Approaches to Network Monitoring and Situational Awareness in Critical Infrastructure

Transcription

1 SMi proudly present their 3rd annual conference European Smart Grid Cyber and SCADA Security Behaviour, Detection, Applications and Devices 11th - 12th March 2013 Copthorne Tara Hotel, London, United Kingdom KEY SPEAKERS INCLUDE: European Network and Information Security Agency, Head of Resilience and CIIP Unit, Dr. Vangelis Ouzounis European SCADA and Control Systems Information Exchange, Chair European Reference Network of Critical Infrastructure Protection, Coordinator Annemarie Zielstra Iberdrola, IT Manager SIMOD, Miguel Escamilla Chavero E.ON, Information Security Manager, Gitte Bergknut Enel Distribuzione SpA, IT and Security Systems, Daniela Pestonesi Con Edison of New York, Smart Grid Project Manager, Patricia Robison Vattenfall, Senior Research and Development Engineer, Daniel Zajd Alliander, Alliance Manager Privacy & Security, Johan Rambi Swissgrid, Senior Advisor Operations, TSC SC Chairman, Rudolf Baumann CRISALIS, FP7 Project Co-ordinator, Corrado Leita DNV KEMA Energy & Sustainability, Business Director Management and Operations Consulting, Maurice Adriaensen FOX IT, Sales Director Europe CNI, Henk Pieper Infrastructure Security Labs, President, John McNabb Cylance, Senior Researcher, Justin Clarke Zigbee Alliance, Principal Consultant, Robert Cragie Security Matters, COO, Damiano Bolzoni CNA Insurance, European Underwriting Director, Technology & Cyber Risks, Jacob Ingerslev POST CONFERENCE WORKSHOP 13th MARCH 2013 Approaches to Network Monitoring and Situational Awareness in Critical Infrastructure Presented by Dr Damiano Bolzoni, University of Twente 8.30am pm SPONSORED BY Register online and receive full information on all of SMi s conferences Alternatively fax your registration to +44 (0) or call +44 (0) Book by 7th December and save 300 Book by 18th January and save 200

2 DAY ONE 11th March REGISTRATION & COFFEE 9.00 CHAIRMAN'S OPENING REMARKS Mark Ossel, ESNA Board Member and VP, Echelon Energy and Utility EUROPEAN RECOMMENDATIONS 9.10 ENHANCING THE SECURITY OF SMART GRIDS ENISA'S CONTRIBUTION Recommendations on Smart Grids Security Minimum Security Measures Risks Assessment and Management of Smart Grids Certification of Smart Grids products EU US co-operation on Smart Grids Evangelos Ouzounis, Senior Expert, Network Security Policy, ENISA - European Network and Information Security Agency 9.50 DEPLOYING WORLDWIDE CYBERSECURITY ON THERMAL POWER GENERATION CONTROL SYSTEMS Iberdrola overview Iberdrola & Thermal Stations Strategy Cyber Security s Goal and Vision AURA Project (Cybersecurity projects examples) Conclusions Miguel Chavero, IT Manager SIMOD, Iberdrola MORNING COFFEE RISK MANAGEMENT ASSESSMENT PROTECTING CRITICAL NETWORKING INFRASTRUCTURE FROM CYBER ATTACKS USING UNI-DIRECTIONAL GATEWAYS What kind of CNI are we talking about and what are we trying to protect? Standardization efforts Threat Scenarios Migrating from IT defense to Industrial defense, the need for Defense in depth Implementations of cyber protection in Transport CNI Henk Pieper, Sales Director Europe CNI, FOX IT RISK MANAGEMENT FOR CRITICAL INFRASTRUCTURE Making security a priority Lack of standards and the effect on investment Cyber Security and Electricity pricingcause and effect Fostering a culture of awareness Measuring resiliency Incident response and countermeasures Technical, cultural, and political cooperation for success Maurice Adriaensen, Business Regional Director Management and Operations Consulting, DNV KEMA Energy & Sustainability NETWORKING LUNCH DETECTION, AWARENESS, CHALLENGES 1.50 LESSONS LEARNED FROM THE NEW SMART METER/GRID RISK ASSESSMENT METHODOLOGY IN THE NETHERLANDS Introduction Explanation IS1 Risk Assessment methodology on Smart Meter/Grid in NL Practice on case sector Privacy & Security AMI requirements v2.0 Lessons learned Status European standard on Smart Grid Cyber Security Next steps Johan Rambi, Alliance Manager Privacy & Security, Alliander 2.30 FP7 EARLY WARNING DETECTION PRESENTED BY CRISALIS FP7 project funded by DG Enterprise called CRISALIS, Critical Infrastructure Security AnaLysIS Project focuses: Creation of practical, short-term solutions for the protection of critical infrastructure environment from targeted attacks- primarily power grid Consortium