ISPE Cyber Security S99 Update December 08, 2009

Topics to be covered  Does it matter?  Activity  ISA S99  S99 Work completed  S99 Work in progress

SCADA Specific information Freely available Documented case

DCS Controls Systems Security Program (CSSP) administered by DHS 15 ICS assements 245 vulnerabilities All systems at risk Not inclusive, only most critical vulnerabilities identified

Activity Standards  NERC CIP  Chemical Sector Guidance Documents  NIST  NIST  ANSI/ISA-TR  ANSI/ISA  ISA (Draft)  DHS Certifications  CISP  CISM ®  CGIET ®  CISA ®  ISP

Why a industrial security standard? IT IT Security Control Systems Control System Cyber Security Copyright © 2009 ISA

Multiple Perspectives 7 The right Balance of Understanding in: Industry Sector drivers Control Vendor Limitations User Implementation Challenges Economic/Financial Burdens Community acceptance Community Support Requirements

Committee Scope The ISA99 Committee addresses industrial automation and control systems whose compromise could result in any or all of the following situations:  endangerment of public or employee safety  loss of public confidence  violation of regulatory requirements  loss of proprietary or confidential information  economic loss  impact on entity, local, state, or national security 8

Participation  Over 250 members from more than 200 companies  Sectors include:  Chemical Processing  Petroleum Refining  Food and Beverage  Power  Pharmaceuticals  Process Automation Suppliers  IT Suppliers  Government Labs  Consultants 9

Work Product Types (*)  STANDARD: A document that embodies requirements (normative material) that, if not followed, could directly affect safety, interchangeability, performance, or test results. In general, such requirements should already be widely recognized and used. Standards also include Draft Standards for Trial Use (DSTU), which are draft standards intended for subsequent submittal to ANSI for approval as American National Standards. A standard may contain informative material as long as it is clearly identified as such.  RECOMMENDED PRACTICE: A document that embodies recommendations (informative material) that are likely to change because of technological progress or user experience, or which must often be modified in use to accommodate specific needs or problems of the user of the document.  TECHNICAL REPORT: A document that embodies informative material. For example, reports of technical research, tutorials, and factual data obtained from a survey, or information on the "state-of-the-art" in relation to standards on a particular subject. (*) – From ISA Standards and Practices Department Procedures 10

Common Topics Across Standards… Common Concepts, Models & Terminology (ISA99.01.xx) Management System (ISA99.02.xx) System Technical Requirements (ISA99.03.xx) Component Technical Requirements (ISA99.04.xx) Reference Architecture & Models Zones and Conduits Foundational Requirements Terminology 11 Copyright © 2009 ISA

ISA99 Work Products (*) ISA Establishing an IACS Security Program ISA Terminology, Concepts And Models ISA Operating an IACS Security Program ISA-TR Master Glossary of Terms and Abbreviations ISA-TR Patch Management in the IACS Environment ISA Product Development Requirements ISA Embedded Devices ISA Host Devices ISA Network Devices ISA Applications, Data And Functions Security Program Technical - System Technical - Component ISA99 Common ISA System Security Requirements and Security Assurance Levels was Foundational Requirements was ISA ISA-TR Security Technologies for Industrial Automation and Control Systems was ISA-TR ISA Security Assurance Levels for Zones and Conduits was Target Security Levels ISA System Security Compliance Metrics was ISA Copyright © 2009 ISA

Phased Approach to Requirements Standards Part TitleScope and Purpose Primary UsersExpected Publication Date Technical Requirements: Target Security Levels  Use NIST mapping to establish target security levels  Includes high-level description of domains including their zones and conduits  Asset owner  Security system architect  System integrator  System providers including 3 rd party outsources Mid 2009 Technical Requirements: System Security Compliance Metrics Defines measurable compliance metrics that are context specific  Asset owner  Security system architect  System integrator  ISA Compliance Institute  System providers including 3 rd party outsources Late 2009 Technical Requirements: Allocation to Subsystems and Components  Normative specification of security requirements including rationale and supporting use cases based on example reference models  Includes detailed description of domains including their zones and conduits  Asset owner  Security system architect  System integrator  ISA Compliance Institute  System, subsystem and component providers including 3 rd party outsources 2013 Note: this part could be further subdivided to improve timeliness of publication 13 Copyright © 2009 ISA

Guidelines for Implementing RequirementsRisk Analysis Countermeasure Selection DesignImplementation Continuous Improvement ISA-TR ISA ISA ISA ISA  Part 1 for Definition, Requirements, and “Coming to Terms with Terms”  Part 2 for Program Elements from Business Case to Implementation  Technical Report 1 for Evaluation and Selection of Countermeasures  Part 3 for Performance and Benefit Driven Analysis and Continuous Improvement  Part 4 for Vendors and Asset Owners to Specify and Build More Secure Components – Similar to SIL Copyright © 2009 ISA

Work Products List (1/2) ISA NumberIEC Number (per IEC SMB) Work Product SubjectStatus ISA IEC/TS Terminology, Concepts And ModelsReleased ISA- TR IEC/TR Master Glossary of Terms and Abbreviations Draft ISA IEC Security Compliance MetricsDraft ISA IEC Establishing an IACS Security ProgramReleased ISA IEC Operating an IACS Security ProgramProposed ISA- TR IEC/TR Patch Management in the IACS Environment Proposed Copyright © 2009 ISA 15 October 2009

Work Products List (2/2) ISA NumberIEC Number (per IEC SMB) Work Product SubjectStatus ISA- TR IEC/TR Security Technologies for Industrial Automation and Control Systems Released ISA IEC Security Assurance Levels for Zones and Conduits Draft ISA IEC System Security Requirements and Security Assurance Levels Draft ISA IEC Product Development RequirementsProposed ISA IEC Embedded DevicesProposed ISA IEC Host DevicesProposed ISA IEC Network DevicesProposed ISA IEC Applications, Data and FunctionsProposed Copyright © 2009 ISA 16 October 2009

Connecting with Others ISA100 (Wireless) ISA84 (Safety) ISCI (Compliance) MSMUG ISA99 Committee (Standards) IEC (International) Copyright © 2009 ISA 17 October 2009