Intrusion Detection for Public Transportation Facilities Handbook (2003)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Intrusion Detection for Public Transportation Facilities Handbook 109 CHAPTER 5. Management Policies And Procedures Prior to the attacks of September 11, 2001, many transit systems were already using a variety of intrusion detection strategies. Initially, these strategies were employed to reduce hazards, vandalism and crime; restrict access to secure areas; and raise passenger perceived levels of security when using the transit system. Many of the intrusion detection systems were installed as preventive measures. They were an element in a larger project when buildings were constructed, rehabilitated, or expanded. Others, such as alarm systems placed at parking lots/structures, or barriers at administrative buildings, were installed in response to a specific incident. Generally, these systems have not been modified extensively since they were installed or initiated. In the case of video storage, some agencies have converted from VHS videotape to digital video recorders (DVR). Fences have been repaired, additional cameras and lighting have been installed, and alarm systems have been up-graded. These are the typical system improvements that have been made to intrusion detection systems. During the course of the project survey (See Chapter 2) and the follow-up interviews, the study team sought to understand the organizations’ decision process for selecting the intrusion detection strategies that they are currently using and what their future plans are. The attacks of September 11, 2001, have clearly elevated the priority of security within the transit industry. They have caused some transit systems to implement temporary measures to increase their ability to detect intrusions. Many transit systems have also conducted security surveys to assess their vulnerability to attack and level of preparedness. (For more information on threat and vulnerability analysis, please refer to FTA’s Public Transportation System Security and Emergency Preparedness Planning Guide, DOT-FTA-MA-26-5019-03-01.) The temporary solutions are candidates to upgrade to a level of permanence, and the findings from the assessments also may result in consideration of new or improved intrusion detection strategies. These new projects have taxed the technical, professional, and financial resources available to the transit systems. In the absence of additional funds being made available to the transit agencies for security related projects, these projects are evaluated for funding against all of the other projects awaiting funding. As is the case with any project, there are many decision points throughout the project’s life. Intrusion detection system projects are no exception. The process begins with the identification of the need. The key issue, once the need has been identified, is how to allocate priorities against the many other pressing requirements at the transit agency. If it is determined that the need is critical enough to address as a project, it will be further defined, and the next series of decision points will be assessed to select and formulate a solution. However, more information may cause a deferment of the project, the implementation of interim solutions, or the abandonment of the project. Limited resources have, in some cases, resulted in decisions to identify and implement quick low-cost upgrades. Assuming that the project is proceeding, the solution(s) have been selected, and vendor supplied products and/or services are required, the implementation approach and procurement methodology become key decisions. These decisions can have a significant impact on cost, schedule, and quality. Implementations can be staged or fast tracked; systems integrators may be used; use of in-house forces, design-build may be an appropriate process to utilize, etc.

Intrusion Detection for Public Transportation Facilities Handbook 110 5.1 PROJECT TEAM FORMATION The Project Team responsible for securing the transit system should be a broad based team with a variety of professional skills and perspectives to assist in: x Defining the problem x Identification, evaluation, and selection of the solutions x Implementing the solution/s Although the scope and magnitude of the project will be the determining factor, the membership of the Project Team would generally be drawn from among the following: x Operations x Procurement x Human Resources x Engineering x Security x Labor Relations Broad representation on the project teams will insure full consideration of the issues as the projects move forward and increase the likelihood of success. Depending on the type of solutions being considered, it may be of value to also involve the Information Technology function at the transit system. Where necessary, other individuals, with specialized expertise, should be brought in to assist in the effort. 5.2 PROBLEM DEFINITION The definition of the problem can be determined generally by the security assessments that are being conducted at many transit systems. In some cases, assessments were conducted prior to September 11, and in other cases the attacks of September 11 precipitated a security assessment. These assessments serve to identify the gaps in the current intrusion detection systems. They also identified locations that may be potential targets for a terrorist attack. For example, one transit system had a supply of compressed natural gas to fuel the buses stored at a bus maintenance facility. A detailed security assessment was conducted of the facility and intrusion detection was enhanced significantly with additional fencing, lighting, cameras, and guards. The transit system was not designed with intrusion protection as a design criterion. Some of the short-term remedies that were employed included: fencing (but no razor wire), and new locks. In addition a monthly security assessment of perimeter conditions is now conducted and identified gaps are addressed immediately. Identify short-term remedial actions - Some of the gaps that have been identified were addressed by some basic low-cost system upgrades. The chief executives that were interviewed strongly recommended that transit systems seeking to upgrade security look for the “low hanging fruit”. These measures could be implemented quickly and generally required little capital investment. In some cases, these measures included the installation of water-filled or Jersey Barriers, the repair of or addition of fencing, new locks, additional lighting, or the assignment of additional law enforcement resources. Security gaps were also found in information technology. Several transit systems found that the Internet contained information and maps on all of the

