

09/18/2008

72

72

RISK ASSESSMENT FRAMEWORK

each criterion, a quantitative decision can be made based on multiple qualitative factors. In this example, option 4 should be chosen because it rated the lowest, indicating a more positive impact on travelers.

4.2 OPPORTUNITIES AND CHALLENGES

Several risk assessment methods exist to analyze risks against critical infrastructure. The framework described in this chapter is in general consensus with many other models, including that recommended by the Federal Transit Administration (Community Transportation Association of America 2001). Any application of appropriate assessment tools depends on the type of risks, available data, and the level of details needed. These tools provide opportunities to conduct an objective evaluation of risks to infrastructure from any deliberate attacks. Challenges exist in the availability of the required data, quality of data, and resources necessary to conduct these analyses. The availability of infrastructure management systems and traffic-monitoring intelligent transportation systems in large and medium-size cities can serve as a valuable opportunity for collecting much of the information needed in risk assessment. Requiring a security analysis as part of project planning and operations could provide the proper emphasis on risks analysis, incorporating it with operations and maintenance plans.

4.3 APPLICATION OF THE FRAMEWORK

This chapter describes a conceptual design that can be followed for managing risks to transportation infrastructure. Although this presentation focused on transportation elements, the general process can be emulated for risk assessment of many other types of infrastructure. Chapter 5 discusses the application of this risk assessment and management tools with example problems.

REFERENCES Bekiaris, E., and Y. J. Nakanishi. 2004. Economic Impacts of Intelligent Transportation Systems: Innovations and Cast Studies. Elsevier. Blue Ribbon Panel on Bridge and Transit Security. 2003. Recommendation for Bridge and Tunnel Security, FHWA/AASHTO, September. Chowdhury, Mashrur, and Adel Sadek. 2003. Fundamentals of ITS Planning. Artech House. Chowdhury, M., N. Garber, and D. Li. 2000. ‘‘An Interactive Multiobjective Resource Allocation Methodology for Highway Safety Improvements,’’ ASCE Journal of Infrastructure Systems 6, No. 4: 138–144.

E1E1C04_1

09/18/2008

73

REVIEW QUESTIONS

73

Community Transportation Association of America. 2001. ‘‘Risk Management for Rural Transit Systems.’’ Developed for the Rural Transit Assistance Program of the Federal Transit Administration. Hood, J., T. Olivas, C. B. Slocter, B. Howard, and D. P. Albright. 2003. ‘‘Vulnerability Assessment Through Integrated Transportation Analysis,’’ Transportation Research Record Journal of the Transportation Research Board No 1822: 18–23. The Network Simulator ns-2, http://www.isi.edu/nsnam/ns/, 2001 Nuclear Regulatory Commission (NRC). 1981. ‘‘Fault Tree Handbook.’’ Systems and Reliability Research Office. Available online at www.nrc.gov/reading-rm/doc-collections/ nuregs/staff/sr0492/sr0492.pdf. OPNET Technologies, Inc., OPNET network simulation software, www.opnet.com. Walker, W. E. 2000. ‘‘Policy Analysis: A Systematic Approach to Supporting Policymaking in the Public Sector,’’ Journal of Multicriteria Decision Analysis 9, No. 1–3: 11–27. Xia, J., and M. Chen. 2004. ‘‘Using ITS Data in Risk Assessment of Highway Network.’’ Report prepared for Southeastern Transportation Center.

REVIEW QUESTIONS

1. What are the difference between risk and uncertainty? Give examples. 2. Identify critical transportation assets in your area. Provide a detailed explanation including the criteria you used in selecting these assets. 3. What type of data will you need to carry out the risk assessment to bridges and tunnels? (Refer to Equation 4.1.) 4. What is the general concept behind a fault tree? What is a top-level event for analyzing risks to a transportation bridge? 5. How will you select the mitigating options? What types of data will you need on the available options? 6. Using Boolean algebra, what is the probability of failure of a communication network hosted by a traffic management center, if failure can only occur if both the primary communication system fails (probability 0.1) and the secondary communication systems fails (probability 0.15)? 7. Also applying Boolean algebra, find the probability of failure of a bridge if either a bridge deck (probability 0.001) or a foundation failure occurs (probability of 0.0005) due to a deliberate attack.

E1E1C05_1

09/18/2008

74

CHAPTER 5

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

C

hapter 4 discussed the framework for risk assessment of critical transportation infrastructure and the theoretical concepts behind these tools. The application of different quantitative and qualitative risk assessment tools is a primary component of that framework. Therefore, this chapter demonstrates the application of some risk analysis methods. Those approaching risk assessment for the first time will find Chapter 4 provides useful background to this chapter. Practitioners and researchers will find this chapter a useful resource of example applications and problems. Examples include fault-tree analysis and the Blue Ribbon Panel method. 5.1 APPLICATION OF RISK ASSESSMENT METHODS

The next sections present examples of the application of risk assessment methods. Examples have been created from both hypothetical and real-world data to provide a better insight into these methods and their application. To review the theoretical concepts behind these methods, refer to Chapter 4. 5.1.1 Blue Ribbon Panel Method

The method proposed by the Blue Ribbon Panel on Bridge and Tunnel Security makes use of a number of sources.1 The general expression of risk is shown in 1

AASHTO 2002; Audigier et al. 2000; Babaei and Hawkins 1993; Basoz and Kiremidjian 1995; Hart Consultants Group et al. 1994; Kim 1993; King and Kiremidjian 1994; Maroney 1990; Saaty 1980; Sheng and Gilbert 1991; U.S. Department of Justice 2000. Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

74

E1E1C05_1

09/18/2008

75

5.1

APPLICATION OF RISK ASSESSMENT METHODS

75

Equation 5.1, also presented in Chapter 4. To review, R represents the risk of an infrastructure element and will be output as a risk score (RS). Risk score represents the relative risk between the infrastructures being considered for ranking. After finding the risk scores for the selected critical bridges and tunnels, ranking them can provide direction for security improvements. The next variable, I, represents importance, which characterizes the importance of the infrastructure at the regional and national level. This variable is represented as the weighted average of attributes related to the     

Facility Its historic and symbolic importance Replacement value Importance as an emergency evacuation route Importance to the regional economy R¼IOV

ð5:1Þ

O represents occurrence, characterized by the likelihood of deliberate attacks on infrastructure. It is determined with a weighted combination of these attributes:     

Level of access Level of security Visibility or attractiveness of the facility Level of publicity History, including the number of times that the facility has been threatened in the past

V represents vulnerability, which characterizes severity of a deliberate attack in terms of loss of life, injury, and property damage. This vulnerability factor is computed as the weighted average of:   

Expected damage to the asset Expected time of closure of the facility Expected number of casualties

Figure 5.1 shows the three factors associated with the risk score and their associated attributes. Equation 5.2, showing the risk score (RS) for a particular facility, can be estimated using the general equation 5.1 and summing all of the threats to the facility; therefore, the only differences between the general equation (equation 5.1) and equation 5.2 is that the occurrence and vulnerability factors (OF and VF, respectively) of each threat are multiplied and summed before multiplying by the impact factor (IF) for the facility. RS represents

E1E1C05_1

09/18/2008

76

76

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

Figure 5.1 Components of RS and Their Associated Attributes. (Source: Blue Ribbon Panel 2003.)

relative risks between facilities under consideration. Because not all facilities have multiple threats, the general equation does not show this summation. RS ¼ I 

X ½Oi  Vi 

ð5:2Þ

To find the risk score using this multiattribute utility method, first we must define the variables IF, OF, and VF. Equations 5.3 through 5.5 show how to determine these variables. IF ¼

X ½Wj  VjðXjÞ

ð5:3Þ

OF ¼

X ½Wj  VjðXjÞ

ð5:4Þ

VF ¼

X ½Wj  VjðXjÞ

ð5:5Þ

Xj represents the value of attribute j. For example, ‘‘Replacement Value’’ is an attribute of IF, where the actual value could be represented by a number or some relative measures, such as high and low. In equations 5.3, 5.4, and 5.5, Vj(Xj) represents the function or table that maps Xj to a utility value between 0 and 1, where 1 corresponds to a very high importance, occurrence, or vulnerability. There are many ways to set up utility functions. In general, consistency in application is the key to success. For more details on utility theory related to multiattribute analysis, see Goicoechea et al. (1982). Last, Wj is the weighting factor on attribute j.

E1E1C05_1

09/18/2008

77

5.1

APPLICATION OF RISK ASSESSMENT METHODS

77

Figure 5.2 Relative Weights for Attributes to Compute Importance. (Source: Blue Ribbon Panel 2003.)

Now stakeholders and decision makers need to meet to discuss and assign the importance and value of these key infrastructure elements. The Blue Ribbon Team proposes an Analytic Hierarchy Process that uses a pair-wise comparison process for developing the relative weighting of IF, VF, and OF. To illustrate this process, an example case study is presented. Decision makers assign a relative value to each component or attribute reflecting the relative influence of one component over the others. After averaging these suggestions, the average weighing factors are presented to the group for discussion, revision, and final approval. Figures 5.2 through 5.4 show examples of relative

Figure 5.3 Relative Weights for Attributes to Compute Occurrence. (Source: Blue Ribbon Panel 2003.)

E1E1C05_1

09/18/2008

78

78

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

Figure 5.4 Relative Weights for Attributes to Compute Vulnerability. (Source: Blue Ribbon Panel 2003.)

weights of the attributes associated with IF, OF, and VF for bridge and tunnel security, respectively. Setting all of the weights on a scale that sums to 1 or using a percentage weight are both acceptable when assigning actual values to the weight of each element. The important thing to keep in mind is that each factor is weighted according to the results provided at the stakeholder meeting. Using either a percentage or a fraction of one, both present simple ways of maintaining this ratio.

Figure 5.5 Ranking of a Transportation System by Importance. (Source: Blue Ribbon Panel 2003.)

E1E1C05_1

09/18/2008

79

5.1

APPLICATION OF RISK ASSESSMENT METHODS

79

Figure 5.6 Vulnerable Components and Mode of Access to Bridge 1. (Source: Blue Ribbon Panel 2003.)

After determining the values for the various weighting factors, the importance factor, IF, should be computed for each facility using equation 5.3, the relative weights found in the previous step as presented in Figure 5.2, and the utility of the attributes associated with Vj(Xj). Figure 5.5 shows the relative ranking results of the eight facilities considered in this case study, based on IF. Bridge 1 and tunnels 1 and 2 are the three most important infrastructure elements in this example. Next the vulnerable components and modes of access to each facility should be identified. Figures 5.6 through 5.11 show the vulnerable components and mode of access to the components of the bridge and tunnel facilities considered in the case study. Identification of vulnerable components and mode of access contributes to the selection of possible mitigation projects to reduce the RS. These identifications lead to the selection of possible

E1E1C05_1

09/18/2008

80

80

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

Figure 5.7 Vulnerable Components and Mode of Access to Tunnel 1. (Source: Blue Ribbon Panel 2003.)

mitigation projects to reduce the RS. In these figures, elements that have been identified as threat targets are shaded and those considered vulnerable but not a target are not shaded, for example the land vent in the ceiling of the tunnel 1 (Figure 5.7). As shown in Figures 5.7 and 5.8, the two tunnels have identical infrastructures because they were constructed at the same time and used similar designs.

E1E1C05_1

09/18/2008

81

5.1

APPLICATION OF RISK ASSESSMENT METHODS

81

Figure 5.8 Vulnerable Components and Mode of Access to Tunnel 2. (Source: Blue Ribbon Panel 2003.)

Figure 5.9 Vulnerable Components and Mode of Access to Bridge 2. (Source: Blue Ribbon Panel 2003.)

E1E1C05_1

09/18/2008

82

82

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

Figure 5.10 Vulnerable Components and Mode of Access to Bridge 3. (Source: Blue Ribbon Panel 2003.)

