Professional in Critical Information Infrastructure (PCIP)

Transcription

1 Professional in Critical Information Infrastructure (PCIP) Overview The world is rapidly changing. Our critical infrastructure is at risk on many fronts. Key services that were once taken for granted are now being affected by terrorist attacks, severe weather and other hazards that place our society and economy at risk. The systems and networks that make up the infrastructure of society are often taken for granted; yet a disruption to any one of those systems can have dire consequences across other sectors. Our dependence on information technology presents new vulnerabilities to critical infrastructure. Take, for example, a computer virus that disrupts the distribution of natural gas across a region, or cyber attacks on an electric grid. Without proper protection and recovery planning, these incidents could lead to the forced shutdown of computerized controls and communications. Road traffic, air traffic, and rail transportation would also become affected and emergency services might be hampered. The computer and telecommunications systems that monitor and manage our nation s electric power grid, water supply systems, and manufacturing systems use SCADA, DCS, and control systems protocols which require a higher level of protection and consideration than the computer systems used by traditional enterprise IT systems. This unique PCIP certification is made up of three courses, Program, Technical, and Applied, and instill in the students an all-hazards approach in assessing and managing risks that could lead to disruption in service. It also teaches students how to evaluate the ability of an organization to rapidly respond to an incident, and quickly recover operations and service delivery. Successful completion of all three courses and examinations result in the awarding of a PCIP certificate, which can be used to show expertise in this field.

2 PCIP Program Course (4 days) The four-day PCIP Program Course provides a strategic perspective of Critical Infrastructure Protection (CIP) in order to provide complete coverage of the CIP specialty. While CIP is not complicated, it is certainly complex, and a CIP professional must have a strong overall understanding of the interdependencies, information sharing requirements, governance, and accountabilities within and among the ten (10) Canadian CIP sectors and eighteen (18) American sectors. The course is divided into three segments. First, the major concepts within the CIP specialty are covered, including standardized nomenclature and CIP terms. Second, the CIP risk management model is introduced and explained in detail. This model facilitates CIP-related risk assessments, taking an "all-hazards" approach, followed by the subsequent identification of vulnerabilities and the determination of appropriate, cost-effective safeguards. Third, the CI sectors are examined, compared, key differences are highlighted, and perspectives among various countries are discussed. Students gain a practical understanding of the unique threats, vulnerabilities and risks within the various sectors, as well as sector-specific safeguards, best practices and program considerations. As in the other PCIP courses, students interact with facilitators and colleagues to gain a full understanding through challenging hands-on exercises and case studies. The last two periods of the course are taken up with an examination that tests the major concepts taught on the course. Students prepare short narrative answers that are scored on both content and argument. While it is recommended to take the Program course first in the series, candidates may opt to attend the PCIP Technical Course beforehand. However, both the Program and Technical Courses must be completed before the PCIP Applied Course may be undertaken.

3 PCIP Technical Course (3 days) In today's environment, our country heavily relies on Critical Infrastructure (CI). Critical Infrastructure Systems are crucial to many facilities that are important to maintaining our way of life. The United States has 18 Critical Infrastructure Sectors and Canada has 10. Energy, finance and information technology (IT) are several of the most important CI Sectors which are relied on by our citizens. Being able to properly design, implement, and manage your CI system security architecture is a key component of every successful security program. Understanding how to implement physical security measures is crucial to safeguarding facilities and personnel. Addressing today's threats requires an all hazard approach; focusing on terrorism, accidents, and workplace violence, as well as natural disasters such as Hurricane Katrina. Emergency Management and Business Continuity Planning is an important and difficult task to accomplish. However with a robust Emergency Management and Business Continuity Plan, an incident can be addressed quickly and resumption of service can be achieved in a timely and orderly manner. Within IT, there are several critical systems that other CI Sectors are dependent on. These important IT systems include SCADA (Supervisory Control and Data Acquisition), DCS (Distributed Control Systems), EMS (Energy Management Systems), and other high availability, mission critical environments which require different management and security considerations than traditional enterprise IT environments. Sometimes these systems and applications may be so proprietary or vendor-dependant that administrators are not able to maintain the necessary security safeguards. It is also possible that implementing a security safeguard could turn out to be more damaging than the risk itself, due to unforeseen system impacts. This course addresses the complexities and unique differences between traditional enterprise IT systems and SCADA and other real-time environments. Students will also study Physical Security, Emergency Management, Threats, and Security Engineering. The last two periods of the course are taken up with an examination that tests the major concepts taught on the course. Students prepare short narrative answers that are scored on both content and argument. While it is recommended to take the Program course first in the series, candidates may opt to attend the PCIP Technical Course beforehand. However, both the Program and Technical Courses must be completed before the PCIP Applied Course may be undertaken.