members- Enel, Symantec, Security Matters and Alliander First deliverables of the project: Requirement study, in which we will study in depth the characteristics of the power generation and smart metering environments Identify risks and possible threat scenarios Feedback on our activity Corrado Leita, Project Coordinator, CRISALIS 3.10 AFTERNOON TEA 3.40 ICS CYBER SECURITY IN POWER GENERATION AND FUTURE SCENARIO Electric grid and power generation scenario in Italy Power Generation: Architecture and Frameworks Risk Analysis: Threats and impacts CI owner requirements for ICS protection Enel Cyber Security ICS Laboratory CRISALIS project participation Daniela Pestonesi, Project Leader Research Technical Area, Automation & Diagnostics, Enel Engineering and Research Spa 4.20 CHALLENGES IN POWER-NETWORK SECURITY AND IT Updates and improvements in power-network and IT Common processes, systems and collaboration procedures Integration of system planning, operations and IT Future developments and sharing knowledge Rudolf Baumann, Chairman of the Transmission Security Cooperation, Senior Advisor Operations, swissgrid AG 5.00 ENHANCING NETWORK MONITORING AND SITUATIONAL AWARENESS IN CRITICAL INFRASTRUCTURE Current approaches to network monitoring and situational awareness Strengths and shortcomings of current approaches Non-signature based approaches for improved monitoring and situational awareness WORKSHOP ON THIS TOPIC MARCH 13TH Discussion of 2 use cases Damiano Bolzoni, COO, Security Matters 5.40 CHAIRMAN'S CLOSING REMARKS AND CLOSE OF DAY ONE Register online at: Alternatively fax your registration

3 DAY TWO 12th March REGISTRATION & COFFEE NETWORKING LUNCH 9.00 CHAIRMAN'S OPENING REMARKS Annemarie Zielstra, Director CPNINL, Centre for the Protection of National Infrastructure (CPNI) 9.10 HOW THE BOARD SHOULD TAKE CARE OF CYBER RESILIENCE Cyber incidents on the increase, now a risk for any business This leads to serious concerns on business process continuity, privacy of consumers, identity theft or the protection of intellectual property Cyber resilience needs to be part of strategic (both risk and reputation) management and leadership is required Creating concrete, visible boardroom recognition of cyber resilience, as an enabler for cyber benefits Translating boardroom recognition into risk management, communications, legal and operations Annemarie Zielstra, Annemarie Zielstra, Chair of EuroSCSIE, Coordinator of ERNCIP 9.50 SCADA AND ICS SECURITY EXPERIENCES Experiences of how to run a Cyber Security program Business Awareness and Societal Responsibility - Compliance & Review - Training Use of technical mitigations such as IDS in - Cogeneration - Hydro - Heating Results and lessons learned Gitte Bergknut, MU Nordic Information Security Manager, EON Sverige AB SYSTEMS, DEVICES, APPLICATIONS MORNING COFFEE SMART GRID INTEGRATES LEGACY AND NEW ICS (SCADA, DCS, PLC) SYSTEMS, DEVICES, AND APPLICATIONS Smart Grid Cyber Security Integrating legacy and new ICS enhances the grid and simultaneously increases complexity and vulnerability Cyber Security needs to address ICS at all levels: field devices, the device systems, the applications supporting the devices and systems, the communications/network interfacing to the devices and systems, etc. ICS Cyber Security Controls: Technical, Physical, Administrative Risk Management Smart Grid More challenging with increased complexity and extended systems and communications Leverage existing ICS standards and frameworks: IEC, NIST, DOE, ISA, ISO, NERC Smart Grid Architecture and Frameworks with ICS Threats and Vulnerabilities Examples of ICS systems utilized for Smart Grid: transformers, switches, inverters, DG Patricia Robison, Smart Grid Project Manager, Con Edison of New York CREATING AN APP CONNECTED TO A BACKEND SYSTEM Low awareness within the organisation about the effects of a connected app The least secure point in a network will be the target An app will be an extension of the company environment Data stored on the mobile device Daniel Zajd, Senior R and D Engineer, Vattenfall A B 1.50 SECURING DEVICES FOR HOME AND CONTROL NETWORKS Home and Control Networks What is a Home network (HAN)? What is a Control Network? Topologies Devices - Types of devices on home and control networks - Distinguishing characteristics - Security challenges - Information Security