After identifying the vulnerable components of each facility, the occurrence needs to be computed. Figure 5.3 illustrates the weight of each attribute for the facility, such as high visibility. Again, the higher the utility value is, the greater the predicted occurrence is. These data and equation 5.4 can be used to find an occurrence value for each facility. Next, the vulnerability factor is computed with equation 5.5 using the relative weights previously developed, shown in Figure 5.4, and the associated expected utility of the attributes in terms of consequence. These vulnerability factors are the last piece of data needed to apply equation 5.2 to find a risk score for each facility. Risk scores can also be used to determine which security improvements will best lower the risk to the region’s transportation infrastructure. Table 5.1 shows ranks of mitigating projects for all eight facilities in the case study in terms of their benefits and costs. Benefits are represented by ‘‘Reduction in Risk Score.’’ Once the mitigating projects related to different threats are identified, the OF, VF, and corresponding RS values need to be recomputed with the assumption that mitigating projects are in place. The differences between the RS under existing conditions and after the mitigating projects provide the reduction in RS. The benefit and cost values in this table will help decision makers to prioritize projects. If the required budget is more than the funding available to implement the mitigating projects, this information could be used to prioritize which mitigating projects to fund. The final result of this analysis was presentation of the projects in terms of the costs of implementation and benefits due to the reduction in risk score as shown in Table 5.1. Figure 5.12 shows the project ranking for benefits and costs of the mitigating projects. As shown in Figure 5.12, the benefit-cost information

Figure 5.11 Vulnerable Components and Mode of Access to Bridge 4. (Source: Blue Ribbon Panel 2003.)

E1E1C05_1

09/18/2008

83

5.1

APPLICATION OF RISK ASSESSMENT METHODS

83

TABLE 5.1 Ranking of Mitigation Projects Rank

Facility

Location

1 2 3

Bridge 1 Other Facility 1 Tunnel 1

4 5 6 7 8 9 10 11

Other Facility 1 Bridge 1 Bridge 1 Other Facility 1 Tunnel 1 Bridge 1 Bridge 4 Tunnel 1

12 13

Tunnel 1 Tunnel 2

14

Tunnel 2

15 16 17 18

Bridge 1 Bridge 2 Other Facility 1 Tunnel 1

19 20 21 22

Bridge 1 Bridge 1 Other Facility 2 Bridge 4

23 24 25 26 27 28 29

Bridge 3 Other Facility 1 Other Facility 2 Tunnel 1 Tunnel 2 Other Facility 1 Bridge 4

30 31 32 33

Bridge 2 Bridge 3 Tunnel 1 Tunnel 2

Main Pier Base B Element A Vent Buildings Buildings Element B Anchor Element B Anchor Element A Element C Approach Viaduct Main Pier Base A Tension Hangers Vent Buildings Tunnel Ceilings Approach Plaza Vent Buildings Buildings Vent Buildings Tunnel Ceilings Deck Level Main Piers Element D Administration Building Tension Hangers Approach Highway Element A Main-Span Abutment Main Piers Element E Element B Tunnel Structure Tunnel Structure Element F Compression Members Main Span Main Span Portals Portals

Source: Blue Ribbon Panel 2003.

Reduction in Risk Score

Project Cost ($1,000)

0.16 0.30 0.48

753 1,872 7,857

0.34 0.11 0.10 0.23 0.12 0.32 0.05 0.16

8,243 2,840 2,840 6,982 3,891 13,937 2,944 12,619

0.03 0.10

2,787 9,142

0.13

12,523

0.30 0.10 0.05 0.01

30,869 12,048 7,432 434

0.07 0.15 0.01 0.02

12,363 32,686 1,950 5,891

0.09 0.10 0.02 0.51 0.35 0.03 0.01

24,649 31,754 6,896 222,723 186,735 20,516 8,687

0.08 0.07 0.01 0.01

64,996 108,718 16,040 14,287

E1E1C05_1

09/18/2008

84

84

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

Figure 5.12 Benefit-cost Comparison for Security Projects.

presented for the mitigating projects help identify most desirable projects with higher benefits and lower costs to lowest desirable projects with higher costs and lower benefits. 5.1.2 Fault-Tree Analysis

As discussed in Chapter 4, fault-tree analysis can be used as a part of adopting and implementing a security framework. For a security framework, fault tree can be used to assess risks of failure of the transportation system or a component of the system caused by a deliberate attack. The top-level events can be the failure of a transportation system or a system component. The fault tree graphically describes various combinations of faults, parallel and sequential, that lead to the top-level event (Nuclear Regulatory Commission 1981). The events and logic gates that are used to construct a fault tree are described in Chapter 4. The primary events, which include basic, undeveloped, conditioning and external events, are not broken down further in fault trees because: 





They require no further development. For example, basic events can not be described in any more detail. They do not have sufficient consequence or information that requires further development. In particular, undeveloped events have very little information available and an insignificant impact. They represent any conditions or restrictions to any logic gates, primarily INHIBIT and PRIORITY AND gates, and are referred as the conditioning event.

E1E1C05_1

09/18/2008

85

5.1



APPLICATION OF RISK ASSESSMENT METHODS

85

They are expected to occur, which is a not a fault by itself, but which can contribute to a fault when combined with other external events; this is referred to as the external event.

5.1.2.1 Quantitative Evaluation of a Fault Tree. When data are available, quantitative evaluation methods provide valuable tools that enable an analyst to identify the impacts of the mitigating measures to various events that lead to the top-level event. It is necessary to provide probabilities to primary events in a fault tree to compute the probability of the top event, hence data availability is an issue. Once the probabilities of the primary events are provided, Boolean algebra, which relates each successive event to its parent event through logic gates, is used to compute the probability of the top event. Knowledge of probabilistic and statistical analyses is necessary to estimate probabilities for different basic events. The concepts of probability and statistics used for computing the probability of the basic events is outside the scope of this book; however, general knowledge about probability and statistics, such as random samples, different probability distributions, and Bayesian analyses should be sufficient for fault-tree application. Figure 5.13 shows an example of a fault tree, where the top event is ‘‘Power Supply to Computer Fails’’ (known as Event A). The top event occurs if the power supply is disconnected, the operating system fails, or the computer hardware fails. These events are shown as basic events because the assumption here is that these events need no further development. An investigation reveals that the probabilities shown in Table 5.2 are related to these basic events. By applying Boolean algebra, the probability of the top event is calculated in this way, assuming that the A, B, and C, are mutually exclusive events:

PðComputer Fails to StartÞ ¼ PðAÞ þ PðBÞ þ PðCÞ ¼ 0:02 þ 0:05 þ 0:01 ¼ 0:08

OUTPUT Q

+

INPUT A

INPUT B

INPUT C

Figure 5.13 Application of an OR Gate.

E1E1C05_1

09/18/2008

86

86

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

TABLE 5.2 Probabilities for Basic Events Basic Events

Probabilities

Power supply is disconnected (Event A) Operating system fails (Event B) Computer hardware fails (Event C)

0.02 0.05 0.01

Therefore, based on the probabilities of the basic events in this example, there is an 8 percent chance that the computer will fail to start. Figure 5.14 shows an example of a fault tree, with the top event being ‘‘Power Supply to TMC Fails.’’ As shown in the figure, this top event occurs only if both of these two events occur: primary power supply fails and alternate power supply fails. These events are shown as basic events; the assumption in this example is that these events need no further development. An investigation revealed the probabilities shown in Table 5.3 related to these basic events. By applying Boolean algebra, the probability of the top event is calculated in this way, with the assumption that A and B are independent events: PðPower Supply to TMC FailsÞ ¼ PðAÞPðBÞ ¼ 0:05  0:02 ¼ 0:001 When conducting fault-tree evaluation, events must be examined for mutual exclusiveness and independence. When constructing fault trees with OR gates, mutual exclusiveness is the key property to examine between the events. Events that are mutually exclusive cannot occur at the same time. If events under an OR Power Supply to TMC Fails

0.001

Primary Power Supply Fails

Alternative Power Supply Fails

0.05

0.02

Figure 5.14 Application of an AND Gate.

TABLE 5.3 Probabilities for Basic Events Basic Events Primary power supply fails (Event A) Alternative power supply fails (Event B)

Probabilities 0.05 0.02

E1E1C05_1

09/18/2008

87

5.1

APPLICATION OF RISK ASSESSMENT METHODS

87

gate are not mutually exclusive but are independent of each other, then the probability of the top event, for example, Figure 5.13, would be governed by the statement: PðQÞ ¼ PðAÞ þ PðBÞ þ PðCÞ  PðAÞPðBÞ  PðBÞPðCÞ  PðCÞPðAÞ þ PðAÞPðBÞPðCÞ The justification for the additional terms of this statement compared to the previous OR gate example is best illustrated using a Venn diagram. Figure 5.15 shows the probability space of each failure type. If these events were all mutually exclusive, one could image that none of the circles would overlap. Because they are not exclusive and do overlap, Boolean algebra needs to account for this overlap correctly, ensuring that no area is counted twice or even three times; therefore, the areas of overlap between A and B, between A and C, and between B and C need to be subtracted. However, when subtracting these areas, the space covered by A, B, and, C is subtracted three times when it only needs to be removed once, thus the addition of two times this probability at the end of the expression. Other complications arise during fault-tree construction if events are dependent on each other. For example, referring to Figure 5.14, if the two events were dependent whereas the probability of the alternative power supply failing was higher when the primary power supply failed, then the previous equation could greatly underestimate the failure probability. If the two events in Figure 5.14 were dependent as discussed, the probability would be found by PðQÞ ¼ PðBÞPðAjBÞ. Figure 5.16 shows a more realistic and more complicated example of a faulttree construction related to transportation security, where the top event is the failure of a traffic management center (TMC). TMCs are centralized control centers for monitoring and controlling traffic connected with field devices and other centers related to transportation and emergency management through

Operating System Fails Q=0.05

B

Power Supply Disconnected Q=0.02

Computer Hardware Fails Q=0.01

A

C

Figure 5.15 Venn Diagram of Independent but Not Mutually Exclusive Events.

Figure 5.16 Example of Fault-Tree Application to Transportation Security.

E1E1C05_1 09/18/2008

88

88

E1E1C05_1

09/18/2008

89

5.1

APPLICATION OF RISK ASSESSMENT METHODS

89

wired and/or wireless communications for online traffic management, especially during emergency situations. The fault tree is constructed to show the events leading to the failure of the TMC. As shown in the figure, probabilities were assigned to basic events. These probabilities are used to calculate the likelihood of the top-level event, using Boolean algebra.

EXERCISE

Individually or in a group, write out the Boolean algebra equations to solve the fault tree in Figure 5.16. Work from the bottom up to solve each branch. When the four top branches are solved, check that the probability is 0.6097. What assumptions must you make to find the same answer? 5.1.2.2 Minimal Cut Sets. The Fault-Tree Handbook (NRC 1981) defines

minimal cut sets as a smallest combination of component failures which, if they occur, will cause the top event to occur . . . a minimal cut set is thus a combination (intersection) of primary events sufficient for the top event. The combination is a ‘smallest’ combination in that all the failures are needed for the top event to occur; if one of the failures in the cut set does not occur, then the top event will not occur (by this combination).

A fault tree consists of a number of minimal cut sets. Because a fault tree is merely a graphical represented of Boolean equations, it can be used to determine the minimal cut sets. Basic rules of Boolean expressions are shown in Table 5.4. Figure 5.17 shows a fault tree. Figure 5.18 shows its equivalent fault tree identified through minimal cut sets determination. The following text boxes show an example of the mathematical solution process for determining the minimal cut sets through the rules of Boolean algebra for the fault tree in Figure 5.17. Although this example shows a top-down substitution process, either a top-down or bottom-up approach can be used as long as the rules of Boolean algebra are properly adhered to. The first equation in the text box shows that the event T is equal to the multiplication of the probabilities of events E1 and E2 because of the presence of an AND gate. Further defining this fault tree, the probability of event E1 is the sum of the probabilities of basic event A and event E3 because there is an OR gate. Solving the rest of this branch, the probability of event E3 is the sum of the probabilities of the basic events B and C. Similarly, the probability of event E2 is equal to the sum of the probability of the basic event C and event E4. Finishing this disaggregation, the probability of event E4 is equal to the multiplication of the probabilities of basic events A and B.

