Denial of Service Prevention in PSAPs
This blog post provides an overview of the threats posed by DoS attacks against PSAPs, their potential operational and public safety impacts, and the technical and organisational measures available to reduce these risks. It highlights the importance of resilient system design, network redundancy, intelligent traffic filtering, and close cooperation with telecommunications providers to ensure the continuous availability of emergency services.
In a world where everything is interconnected, even our emergency response chains are no longer immune to cyberattacks. While a conventional Denial-of-Service (DoS) attack might merely cripple a shopping website, for an emergency call center (PSAP – Public Safety Answering Point), it can mean – in the worst-case scenario – the loss of human life.
DDoS against IT-Infrastructure
Today, a modern PSAP is a highly complex data center. In addition to telephone lines, critical systems are connected to the internal network and partly even to the internet: computer-aided dispatch (CAD) systems, geographic information systems (GIS) for navigation, and digital radio interfaces (TETRA). During a DDoS attack, an attempt is made to bring these servers to their knees through a massive flood of data packets.
Attack Vectors at the Server Level
1. Volumetric Attacks: The PSAPs internet connection is flooded with such a massive volume of junk traffic (Gbps) that legitimate data packets (e.g., emergency calls, GPS data from ambulances) can no longer get through.
2. Protocol Attacks: These exploit vulnerabilities in network protocols (e.g., SYN floods) to exhaust the resources of firewalls or load balancers.
3. Application Layer Attacks (Layer 7): These are the “surgical” attacks. They imitate human behavior and deliberately overwhelm the PSAPs database with queries until the software freezes (for example, if the PSAP receives information via web forms).
If a PSAPs servers are paralyzed by a DDoS attack, a state known as “flying blind” ensues:
- Unavailability: Emergency numbers are no longer reachable if the telephone system is affected.
- Loss of Tracking: Dispatchers can no longer see the real-time locations of emergency vehicles.
- No Documentation: Logs must be maintained manually, which massively increases the error rate.
- Information Blackout: Critical data (for example fire safety plans) becomes inaccessible.
What’s TDoS?
In the context of PSAPs, one often speaks specifically of TDoS (Telephony Denial of Service). This involves not attempting to crash a server through computational overload, but rather clogging the communication channels.
- The mechanism: Hundreds or thousands of automated calls (botnets) simultaneously flood the emergency number 112.
- The consequence: Genuine emergency calls end up on hold or receive a busy signal. Call takers are occupied with “phantom calls” while, on the other side of the city, precious seconds tick away during a heart attack or a residential fire.
The specific risks to public safety
A successful attack on a PSAP triggers a dangerous chain reaction:
1. Delayed Response Times: The “Golden Hour” – the critical window in emergency medicine – cannot be met.
2. Psychological Strain: Call takers face extreme stress when they realize they cannot handle the overwhelming volume of calls and that genuine emergencies are slipping through the cracks.
3. Loss of Trust: If citizens are unable to reach emergency services, the public’s sense of security erodes.
4. Vulnerability to Extortion: Additionally, these attacks can be part of a ransomware strategy – “Pay up, or we will cripple your entire emergency response chain.”
Specific Defense Mechanisms for PSAPs against DDoS and TDoS Attacks
Against the brute force of a massive stream of data or calls, only a combination of technology, strategy, and cooperation is effective. To protect the systems, PSAPs need to rely on a multi-layered defense strategy:
Filtering
Before data traffic reaches the PSAP, it is routed through a scrubbing center. There, high-performance servers filter out malicious traffic, while “clean” data packets are forwarded with almost no delay. This is particularly important for intercepting volumetric attacks.
To secure their telephony systems PSAPs should rely on Session Border Controllers (SBCs). These act like bouncers:
• They analyze call patterns in real time.
• Calls from suspicious sources – or occurring at an unnaturally high frequency – are blocked before they even reach the call taker. The challenge here is to avoid filtering out genuine emergency calls. It might be better just to lower the priority of these calls.
Geofencing and Prioritization
Since emergency calls are typically geographically localized, calls originating – atypically – from abroad or from anonymous VoIP services can, during an attack, be assigned a lower priority or pre-filtered via automated prompts (IVR: “Press 1 if you have an emergency”).
Air Gapping and Network Segmentation
Critical systems should be isolated from the public Internet as much as possible (air gapping). If an Internet connection is necessary (e.g., for SIP or emergency apps), it is routed through strictly controlled gateways and demilitarized zones (DMZs) to protect the rest of the network.
Redundant Data Centers
PSAPs often operate within a network. If the server infrastructure at Site A fails due to an attack, Site B takes over (geo-redundancy). Data is mirrored in real time, ensuring that operations can continue seamlessly.
Dynamic Routing
If a PSAP is disabled by an attack, the system must be capable of automatically rerouting calls to neighboring PSAPs. This requires a high degree of interconnectivity at several levels.
Close collaboration with providers
Telecommunications providers sit at the source. They can “clean” traffic within the core network itself – before it even reaches the PSAP infrastructure.
Conclusion
The threat posed by TDoS attacks is real and is growing alongside the professionalization of cybercrime. While absolute security is unattainable, the risk can be minimized through the deployment of intelligent filtering systems and robust networking among PSAPs. Ultimately, in this domain, cybersecurity is nothing other than disaster protection in the digital realm.
While TDoS blocks communication, DDoS endangers overall coordination. Protecting servers is, therefore, not just an IT task, but a core element of security strategy. Only those who secure their server landscape like a fortress can remain operational – even under fire.
