Record of Changes
Arkansas Emergency Operations Plan
Cyber Incident Support Annex

|Date of Change and Initials |Location and Nature of Change |
|9/17/2010- JRC |Minor editing corrections throughout document. |
|10/1/09 JC |Pg 3: reworded first sentence to clear up confusion. |
Cyber Incident Support Annex

Coordinating Agency:
Arkansas Department of Information Systems (DIS)

Support Agencies:
Office of the Governor
Arkansas Department of Emergency Management
Multi-State Information Sharing and Analysis Center (MS-ISAC)

Cooperating Public Organizations:
All Arkansas agencies, boards and commissions
Institutions of Higher Education
Public Schools (K – 12)

Authorities and References

Act 751 of 2007
National Response Framework (NRF)
National Incident Management System (NIMS)

Introduction

Purpose

The Cyber Incident Support Annex discusses policies, organizations, actions, and responsibilities for a coordinated approach to prepare for, respond to, and recover from cyber-related incidents impacting critical state government and educational processes.

Scope

This appendix describes the framework for state cyber incident response coordination among state and local government, institutions of higher education, and the public schools of Arkansas. The framework may be utilized in any incident of state significance with cyber-related issues, including significant cyber threats, disruptions, and crippling cyber attacks against state critical infrastructure information systems.

Concept of Operations

Large scale cyber incidents have overwhelmed government resources by disrupting the Internet, taxing critical infrastructure information systems and infecting critical infrastructure information systems. Similar events will likely happen in the future as more threats are revealed. The results of these events can lead to unavailability of information and systems that supports law enforcement personnel, health officials, health professionals, state emergency management professionals, educational professionals, and all the other organizations that sustain and provide critical services to Arkansas’ citizens. Cyber incidents can hinder the state’s ability to provide information to organizations outside the state during events that effect public safety and public health.

The Department of Information Systems is the focal point for cyber information on the state’s network which provides Internet and network connectivity to state agencies, institutions of higher education, public schools, and some county and city governments. DIS will coordinate response to cyber incidents to minimize damage. DIS’ responsibilities include:

• Providing indications and warnings of potential threats, attacks, and incidents; • Information-sharing both inside and outside the government, including best practices, investigative information, coordination of incident response, and incident mitigation; • Analyzing cyber attacks; • Providing technical assistance; • Assisting law enforcement with cyber related investigations, forensics analysis, and prosecution; • Attributing the source of cyber attack; and • Removing known sources of attack from within the state network.

This is a concerted effort among the coordinating public organizations.

Organizations

Department of Information Systems

Personnel from the Department of Information Systems’ divisions make up the response coordination group. The Department of Information Systems maintains round-the-clock contact information for appointed technical professionals from organizations on the state network in order to communicate during a cyber event.

Emergency Response Actions

Upon detection of a threat or significant event on the state network, the Department of Information Systems response team meets to determine appropriate action to mitigate damage. Depending on availability of infrastructure and the nature of the communication, communication can take place by fax, voice, or email. Communications can include methods of prevention, instructions for cleaning, requests to disconnect infected machines, updates on the general health of the network and other types of communication.

During a significant incident, the Department of Information Systems will report information to the Multi-State Information Sharing and Analysis Center (MS-ISAC) which can share the information with the United States Computer Emergency Readiness Team (US-CERT) of the Department of Homeland Security. The Department of Information Systems may also consult with the InfraGard Arkansas Members Alliance chapter, an FBI-sponsored group of public and private organizations sharing information related to cyber and physical security.

Challenges and Considerations

• The state network supports most Arkansas government agencies that provide critical services, including those that support public safety and public health. • Most local law enforcement personnel depend on the state network to provide current, accurate information. • The technical personnel within state agencies must keep up with current technologies as cyber threats change and the training can be expensive. • Redundancy must continue to be built into the state network and the continuity of operations plans created by the state agencies must continue to be maintained and tested.

Responsibilities

Table 1. Agency Roles and Responsibilities

|Function |Responsibilities |
|Office of the Governor |Ensure that critical state government services remain available in the event of a |
| |cyber attack. |
| |Keep Arkansas citizens abreast of efforts to reestablish unavailable services. |
|Arkansas Department of Information Services (DIS) |Provide training to agencies on conducting table top exercises involving cyber |
| |security scenarios. |
| |Facilitate table top exercises when requested. |
| |Monitor the state network at all times for suspicious cyber activity. |
| |Report any suspicious activity to MS-ISAC, the Office of the Governor, and ADEM when|
| |critical infrastructure is significantly threatened by a cyber incident. |
| |Communicate with organizations experiencing cyber infections on the state network. |
| |Provide information regarding infection eradication. |
| |Configure or, if necessary, disconnect infected equipment from the state network. |
| |Provide access to hosted services within 72 hours of a disaster through a disaster |
| |recovery alternate site. |
|Arkansas Department of Emergency Management (ADEM) |Work with DIS, teaching and leading table top exercises involving cyber security |
| |scenarios. |
| |Activate the state EOC to coordinate response and recovery during a large scale |
| |cyber attack. |
|Multi-State Information Sharing and Analysis Center |Provide access to the United States Computer Emergency Readiness Team (US-CERT) of |
|(MS-ISAC) |DHS. |
| |Provide a means of communications with other states’ chief security officers. |
| |Provide a focal point for information related to state government cyber security |
| |Can aid in establishing trends from reported information. |
| |Offer technical expertise to states during potential cyber incidents. |
| |Notifies states when it becomes aware of compromised systems owned by state and |
| |local governments. |
|All Arkansas Agencies, Boards, Commissions, Institutions |Employ appropriate cyber security measures to defend their organizations systems |
|of Higher Education and Public Schools (K – 12) |Communicate with DIS about organizational cyber events |
| |Agree to disconnect and clean infected machines. |