Cybersecurity and Communications Security for Public Safety Radio
What this domain tests
Domain 7 covers protecting confidentiality, integrity and availability of public safety radio: P25 encryption and key management, network segmentation, device hardening and the policy around them.
Core rules
- P25 link-layer encryption uses AES-256 as the current standard, with legacy DES-OFB still present in older fleets. Encryption protects the air interface only; console links, ISSI/CSSI and backhaul need IPsec, TLS or MACsec.
- Key management: a Key Management Facility generates and distributes keys, key fill devices load them, and a Key Encryption Key protects Traffic Encryption Keys delivered by OTAR/OTAP.
- Keys must be rotated, escrowed securely and zeroised on decommissioned radios. Lost or stolen radios need remote inhibit and key revocation.
- Authentication matters as much as encryption: unit registration, certificate or 802.1X device identity, role-based console access, and removal of default credentials.
- Segment the radio core from business IT and the internet with firewalls, ACLs and VLANs, log to a SIEM, and patch firmware on a controlled schedule.
- Map controls to the NIST Cybersecurity Framework functions (Govern, Identify, Protect, Detect, Respond, Recover), use FIPS 140-3 validated modules where required, and follow the CJIS Security Policy for law-enforcement data.
Worked example
A portable is reported stolen. The team issues a remote inhibit so the unit cannot register, removes its keys from the KMF so any recovered key material is useless, reviews registration logs for that unit ID to see whether it was used after the theft, and documents the timeline. Encryption alone would not have stopped use of the radio; inhibit plus key revocation did.
Traps
Believing a trunked system is secure because it is not scanner-friendly, assuming AES covers the console-to-site link, leaving default passwords on site equipment, and failing to plan key rotation so a lost KMF takes the fleet offline.