90

Designation

These relationships are unnamed but are frequently useful in the reduction process.

Operations with f and V

de Morgan’s Theorem

Complementation

Low of Absorption

Idempotent Law

Distributive Law

Associative Law

Commutative Law

Source: NRC 1981. *The symbol I is often used instead of V to designate the Universal Set. In engineering notation V is often replaced by I and f by 0

(3b) X [ ðY \ ZÞ ¼ ðX [ YÞ \ ðX [ ZÞ (4a) X \ X ¼ X (4b) X [ X ¼ X (5a) X \ ðX [ YÞ ¼ X (5b) X [ ðX \ YÞ ¼ X (6a) X \ X 0 ¼ f (6b) X [ X 0 ¼ V ¼ I * (6c) ðX 0 Þ0 ¼ X (7a) ðX \ YÞ0 ¼ X 0 [ Y 0 (7b) ðX [ YÞ0 ¼ X 0 \ Y 0 (8a) f \ X ¼ f (8b) f [ X ¼ X (8c) V \ X ¼ X (8d) V [ X ¼ V (8e) f0 ¼ V (8f) V0 ¼ f (9a) X [ ðX 0 \ YÞ ¼ X [ Y (9b) X 0 \ ðX [ Y 0 Þ ¼ X 0 \ Y 0 ¼ ðX [ YÞ0

XY ¼ Y X XþY ¼Y þX XðY ZÞ ¼ ðXYÞZ XðYZÞ ¼ ðXYÞZ X þ ðY þ ZÞ ¼ ðX þ YÞ þ Z XðY þ ZÞ ¼ XY þ XZ XðY þ ZÞ ¼ XY þ XZ X þ Y Z ¼ ðX þ YÞðX þ ZÞ XX ¼ X XþX ¼X XðX þ YÞ ¼ X X þ XY ¼ X XX 0 ¼ f X þ X0 ¼ V ¼ I ðX 0 Þ0 ¼ X ðXYÞ0 ¼ X 0 þ Y 0 ðX þ YÞ0 ¼ X 0 Y 0 fX ¼ f fþX ¼X VX ¼ X VþX ¼V f0 ¼ V V0 ¼ f X þ X 0 Y ¼ X þ Y X 0 ðX þ Y 0 Þ ¼ X 0 Y 0 ¼ ðX þ YÞ0

Engineering Symbolism

09/18/2008

(2b) X [ ðY [ ZÞ þ ðX [ YÞ [ Z (3a) X \ ðY [ ZÞ ¼ ðX \ YÞ [ ðX \ ZÞ

(1a) X \ Y ¼ Y \ X (1b) X [ Y ¼ Y [ X (2a) X \ ðY \ ZÞ ¼ ðX \ YÞ \ Z

Mathematical Symbolism

TABLE 5.4 Rules of Boolean Algebra

E1E1C05_1 90

E1E1C05_1

09/18/2008

91

5.1

91

APPLICATION OF RISK ASSESSMENT METHODS

T

E1

A

E2

E3

B

C

C

E4

A

B

Figure 5.17 Example of a Fault Tree.

Boolean Equations from Figure 5.17 T ¼ E1E2 E1 ¼ A þ E3 E3 ¼ B þ C E2 ¼ C þ E4 E4 ¼ AB E2 can be expressed as: E2 ¼ C þ AB The next step in finding minimal cut sets is starting to put these pieces back together to form one equation that represents the entire fault tree. The following example was reproduced from the Fault-Tree Handbook (NRC 1981). As shown, the minimal cut sets of E2 are C and AB. In other words, the two ways to make system E2 fail are by either C failing or by E4 failing, which is equivalent to AB. As shown in Figure 5.17, B and C are minimal cut sets for E3. Three minimal cut sets A, B, and C are obtained by substituting into E1. The expression for T transforms as: T ¼ E1  E2 T ¼ ðA þ E3Þ  ðC þ E4Þ T ¼ ðA þ B þ CÞðC þ ABÞ

E1E1C05_1

09/18/2008

92

92

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

Now that there is one equation representing the entire system of failure options, the rules of Boolean algebra, as presented in Table 5.4, can be applied to simplify the failure mechanisms. 1. Multiplying the events within each set of parentheses gives the top expression in the text box. 2. To obtain the second expression, the Idempotent law (4a in Table 5.4) was used to reduce AAB to simply AB, reduce BAB to AB, and simplify CC to just C. 3. The Idempotent law was used again to reduce AB þ AB ¼ AB 4. To obtain expression 4, the Law of Absorption was used to reduce C þ CAB ¼ C. 5. The terms were rearranged. 6. The Law of Absorption was used to reduce C = CA = C. 7. C þ BC ¼ was reduced to just C using the law of absorption again.

Creating Minimal Cut Sets 1. 2. 3. 4. 5. 6. 7.

T T T T T T T

¼ AC þ AAB þ BC þ BAB þ CC þ CAB ¼ AC þ AB þ BC þ AB þ C þ CAB ¼ AC þ AB þ BC þ C þ ABC ¼ AC þ AB þ BC þ C ¼ C þ AC þ AB þ BC ¼ C þ BC þ AB ¼ C þ AB

T

A·B

C

A

B

Figure 5.18 Equivalent Fault-Tree Derived through Boolean Analysis.

E1E1C05_1

09/18/2008

93

5.1

APPLICATION OF RISK ASSESSMENT METHODS

93

Overall, there are many different ways to use Boolean algebra rules to simplify these expressions and find the easiest calculation of failure. Many of these applications require a bit of creativity and get easier with practice. The results of the solution is the equivalent to the fault tree shown in Figure 5.18. With two minimal cut sets, (1) C and (2) A and B, the top-level events occur if either C occurs or both A and B occur.

5.1.3 Weibull Hazards Model Example

The Weibull hazards model, as discussed in Chapter 4, provides a method to model the failure rate of a system with known failure data. Figure 5.19 shows an example of the percent failure found for inductive loop detectors (ILDs) and the percent failure as predicted by a calibrated Weibull distribution. As shown in the figure, the distribution peaks around the average failure rate of the device and then gradually decreases. To fit the Weibull distribution to a data set, the shape and scale parameters must be iteratively selected until the desired goodness of the fit is achieved. In some cases, the desired goodness of fit cannot be achieved after much iteration, indicating that the Weibull distribution is not the best model to predict the failure. In those cases, risk modelers should investigate the shape of the

Figure 5.19 Example of a Weibull Distribution.

E1E1C05_1

09/18/2008

94

94

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

failure data, identify anomalies such as multiple peaks, and experiment with different probabilistic distributions, such as Poisson or binomial. 5.2 APPLICATION OF EVACUATION MODELS AND TRAFFIC MODELS FOR RESPONSE PLANNING

Even with a comprehensive security plan in place, the chance remains for a deliberate attack on a transportation facility that may cripple evacuation mobility. Consequently, the security plan must include a response plan in case such an event ever occurs. These plans include immediate response to contain the impact, such as fire, chemical and nuclear containments, and medical attention. Evacuation of the victims from the affected site as well as atrisk populations near the site must be conducted efficiently. There have been numerous studies on evacuating at-risk populations during natural disasters, such as hurricane and floods.2 During Hurricane Katrina, the failure to use contra-flow to manage evacuation traffic volumes was one of many transportation problems (Litman 2006). U.S. public agencies subsequently developed evacuation plans for at-risk populations. These models may also be applied for planning evacuations due to security incidents. A systematic approach for evacuation planning will ensure the systematic and safe evacuation of at-risk populations in the shortest possible time. Figure 5.20 shows a systemic approach for planning such evacuations. This approach is applicable to planning for any evacuation, due to either natural disaster or man-made threat. As shown in Figure 5.20, the first task includes identifying at-risk areas. These areas can be determined by identifying possible terrorist targets and the areas that will be impacted by an attack. The estimation of the evacuation demand includes determining the at-risk population, the participation rate, the evacuation route, and the traffic distribution over time. The at-risk population and vehicle ownership can be determined by applying the United States Census data of the selected evacuating cities. A growth factor can be applied to each of these values to account for the population growth and urban development between the census and planning years. In an example scenario presented in the following discussion, travel demand was calculated by multiplying the at-risk population by the participation rate for hurricane evaluation planning in Charleston, South Carolina. Based on the findings of prior hurricane evacuations (USACE 2007), this case study assumed that all residents of storm surge areas and mobile homes evacuated and that evacuees used 65.75% of the vehicles available in each household. The evacuating volumes were determined using equation 5.6.

2

Chien and Opie 2006, Wolshon 2001, Tuydes and Ziliaskopoulos 2006; Theodoulou 2001.

E1E1C05_1

09/18/2008

95

5.2

95

APPLICATION OF EVACUATION MODELS AND TRAFFIC MODELS

Determine at-risk areas

Identify evacuation demand

Select evacuation strategies

Develop, calibrate, and validate model Configure network for different evacuation strategy simulation Run simulations for evacuation scenarios Analyze simulation results

Figure 5.20 Scene Response Planning Using Simulation.

 Volume ¼

 Average Vehicles  ð# HouseholdsÞ ðGrowth FactorÞ Househould ð5:6Þ

Evacuation strategies may include operational traffic plans, evacuation of the elderly and the sick, and the use of high-occupancy and emergency vehicles. To determine the distribution of evacuees over time, the behavioral curves, such as those developed by U.S. Army Corps of Engineers (2003) can be used to represent rapid, medium, and long responses to the evacuation order. An illustrative case study of a hurricane evacuation plan for South Carolina is presented in Figure 5.21. (The official South Carolina plan was modified in this case study to include a connector, as illustrated by the bold solid line.) These freeway operation strategies were combined with different response times and number of lanes contra-flowed to speed the evacuation. 

The existing geometry shown as dots in Figure 5.21, was considered to be used during the existing SCDOT evacuation plan and included a configuration to contra-flow inbound lanes.

Figure 5.21 Contra-flow Case Study. (Source: SCDOT 2006.)

E1E1C05_1 09/18/2008

96

96

E1E1C05_1

09/18/2008

97

5.2

APPLICATION OF EVACUATION MODELS AND TRAFFIC MODELS

97

Scenarios Tested

Existing Geometry

Proposed Connector

Do Nothing

3 Lanes

2 Lanes

3 Lanes

2 Lanes

3 Lanes

2 Lanes

3 Lanes

2 Lanes

3 Lanes

2 Lanes

D

E

F

G

H

I

J

K

L

Long Response

2 Lanes

C

Medium Response

3 Lanes

B

Rapid Response

Long Response

Medium Response

Rapid Response

Long Response

Medium Response

Rapid Response A

M

N

O

Figure 5.22 Alternatives for Simulation Analysis.





The proposed connector scenario includes the vehicle flow paths from the existing scenario (dots) and includes an additional path (bold solid line) to increase the use of contra-flowed lanes. The do-nothing scenario evaluated evacuation operations using only normal freeway operations; therefore, no contra-flow was evaluated.

The simulation portion of the planning process includes developing the simulation model with traffic and geometric data, followed by calibrating and validating the simulation model for the local conditions so that the simulation models closely mimic the real world transportation network. Fifteen scenarios were simulated to determine the results of these different combinations of evacuation response and management, as illustrated in Figure 5.22. Since a description of the combination of highway geometry used, evacuee response time (long, medium, and rapid), and number of lanes used for contra-flow would be lengthy, the letter below each scenario in Figure 5.22 will be used to reference each scenario. Figure 5.23 was generated using the values from the simulation runs. As shown in the figure, the results include the evacuation duration and travel times for 15 different evacuation scenarios, categorized by the anticipated evacuee response. The results of this research suggested the any contra-flow scenario produces both shorter average vehicular travel times and evacuation

09/18/2008

98

98

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

19:12

Evacuation Duration (Hr:Min)

16:48 14:24 12:00 9:36 7:12 4:48 2:24 0:00 O

F

L K Long

E

N

D

J C I M Medium Evacuation Scenario

B

H A Rapid

B

H A Rapid

G

6 5 Travel Time (hr)

E1E1C05_1

4 3 2 1 0 O

F

L K Long

E

N

D

J C Medium

I

M

Evacuation Scenario

Figure 5.23 Results from Simulation Modeling.

