If the recent attack in Orlando has shown Caitlin Durkovich anything, it's that any site can now be a target of terror.
"We're living in a different world right now," she said. "The reality is that these places that you go for entertainment, that you go to enjoy, are now targets. The battlefield is here at home."
The assistant security of infrastructure protection spoke on June 21 at the AFCEA Homeland Security Conference and discussed initiatives that the Department of Homeland Security had in place to protect critical systems from attacks, whether they be digital or physical.
DHS has designated 16 sectors as critical infrastructure systems that the federal government works to protect, including electrical grids but also shopping malls and sports arenas.
Durkovich said that large-scale entertainment infrastructures, like the National Football League, have developed state-of-the-art systems to protect against a broad attack.
But the June 12 attack at the Pulse Nightclub that left 49 dead has opened the door to smaller targets that may not have the resources or training to handle terrorist assaults.
"My concern is not FedEx Field, it's not Nats Park. It's the 9:30 Club, it's M Street. It's the 2000 block of Wilson Boulevard [in Arlington]," she said. "The crowded city streets and smaller venues where the public goes to gather."
Preparedness
To help the smaller, so-called soft targets guard against the increasing likelihood of a terror attack, Durkovich said her office has started a campaign called "Connect, Plan, Train and Report."
Conceived after last fall's terror attacks in Paris, the plan involves having federal agencies connect and coordinate with local law enforcement before an incident occurs so multi-level response and communication is already in place.
"We regularly encourage owners and operators to call your local police departments and local sheriffs, build a relationship in advance," she said. "Make sure they understand your facility, invite them over, have them train with you and develop plans.
"Because the last thing that you want is for that local law enforcement to arrive at your business establishment in the middle of your worst day."
She added that reports coming out of Orlando suggest that the speed of law enforcement response was aided by previous training for such an attack.
For business owners looking to develop better preparedness, Durkovich suggested reaching out to local police departments or DHS's Protective Security Advisors to get training and education. The other aspect private businesses need to take into account, she said, are updated preparedness and security plans in case of an event.
"You would be surprised at numbers of owners and operators that don't have a plan or built plan 10 years ago and haven't dusted it off," she said. "Increasingly, we are seeing the use of CCTVs. We are seeing the use of more screening measures in place. So thinking, 'What's appropriate for the business that I run?'"
Other aspects include an emergency communications plan using tools like social media. Durkovich again pointed to Orlando as an example, were Pulse nightclub staff warned the public to leave the area through its Facebook page.
On the cyber side, Durkovich said DHS is continuing to prevent cyberattacks through info-sharing initiatives with public and private partners.
"We work very closely with owners and operators to share information directly," she said. "We do that through a number of different mediums and tools, most notably the Homeland Security Information Network."
The network provides each critical infrastructure sector with a portal in which DHS posts threat cyber threat updates and information. DHS is also using automated indicator sharing, but also business partnerships to share threat information at classified levels.
Durkovich said the agency is also working to share information and advice through a number of DHS experts who are available to businesses across the nation in an effort to strengthen the response to a cyberattack.
"Most of my customers, the owners and operators of critical infrastructure, are not inside the Beltway," Durkovich said. "So we have protective security advisers who are security experts. We have cybersecurity advisers who are cyber ninjas and can interact directly with owners and operators and really bring the department and federal government's resources to bear in helping [them] manage risk."
Durkovich added that DHS is further examining how the interdependencies of industries that could be effected by a cyberattack and the tools that DHS can apply to prevent and mitigate such an attack.