4 PCIP Applied Course (5 days) This course allows students to apply directly what they learned in the Program and Technical courses to an actual CIP assessment. It teaches candidates how to conduct an integrated CIP assessment of a facility, campus or organization. This course is predominantly hands-on. During this course, candidates will be provided with an exercise scenario at the outset, which is built upon throughout the course with periodic inputs. Individually, and in small groups, candidates will conduct an analysis of threats, hazards and vulnerabilities and provide recommendations on the appropriate safeguards to protect identified CI. The analysis tools used will be those taught during the Program and Technical Courses. This course will cover the skill sets required of each of the specialists in a CIP assessment team, describing the areas for information gathering and analysis required of each specialty. A typical installation will be assessed by the students under the supervision of the instructors. The proactive nature of this course builds on the experience of the instructional cadre in planning and conducting assessments of large critical infrastructure installations. Tools and guidance will be provided to students and will be exercised during the assessment. A security clearance and /or background check may be required, as well as the signing of nondisclosure agreements. There is no final written examination for this course. Students will be assessed by the instructors on the quality of their written work assignments, their oral briefing skills, their ability to analyze a problem, their skill at evaluating options and making recommendations, their participation in class, and their ability to work as a member of a multi-disciplinary team. Upon successful completion of this course, students will have truly demonstrated the required knowledge and skills to effectively manage a CIP program. Both the Program and Technical Courses must be completed before the PCIP Applied Course may be undertaken.

5 Tentative Program PCIP Class 1: CIP Program Course, (4 days) Course Description Day 1 Day 2 Day 3 Day 4 Introduction to CIP Review Exercise Review Exercise Food & Agriculture Sector Threats & Vulnerabilities Introduction Water Sector Government, Postal & Shipping Sector CIP Policies Blast Threats Transportation Sector I Overview and Mass Transit Manufacturing, Chemical and Defence Industrial Base Sectors CIP in an Asset Interdependencies Transportation Establishing a Protection Sector II CIP Program / Organization Marine and Rail Review CIP in an Asset Legal Aspects of Health Care / Review / Exam Protection CIP Emergency Services Organization Sector (Cont'd) Management of Risk s Telecommunications the CIP and Safeguards & Information Program Technology Sector Mission CBRN and OSH Energy & Utilities Ethics for PCIPs Analysis Threats Sector Criticality Medical Threats Banking & Finance Course Close Analysis Sector

6 Course Description Day 1 Day 2 Day 3 Day 4 FMission Analysis and Criticality Exercise Threat & Risk Exercise F19:00 Reception

7 Class 2: CIP Technical Course, and (3 days) Course Description Day 1 Day 2 Day 3 Class Introduction and CIP Model Review Day 1 Recap and Security Overview (CIA vs. AIC) Day 2 Recap, Review of Security Roadmap, Social Engineering Sector-Specific Technology and Interdependencies Wireless Technology and RFID Tracking Systems Protection of Technical Assets (Defense-in- Depth introduced as well as Prevention and Detection) Computer Networks Part 1 - Overview of Enterprise IT Systems Banking and Financial Systems (they are realtime) Standards and Regulations - Sector Specific Computer Networks Part 2 - Telecommunications Technical Threats and Hacking Methodologies Standards and Regulations - NERC CIP SCADA Part 1 - Overview of SCADA and Control Systems Technical Vulnerablities - Computer Networks Standards and Regulations - ISA99 SCADA Part 2 - SCADA Protocols and Communications Technical Vulnerabilities - SCADA Systems Applying Security to SCADA and Industrial Control Systems (CIA vs. AIC) RF Communications Systems Recovery of Technical Assets (Response, Recovery, and Restoration) Exam Recap from Day 1 Recap from Day 2, and review concepts contained in Exam Exam

8 PCIP Class 3: CIP Applied Course. (5 days) Course Description Day 1 Day 2 Day 3 Day 4 Day 5 Windshield EOC Inbrief to Final Outbrief Tour, Course Operations Facility Preparation Introduction and Class Photo Course Review Protective Controls and Measures (Phys, Pers, Ops) Final Outbrief Preparation CIP Process (Preparation) Protective Controls and Measures (Phys, Pers, Ops) Final Outbrief Preparation CIP Process (Conduct) Protective Controls and Measures (Cyber) Final Outbrief Preparation CIP Team Out brief Outbrief to Breakout and Report Facility Process (Prepare Preparation (Post- Inbrief) ) Ex Scenarios Incident Out brief Outbrief / and Management and Report Introduction (Overview) Preparation Critique to CIPAC