G

E1E1C05_1

09/18/2008

99

REFERENCES

99

durations. In this case study, evacuation and travel time were chosen as measures of effectiveness. Any other measures of effectiveness, such as delay per vehicle or delay to nonevacuation routes, can also be selected based on the analysis objectives

5.3 APPLICATION OF OTHER METHODS

In addition to the tools described in this chapter, several other methods (e.g., the Monte Carlo analysis presented in Chapter 4) can help in assessment of security risks for existing transportation infrastructure. Other methods also can be considered for risk assessment to create appropriate mitigating measures. For further study, the reader may consult the references listed in this chapter and in Chapter 4 detailing current risk assessment methods.

REFERENCES AASHTO. 2002. ‘‘A Guide to Highway Vulnerability Assessment for Critical Asset Identification and Protection.’’ Prepared by SAIC. Washington, DC. Audigier, M. A., Kiremidjian, A. S. Chiu, S. S. and King. S. A. 2000. ‘‘Risk Analysis of Port Facilities.’’ Proceedings of the 12th World Conference on Earthquake Engineering, paper no. 2311. Babaei, K., and Hawkins. N. 1993. ‘‘Bridge Seismic Retrofit Planning Program.’’ Report WARD 217.1, Washington State Department of Transportation, Olympia, WA. Basoz, N., and Kiremidjian. A. S. 1995. ‘‘Prioritization of Bridges for Seismic Retrofitting.’’ Report No. 114, John Blume Earthquake Engineering Center, Department of Civil Engineering, Stanford University, Stanford, CA. Blue Ribbon Panel on Bridge and Transit Security. 2003. Recommendation for Bridge and Tunnel Security, FHWA/AASHTO, September. Chien, S. I.-J. and Opie. K. 2006. ‘‘Analysis and Modeling of Cape May County Roadway Elevations and Evacuation Routes.’’ Final Report for the New Jersey DOT Bureau of Research, FHWA-NJ-2005.022, May. Goicoechea, A., Hansen, D. R. and Duckestein. L. (1982). Multiobjective Decision Analysis With Engineering and Business Applications. New York: John Wiley & Sons. Hart Consultant Group et al. 1994. ‘‘Seismic Risk Decision Analysis for Kaiser Permanente Pasadena.’’ Final Project Report, Santa Monica, CA. Kim, S. H. 1993. A GIS-Based Risk Analysis Approach for Bridges against Natural Hazards. Ph.D. dissertation, Department of Civil Engineering, State University of New York, Buffalo, NY. King, S. A., and Kiremidjian.A. S. 1994. ‘‘Regional Seismic Hazard and Risk Analysis Through Geographic Information Systems. Report No. 111, John Blume Earthquake Engineering Center, Department of Civil Engineering, Stanford University, Stanford, CA.

E1E1C05_1

09/18/2008

100

100

APPLICATION OF RISK ASSESSMENT AND MANAGEMENT TOOLS

Litman, T. 2006. ‘‘Lessons from Katrina and Rita: What Major Disasters Can Teach Transportation Planners,’’ ASCE Journal of Transportation Engineering 132 (January): 11–18. Maroney, B. 1990. ‘‘CALTRANS Seismic Risk Algorithm for Bridge Structures. Division of Structures California Department of Transportation, Sacramento, CA. Nuclear Regulatory Commission. 1981. Fault-Tree Handbook. Available online at www .nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0492/#pub-info. Saaty, T. L. 1980. The Analytic Hierarchy Process. New York: McGraw-Hill. Sheng, L. H., and Gilbert.A. 1991. ‘‘California Department of Transportation Seismic Retrofit Program: The Prioritization and Screening Process,’’ Proceedings of the Third U.S. National Conference on Lifeline Earthquake Engineering, 1110–1119. South Carolina Department of Transportation. (2006). ‘‘South Carolina Hurricane Evacuation Plan’’. Theodoulou, G. (2001). ‘‘Contraflow Evacuation on the Westbound I-10 Out of the City of New Orleans’’ MS Thesis, Louisiana State University and Agricultural and Mechanical College, Baton Rouge, Louisiana. Tuydes, H., and Ziliaskopoulos.A. 2006. ‘‘A Tabu-Based Heuristic Approach for the Optimization of Network Evacuation Contraflow,’’Proceedings of the Transportation Research Board Annual Meeting, National Research Council. United States Army Corps of Engineers. (2003). ‘‘Delmarva Hurricane Evacuation Study’’. Prepared for the U.S. Army Corps of Engineers, Philadelphia Division. Available at www.nap.usace.army.mil/HES/Delmarva/index.html. Accessed October 20, 2007. United States Army Corps of Engineers. (2007). ‘‘BEHAVORIAL Data collected for Hurricane Evacuation Studies’’. Available online chps.sam.usace.army.mil/USHESdata/ Behave_Start_Frame.htm. Accessed February, 2007. U.S. Department of Justice. 2000. Fiscal Year 1999 State Domestic Preparedness Support Program. Washington, DC. Wolshon, B. 2001. ‘‘One Way Out,’’ Natural Hazards Review 6, no. 3 (August). 105–112.

REVIEW QUESTIONS

1. Show an application of the Blue Ribbon Panel method for security risk assessment for a critical transportation infrastructure in your region. 2. Develop a fault-tree model for analyzing the failure risk of a highway tunnel. 3. If researchers have found that the average life span of a particular type of fiber optic line is 20 years and that the Weibull distribution with l = 23 and k = 1.2 fits the observed failure rates best, find the probability that this type of line will fail at five years. 4. Describe how simulation can be applied for planning for incident response and evacuating at-risk populations. 5. Find the probability of failure for the top event in the following fault tree.

E1E1C05_1

09/18/2008

101

REVIEW QUESTIONS

101

Primary Event

E1

A, P=0.001

E2

E3

A, P=0.001

B, P=0.005

C, P=0.03

E4

A, P=0.001

B, P=0.005

6. Find the minimal cut sets for the fault tree shown in question 5.

E1E1C06_1

09/18/2008

102

CHAPTER 6

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

A

s communications between centers, devices, vehicles, and travelers are the foundation of intelligent transportation systems (ITS), an understanding of computer networking is important for professionals working in this area. This chapter provides an overview of the major elements for securing these networks from both unintentional and deliberate attacks, where an attacker attempts either to gain unauthorized information and control or to disrupt network services. It is important to secure ITS elements from attacks, unintentional as well as deliberate, so that no disruption of services is experienced. This is especially true regarding security-related services, such as surveillance, detection, and response. Securing the ITS network is the foundation for providing reliable security services. This chapter discusses the fundamentals of computer network security for a secure ITS network. 6.1 INTRODUCTION

There are many books on computer security. However, from the viewpoint of ITS professionals, they appear to be written by security experts for security experts. Such books tend to have detailed explanations of security protocols and encryption systems (e.g., the Rivest, Shamir and Adleman [RSA] algorithm, which is used for encryption of messages for secured communication between a sender and a receiver), or they focus on the details for building secure operating system kernels or databases. The references section of this chapter lists some recommended texts on these and other computer network security topics; Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

102

E1E1C06_1

09/18/2008

103

6.2

ELEMENTS OF COMPUTER NETWORK SECURITY

103

however, because most transportation professionals are not security experts, these books will not be of much assistance to them without background information as it applies to ITS. There exist even fewer references to turn to for help with understanding and using secure computer network systems as they apply to ITS. This chapter explains the fundamental elements of a secure system and how to use such a system to protect your security objectives. Computer network security is presented from the viewpoint of security policy. Because a security policy is a set of rules that govern the security of a system or network, this chapter focuses on what secure systems can allow or forbid, not on the mechanisms that enforce the policy. 6.2 ELEMENTS OF COMPUTER NETWORK SECURITY

Security is an essential part of any computer network. Computers have become more important than ever, primarily because of their ability to network with one another. In the past, isolated systems were easier to secure since they did not have many interfaces outside of a private network. Today’s networking capability enables sharing information and having interoperable systems, but it also introduces vulnerabilities. The computer network security can be organized into two categories, as shown in Figure 6.1. The two areas are (1) computer system security, which includes both source and destination computers and encompasses the physical asset (the computer), operating systems, databases, and software in the computer; and (2) communication security, which encompasses security of the physical links as well as the protocols used to transport information between the source and destination computers. A deliberate attack can alter, compromise, or damage the operating systems, databases, and programs in host computers to disrupt their functionalities.

Computer Network Security

Computer System Security (Source and Destination) Hardware Operating Systems Databases Programs

Communication Security Network Communication Links Transportation Protocols

Figure 6.1 Computer Network Security Elements.

E1E1C06_1

09/18/2008

104

104

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

Attackers can also access critical information, such as databases with sensitive personal information. Similarly, the threat can be on the communication link to access information in transit or disrupt services through interruption. 6.3 IMPORTANCE OF COMPUTER NETWORK SECURITY

Every part of the world has experienced attacks against computer networks. For example, the Slammer worm in 2003, CodeRed in 2001, and the Melissa Virus in 1999 crippled computer networks worldwide for significant amounts of time, resulting in economic and other losses (Kurose et al. 2003). Attacks on computer networks can cause disruptions that result in significant harm to the services provided by a public or a private agency. To safe guard against the potential harm caused by these attacks, public and private organizations have invested a significant amount of their budgets in establishing and operating secured computer networks. With the increased functionality and coverage of the computer networks connected by the Internet, computer crimes have been on the rise. One problem with computer crimes is that it is difficult to identify the perpetrators, who may live anywhere in the world. Furthermore, it is not easy to prosecute computer crime perpetrators (Pfleeger et al. 2003). Supervisory control and data acquisition (SCADA) systems, those monitoring processes and autonomously making needed adjustments, are also vulnerable to network security threats. Although in SCADA and other control systems, security threats were previously managed by operating off-line, the control industry now relies on an increasing number of on-line systems, such as seen in most ITS applications (Wiberg 2006). It is critical to secure SCADA systems, particularly those operating critical transportation infrastructure. 6.4 APPROACH TO COMPUTER NETWORK SECURITY

Computer network security must be addressed in a systematic manner, similar to the security plan for the transportation infrastructure (see Chapter 9). Current situations must be analyzed, and all possible vulnerabilities in the network must be identified. Then, precautions must be taken against possible attacks on critical systems, and recovery plans must be in place in case of an attack. Because mitigating all vulnerabilities is cost-prohibitive, a selection process should be used to rank and choose which systems and vulnerabilities are critical. A computer network security plan must address seven elements (Pfleeger et al. 2003): 1. Policy. 2. Current state. 3. Security requirements.

E1E1C06_1

09/18/2008

105

6.4

4. 5. 6. 7.

APPROACH TO COMPUTER NETWORK SECURITY

105

Recommended controls. Accountability. Timetable. Continuing attention.

A computer network security plan for ITS should be developed using these seven elements, as described in the next sections.