Pillars - Cryptography - Public key cryptography - Symmetric key cryptography - Hybrid cryptography - Protocol stack security - Building blocks - Frame security - Authentication and key establishment - Credentials - ZigBee SEP 1.0 stack security description - ZigBee SEP 2.0 stack security description Robert Cragie, Chair, Security Task Group, Zigbee Alliance 2.30 SECURITY ISSUES OF CONTROL SYSTEMS & WIRELESS METERS AT DRINKING WATER UTILITIES How do they differ from Smart energy meters? Communications infrastructure vulnerabilities of fixed and wireless Lack of encryption Theft Data collection privacy Billing John McNabb, Principal, Infrastructure Security Labs 3.10 AFTERNOON TEA New for 2013 EXPOSING VULNERABILITIES AND CYBER RISK AND INSURANCE 3.40 VULNERABILITIES IN CRITICAL INFRASTRUCTURE AND EMBEDDED DEVICES Key roles of embedded devices in our every day lives Vulnerabilities in embedded system Findings and impact behind several recent SCADA vulnerabilities that had worldwide impact Moving towards a resolution of existing vulnerabilities and avoidance of future vulnerabilities -Education of manufacturers, end users, academia, government, and the general public The process that occurs when end users or the general public identify vulnerabilities in critical infrastructure - What to expect - How to reduce your risk - How to leverage existing agencies - Processes to minimize your required effort Justin Clarke, Security Researcher, Cylance 4.20 CYBER RISKS & INSURANCE Cyber Crime as an Industry Legal environment What is Cyber Insurance Industry specific exposures Jacob Ingerslev, European Underwriting Director, CNA Europe 5.00 CHAIRMAN'S CLOSING REMARKS AND CLOSE OF DAY TWO to +44 (0) or call +44 (0) GROUP DISCOUNTS AVAILABLE

4 POST CONFERENCE WORKSHOP Wednesday 13th March 2013, Copthorne Tara Hotel, London, UK Approaches to Network Monitoring and Situational Awareness in Critical Infrastructure 8.30am 1.00pm In Association with University Twente Overview of workshop This workshop will present solutions currently available for monitoring critical networks and situational awareness. We will analyse what are the major strengths and weaknesses of each approach, when it can be used and what is the output users can expect. We will wrap up the session with demonstrations of the approaches presented using real-life examples. Why you should attend: Understand the importance of situational awareness and behavioural monitoring Gain insight in to the benefits and disadvantages of signature based, rule based, behavioural and visualisation based solutions Learn what threats can be detected and what skills are required to operate Interact with industry and engage with our workshop leader who is actively involved in two security projects with major energy companies at present. Programme 8:30 Registration and Coffee 9.00 Current solutions for network monitoring and situational awareness of critical networks - Signature-based - Rule-based - Behaviour-based - Visualization Advantages and disadvantages of each approach - Where and when use what - Which threats can be detected? - Technical skills required to operate Coffee Break Demonstrations 1.00 Question and Answer session About the workshop host Dr Damian Bolzoni (1981) received his PhD in 2009 from the University of Twente, where he performed research on anomalybased intrusion detection. Since 2008 he has been involved in securing computer networks of critical infrastructure. Before joining the University of Twente, he has been working for the Italian branch of KPMG, within the Information Risk Management division. Since 2009 he holds the position of Chief Operations Officer within SecurityMatters BV.. SMi's Event Communities SMi Group is a global events business specialising in business to business conferences, workshops and masterclasses. We successfully create and run 250 events every year across 6 sectors including Defence and Security, Energy and Utilities, Finance and Pharmaceutical. We believe in bringing together the most knowledgeable experts from across the globe in each sector to learn, engage, share and network be it in London, Paris or Singapore. To further enhance the SMi experience, we have launched our very own SMi Event Communities. These will be exclusive, private and secure communities in which our clients will learn, share, engage and network. The SMi Event Communities will build and expand your experience beyond the conference, workshop or Masterclass you attend. Not just another "social network, SMi s Event Communities have been specifically designed around the needs of our delegates, speakers and sponsors, allowing all of our clients to foster longer term relationships with all of the other attendees beyond the two day event for year round engagement. To take part all you need to do is register for this event. SMi Group Communities Learn Engage Share Network