9 Course Description Day 1 Day 2 Day 3 Day 4 Day 5 Team Incident Out brief Practical Breakout Management and Report Problems (Analysis) (Applied) Preparation Presentation Team Review Interviewing Murder Practical and Techniques Board Problems Preparation Presentation CIPAC/Internet Course Close Course Requirements PCIP registrants must be affiliated with (to include consulting) a verified organization with the critical infrastructure industry for at least 3 years. This means the registrant must have been providing support to a critical infrastructure, SCADA, control system, mission-critical IT system, or other high availability environment. This can include management of the applicable department. Examples of employment include: engineer, operations staff, corporate or IT security staff, facility management staff, emergency services staff, business continuity planning staff, auditor, consultant, policy advisor, government CI specialist. Due to the sensitive nature of the class material, assessment facility, a background check may be required. Individual Class Prerequisites: a. PCIP Program Course 1. General understanding of mission-criticality and high availability business requirements. 2. General understanding of basic security principles. b. PCIP Technical Course 1. General understanding of Emergency Management, Business Continuity Operations, and Threat/Hazards. 2. Basic knowledge of networks and networking principles. 3. Basic knowledge of SCADA or other infrastructure/high-availability environment within a critical infrastructure sector. c. PCIP Applied Course 1. Successful completion of both PCIP Program and Technical Courses with a passing score.

10 Tentative Date The training is tentatively will be held on November Tentative Training Venue The training is tentatively will be held at Kuala Lumpur. Training Fee USD6,000.00

11 Instructor MR WAYNE PICKERING 1.0 EDUCATION AND PROFESSIONAL DEVELOPMENT: 1.1 Education: Bachelor of Engineering (Mechanical), Royal Military College of Canada, 1966 Graduate of British Army (Technical) Staff Course, Royal Military College of Science, 1971 Graduate of Canadian Land Forces Command and Staff Course, Kingston, Ontario, 1976 Graduate of Canadian Forces Command and Staff Course, Toronto, Ontario, 1979 Professional Engineer, Association of Professional Engineers of Ontario, from 1986 Engineering Management Courses, University of Ottawa, Graduate of National Security Studies Course, National Defence College, Kingston, Ontario, 1996 Master of Applied Military Science, Royal Military College of Canada, Training and Development: Canadian Forces Combat Intelligence Officer Course, 1968 National Defence Project Management Course, Ottawa, Ontario, 1985 Management of International Projects Course, Royal Military College of Science, United Kingdom, 1991 National Defence Resources Management Course, Ottawa, Ontario, 1992 Information Warfare Post Y2K: National Security Perspective Seminar, Washington, 2000 Force Protection Program Officer Course, Borden, Ontario, 2004 Cyber Information Protection Seminar, Ottawa, Ontario, 2005 Critical Infrastructure Institute (CII) Critical Infrastructure Protection (CIP) Technical, Program and Applied Courses, Ottawa, Ontario, 2006