6.4.1 Policy

Policy is at the heart of network security. A secure system is one that enforces a comprehensive policy. Without a policy, security is a rather nebulous concept. Policy describes which system and user actions are allowed and which ones are forbidden. Policy also describes the actions a system must perform and when it performs them. Policy rule statements contain subjects, actions, and objects. For example, a policy rule could be: Each system user must change his or her password every 90 days. The subject is the system user; the action is to change; and the password is the object that the subject is allowed to act on. Policy can also be conditional, for example: Between the hours of 6 A.M. and 10 A.M., the reversible lane gates shall be down in the southern direction of traffic flow. In this example, the condition of between the hours of 6 A.M. and 10 A.M. governs when the gates should be down. If the condition is true, then the policy is enforced; otherwise, it is not. Security systems usually identify subjects using the concept of credentials. The security system cannot control what a subject does; it can control only whether it will allow the subject to take actions. The policy governs what the system will or will not do for each subject. In order to enforce the policy, the system has to be able to distinguish between different subjects and make judgments about them. The system requires security attributes that fall into two categories: identities and privileges. Identity attributes are solely for individual subjects; privileges can be shared by many subjects. Credentials are collections of subject security attributes. The security system may need to use some or all of these attributes when making policy decisions. Policies can be regional in nature and also system specific. For a regional ITS computer network security policy, overarching security rules must be clearly documented. The regional security policy document should include:  



Regional ITS stakeholders’ goals for computer network security Responsible stakeholders and responsible persons within each stakeholder group A commitment from each stakeholder for security, including each person’s role(s) for upholding computer security in business practices (Pfleeger et al. 2003)

E1E1C06_1

09/18/2008

106

106

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

System-specific security policies must require that subjects provide some sort of authentication data (e.g., a password or retinal scan) to identify themselves. Once authenticated, subjects can be given certain privileges based on their credentials. Access control policy does not scale well if each subject is given a different set of privileges; therefore, many security systems use collective privileges (i.e., accountants and engineers) that reduce the number of rules to a more manageable set based on the subject’s role. Overall, the policy document should identify: 



Authorized personnel (subjects) to access the computer network (actions) and what resources (objects) each of these people can access and under what conditions Types of access (i.e., full or restricted access to all or part of the resources) to the computer network by authorized personnel

Policy should take into account the threat of playback from a packet sniffer. Packet sniffers can be a combination of hardware and software that intercepts message traffic passing through a network. As the data flows through the network, the packet sniffer collects each packet of data and can eventually decode its content. It is also possible that the same stream of packet data can be reintroduced into the network called playback. 6.4.2 Current State

The security plan should include a description of the existing security status, including the vulnerabilities and the risks of a successful attack due to these vulnerabilities. The plan identifies computer network assets, risks of those assets being attacked, a protection plan for resisting and detecting those attacks, and a response plan for when an attack occurs (Pfleeger et al. 2003). 6.4.3 Security Requirements

The security requirements specify functional requirements to meet the security goals identified in the security policy. Table 6.1 presents security requirements. 6.4.4 Recommended Controls

The recommended controls step of the security plan specifies the measures to be implemented. It identifies the planning, design, and development approaches to meet the security requirements identified in the preceding step. For example, it could specify the specific access control mechanisms (i.e., passwords and their characteristics), data encryption techniques, virus protection, specific firewall configurations, and auditing.

E1E1C06_1

09/18/2008

107

6.4

APPROACH TO COMPUTER NETWORK SECURITY

107

TABLE 6.1 Security Requirement Characteristics General Requirement Characteristics Correctness Consistency Completeness Realism Need Verifiability

Traceability Privacy Non-repudiation Access control

What It Means Requirements are error free and understandable. Requirements are not conflicting or ambiguous. Requirements include all possible scenarios. Requirements can be implemented. Requirements are not unnecessarily restrictive. Tests plans can be developed to evaluate conclusively and objectively whether the requirements are met and at what degree. Each requirement can be traced back to the functions and data related to it. Requirements do not violate federal, state, local, or company privacy policies. Requirements ensure integrity and traceability to the sender. Requirements allow only appropriate persons and systems access at allowable times.

Source: Pfleeger et al. 2003.

‘‘Recommended Security Controls for Federal Information Systems,’’ a publication of the National Institute of Standards and Technology (NIST), presents a detailed list of recommended control measures for computer systems. NIST grouped the controls in the three general categories: access control, awareness and training, and physical and environmental protection. A complete list of these controls and their description as presented in Ross et al. 2007 can be found at http://csrc.nist.gov/publications/PubsSPs.html. 6.4.5 Accountability

The security plan assigns responsibilities of each party involved in computer network security. For example, in a transportation management center, the database administrator may be responsible for availability and access to the database; human resources staff may be responsible for screening potential staff for security and for providing or arranging security-related training of the employees. 6.4.6 Timetable

The security plan must identify a phased implementation schedule of the recommended countermeasures or mechanisms to address the identified vulnerabilities. This schedule also can be used to evaluate the implementation progress of the security plan. The recommended countermeasures should be

E1E1C06_1

09/18/2008

108

108

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

scheduled based on their prioritization in terms of risks of an attack due to the identified vulnerabilities. Benefit-cost analysis and other tools might aid in the prioritization of these items. This timetable should be a strategic and living document; for example, it should be able to adapt when a new threat is identified or when new tools become available to minimize identified vulnerabilities. Today some agencies are facing the challenge of addressing security in existing computer networks; it is always better to implement security mechanisms when the system is first deployed. 6.4.7 Continuing Attention

As previously stated, the security plan is a living document. The plan should be evaluated periodically to identify its current effectiveness and to determine if changes are needed. The security plan may need to be revised based on new threats, technologies, and/or priorities. Proactive agencies may want to test their security plans. Employing external personnel to conduct a penetration test of their computer network can provide valuable information about network strengths and weaknesses. Identifying weaknesses through a benign attack such as a penetration test can prove less costly than identifying those weaknesses after a true network security breach. 6.5 COMPUTER NETWORK SECURITY IN ITS

Computer network security is an important part of securing the ITS infrastructure so its functionalities are not compromised or halted. As shown in Figure 6.2, an ITS computer network includes computer systems at centers (e.g., traffic management and emergency management centers), computers in vehicles, computers in conjunction with roadside devices such as automated toll tag readers and traffic sensors, and computers used by travelers to access transport information, all of which are vulnerable to deliberate attacks. Similarly, these centers, roadside devices, vehicles, and travelers communicate with wireline and/or wireless media. Communication networks connecting these different ITS services at different locations are also vulnerable to deliberate attacks. The communication links between these systems must be evaluated for potential security threats. Chapter 7 discusses leveraging the National ITS Architecture to help quantify the threats to the flow of information and to the systems themselves. 6.6 NETWORK SECURITY OBJECTIVES

Each computer network should be planned, designed, operated, and maintained with specific security objectives. Confidentiality, integrity, and availability are three primary security objectives for ITS. Consequently, the security

E1E1C06_1

09/18/2008

109

6.6

NETWORK SECURITY OBJECTIVES

Computer System

Computer System

Center

Center

Center

Field

Center

109

Traveler Communication Media

Center

Vehicle

Field

Field

Field

Vehicle

Vehicle

Vehicle

Figure 6.2 Computer Network in ITS.

component of the National ITS Architecture was evaluated in terms of meeting these three objectives Chapter 7 discusses securing ITS in detail. However, authentication, nonrepudiation, and access control are related security objectives that that can overlap with the three objectives considered in the National ITS Architecture. The next sections discuss the computer network for these five security objectives: 1. 2. 3. 4. 5.

Confidentiality. Authentication. Message integrity and nonrepudiation. Availability. Access control.

6.6.1 Confidentiality

Confidentiality is an important part of computer network security. The security objectives related to confidentiality include the concept that only the receiver can understand the messages transmitted by the sender and vice versa. Encryption and decryption are widely used tools for encoding and decoding messages, so that unintended persons cannot understand the transmitted

E1E1C06_1

09/18/2008

110

110

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

encrypted, or ‘‘coded,’’ information. Thus, if unauthorized persons stole coded information from the computer network during transmission, they would learn nothing as the information was transmitted in a coded form; that is, unless the attackers can decode the encryption. In ITS, confidentiality must be maintained when critical information or control is being exchanged between ITS elements, such as between a traffic management center and a law enforcement agency about a potential threat or between a financial institution and a toll collection system regarding toll transactions. Cryptographic techniques are employed to encrypt and decrypt information within systems as well as data exchanged between computer systems. Two common terms associated with encryption and decryption are plaintext and ciphertext. Plaintext is defined as the original message; ciphertext is the encrypted message. A string of numbers or characters—a key—is used to encode or decode the messages. There are two types of key systems: 1. Sender and receiver both know the key. 2. A public key and a private key are utilized. In the first key system, both the sender and the receiver know a secret key (symmetrical key systems). The only proven early unbreakable cipher is the one-time pad. This system, developed in the mid-twentieth century, was used by spies of several nationalities who were given a pad of paper containing a randomly chosen secret key and told that it could be used for one encipherment only (Simmons 1992). The primary problem with this approach is that both the sender and the receiver must somehow obtain the secret key. This problem has led to the development of a key system that allows for secure systems to be built that require no secure transfer of any secret key. In an asymmetric key system, a pair of keys are used. One key, the public key, is available publicly; the secret key known only to the receiver or the sender is called a private key. Figure 6.3 shows the basic concepts of the encryption and decryption technique. A key to encrypt the plaintext into ciphertext using an encryption algorithm, and another key is used by the receiver to decode the system using a decryption algorithm. In symmetrical key systems, these two keys are identical and known only by the sender and the receiver. In public key systems, one key is known to both the sender and the receiver and the other, a private key, is known only by the sender or the receiver.

Plaintext

Plaintext

Ciphertext

Encryption Algorithm

Decryption Algorithm

Figure 6.3 Concept of Encryption and Decryption.

E1E1C06_1

09/18/2008

111

6.6

NETWORK SECURITY OBJECTIVES

111

Different encryption and decryption methods, such as the RSA algorithm, elliptical curve cryptography (ECC), Secure Shell (Version 1 and 2), Secure Socket Layer, and Transport Layer Security have been developed so that senders can encode information and receivers can decode information (Kurose and Ross 2005). Of these methods, the RSA algorithm has been the most widely used in the area of public key cryptography (Kurose and Ross 2005). As computing power increases, the most secure encryption/decryption algorithm and method changes as well. In the 1970s, for example, the U.S. government chose the Data Encryption Standard (DES) as a U.S. Federal Information Processing Standard (FIPS PUB 46). In May 2005, the DES FIPS 46.36 standard was officially withdrawn due in part to its small key size, but the NIST has approved Triple DES (three separate rounds of applying the DES) through the year 2030 for sensitive government information (NIST 2006). The Advanced Encryption Standard (AES) is a cipher adopted as an encryption standard by the U.S. government in May 2002. Like its predecessor, DES, AES has been analyzed extensively and is now used worldwide. AES was announced by NIST as U.S. FIPS PUB 197 in November 2001 after a five-year standardization process. As of 2006, AES was one of the most popular algorithms used in symmetric key cryptography. It is available by choice in many different encryption packages (Wikipedia, AES). A simple example of the application of RSA algorithm follows. In order to understand its depth and breadth, readers are encouraged to consult Simmons (1992) and other works on encryption and decryption in computer network security. For using RSA, two large prime numbers p and q are chosen. The larger these values are, the more difficult it is to decode by an unauthorized person (Kurose and Ross 2005). For simplicity in the following example, we choose p ¼ 3 and q ¼ 11 and encode the word ‘‘go’’. The following steps are taken to encode (by the sender) and decode (by the receiver) the message (Kurose and Ross 2005): 1. Choose values for p and q such that they are both prime. The larger these numbers are, the more difficult it will be for unauthorized persons to decode the message and the more computationally complex it will also be on the network. In this example, we will use p ¼ 3 and q ¼ 11. 2. Next, find the variables n and z. n is the product of p and q, and z is the product of 1 less than each p and q, respectively. In this example, n ¼ p  q ¼ 3  11 ¼ 33 and z ¼ ð p  1Þ  ðq  1Þ ¼ ð3  1Þ  ð11  1Þ ¼ 2  10 ¼ 20. 3. Use the z-variable to select another variable, e, such that it and z have no common factors. In this example, we choose e ¼ 3, since 3 and 20 have no common factors. 4. Select another variable, d, such that e  d  1 is evenly divisible by z. For the example, we select d ¼ 7, since 3  7  1 (i.e. e  d  1) is exactly divisible by 20.

