1. SMART GRID DEVICES SECURITY CERTIFICATION
ESMIG meeting, Brussels, 26 March 2015
SMART GRID DEVICES SECURITY CERTIFICATION
Konstantinos Moulinos
Information Security Expert
ENISA

2. ENISA activities Mobilising Communities Policy Implementation
Recommendations
Mobilising
Communities
Think Tank
Recommendations// deliverables.. Link to the enisa website
Community Building
Art 14 Requests
Financial ISACs
NIS Platform
Cyber Security Coordination Group
Legislation
Hands on
Cyber exercises
CERT training
Hands on

3. Workshop on certification of smart grid components
27th of June 2012, Brussels.
In cooperation with EC-DG CONNECT.
Around 60 participants from different domains.
ENISA Study on SG security, 2012.
10 Recommendations
“Both the EC and the MS competent authorities should promote the development of security certification schemes for components, products and organisational security.”

4. Aim and Objectives of the workshop
Follow up the recommendation of the study.
Support the MS in better understanding the challenges of the security certification process.
Contribute in the harmonization of different certification policies.
Invite MS to present their national certification schemes and private sector to present their views on the matter.
Debate about the possible steps to take, at national and EU level, to speed up the secure introduction of Smart Grids.

5. Key findings (1/2)
Need for a certification scheme for SG security personnel.
Need a certification scheme for the whole grid, not only for the components.
Development of minimum security requirements (protection profiles) for other than Smart meters SG devices.
New SG security certification schemes are on the way.

6. Key findings (2/2)
Need to assess the criticality of the different SG parts and apply different assurance techniques based on the criticality.
M490: a promising initiative towards market harmonization and interoperability.
Focus on the whole life-cycle not only on the product itself
Product development process
Expected security quality level
Functionality
Implementation and deployment of the systems
Operational process.

7. Characteristics of the future certification scheme
Mandatory.
Harmonization.
One unified security profile.
Not a single certifying authority.
Easy to be adopted by the MS.
Deal with the patch management problem.
Once certified not extra certification needed across Europe.
Take into account the existing technologies.
In line with the standardization efforts in the SG area.

8. Not focus only on the smart meters
Conclusions (1/2)
Certification is only a part of the process for secure systems development.
Not focus only on the smart meters
Protection profiles for the rest elements of SG
Only a part of the SG i.e windmills, e-cars etc.
A single interoperable standard
Geographically: European
Cross sector: SG are parts of CII and there is a need for such a standard
Competition: One standard does not mean one technical solution.

9. More information sharing on vulnerabilities. Incentives for
Conclusions (2/2)
More information sharing on vulnerabilities.
Incentives for
A more reasonable legal framework
Doing more than is needed.
If one standard is developed then the throughput must be satisfactory enough to keep all vendors capable of competing at the same level.
Compliance does not mean security.

10. Actions Create a SG Certification WG in existing European structures.
Maintain the Security testers / certifiers/certification frameworks database up to date.
Create protection profiles for all SG components.

11. Report on Certification of components (2014) Objectives
Perform a desktop research.
Identify the gaps between different certification schemes.
Produce technical advice, recommendations and good practices for certification in smart grid security.
Provide recommendations on how to develop new or improve existing approaches to a pan European harmonised smart grid security certification.
In collaboration with EC

12. Working method Desk research regarding cyber security certification
Existing standards
National approaches
Qualitative analysis of cyber security certification schemes
Requirements by a future approach
Gaps and lessons learnt
Recommendations and roadmap development
Discussion of approach with stakeholders
Draft report for comments
Addressing of comments with stakeholders
Workshop for discussion of main topics
Final report

13. Desk research
Separation between certification schemes and other information
Articles and investigations
Security and/or smart grid standards and schemes
Smart grid related security services
Current stocktaking lists the following additional sources and initiatives eligible for investigation
Further analysis to select schemes for qualitative analysis:
8 out of 19 certification schemes were selected

14. Certification meta-scheme
Based on ISO 17067

15. Detailed scheme analysis

16. Discussions with stakeholders
Stakeholders included:
SISEC members
ESMIG is represented
Selected members of the ENISA contact list
Certification authorities: ANSSI, BSI, CESG, FMV, …
Associations: EURELECTRIC, ESMIG, T&D Europe
Standardization initiatives: M/490 SG –CG/SGISWG, DKE VDE DIN
Private sector: Alstom, ULL, EDF R&D
DKE Deutsche Kommission Elektrotechnik Elektronik Informationstechnik im DIN und VDE

17. How is it currently applied in EU
France – CSPN and common criteria, ISO 27002
Germany – common criteria EAL4+, DIN 27001
Netherlands – common criteria EAL2, ISO27001
United Kingdom – CPA, ISO27001, IASME
SOG-IS MRA and EA (European cooperation for Accreditation )
No legislation, only Germany is going to mandate ISO27001
Different requirements and designs per country
No public-private participation in half of the countries
Conclusion: there is no harmonisation, different methods, schemes and different levels of security per country

18. Key findings Only a few member states defined security requirements
Not clear view of the amount of publicly known cyber incidents
Focus on HAN and Grid end applications
Diversity in the production process of the requirements
Public private collaboration
CC de facto standard
Lack of harmonisation

19. The supply chain view of the smart grid

20. What to certify: SGAM, lifecycle and chain of trust

21. What is available: SG-AM/SG-IS usage

22. Scheme implementation

23. Roadmap

24. What is this report about?
-A proposal for a steering working group/ task force
-A proposal for a certification framework (chain of trust)
-A proposal for using an existing reference model (SGAM)
-A mapping between different certification standards and the SGAM layers
-A recommendation to reuse existing mechanisms
-Roadmap to implement the framework
IS NOT -A proposal for a new certification scheme -A recommendation for the use of any particular standard

25. Key recommendations
Appoint a EU steering committee to coordinate smart grid certification activities (EC)*
Provide guidance and a reference model to implement a chain of trust (SC)
Use of the currently available standards and schemes, and accommodating, better coordinating and harmonising national approaches (SC)
Promote international recognition of schemes (EC)
Promote validation that is commensurate with the risk appetite involved in each use case (SC)
Use national profiles as detailed specifications of international standards to cover the specific national use cases and nationally supported test and certification methods (MS)
Use technical committees in collaboration with the European energy associations to create European profiles (EC)
*EC: European Commission, SC: Steering Committee, MS: Member States

26. Open issues – Next Steps
Assessment of financial costs of the min security measures
Identification of incentives for investments on security
Identification of good practices for ICS-SCADA/Smart Grids incident reporting
Certification of smart grid components and systems
Definition of EU baseline security requirements
A roadmap for more harmonized national certification approaches
Certification of smart grid cyber security skills
Incident response capability for smart grids and relationships to existing national ICS-CERT/Gov CERTs
Inject smart grids into NIS platform
Bring competent authorities on board

27. DRAFT

28. Thank you!