5 Sponsored by Fox-IT prevents, solves and mitigates the most serious cyber threats with innovative solutions for government, defense, law enforcement, critical infrastructure, banking, and commercial enterprise clients worldwide. Our approach combines human intelligence and technology into innovative solutions that ensure a more secure society. We develop custom and packaged solutions that maintain the security of sensitive government systems, protect industrial control networks, defend online banking systems, and secure highly confidential data and networks. Advantech, world leading industrial electronics platform provider for SCADA and Smart Grid applications, supplying network appliances to solution builders for data-centre security and rugged end-point platforms in harsh and remote environments, such as high-voltage and distribution substations, renewable (distributed) energy resources, electric vehicle charging stations and meter data collection nodes. DNV KEMA Energy & Sustainability, with more than 2,300 experts in over 30 countries around the world, is committed to driving the global transition toward a safe, reliable, efficient, and clean energy future. With a heritage of nearly 150 years, we specialize in providing world-class, innovative solutions in the fields of business & technical consultancy, testing, inspections & certification, risk management, and verification. As an objective and impartial knowledge-based company, we advise and support organizations along the energy value chain: producers, suppliers & endusers of energy, equipment manufacturers, as well as government bodies, corporations and non-governmental organizations. DNV KEMA Energy & Sustainability is part of DNV, a global provider of services for managing risk with more than 10,000 employees in over 100 countries. For more information on DNV KEMA Energy & Sustainability, visit Waterfall Security Solutions Ltd. is the leading provider of Unidirectional Security Gateways for industrial control networks and critical infrastructures. Frost & Sullivan awarded Waterfall the 2012 Network Security Award for Industrial Control Systems Entrepreneurial Company of the Year. Waterfall s offerings include support for leading industrial Historians, SCADA and IT protocols. Supported by For Sponsorship or Speaking Opportunities please contact Jamison Nesbitt Business Development Director P: +44 (0) M: +44 (0) jnesbitt@smi-online.co.uk TM Don t miss out on social media networking! Follow us on and join us on Linkedin

6 EUROPEAN SMART GRID CYBER AND SCADA SECURITY Conference: 11th & 12th March 2013, Copthorne Tara Hotel, London Workshop: 13th March WAYS TO REGISTER ONLINE at FAX your booking form to +44 (0) POST your booking form to: Events Team, SMi Group Ltd, 2nd Floor PHONE on +44 (0) South, Harling House, Great Suffolk Street, London, SE1 0BS Register by 7th December 2012 and receive 300 EARLY BIRD off the conference price DISCOUNT Register by 18th January 2013 and receive 200 off the conference price CONFERENCE PRICES GROUP DISCOUNTS AVAILABLE I would like to attend: (Please tick as appropriate) Fee Total Unique Reference Number Our Reference LV U-013 DELEGATE DETAILS Please complete fully and clearly in capital letters. Please photocopy for additional delegates. Title: Forename: Surname: Job Title: Department/Division: Company/Organisation: Address: Town/City: Post/Zip Code: Direct Tel: Mobile: Switchboard: Signature: Country: Direct Fax: Date: I agree to be bound by SMi's Terms and Conditions of Booking. ACCOUNTS DEPT Title: Surname: Forename: Address (if different from above): Town/City: Post/Zip Code: Direct Tel: Country: Direct Fax: Terms and Conditions of Booking Payment: If payment is not made at the time of booking, then an invoice will be issued and must be paid immediately and prior to