12 2.0 FORCE PROTECTION EXPERIENCE: 2.1 THREAT Mr Pickering holds a valid Level III (Top Secret) clearance. Mr Pickering has had over three years experience in the last 10 years in the development and implementation of CF Force Protection Doctrine, Policy and Procedures. This included four contracts between November 2003 and August 2007 to develop Force Protection Doctrine, Policy and Procedures for the CF Provost Marshal, Force Protection Procedures for Canada Command, Force Protection Doctrine for the Air Staff and Force Protection Policy and Procedures for the ADM Infrastructure and Environment staff. Mr Pickering prepared the DND force protection policy directive, two CF force protection doctrine manuals (the Joint doctrine manual and the Air Force doctrine manual) and a procedures manual (the Force Protection Guide). Mr Pickering has had two years experience in the last 10 years in the development and implementation of training within the CF Training System. From June 2005 to February 2006 Mr Pickering was a member of the team that revised the Force Protection Program Officer Occupational Specialty Specification and prepared the Qualification Standard and Training Plan. He was part of the course development team that prepared lesson plans and lessons for four CF Force Protection Program Officer Courses (FPPOC) and wrote the course practical exercise, Exercise Northern Shield. He was involved in assessing the After Action Reviews of each course. This work began in April 2004 and continued until May He has been a Course Instructor for four FPPOC, in September 2004 (CF Military Police Academy, Borden), April 2005 (CFB Gagetown), November 2005 (Canadian Police College, Ottawa) and March 2006 (CF Military Police Academy, Borden), to train members of the Canadian Forces, RCMP and Transport Canada to lead and/or participate in Threat-Vulnerability-Risk s (TVRAs) of facilities. Mr Pickering has been a Course Instructor for four Critical Infrastructure Institute Critical Infrastructure Protection Courses. This included two Program Courses and two Applied Courses, designed to train members of government and industry to lead and/or participate in TVRAs of facilities. Their content is very similar to that of the FPPOC. The courses were conducted in September 2006, January 2007 and October 2007 (2 courses). Mr Pickering has been a course developer and instructor for two Transport Canada Marine Facility Security Courses (December 2007 and February 2008). Their content is very similar to that of the FPPOC. Mr Pickering has participated in eight formal threat-vulnerability-risk assessments (TVRAs) of Canadian government facilities in the past four years: o June 2006 Canadian Forces Joint Task Force North facilities in Whitehorse, Yukon and Yellowknife, North West Territories. o April 2006 Canadian Forces Base Borden and Canadian Forces Ammunition Depot Angus. o November RCMP National Headquarters Campus, Ottawa. o November RCMP Technical Protective Operations Facility, Ottawa. o June Wing/Canadian Forces Base Greenwood, Nova Scotia. o April Area Support Group/Canadian Forces Base Gagetown, New Brunswick. o October 2004 Canadian Forces Base Ottawa/National Defence Headquarters, Ottawa. o September Wing/Canadian Forces Base North Bay, Ontario.

13 3.0 PROFESSIONAL EXPERIENCE 3.1 Senior Consultant National Defence, Royal Canadian Mounted Police and Transport Canada - Force Protection and Security October Present Providing services to Department of National Defence, Ottawa, Ontario, Royal Canadian Mounted Police, Ottawa, Ontario, and Transport Canada, Ottawa, Ontario, through Lansdowne Technologies Incorporated on doctrine, procedures and training required to provide protection and security to Canadian government installations and operations. This includes writing operational level Aerospace Force Protection Doctrine for the Canadian Forces Air Warfare Centre, drafting Force Protection Levels and Measures, including emergency response measures, for Canadian Forces Canada Command, developing a risk evaluation matrix for Department of National Defence/ Infrastructure and Environment Group, coordinating a project to review the security of the RCMP Headquarters Campus, Ottawa, and conducting port and marine facility inspections and Marine Facility Security Courses for Transport Canada. During this period, he was a member of the course development team and instructed on four Critical Infrastructure Institute Critical Infrastructure Protection Courses, to train members of government and industry to lead and/or participate in TVRAs of facilities. This included lecturing on threat and criticality assessments, and developing exercises and scenarios. 3.2 Senior Consultant National Defence - Canadian Forces Force Protection and Security Project November 2003 September 2006 Provided services to Department of National Defence, Ottawa, Ontario through Consulting and Audit Canada, on policy, concepts, doctrine and procedures required to provide force protection and security to Department of National Defence/Canadian Forces installations and operations at home and abroad. Principal author of the Joint Force Protection Doctrine Manual and the Force Protection Guide; the latter was a procedures manual that contained security and emergency response guidelines and checklists. Drafted the Force Protection policy Defence Administrative Order and Directive (DAOD). Instructed in threat and risk assessment, criticality assessment, incident response and consequence management and related subjects on multi-disciplinary courses conducted for the Department of National Defence and other federal government departments. Director and author of the exercise that supported the courses. Conducted TVRAs of six (6) Department of National Defence installations in Canada and two (2) Royal Canadian Mounted Police installations against a variety of threats and hazards, including terrorist acts, environmental disasters and accidents.