E1E1C06_1

09/18/2008

112

112

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

5. The receiver makes the two values public, n and e, and keeps the value of d secret. The pair made public is called the K þ B pair and is written (n, e). The pair is used for the message encryption into ciphertext. The secret Kþ B number is also paired with n and is called the K  B pair. In this example, the  Kþ pair is (33, 3) and the K pair is (33, 7). B B 6. Use these variables to encrypt or decrypt a message. In encryption terminology, the plaintext is encrypted into ciphertext or the ciphertext is decrypted into plaintext. In this example, we will encrypt and decrypt the message ‘‘GO.’’ To convert alphabetical messages into a numeric representation, label each character as its corresponding numeric place in the alphabet. For example, the letter a is 1 and the letter b corresponds to 2. 7. The public key is (n, e), which the sender makes known to everyone, and the private key (n, d), is only known to the sender. Here are the equations for encryption and descriptions (Kurose et al. 2005): C ¼ Me MOD n M ¼ Cd MOD n If the sender sends a bit pattern, or number m where m is less than n, he or she encodes using the public key (n, e) and the equation for ciphertext c ¼ me mod n. This process converts plaintext into ciphertext; see Table 6.2. The receiver decrypts the ciphertext, c, to find m with the following equation using the private key (n, d) and the equation m ¼ cd mod n. The results of this process are displayed in Table 6.3. 6.6.2 Authentication

Authentication for a computer network is a process of proving the sender’s identity. There are different types of user authentication mechanisms from three sources: user knowledge, user possessions, and user physical characteristics (Pfleeger et al. 2003). User knowledge authentications are popular for banking and other transactions where users are asked to enter a personal identification number (PIN) or password. User possessions can include identification cards and keys. User physical characteristics can include retinal scans or fingerprints, which are known as biometrics. TABLE 6.2 Sender’s RSA encryption using the K þ B pair, e ¼ 3, n ¼ 33 Plaintext Letter g o

m: numeric representation

me

ciphertext c ¼ me mod n

7 15

343 3375

13 9

E1E1C06_1

09/18/2008

113

6.6

NETWORK SECURITY OBJECTIVES

113

TABLE 6.3 Receiver’s RSA decryption using the K  B pair, d ¼ 7, n ¼ 33 Ciphertext c 13 9

c

d

m ¼ cd mod n

Plaintext Letter

7 15

g o

62748517 4782969

The successful authentication process prevents someone with bad intentions from establishing a false identity. However, the authentication process can be quite complex and requires careful consideration of all possible ways an unauthorized user may try to establish a false identity to receive information or attack the computer network. For example, in a common scenario, the system identifies a sender through his or her Internet Protocol (IP) address. Reliance on only an IP address for authentication may pose a risk that a potential unauthorized system is spoofing the network. Spoofing is replacing the IP source address of the packet sent, in order to subject the system to an attack and hide the true source of the attack. A sender’s unique password could be a better way to authenticate him or her; however, it must be encrypted so that a potential attacker is not able to access the password during communication between the sender and the receiver. A more secure authentication protocol may require using private and public keys, as done in the encrypting and decrypting a message. Although the authentication process can be quite complex, it is necessary to ensure that only the correct personnel are allowed access to the computer network. 6.6.3 Message Integrity and Nonrepudiation

Message integrity means that the original message has not been changed during communication. Nonrepudiation refers to the fact that the message or information sent by a person must be able to be traced back to that person. For example, an incident event notification sent from a traffic management center to an emergency management center over the Internet must satisfy two requirements: 1. It must not be changed in its content, format, or any other original features (message integrity). 2. It must be traceable to the sender (non-repudiation). Both of these objectives could be accomplished by a digital signature, which is a form of cryptographic technique. Digital signatures include use of private and public keys to ensure that the document that was received was not altered in any way and is traceable to the actual sender. Digital signature schemes normally use two algorithms, one for signing, which involves the user’s secret

E1E1C06_1

09/18/2008

114

114

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

key, and one for verifying signatures, which involves the user’s public key acting much like an actual signature on paper. 6.6.4 Availability

Availability ensures that the system is available to authorized users. Over the past several years, computer networks all over the world have been attacked to disrupt availability or service. Such an attack is known as denial of service (DoS). In addition to intentional attacks, unpredictable events, such as transmission failure, may result in DoS. Enterprises that depend significantly on a computer network to perform business and provide services suffer significant economic losses due to a DoS event. Transmission failure is a common DoS incident experienced by computer networks around the world. Some reasons for transmission failure include (Pfleeger et al. 2003):  





Transmission line is cut accidentally or deliberately. Network noise corrupts transmission packets, so the communication message could not be recognized or delivered. Hardware or software failure makes a transmission sender or receiver system fail. A device is saturated with data; incoming data are rejected until overloading of the device is cleared.

As can be seen, some of these attacks are physical in nature, such as the intentional cutting of transmission lines. However, some are electronic, such as connection flooding. In connection flooding, attackers send huge amounts of data through the network to oversaturate it; their aim is either to prevent other users from accessing the network or to significantly degrade the performance of the attacked network (Pfleeger et al. 2003). Some of these problems can be solved easily; however, others require replacement of the devices or communication lines. For example, the entire communication line may have to be replaced to restore services after a transmission line is cut. Redundancy of ITS devices or communication networks will improve system availability and reduce the risks of DoS under both accidental events and intentional attacks. For example, if a transmission line is cut, another redundant line can provide the function without any disruption of services. However, the cost of providing this redundancy may prevent its adoption. Selection of a distributed system architecture for ITS may also contribute to the increase in availability. For example, a distributed sensor network for ITS, where a cluster of sensors process data locally and send the processed data to the network’s cluster controllers, may reduce the risk of a single point of failure. Centralized control, where each sensor continuously sends data back to a single transportation management center increases the risk of a single point failure.

E1E1C06_1

09/18/2008

115

6.6

NETWORK SECURITY OBJECTIVES

115

In a centralized architecture, the operation of the entire highway system network may fail due to the failure of the central computer system at a transportation management center or be significantly impaired by the disabling of a fiber optic trunkline. Wireless communication is receiving significant attention for connecting ITS centers, devices, and vehicles for data exchange and control functions. Among a multitude of challenges in wireless communications, security has been one of the utmost concerns. For example, while Radio Frequency Identification Devices (RFID) are used in automated toll collection and other applications in ITS for automated wireless electronic identifications, it proves challenging in authentication and mitigating other security threats. Even advanced technologies, such as the Digital Signature Transponder (DST), which have used Advanced Encryption Standard (AES) and special cryptographic keys, have shown to be vulnerable to attacks (Brooks et al. 2008). It suggests that selection of specific technology in ITS for its security features will be as important as it functionality for many applications. Existing wireless ITS applications have broadly utilized cell phone infrastructure or Wi-Fi technologies. However, with the future potentials in WiMAX and 4G technologies, many ITS applications will adopt these systems for their potential broad coverage area and performance. Yet reliability of wireless communication systems remains an issue because of different environmental conditions and security threats. With new generation of ITS applications, such as vehicle-infrastructure integration, where vehicle-tovehicle (V2V) and vehicle-to-roadside (V2R) communications are needed, Vehicle Ad Hoc Networks (VANets) have been proposed in addition to other options, including WiFi and WiMAX. These systems can assist in vehicle collision avoidance and real–time traffic management through information dissemination and control. V2V or V2R networks may be vulnerable to terrorist attacks trying to cause harm in the traffic management and safety functions. Wireless communications will be an integral part of most future ITS applications so will be its security. Resources such as the Propagation Handbook for Wireless Communication System Design (Crane 2003) and the U.S. Center for Wireless Communications (USCWC, Stanford, California)1 can provide support to wireless communication network designers. ITS professionals should evaluate the reliability of any communication network, wireless or wireline, under different operational and environmental situations in order to assess its overall availability. Brooks et al., recently completed a survey on the challenges of state-of-the-art automotive system security that provides many insights on future wireless communications security for the transportation system (Brooks et al. 2008).

1

U.S. Center for Wireless Communications, P.O.Box 19789, STANFORD, CA 94309, USA.

09/18/2008

116

6.6 NETWORK SECURITY OBJECTIVES

116

6.6.5 Access Control

Access control refers to the objective for a computer network to allow access only to authorized users. Unauthorized access to a computer network can impact confidentiality, message integrity, nonrepudiation, and availability. A computer firewall is a method or device that regulates the level of trust between two or more networks. A firewall is usually a combination of hardware and software, and it is a widely used technique to protect a network from the Internet as well as regulate the traffic between networks within the same company. A firewall separates an enterprise’s internal computer network from the outside Internet to restrict access of packets of data. Packets that are not considered to be security threats are allowed to pass while the others have no access to the internal network (Kurose and Ross et al. 2003). A firewall should be required by all ITS centers, restricting unauthorized access to a center or agency’s internal network and permitting authorized access based on the security policy. As shown in Figure 6.4, a typical network would have one or more firewall servers on the network to regulate data traffic between computers on the network and the Internet. It could also regulate the data traffic between the computers on the network. The firewall box represents the filtering of all communication passing through the firewall. The firewall is then able to ensure that only authorized packets are allowed. Authorized packets are defined by packet-filtering rules that indicate which packets should be accepted and which packets should be denied. Further, packets can be inspected for tampering, called packet sniffing, to ensure the original message is intact. In this application, for example, if an untrusted server has previously flooded an ITS network with data, then a rule could be placed that blocks all incoming email from that host. There are also more complex types of firewalls called Guard, Application Proxy and Stateful Inspection Firewall for improved access control (Anderson 2001, Pfleeger et al. 2003). Computer on the Network … Computer on the Network

Firewall

E1E1C06_1

Internet

Firewall Server

Figure 6.4 A Firewall for a Computer Network.

E1E1C06_1

09/18/2008

117

REFERENCES

117

6.7 FUTURE OF NETWORK SECURITY AND ITS IMPACTS ON SECURING AN ITS NETWORK

Technology has been changing at a rapid pace. As the trend is likely to continue, improved systems will provide better services and functionalities. The advances in technology will include advances in computer networking that will provide faster services and processing of information. Computer network security likely will become more complicated with the increase in speed, capacity, bandwidth, and throughput of network and network devices (Pfleeger et al. 2003). Synchronous with these advances, the possible attacks against computer networks around the world to gain unauthorized information or disrupt services likely will increase with more technologically savvy attacks that may be more malicious than ever. Computer network security experts will have new challenges to protect networks and respond to these attacks. ITS professionals must use the most up-to-date information to identify possible types of attacks and their risks and to implement measures to protect and respond to such attacks. For example, by creating a security policy within a security plan, by considering the security architecture as the system is developed, and by adhering to industry and ITS standards/protocols, the future security of ITS networks should improve. As described in Section 6.6.4, the migration from the existing centralized online traffic management model to a distributed model may reduce single points of failure, where the system could fail if the centralized control fails. Distributed systems also help with the distribution of processing requirements, eliminating the need to transfer all data through the network to a centralized processing center (Rambhia 2002). With computers in vehicles and roadside traffic devices, the breadth and depth of computer networks in ITS will likely increase. For example, the Vehicle-Infrastructure Integration (VII) initiative, in which vehicles and infrastructure units communicate with one another through wireless communication network(s), offers an opportunity to improve the effectiveness and efficiency of providing information to drivers, such as signing, speed limit, and traffic information. Opt-in or anonymous traffic surveillance collection data from vehicles on their speed, acceleration/deceleration, position, and maneuvering could provide unprecedented information for ITS systems (National VII Coalition 2007). The expected improvement in the quality and availability of information would increase the risk of vulnerabilities in supporting the security objective of confidentiality, authentication, access control, and availability. This and other ITS applications will increase the challenges for the ITS professionals to develop appropriate security policies, plans, and measures to protect the integrity of the network. REFERENCES Anderson, Ross J. 2001. Security Engineering – A Guide to Building Dependable Distributed Systems. John Wiley & Sons.