the start of the event. If payment has not been received then credit card details will be requested and payment taken before entry to the event. Bookings within 7 days of event require payment on booking. Access to the Document Portal will not be given until payment has been received. Substitutions/Name Changes: If you are unable to attend you may nominate, in writing, another delegate to take your place at any time prior to the start of the event. Two or more delegates may not share a place at an event. Please make separate bookings for each delegate. Cancellation: If you wish to cancel your attendance at an event and you are unable to send a substitute, then we will refund/credit 50% of the due fee less a 50 administration charge, providing that cancellation is made in writing and received at least 28 days prior to the start of the event. Regretfully cancellation after this time cannot be accepted. We will however provide the conferences documentation via the Document Portal to any delegate who has paid but is unable to attend for any reason. Due to the interactive nature of the Briefings we are not normally able to provide documentation in these circumstances. We cannot accept cancellations of orders placed for Documentation or the Document Portal as these are reproduced specifically to order. If we have to cancel the event for any reason, then we will make a full refund immediately, but disclaim any further liability. Alterations: It may become necessary for us to make alterations to the content, speakers, timing, venue or date of the event compared to the advertised programme. Data Protection: The SMi Group gathers personal data in accordance with the UK Data Protection Act 1998 and we may use this to contact you by telephone, fax, post or to tell you about other products and services. Unless you tick here we may also share your data with third parties offering complementary products or services. If you have any queries or want to update any of the data that we hold then please contact our Database Manager databasemanager@smi-online.co.uk or visit our website quoting the URN as detailed above your address on the attached letter. PUBLIC SECTOR, ACADEMICS & UTILITIES Conference & Workshop VAT Conference only VAT Workshop only VAT COMMERCIAL ORGANISATIONS Conference & Workshop VAT Conference only VAT Workshop only VAT PROMOTIONAL LITERATURE DISTRIBUTION Distribution of your company s promotional literature to all conference attendees VAT The conference fee includes refreshments, lunch, conference papers and access to the Document Portal containing all of the presentations. VENUE Copthorne Tara Hotel, Scarsdale Place, Kensington, London, W8 5SR. Please contact me to book my hotel Alternatively call us on +44 (0) , hotels@smi-online.co.uk or fax +44 (0) DOCUMENTATION Payment must be made to SMi Group Ltd, and received before the event, by one of the following methods quoting reference U-013 and the delegate s name. Bookings made within 7 days of the event require payment on booking, methods of payment are below. Please indicate method of payment: UK BACS Sort Code , Account Wire Transfer Lloyds TSB Bank Plc, 39 Threadneedle Street, London, EC2R 8AU Swift (BIC): LOYDGB21013, Account IBAN GB48 LOYD Cheque We can only accept Sterling cheques drawn on a UK bank. Credit Card Visa MasterCard American Express All credit card payments will be subject to standard credit card charges. Card No: Valid From / Expiry Date / CVV Number 3 digit security on reverse of card, 4 digits for AMEX card Cardholder s Name: Signature: I agree to be bound by SMi's Terms and Conditions of Booking. Card Billing Address (If different from above): (Shipped days after the event) I cannot attend but would like to purchase access to the following Document Portal/paper copy documentation: Price Total Access to the conference documentation on the Document Portal VAT The Conference Presentations - paper copy (or only 300 if ordered with the Document Portal) PAYMENT VAT Date: VAT at 20% is charged on the attendance fees for all delegates. VAT is also charged on Document Portal and Literature Distribution for all UK customers and for those EU customers not supplying a registration number for their own country here: If you have any further queries please call the Events Team on tel +44 (0) or you can them at events@smi-online.co.uk