When it comes to building a cybersecurity system, nothing can be perfect — but it can be bulletproof.
That’s the goal for the teams at AT&T and FirstNet, as they plan out security for the country’s first high-speed, nationwide wireless broadband network dedicated to public safety.
“We are going to great lengths to ensure that this network is as secure as possible because as you say, this could obviously be a target for attack,” said Chris Sambar, senior vice president at AT&T, during a July 20 hearing of the Senate Subcommittee on Communications, Technology, Innovation, and the Internet.
“We have to treat this network very differently than we treat our regular core AT&T network, so we will be building a couple of things that differentiate it, or a number of things,” Sambar said to Sen. Brian Schatz (D-Hawaii), who asked about cybersecurity. “First of all, the devices themselves need to be screened and ensured that they are secured for first responders. Secondly, the applications on the devices; the first responders won’t go to the regular application stores that we all go to, to get their applications. They will go to a FirstNet specific application store where the applications will be vetted for security and functionality.”
First responder traffic will also run on a separate core network, that’s both wireless and encrypted, Sambar said. Sambar told Federal News Radio AT&T is also standing up a security operations center over the next year, which will be monitored 24/7, 365 days a year.
“So there will be security professionals just looking at first responder traffic on the first responder core network,” Sambar said, adding the hope was to make the network security “as bulletproof as possible.”
Although FirstNet is housed in the Department of Commerce, it operates as an independent entity and receives its funding directly from Congress.
CEO Michael Poth said FirstNet is getting input from the Homeland Security Department, Justice Department, and Office of Management and Budget, on how best to secure the network.
“We’re going to do periodic inspections and audits, to make sure we’re meeting all the needs,” Poth said. “This is a very high-profile network and is highly susceptible for people wanting to try to attack it.”
Sen. Amy Klobuchar (D-Minn.) was also interested in the cybersecurity aspect of FirstNet data, and pointed out that while FirstNet represents a “new form of communication … with any new technology comes new risk.”
Sambar said his company is building the FirstNet network in such a way that no first responder data will touch the commercial AT&T network.
Security of the FirstNet network is one of the concerns highlighted in a Government Accountability Office report from Mark Goldstein, director of physical infrastructure issues.
GAO also reported concerns around:
providing network coverage to rural areas, in buildings, or underground.
ensuring the network’s overall resiliency.
managing frameworks for user identity, credentialing of users, access management, and prioritization of users on the network.
Coverage in rural areas was brought up by several senators who represent states with far-flung communities — not least of which was Hawaiian Senator Shatz, who asked both Sambar and Poth to “recommit or reaffirm [their] commitment to making rural coverage a priority.”
Another concerned senator was Jim Inhofe (R-Okla.).
“You’re dealing with states, communities, counties that are totally different,” Inhofe said. “We’re a rural state. To me that would pose a lot more problems. I do understand my state of Oklahoma is a rural state and it would be much more difficult I would think, to coordinate these things.”
Sambar said regardless of whether a state is rural or dense, what they’re looking for is broadband coverage “that’s fast, reliable, and gives priority access to first responders.”
“We hear virtually the same thing: we need coverage where first responders operate, which is everywhere,” Sambar said.
Sambar said AT&T is building 72 mobile cell tower trucks dedicated to FirstNet, which will be deployed all over the country where there is no broadband or where a natural disaster has knocked out power.
“We can drive one of these trucks into that rural area and pop up an antenna, and create a cell phone connection as well as a broadband connection for first responders, where they would have priority access to it,” Sambar said.
Poth said while the process to increase and improve rural coverage will take years, it will be addressed at each phase of the network’s build out.
“We’re forging new areas of how we work effectively with the private sector,” Poth said. “The model we pursued in kind of solving — in this example — rural coverage; we went out to the private sector and said what is the best approach to solve some of these problems.”
According to the GAO report, FirstNet came out of the Middle Class Tax Relief and Job Creation Act of 2012, which set aside $7 billion to fund the network’s initial build-out. After that amount, FirstNet must be self-funding.
Poth said FirstNet is three months ahead of schedule from the original set timeline. It awarded a 25-year contract to AT&T in March.
“This independent authority is not going to come back to Congress and ask for additional funds, ever,” he said. “I think that’s a significant plan that Congress had envisioned when they stood up this authority.”
“We don’t often around here have anyone ahead of schedule,” Inhofe said. “We ought to move you over into DoD.”