E1E1C06_1

09/18/2008

118

118

FUNDAMENTALS OF COMPUTER NETWORK SECURITY FOR ITS

Brooks, R., Sander, S., Deng, J., and Taiber, J. (2008) Automotive Systems Security Challenges and State-of-the-art, submitted for review. Crane, R. K. 2003. Propagation Handbook for Wireless Communication System Design. Taylor & Francis. Kurose, James, and Keith Ross. 2005. Computer Networking, 3rd ed. Pearson Education. National Institute of Standards and Technology. 2006. Recommendation for Key Management – Part 1: General. NIST Special Publication 800–57. Available online at National VII Coalition. 2007. VII Coalition homepage [Online]. Available: www.vehicleinfrastructure.org. Pfleeger, Charles, and Shari Pfleeger. 2003. Security in Computing, 3rd ed. Prentice Hall. Rambhia, Ajay M. 2002. XML Distributed Systems Design. Sams. Ron Ross, Stuart Katzke, Arnold Johnson, Marianne Swanson, Gary Stoneburner, George Rogers, and Annabelle Lee. 2007. Recommended Security Controls for Federal Information Systems: Guidance for Selecting Cost-Effective Controls Using a Risk-Based Method. National Institute of Standards and Technology. <www.itl.nist.gov/lab/bulletns/ bltnmay05.htm > Simmons, Gustavus J. (Editor), Contemporary Cryptology, IEEE Press, The Institute of Electrical and Electronics Engineers, Inc., New York, 1992. U.S. Department of Commerce. 1999. Federal Information Processing Standards Publication 46. Wiberg, Kenneth C. 2006. Identifying Supervisory Control and Data Acquisition (SCADA) Systems on a Network via remote Reconnaissance. Masters Thesia. Naval Postgraduate School, Monterey, CA.

REVIEW QUESTIONS

1. What are the differences between computer system and network security in terms of the security objectives? 2. Develop a computer network security policy for a basic traffic management center. 3. Describe the basic concepts of confidentiality in computer network security. Describe a method to achieve confidentially in the computer network. 4. Explain with an example the differences between message integrity and nonrepudiation. 5. What is a firewall? How does it help computer network security? 6. How could the advances in computing resources and network impact the security of the ITS computer network? 7. What do you think is the biggest security threat for an ITS computer network? Which security objectives may minimize this threat? 8. Explain the difference and advantages/disadvantages between private and public key encryption schemes.

E1E1C06_1

09/18/2008

119

REVIEW QUESTIONS

119

9. Name the seven elements of a computer network security plan with a brief description of each element. 10. What is the most secure encryption technique providing perfect security? Explain how it works. 11. With the K  B pair (33, 7), decode this message: 14 9 5. 12. Encrypt this message using the K þ B pair (33, 3): I T S. 13. Match the terms to their definition: Confidentiality ________ Authentication ________ Message integrity ________ Availability ________ Access control ________ Plain/clear text ________ Cipher text ________ Packet sniffing ________ Virus attacks ________ Spoofing ________ a. The process of confirming that a sender or receiver is who/what they say they are b. The original form of a message without considering confidentiality c. Ensures that only legitimate users may access a network d. Created by using an encryption algorithm on a plain text message e. Takes over an existing connection or computer and can fool other network connections by untrue authentication f. Can be used to monitor the transmission of packets within a network but can allow hackers to view passwords and verifications sent between users g. Only the sender and receiver of the message are able to understand it, preventing eavesdroppers from knowing the message h. Ensures that legitimate users can always access their network information i. Enacts programs that use a computer in an unwanted way, sending private information, deleting wanted information, or downloading other dangerous information j. Ensuring that messages have not been altered during a transmission either by error or from malicious intent

E1E1C07_1

09/18/2008

120

CHAPTER 7

SECURING ITS

C

omputer systems are easy targets for a security breach. As intelligent transportation systems (ITS) are increasingly used for security purposes, the systems themselves could become targets for hindering their intended functions or creating situations hazardous to public safety. This chapter discusses how ITS can be vulnerable to security threats and ways to minimize these risks. It also presents the security aspects of various ITS deployment standards.

7.1 INTRODUCTION

A commonly neglected aspect of ITS is recognizing system threats and vulnerabilities and taking the appropriate security-related actions. In the United States, after the September 11 terrorist attacks, there was a renewed interest in ensuring that our transportation infrastructure was as secure as possible. One of the key activities was updating the U.S. National ITS Architecture to include security more extensively. After much analysis, it was decided to create eight security areas within the ITS domain as well as an underlying ‘‘Securing ITS’’ foundation as depicted in Figure 7.1. The eight security areas of ITS functionality were introduced in Chapter 3. Securing ITS is an important paradigm for the transportation system. ITS is built on computerized information and communication systems. These systems could be accessed without authorization to interfere with their intended functions or create risks to public safety. Transportation Infrastructure Security Utilizing Intelligent Transportation Systems R. Fries, M. Chowdhury and J. Brummond Copyright © 2009 John Wiley & Sons, Inc.

120

E1E1C07_1

09/18/2008

121

7.1

INTRODUCTION

121

Figure 7.1 Securing ITS. (Source: RITA, Security Document, National ITS Architecture 6.0, May 2007.)

ITS system security is founded on the interrelated concepts shown in Figure 7.2. The diagram shows the relationship among overall security objectives, identified security threats, and security services (also known as safeguards or countermeasures) chosen to support the security objectives and protect against identified threats.

Security Threat

Exploits

Leads to Vulnerability Security Objectives

Risk

Directly affects ITS System Security Service

Can damage

Can be protected by a

Figure 7.2 Applying Security to an ITS System. (Source: RITA, Security Document, National ITS Architecture 6.0, May 2007.)

E1E1C07_1

09/18/2008

122

122

SECURING ITS

The analysis performed for a specific ITS system is based on three items (RITA, 2007): 1. Analysis of the real or perceived threats factoring in if they are credible or not. 2. Further analysis on whether the system is vulnerable to those threats. 3. Overall risk analysis that balances the cost (both monetary and the effect on operations) of security service(s) against the likelihood of the threat and the consequences if the threat is realized. As shown in Figure 7.2, security objectives start the process by defining what is to be accomplished to address security. The references to this chapter cite a number of excellent resources that fully explain the process of applying security in the design, development, and operation of an information system. Versions 5.0 of the National ITS Architecture, which was subsequently updated further to Version 6.0, included only some of the security concepts in Figure 7.2. Actual system vulnerabilities, assessment of risk, and the ITS system itself require specific system deployment characteristics. For that reason, it was decided to include general security objectives, threats, and security services that are independent of system implementation. Instead of the deployed computer and communications systems—the ‘‘ITS System’’ box in Figure 7.2, these general security concepts are applied to National ITS Architecture subsystems and information flows, as shown in Figure 7.3. Keep in mind that the security analysis included in the National ITS Architecture is high level in order to remain representative of the initial security analysis performed for any system.

Figure 7.3 Applying Security to the National ITS Architecture. (Source: RITA, Security Document, National ITS Architecture 6.0, May 2007).

E1E1C07_1

09/18/2008

123

7.2

SECURITY OBJECTIVES

123

The remainder of this chapter discusses how the National ITS Architecture secures ITS. We define general security objectives and threat rankings and describe how those lead to candidate security services for subsystems and architecture flow groups. The chapter also describes how this general security analysis can serve as a starting point for a more in-depth analysis associated with a specific ITS system or regional ITS architecture. 7.2 SECURITY OBJECTIVES

Security objectives help form the basis for evaluating appropriate security services and levels of service that satisfy those objectives. The major security objectives identified for the National ITS Architecture—confidentiality, integrity, and availability—very likely apply to some degree in almost any ITS implementation. All security services are used to support one or more of these objectives. Similarly, all threats undermine one or more of these objectives. How well a security system operates can be found by the extent to which it meets the desired objectives. The security objectives each have classifications of high, medium, low, and minimal. For example, one security system may provide a high level of confidentiality, a medium level of integrity, but only a low level of availability. Comparing security systems using these metrics can aid designers in selecting between alternatives. 7.2.1 Confidentiality

The confidentiality objective prevents the disclosure of information to unauthorized individuals, processes, or systems (e.g., protecting the personal information of company employees). This security objective focuses on preventing unauthorized disclosure of information that is deemed sensitive and defines the level of restriction to sensitive information that is transmitted or stored within a system (RITA 2007). 7.2.2 Integrity

The integrity objective aims to guarantee the reliability and accuracy information and systems defining the level of protection. This protection prevents the alteration of messages either from unauthorized intentions or authorized but unintentional acts. This objective directly relates to authentication, auditing accountability, and access control for sensitive information (RITA 2007). Integrity usually takes the form of a protected audit trail that links specific user accounts with the user’s actions on the system. 7.2.3 Availability

The availability objective ensures that information and systems are open to and usable by authorized individuals and/or processes. In contrast to the previous

E1E1C07_1

09/18/2008

124

124

SECURING ITS

two objectives, that focus on restricting access, the availability objective focuses on allowing access to the required information if a user or system is authorized and there are no time of day restrictions. 7.3 SECURITY THREATS

A security threat is an event or circumstance that, if realized, would adversely impact the surface transportation system or communication between control systems. Threats can include errors, fraud, disgruntled employees, fire, water damage, hackers, terrorist acts, viruses, and natural disasters. In some cases, attackers purposely try to attack a user’s account or system. In a denial of service (DoS) attack, attackers may wish to prevent the legitimate users from using the system. There can also be threats to the transportation supply chain. Within the National ITS Architecture, the seemingly broad spectrum of threats are categorized in a general, uniformly applicable way. The four general threat categories defined in the architecture are: 1. 2. 3. 4.

Deception. Disruption. Usurpation. Unauthorized disclosure.

Their definitions from the Security Document of the National ITS Architecture are presented in the next sections. 7.3.1 Deception

Deception is, ‘‘. . . a circumstance or event that may result in an authorized entity receiving false data and believing it to be true.’’ 7.3.2 Disruption

Disruption is, ‘‘. . . a circumstance or event that interrupts or prevents the correct operation of system services and functions.’’ 7.3.3 Usurpation

Usurpation is, ‘‘. . . a circumstance or event that results in control of system services or functions by an unauthorized entity.’’ 7.3.4 (Unauthorized) Disclosure

(Unauthorized) disclosure is, ‘‘. . . a circumstance or event whereby an entity gains access to data for which the entity is not authorized.’’

E1E1C07_1

09/18/2008

125

7.4

SECURITY SERVICES

125

7.4 SECURITY SERVICES

The system designers, implementers, and system managers ultimately must identify and analyze specific threats to determine the probability of their occurrence and their anticipated damage to a specific transportation system. Security threats, along with security objectives, provide the basis for evaluating and selecting appropriate security services. Security services represent typical security mechanisms, safeguards, or countermeasures that help provide different aspects of security. Security services are driven by the security objectives and threats expected to adversely impact a system or its communication. Security services are partitioned into four broad areas: 1. 2. 3. 4.

Information security. ITS personnel security. Operational security. Security management.

7.4.1 Information Security

Information security includes securing the source, communication, and endpoint of the information itself. Information security is no different for ITS than for other computerized information systems. Information security provides security services that can be utilized based on the defined security threats and security objectives. In the U.S. National ITS Architecture, these security services, threats, and objectives are classified along with their importance for each group of architecture flows (i.e., emergency security group dealing with incident management). In addition, each National ITS Architecture subsystem has a description of potential security considerations. The seven areas of information security listed are: 1. 2. 3. 4. 5. 6. 7.

Confidentiality. Integrity. Availability. Accountability. Authentication. Auditing. Access control.

Further discussion of these information security services can be found in the National ITS Architecture Security document (RITA 2007). 7.4.2 ITS Personnel Security

It is well known within the security industry that insider personnel can inadvertently or maliciously breach security from within. ITS personnel security deals with:

E1E1C07_1

09/18/2008

126  

    

126

SECURING ITS

Screening of personnel Giving supervisors policies and controls to ensure that personnel responsibilities are appropriate Providing regular awareness and training Separation of duties Least privilege Accountability through audit trails Ensuring that terminated or transferred personnel do not have unauthorized access

Further definition of the ITS personnel security items can be found in the National ITS Architecture Security document (RITA 2007). 7.4.3 Operational Security

Physical and environmental threats to ITS assets need operational security protection. Operational security provides access control, real-time monitoring, configuration control, and security incident and materials management of critical ITS assets. There are seven areas within operational security: 1. 2. 3. 4. 5. 6. 7.