Intrusion Detection for Public Transportation Facilities Handbook 111 access points to the transit system. The short-term corrective measure was to secure the non- passenger access and egress points and to concurrently have the information removed from the Internet. During an interview, a chief executive noted that closing a gap with the deployment of labor might not always be the optimum solution because of the labor costs. The chief executive also indicated that security was not the only concern, “ongoing operations costs are also a concern.” Begin to identify long-term measures - Long-term solutions may entail the use of technology, environmental design, or some other capital investment. It may be the use of technology to reduce the use of manpower to close a gap or enhance the ability to detect intrusions, or the inclusion of increased security measures in the design of a new facility. Other solutions may be the development and implementation of complex procedures and processes, requiring labor negotiations, agreements with other agencies, etc. As is the case with the short-term measures, financial priorities are a key factor to consider. Identification, evaluation and selection of the solutions – There are an array of solutions being offered to transit systems to enhance intrusion detection. Some are specific to a particular type of gap. Some have to be modified from the original intended purpose to satisfy the requirements. Others, such as fencing, are directed toward a more general requirement. Most of the solutions involve the use of manpower to varying degrees. Others may only be the implementation of a process or a procedure. Some of the technologies being offered are very complex and the transit systems may not be familiar with what is available. One chief executive noted that: “Too many vendors with technology show up at the door.” Another chief executive expressed frustration over the numerous products being offered that claim to perform a task, but when tested, fail. The chief executive suggested, “The Department of Defense should have a clearinghouse of technologies, thereby saving agencies the time of performing extensive research into potential countermeasures and giving agencies assurance that the technology works.” Outside expertise may be required to assist in the evaluation and selection. There are a number of key considerations in identifying and selecting a solution. x How well will it work? x Does it perform as advertised? x Does it satisfy the need? x How much will it cost to purchase and install? x How much will it cost to maintain and operate? x What supporting or related systems will need to be upgraded or modified, and at what cost? x How long will it take to implement? x Is there adequate expertise available to support and maintain the equipment? x What are the training requirements? x Are repair and replacement parts available? x How long will parts be available?

Intrusion Detection for Public Transportation Facilities Handbook 112 x Will it have any adverse impact on service? x Is it too labor intensive? x Are there any labor contract issues? x Can it be integrated into the existing system? x Is it compatible with the existing systems? This represents a sample of the factors to consider. Additional technical and policy considerations will likely be appropriate to accommodate local requirements. 5.3 IMPLEMENTING THE SOLUTIONS The implementation phase of the project consists of several elements. It includes the preparation of the solicitation, the selection of vendors, and the actual implementation. Prior to the preparation of the solicitation, the optimum implementation approach should be determined. The selected approach will have an impact on the specifications and the form of the solicitation. Among the approaches that may be considered are: x Use of an integrator as the prime contractor x Use of in-house forces to install the technology x Use some form of a design build or turnkey approach x Use a fast track implementation approach x Use a traditional design bid build approach x Stage the implementation As is the case with any project, a number of factors influence the implementation approach. These factors include: x Degree of project urgency x Funding availability and sources x Availability of in-house expertise x Local procurement laws x Degree of technological complexity x Degree of project risk x Desired level of control x Project schedule x Availability of contractors and suppliers x Level of required integration Once the project approach is determined the procurement can be conducted. In those cases where FTA funds are used, in whole or in part, to fund the intrusion detection project, the procurement methodologies allowed are contained in Section 9 of FTA Circular 4220.1D. The procurement process can range from a telephone call to a request for proposals or sealed bids. While the FTA Circular provides broad choice and discretion in the procurement methodology, local law usually restricts the method of procurement more tightly than these Federal requirements. Procurement methodologies and considerations would therefore depend

Intrusion Detection for Public Transportation Facilities Handbook 113 on the type of intrusion detection project, complexity, estimated cost, and applicable procurement regulations that apply to the transit system. Under certain restricted circumstances, a non-competitive proposal from a sole source will be appropriate. In cases of emergencies, as may be the case with some intrusion detection projects, many transit systems are generally permitted, in accordance with Federal and state law, to enter into sole source contracts in those cases where it has been determined that a public exigency exists. Non-competitive proposals from a sole source may also be appropriate in certain upgrade projects that involve proprietary software or systems.