Cyber Mutual Aid

Dennis Tomlin, Chief Information Security Officer,Multnomah County

Dennis Tomlin, Chief Information Security Officer,Multnomah County

THE FIRE:        

It burned completely to the ground. 

The year was 1972 and the small community where I grew up, Parkdale, Oregon would take years to recover. 

McIssac’s Store was built in 1910 and had been continuously operated by the RJ McIsaac family that entire time.             

Mac’s was a place where one could buy groceries, firearms and ammunition, tractor parts, general hardware and most importantly had an extensive comic book rack where I developed my love for Mad Magazine and DC Superman comics. It was all things to all people in our relatively isolated community in the shadow of Mt. Hood.           

I will never forget the day. I was in high school and was a part of a program called Jr. Volunteer Firefighters. This was a program that enabled high school students to serve their communities as well as learn some techniques that would enable us to become full-fledged volunteer firefighters upon graduation.  

The intercom at Hood River Valley High School blasted “ALL PARKDALE JR. FIREFIGHTERS TO THE OFFICE”. This was "a first." We were all shocked to hear that the store was on fire and our assistance was needed. Not knowing what to expect, I vaguely remember driving the 16 miles to my hometown and the feeling in the pit of my stomach when I saw that Mac’s was fully involved and learning that the mission had shifted from saving the building and it contents to just controlling the fire and to keep it from spreading and destroying the entire community.

This tragic fire was only able to be contained because Parkdale had a mutual aid agreement with the other 5 fire departments in the Hood River Valley. Each department sent a truck and trained personnel to assist with the containment that otherwise would have been far more devastating and could have possibly spread through the small town.    

THE HURRICANE:       

In 2017 Hurricane Irma caused widespread destruction to everything in its path as it swept across the Southeastern portion of the US. Hurricane Irma cut power to nearly two-thirds of Florida's electricity customers. Hurricane Irma knocked out power to 6.7 million electricity customers—64 percent of all customer accounts in the state.         

My nephew who is a lineman in the State of Washington and several of his co-workers responded to the call for mutual aid to assist the power companies in the state to restore their services. Within days the majority of the population of the State of Florida had their power restored.

MUTUAL AID:

In emergency services, mutual aid is an agreement among emergency responders to lend assistance across jurisdictional boundaries. This may occur due to an emergency response that exceeds local resources, such as a disaster or a multiple-alarm fire. Several states and most utilities have state and nationwide mutual aid systems.           

While fire departments and utilities have models in place to provide assistance to one another in the event of a catastrophe, why don't we as State, Local, Tribal, Territorial (SLTT)government entities and other private sector IT organizations enter into similar agreements?

RESOURCES:

None of us have idle resources but in addition to keeping the lights on many of us have staff assigned to project work as well. I am in a unique position in that my security team is staffed (5 FTEs) with as many individuals as the entire IT staff of some smaller tribes, cities and counties.

IMAGINE:

What if a neighboring city, county or other SLTT entity were to get hit with a major cyber attack? Boots on the ground in a timely manner can make the difference between losing a grocery store or an entire community. It could be the difference between a short power disruption or a massive outage.   

“If you want to go fast, go alone. If you want to go far, go together.” — African proverb

Collectively we are stronger than we are individually. What prevents me from asking for imaging or incident response resources from a neighboring county when my grocery store is on fire? What prevents you from requesting a network resource or a cyber analyst when your power is out? This model should not only be exercised in the heat of the battle but during preparation as well.     

“Thus the wise win before they fight, while the ignorant fight to win.” - The Art of War (Zhuge Liang)

I propose that we leverage our relationships and forge these agreements that will allow us to help one another during an adverse cyber event. These agreements can be as formal or as ad-hoc as the participating parties are comfortable with. They can be as simple as a conversation and a handshake. These agreements can also be based on best effort or available resources. I think the key is to begin having these conversations and working through the process.

EPILOGUE:

While McIsaac’s Store was a total loss, they were able to rebuild and the original owners sold the iconic store in 1985 and it serves the local community to this day.

Utilities

cyber attack