Conformity Assessment Cybersecurity & Conformity Assessment introduction to the Generic Matrix Model David Hanlon IEC Secretary of the Conformity Assessment Board Standardization in the Digital Transformation, St Petersburg, Russia 2018-05-22

CRITICAL INFRASTRUCTURE CYBERSECURITY SMART GRID TRANSPORT SYSTEMS BANKING SYSTEMS OIL CLOUD COMPUTING RAIL HACKING AVIONICS INTERNET OF THINGS CRITICAL INFRASTRUCTURE GAS 2

CYBERSECURITY Security Risk  International Standards  Appropriate level of Conformity Assessment 3

CYBERSECURITY value creation Standards and Conformity Assessment are like two sides of a coin… …neither side has value without the other side Standards + Conformity Assessment = Value 4

GENERIC MATRIX MODEL  a system’s-approach to cybersecurity A tool in a process Cross-references  Technical system elements against  Objects of conformity (things that can actually be assessed) Risk analysis Standards gap analysis  a system’s-approach to cybersecurity 5

Technical-system Systems ≈ Systems A technical system Elements  interacting, interacting, interdependent  physical and/or virtual  Confined or dispersed  Need occasional/constant repair, replace, update, upgrade  many transmit & receive information Forming purposeful whole Periodic or constant modification  by virtual, automated or human intervention 6

physical security ≠ physical security cybersecurity ≈ cybersecurity Technical-system Systems ≈ Examples Industrial Automation System  Many components  In confined physical area Railway System  Many components  Spread over large physical area Electrical Energy Grid System  Many components  Spread over large physical area physical security ≠ physical security cybersecurity ≈ cybersecurity 7

Technical-system Components SYSTEM MODEL Interconnections Model of Technical-system Model of Components product A, B… Product development Product manufacture etc Interconnections SYSTEM MODEL Systems integration design Systems integration implementation etc / realisation Interventions Asset owner operation Systems upgrades / patch management Vendor & service providers etc 8

Things that can actually be assessed. Objects of conformity Things that can actually be assessed. Products Physical products or components Virtual products Data, information, identity etc People competency System design, build competencies IT / OT competencies Management process cometencies etc Service = + + Processes Quality management & operational processes Manufacturing, system build processes Supply chain management, detection & recovery processes etc 9

Systems-approach to CA Generic Matrix Model (GMM) OBJECTS OF CONFORMITY Products Products People Processes Components product A, B, C… Product development Product manufacture etc Interconnections Systems integration design Systems integration implementation etc / realisation Interventions Asset owner operation Systems upgrades / patch management Vendor & service providers SYSTEM MODEL People People competency Processes 10

Systems-approach to CA Generic Matrix Model (GMM) Components product A, B, C… Product development Product manufacture etc Interconnections Systems integration design Systems integration implementation etc / realisation Interventions Asset owner operation Systems upgrades / patch management Vendor & service providers SYSTEM MODEL OBJECTS OF CONFORMITY Products People Processes Testing Product design competency Design processes Product manufacturing competency Manufacturing processes Systems design competency Interoperability Component selection processes Systems build competency Design / realization processes IT/OT competency People selection processes Supplier qualification processes IT/OT competency 11 Service processes

Generic Matrix Model (GMM) 12

Cybersecurity Standards Situation >600 standards Convergence OT  IEC 62443 series IT  ISO/IEC 27000 series Examples Industrial Automation System  IEC 62443 Railway System  IEC 62443 Smart Grid Electrical System  IEC 62443, ISO/IEC 27000, IEC 62351 Cloud Computing  ISO/IEC 27000, IEC 62443 ISO/IEC 19086 13

Systematic Methodology Map sector application to Generic Matrix Model (GMM) Risk analysis of sector application map Identify and rate risk points Determine appropriate level of CA for each risk point according to risk level rating Identify requirements documents (standards) Determine what is available/appropriate  standards gap analysis Determine how to fill the gaps ( standards development) Apply appropriate CA to appropriate standards at each risk point Revue, revise, renew (R3) periodic 14

IEC standards development (SD) & conformity assessment (CA) activities  global services ISO/IEC 17000 series International Standards for CA 15

IECEE global CA schemes CB-Scheme new Cybersecurity Scheme  IEC 62443 series 16

Common Regulatory Objectives UN CRO guidelines Common Regulatory Objectives Cybersecurity A Common Regulatory Framework for Cybersecurity Based on…  Generic Matrix Model  Systematic Methodology  IECEE global cybersecurity CA services  world’s best practice 17

Questions 18

Thank you David Hanlon Standardization in the Digital Transformation, IEC Secretary of the Conformity Assessment Board Standardization in the Digital Transformation, St Petersburg, Russia 2018-05-22