OT (or BCP) - Thoughts on Haiti, Olympics, and other disasters

["Rob, grandpa of Ryan, Trevor, Devon & Hannah" <rmslade () shaw ca>]

Absent those who have gone gaga over the iPad, the top news for the past two 
weeks has been the earthquake and disaster in Haiti.  The concern, the outpourings 
of support (and, yes, the malware and phishing sites that have been attempting to 
capitalize on the crisis) are all reminiscent of the tsunami, Katrina, and other 
events stretching back in time.

Haiti has been different.  The major factor has been the total breakdown of 
infrastructure, and the consequent difficulty in getting the help to those who need 
it most.

Those of us in the security communities are always interested in disasters.  We are 
forever dealing with crises, both large and small, assessing risks, planning and 
comparing mitigation strategies, and looking at the management of it all.  So, I 
recall that, when Katrina struck, there were endless discussions of the latest details, 
the structures, the organization (and lack thereof) in the followup efforts.  One 
person made a donation to a charity, and challenged the group to match his gift.  I 
upped the stakes.  I challenged everyone to get trained for disasters.

Unfortunately for the point I'm trying to make, I am speaking from a position of 
privilege.  Canada has the best emergency structure in the world.  (Our disaster 
response team is in Haiti at the moment, and is always one of the first on the 
ground whenever there is a major incident, anywhere.)  British Columbia has the 
best emergency response management system in Canada.  (No, I'm not 
volunteering at the Olympics.  But for the past year, I've been working with a 
group that has been planning for the fact that, with the big event in town, even a 
minor crisis is probably going to mean that we may have to provide emergency 
lodging for a few hundred people.)  And the North Shore, where I live, has the best 
disaster training regime in BC.  (The group lodging thing isn't done by VANOC: it's 
an effort by the ESS volunteers from the North Shore, Vancouver, and Richmond.)

Emergency response, in a major disaster, is not simply a matter of having water, 
generators, blankets, and rescue dogs.  It has to do with organization, co-
ordination, management, and, particularly, trained people.  Most of them 
volunteers, since nobody can afford to pay for a full-time staff of all those you 
need to have ready in an emergency.

That's where you come in.

Get trained.

There is some emergency measures organization that covers your area, regardless 
of where you live.  Your local municpality probably has an office.  And they 
probably needs volunteers.  And they provide training.

If you volunteer, you will probably get trained.  For free.  (You may also get 
additional perqs.  I get my flu shots paid for every year, since I'm an emergency 
worker.)

First of all, you'll probably get trained on what you need for you and your family.  
What do you need to survive the first 72 hours following a disaster?  Do you know 
how much water, what type of food, etc, you need, in the event of a total failure 
of utilities and other factors we rely on?

Then there are the skills you need to help other people.  Sometimes this might 
relate to first aid, or structural assessment of buildings after an earthquake, etc.  
However, there are many necessary skills that are not quite so dramatic.  Most 
emergency response, believe it or not, has to do with paperwork.  Who is safe?  
Who needs care?  Do families need to be reunited?  Documentation of all of this is 
a huge effort, which goes on long after the bottles of water and hot meals have 
been distributed.

Then there are management skills, to co-ordinate all of the other skills.  An awful 
lot of "charity" gets wasted because some people get too much help, and others 
don't get enough.  Someone needs to oversee the efforts.

Training in all of this is available.  And, in an emergency, having trained people is 
probably more important than having stockpiles of tents.  Trained people can 
make or improvise shelter.

Maybe your municipality or county doesn't have a formal emergency structure.  In 
that case, there are organizations covering the gap.  In Canada, the government 
doesn't do it all.  The Red Cross and Salvation Army are two of the groups that 
have been working on this for years, and have specialists.  In BC we have courses 
provided by the Justice Institute in a number of areas.  The provincial government 
has created a marvelous structure, ensuring consistent organizational layout for all 
sizes and types of disasters, and all types of response.  But we don't bother 
reinventing the wheel.  In our formal training curriculum, a number of the courses 
are prepared, provided and run by the groups that have been doing it for years, and 
know it best.  If your government doesn't have the courses available, go to those 
who do.  They are around.

(For those who have security related certifications, like the CISSP, ongoing 
professional education is a requirement.  A constant complaint is that training is 
expensive, and getting the credits costs too much.  I get all kinds of training 
related to business continuity and disaster recovery.  I get almost all of it free.)

Get trained.  Volunteer.  You'll get a wealth of experience that will help you plan 
for all kinds of events, not just for major disasters, but for the minor incidents 
that plague us and our companies every day.  You'll be ready for the big stuff, too.  
You'll be able to keep yourself and those near to you safe.  You'll be able to make 
a difference to others, certainly reducing suffering, and possibly saving lives.  If 
and when something major happens, you will be a part of the infrastructure 
necessary for the response to be effective.  You'll be part of the solution, rather 
than part of the problem.

======================  (quote inserted randomly by Pegasus Mailer)
rslade () vcn bc ca     slade () victoria tc ca     rslade () computercrime org
It is more fun to talk with someone who doesn't use long,
difficult words but rather short, easy words like 'What about
lunch?'                                                       - Pooh
victoria.tc.ca/techrev/rms.htm blog.isc2.org/isc2_blog/slade/index.html
http://blogs.securiteam.com/index.php/archives/author/p1/
http://twitter.com/NoticeBored http://twitter.com/rslade
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.