Adverse physical and environmental conditions protection. Physical access control. Security monitoring. Security incident management. Contingency planning. System maintenance. Sensitive materials management.

Further definition of the operational security items can be found in the National ITS Architecture Security document (RITA 2007). 7.4.4 Security Management

Security management provides the overall connections and associations necessary for information security, operational security, and ITS personnel security as well as supporting the eight ITS security areas. A system-wide security policy provides the basis for overall system security. A system security policy specifies the security procedures, roles and responsibilities, system configuration (both between subsystems and between subsystems and terminators), operational security needs, ITS personnel security, and ITS asset security. The security management service includes user and system assignment of appropriate access control, password management, and a host of other security mechanisms based on the identified risks. The military concept of defense in

E1E1C07_1

09/18/2008

127

7.5

SECURING ITS SUBSYSTEMS

127

depth can be used by having multiple layers of security mechanisms so that the compromise or failure of one security mechanism is mitigated by the other security layers. An example would be placing a password on your email client that is different from the password to log in to your system. Even if an attacker breeches the operating system password, the email account is still protected. Another principle is the concept of avoiding security by obscurity, which means that you should assume that the attacker knows what security mechanisms or services are in place. (Such situations arise with disgruntled former employees who are seeking revenge on previous employers, for example.) Another important principle of security management is to keep the security mechanisms as simple as possible. Complex security mechanisms are difficult to fully comprehend and have the potential for more vulnerabilities. 7.5 SECURING ITS SUBSYSTEMS

The traditional computer, network, personnel, and communications foundational security tools are found in the area of securing ITS. In order to have available and operational ITS security areas, the underlying information technology security mechanisms must be secure. ITS security should be built on two major premises: 1. Securing ITS subsystems, which includes the integrated hardware and software that support particular ITS functions. 2. Securing the communication between the subsystems. Version 6.0 of the National ITS Architecture defines 22 subsystems, each of which has potential security considerations. These subsystems are divided into four classes: 1. 2. 3. 4.

Travelers. Centers. Vehicles. Field.

The Travelers class contains the Remote Traveler Support and Personal Information Access subsystems, which communicate to the traveling public. The Vehicles class contains these subsystems, which communicate to individual vehicles and vehicle fleets:     

Vehicle (functions applicable for all types of vehicles) Emergency vehicle Commercial vehicle Transit vehicle Maintenance and construction vehicle.

E1E1C07_1

09/18/2008

128

128

SECURING ITS

The Field class (renamed in version 5.0 from what had been the Roadside class) contains these subsystems, which are field devices or systems in the field:     

Roadway Security monitoring Toll collection Parking management Commercial vehicle check

The largest class of subsystems is the Centers class, which contains these subsystems:          

Traffic management Information service provider (traveler information) Emergency management Emissions management Toll administration Transit management Commercial vehicle administration Fleet and freight management Maintenance and construction management Archived data management

These subsystems represent the controlling entities that manage the surface intelligent transportation system. The Physical Architecture document of the National ITS Architecture defines all these subsystems in detail. Appendix B of the National ITS Architecture Security Document describes potential security considerations for each subsystem. These high-level descriptions are intended to highlight the confidentiality, integrity, and availability objectives that apply to each subsystem. Because of the breadth of function and diverse nature of the processing within each subsystem, users must develop specific security considerations for a given ITS implementation based on an understanding of the objectives, threats, and system vulnerabilities to these subsystems. 7.6 SECURING COMMUNICATIONS BETWEEN SUBSYSTEMS

One of the objectives of the U.S. ITS program is for systems to be able to exchange information seamlessly. Securing communications between subsystems and between subsystems and terminators is critical to securing ITS. The interfaces, or information flows (to use National ITS Architecture terminology) have been analyzed by the National ITS Architecture Team to ascertain the relative importance of applicable security services. In order to keep the security

E1E1C07_1

09/18/2008

129

7.6

SECURING COMMUNICATIONS BETWEEN SUBSYSTEMS

129

considerations for architecture flows manageable, groupings were created for architecture flows that share similar security objectives, threats, and candidate security services. Architecture flows have been placed into one of 16 groups based on their unique security considerations. In cases where an architecture flow could be allocated to multiple groups, the most appropriate security group was chosen. Each architecture flow group has been given typical security services, security objectives, and security threat classifications of high, medium, low, or minimal. Similar architecture flows are grouped together so that security services can be applied consistently. The security service classifications are based on the security objective and threat importance. For example, the combination of a high level of integrity (i.e., unauthorized modification of the information) and a high level for the threat of deception would necessitate, among other services, a high or great need for the Access Control security service. Keep in mind that these are general classifications representing a starting point for further security analysis as systems are deployed. The information content of the architecture flow coupled with its operational role was considered by the National ITS Architecture Team in the security service classifications. In some cases, the security service, objective, or threat is not applicable and thus will not be in the corresponding table. The security service considerations are typical; users must tailor the security considerations as appropriate to the ITS application (e.g., sensitive archive data might require a higher classification than the nominal ‘‘low’’ designation identified in the National ITS Architecture). The security information for all architecture flows is available in the hypertext presentation on the Web site (www.iteris.com/itsarch/html/ security/securingits.htm) and the National ITS Architecture Version 6.0 CDROM available from USDOT. The architecture flow groups are:              

Archived Data Architecture Flows Business Sensitive Architecture Flows Emergency Architecture Flows Enforcement/Crash Reporting Architecture Flows Financial/Personal Architecture Flows Map Data Architecture Flows Media Architecture Flows Not Applicable Architecture Flows Operational Information Architecture Flows Operational Information—Safety Architecture Flows Public Architecture Flows Secure Human Interface Architecture Flows System Control Architecture Flows Traveler Information Architecture Flows

E1E1C07_1

09/18/2008

130  

130

SECURING ITS

Traveler Information—Safety Architecture Flows Weather/Environmental Architecture Flows

To illustrate the types of security information available, the Emergency Architecture Flows group is presented and explained here. The Emergency Architecture Flows architecture flow group contains architecture flows that support emergency response and related critical public safety activities. These flows have critical availability and integrity requirements. For each architecture flow group, there are three tables. Table 7.1 includes a list of TABLE 7.1 Emergency Architecture Flows Security Services Service

Importance

Service Description

Confidentiality

Medium

Integrity

High

Availability

High

Accountability

High

Authentication

High

Auditing

High

Access Control

High

The system should prevent unauthorized disclosure of information deemed sensitive. The system should ensure that information is protected from unauthorized intentional or unintentional modifications. The system should protect critical ITS services in order to prevent degradation or denial of the ITS services to users of the services. Single points of failure should be avoided. The system should provide protection against a sender of an information transmission later denying that they sent the information. The system should provide protection against a receiver of an information transmission later denying that they received the information. This concept is known as Non-Repudiation or Accountability. The system should verify the identity of a user and/or other system prior to granting access to a requested resource. The system should have the capability to trace ITS subsystem and individual user actions and activities. The auditing function of the system places the actions and activities in an audit trail that is protected from unauthorized access and modification. The system should limit access to the resources of a subsystem to only those users and other subsystems that are properly authorized. After authenticating an entity, the system should have the capability to limit system access to information or resources based on that entity’s access privileges. The system should limit software modifications and upgrades to users and other systems that have authorization.

Source: RITA, Security Document, National ITS Architecture, 2007.

E1E1C07_1

09/18/2008

131

7.6

SECURING COMMUNICATIONS BETWEEN SUBSYSTEMS

131

TABLE 7.2 Emergency Architecture Flows Security Objectives Objective

Classification

Confidentiality

Medium

Integrity

High

Availability

High

Class Description Information that is generally available to ITS personnel. Unauthorized or unintended modification of the information could result in degradation of public safety. Loss of the information could jeopardize public safety.

Source: RITA, Security Document, National ITS Architecture, 2007.

the applicable security services and their relative importance, which have been derived from the security objectives and threats depicted in Tables 7.2 and 7.3. Consider, for example, one of the architecture flows in this group, ‘‘border incident information,’’ representing information about an incident at the country’s border. As shown in Table 7.1, all of the security services for architecture flows in this group are of high importance except confidentiality. The disclosure of some of the border incident information may be sensitive or of medium importance; such information might include the number of fatalities at the border and their identities. The access control security service is important because the system, for security reasons, should protect against unauthorized system access. The security services and their importance (Table 7.1) have been derived from the security objectives and their classifications (Table 7.2) and the security threats and their importance (Table 7.3). The ‘‘medium’’ classification of the confidentiality security objective coupled with the ‘‘medium’’ importance of the threat of disclosure resulted in a ‘‘medium’’ importance for the confidentiality security service. Similarly, the level of importance assigned to each of the other security services was derived by taking into account the security objectives and threats. After the tables on the National ITS Architecture Web site and CD-ROM is a list of the architecture flows in this architecture flow group being considered. Table 7.4 shows the architecture flows for the ‘‘Emergency Architecture Flows’’ group. TABLE 7.3 Emergency Architecture Flows Security Threats Threat

Importance

Deception

High

Disclosure

Medium

Disruption

High

Threat Description A circumstance or event that may result in an authorized entity receiving false data and believing it to be true. A circumstance or event whereby an entity gains access to data for which the entity is not authorized. A circumstance or event that interrupts or prevents the correct operation of system services and functions.

Source: RITA, Security Document, National ITS Architecture, 2007.

E1E1C07_1

09/18/2008

132

132

SECURING ITS

TABLE 7.4 Architecture Flows for the ‘‘Emergency Architecture Flows’’ Group alarm alarm acknowledge alarm notification alert notification alert notification coordination alert status alerts and advisories border incident information border incident response status care facility status care facility status request commercial vehicle breach commercial vehicle data commercial vehicle data request decision support information disable commercial vehicle emergency acknowledge emergency data request emergency dispatch requests emergency dispatch response emergency notification emergency operations status emergency personnel information presentation emergency plan coordination emergency route request emergency routes emergency transit schedule information emergency transit service request emergency transit service response emergency vehicle tracking data evacuation coordination evacuation information fleet and freight threat information freight breach

hazmat information hazmat information request hazmat spill notification incident command information coordination incident command information presentation incident information incident information for public incident notification incident notification response incident report incident response coordination incident response status incident status maint and constr resource request maint and constr resource response patient status public health request public health response rail incident response status remote vehicle disable resource coordination resource deployment status resource request safe vehicle disable secure area sensor data secure area surveillance data suggested route threat data for analysis threat information threat information coordination threat support data toll advisories transit emergency data transit incident information

Source: RITA, Security Document, National ITS Architecture, 2007.

The architecture flow group descriptions for all 16 groups are defined in Appendix C of the National ITS Architecture Security Document. Further information regarding the corresponding security objectives, threats, security services, and applicable architecture flows for each group can be found on the National ITS Architecture CD-ROM or Web site hypertext by selecting ‘‘Security’’ from the left-hand menu and following the links.

E1E1C07_1

09/18/2008

133

7.7

SECURITY AND ITS STANDARDS

133

7.7 SECURITY AND ITS STANDARDS

ITS standards are necessary in order to establish an open (or nonproprietary) ITS system communications environment. Standards reach toward the goal of having deployment of seamless, interoperable systems at local, regional, and national levels. The ITS Joint Program Office (JPO) of the U.S. Department of Transportation (USDOT) is currently supporting Standards Development Organizations (SDOs) that are responsible for a consensus-based standards development process to facilitate successful ITS deployment in the United States. The USDOT ITS JPO’s Standards Site at www.standards.its .dot.gov/provides the current status on the ITS standards that are supported. In addition, this site contains resource d