© 2011 EnerNex. All Rights Reserved. Lemnos Interoperable Security Project Background and Benefits 8/11/2011

© 2011 EnerNex. All Rights Reserved. Energy Sector Challenges  Security of the control systems utilized in the energy sector is more IMPORTANT than ever before as control system are evolving rapidly – Increasing use of Ethernet and IP communications Increased attack surface – Connections to external systems Supports changing operational and business needs – New and emerging regulatory requirements 2

© 2011 EnerNex. All Rights Reserved. Energy Sector Challenges  Implementing Security is more COMPLICATED than before – End Users are faced with limited security expertise It shouldn’t take a security expert to configure a device properly! – Vendors need alternatives to proprietary solutions – End Users and Vendors need a straight forward method to communicate user needs, product features, and configuration parameters relating to cyber security functions 3

© 2011 EnerNex. All Rights Reserved. Lemnos Project Background  Funded by DOE under the Cybersecurity for Energy Delivery Systems (CEDS) Research and Development Program  Ultimate goal is to make interoperability of devices supporting cyber security functions less difficult to the end users – Often labor intensive and requiring extensive security expertise by the end user – Installed configurations often different for various vendor pairs  Lemnos emphasizes the development and use of a common set of configuration parameters

© 2011 EnerNex. All Rights Reserved. 5 Define functional requirements based on asset owner needs STEP 1 Select open source specifications (IETF RFCs) to meet the identified functional requirements STEP 2 Develop Interoperable Configuration Profiles for these specifications tailored for the energy sector control systems environment Test and validate the interoperable configuration profiles STEP 3 STEP 4 Lemnos Process

© 2011 EnerNex. All Rights Reserved. Lemnos Project Partners  EnerNex (Prime Contractor to DOE)  Sandia National Laboratories (FFRDC) – Directly funded by DOE  Tennessee Valley Authority (Utility/End User)  Schweitzer Engineering Laboratories – Sub contractor to EnerNex 6

© 2011 EnerNex. All Rights Reserved. Participating Vendors and R&D  Participating Vendors To Date – Cisco – Encore Networks – GarrettCom – Industrial Defender – N-Dimension – Phoenix Contact – Ruggedcom – Siemens  Participating R&D Organizations – Electric Power Research Institute (EPRI)

© 2011 EnerNex. All Rights Reserved. Current Lemnos Project Status  Security functions and protocols identified to date – Messaging (Syslog) – Centralized Authentication (LDAP) – Secure channel (IPsec) – Secure remote access (SSH)  Lab testing and field testing continues  DOE funding ending this year – Potential private sector sponsorship in the future – Looking for utility input to identify priorities 8

© 2011 EnerNex. All Rights Reserved. End User Perspective  Enables End Users to choose BEST IN CLASS solutions for various facilities (versus a “one size fits all”) – For example, an electric utility may have unique needs for: -Communications Hub/Control Center -Generating Plant DCS -Substation LAN -Outdoor and Pole top  Reduction in setup/deployment time and effort – Lower Total Cost of Ownership  Reduction in configuration errors  Communicates equipment requirements 9 Lemnos Benefits

© 2011 EnerNex. All Rights Reserved. Vendor Perspective  Permits shortened development cycle by providing reference design – OPSAID reference design available to public  Uses configurations proven in lab and field to secure control system communications in a way that doesn’t trade off reliability  Enhances the vendor’s ability to meet the customer’s needs – Provides a common understanding between customer and vendor 10 Lemnos Benefits

© 2011 EnerNex. All Rights Reserved. Moving Forward  Challenges for Cybersec-Interop TF after handoff from Lemnos – Versioning of the ICPs Moving forward, options in the IETF RFC’s will become deprecated to maintain alignment with NISTIR 7628 and other industry guidance Difficult to maintain backwards compatibility Interoperability may be at the ICP version level – Certification and Conformance Additional details needed in ICPs? 11