14 3.3 Post Graduate Studies Royal Military College of Canada September 2001 November 2003 Post graduate student at the Royal Military College of Canada, Kingston, Ontario. Wrote thesis towards Masters Degree in Applied Military Science on emergency management/consequence management planning against mass casualty terrorism. Research included extensive review of academic literature and case studies on motivation, activities and capabilities of terrorist groups and design of chemical, biological, radiological, nuclear and high yield explosive devices. Thesis included the development of a number of scenarios of terrorist attacks on targets in Canada. 3.4 Senior Consultant National Defence Asymmetric Threat Project March 2000 August 2001 National Defence Headquarters, Ottawa, Ontario. Ajilon Canada Team Leader and Senior Consultant of Deputy Chief of Defence Staff study on capabilities needed by the Canadian Forces to provide security against present and future non-traditional threats, also known as asymmetric threats. This included developing strategic guidance and concepts for security of Canadian Forces missions, personnel, information systems and facilities from threats including acts of terrorism, insurgency, irregular militias and organized crime, information operations attacks and the use of chemical, biological, radiological, nuclear and high yield explosives, also known as weapons of mass destruction. Responsibilities included project management, research, analysis, conducting interviews and seminars, consulting with allies, other federal departments, provinces and municipalities, briefing senior leadership and writing Asymmetric Threat interim and final reports. 3.5 Director and Acting Director of Land Strategic Concepts Land Staff, National Defence (Army Officer Lieutenant Colonel) Acting Director and Director of the staff agency of 10 military officers and scientists responsible for future concepts and long-range planning for the Army. Team Leader and author of future security environment study and future army development plan. Responsibilities included: establishing the process for future planning in the Army, conceptual analysis, writing and editing Army strategic and operational planning documents, scenario development, preparing table top exercises, seminars and briefings for senior leadership and representing the Army on Joint boards and committees. Oversaw establishment of Army Experimentation Centre, with the responsibility for conducting tabletop exercises and simulations. Canadian representative on U.S. Army Transition Wargames and NATO Land Operations 2020 study, both of which included wargames and simulations related to future operations, including counter-terrorism, concepts, force structure, security and force protection. 3.6 Section Head, Land Strategic Planning Staff Land Staff, National Defence 1997 (Army Officer Lieutenant Colonel) National Defence Headquarters, Ottawa, Ontario. Section head in Directorate responsible for staff support to Army long-range planning, allocation of resources to operations and training and coordination with the Navy and Air Force planning staffs.

15 3.7 Coordinator and Acting Director, Land Requirements Land Staff, National Defence (Army Officer Lieutenant Colonel) National Defence Headquarters, Ottawa, Ontario. Deputy Director/Coordinator and, for one year, Acting Director of the staff agency of 90 military officers and civil servants responsible for developing Army equipment requirements and overseeing project management of Army capital projects, including force protection and security projects. Responsibilities included: analysis and coordination of operational requirements, planning and programming of capital projects, preparing briefings and written reports for senior leadership, staffing urgent requirements for current operations, evaluation the performance of Army projects, representing the Army on Joint boards and committees, facilitating seminars with industry, and oversight of research and development projects. Served as member of planning team for several military deployments overseas. Conducted investigations into equipment, facility and security deficiencies that resulted in casualties on overseas missions, and staffed projects to rectify these deficiencies. 3.8 Directing and Instructional Staff, Royal Military College of Science Exchange Duties, Canadian Defence Liaison Staff London, England (Army Officer Lieutenant Colonel) Royal Military College of Science, Shrivenham United Kingdom, on exchange. Responsible for lecturing and preparing course material, in lecture, text and electronic form, on defence and security management, project management, trials management, operational research and evaluation. Lectured in operational analysis and conducted tutorials and seminars on munitions technology, vehicle technology, nuclear, biological and chemical defence, including response to an attack, equipment reliability and the security applications of technology. Course director of trials and evaluation course that made extensive use of simulation and risk management techniques. 3.9 Engineering Staff Officer and Project Manager Materiel Staff, National Defence (Army Officer Major) National Defence Headquarters, Ottawa. Project manager for projects to upgrade protection systems of military vehicles and project officer on a capital construction project to upgrade reserve force training facilities. Engineering and operational requirements staff officer for major capital project to purchase new family of vehicles. Conducted concept studies and analysis of threat and technology options, prepared briefings for senior leadership, supervised contracted operational analysis and computer simulation studies and prepared operational requirement documents.

16 3.10 Second in Command and Executive Officer, Trials and Development Unit Exchange Duties, Canadian Defence Liaison Staff London, England (Army Officer Major) British Army Trials and Development Unit, Bovington, United Kingdom, on exchange. Responsibilities included: Executive Officer of unit of 100 personnel, allocation of resources, coordination of trials program and oversight of tests of vehicles, weapons, communications, surveillance and nuclear, biological and chemical defence equipment, and conduct of briefings and displays for senior officers, allies and industry. Served as security officer of unit testing sensitive NATO equipment and hosting heads of state and cabinet ministers from a number of countries during a period of major terrorist threats to British Army establishments Combat Arms Officer National Defence (Army Officer) Served in a variety of Canadian Army tactical and operational level command, training and staff positions in Ontario, Germany, New Brunswick and Quebec. This included command of a tank, armoured vehicle and headquarters squadron, regimental operations officer, command of a longrange surveillance troop assigned to operations in Germany and regimental intelligence officer. He served as regimental operations officer during the October 1970 terrorist crisis.