Cyber Security focus in ABB: a Key issue. 03 Luglio 2014, Roma 1 Conferenza Nazionale Cyber Security Marco Biancardi, ABB SpA, Power System Division

Transcription

1 Cyber Security focus in ABB: a Key issue 03 Luglio 2014, Roma 1 Conferenza Nazionale Cyber Security Marco Biancardi, ABB SpA, Power System Division

2 Cyber Security in ABB Agenda ABB introduction ABB Cyber Security organization & processes Security in ABB Life Cycles ABB Partnership

3 A global leader in power and automation technologies Leading market positions in main businesses 145,000 employees in about 100 countries $39 billion in revenue (2012) Formed in 1988 merger of Swiss and Swedish engineering companies Predecessors founded in 1883 and 1891 Publicly owned company with head office in Switzerland

4 How ABB is organized Five global divisions Power Products $10.7 billion 36,000 employees (2012 revenues) Power Systems $7.9 billion 20,000 employees ABB s portfolio covers: Electricals, automation, controls and instrumentation for power generation and industrial processes Power transmission Distribution solutions Low-voltage products Discrete Automation and Motion $9.4 billion 29,000 employees Low Voltage Products $6.6 billion 31,000 employees Motors and drives Process Automation $8.2 billion 28,000 employees Intelligent building systems Robots and robot systems Services to improve customers productivity and reliability

5 Managment Support Awareness Training Incident Response External Outreach Research IT Security The foundation of Cyber Security What does it mean for ABB as an organization Organizational priority at top management level Global, cross-functional and long-term initiative Formally established - it is not just a side task Starts with improving people awareness and operational readiness Corporate foundation

6 International standardization and regulation ABB involvement ABB actively supports and drives the development of international standards and regulations, for example: Reference IEC / ISA IEC NERC CIP- 002 to -011 IEEE 1686 Title Security for industrial automation and control systems Power systems management and associated information exchange - Data and communications security Critical Infrastructure Protection Standard for Substation Intelligent Electronic Devices (IEDs) Cyber Security Capabilities For a more comprehensive overview of cyber security standards, guidelines and regulations, see

7 Cyber security is a process, not a project or product Organizational readiness across the entire life cycle Product life cycle Project life cycle Plant life cycle Design Implementation Verification Release Support Design Engineering FAT Commissioning SAT Services and support for Operation Maintenance Review Upgrade ABB follows international and national standards and industry best practices to address cyber security across the entire life cycle.

8 Product Lifecycle - Design & Implementation Cyber Security Training for Developers Security Training depending on role: SDL Introduction Training Secure Design Threat Modeling Secure Coding Security Testing And more advanced training

9 Product Lifecycle - Verification State-of-the-art cyber security testing Formally established, centralized and independent security test center Leveraging state-of-the-art open source, commercial and proprietary robustness and vulnerability analysis tools Close collaboration with ABB developers providing in-depth analysis and recommendations Regular system tests at INL SCADA test bed (First Vendor!!!)

10 Project Lifecycle Engineering / Commissioning Deployment Guidelines

11 Plant Lifecycle - Maintenance Patch Management Example Validation of Microsoft security updates All relevant updates are tested for compatibility Dedicated Security Test Lab covers supported versions Other 3rd party SW (e.g. Adobe Reader, McAfee ) Released from SW vendor without schedule Verified with next Microsoft Security Update Verification status published the same way a Microsoft Security Updates Similar process for other ABB products

12 Plant Lifecycle - Maintenance Vulnerability handling & Incident response Minimize customer risk This requires Cultural change: Accept that vulnerabilities exist (having a vulnerability is acceptable, improperly handling them is not!) Formal processes and policies Proper communication at the right time ABB has established a formal process and vulnerability handling has top priority To report a vulnerability: cybersecurity@ch.abb.com First Response Initial Triage Investigation ReMediumtio n Notification Communication

13 ABB Partnership Industrial Defender Industrial Defender at a Glance Industrial Defender ranked # 1 two years in a row by independent analysts, and the only choice for ICS security, compliance, and Change Management Exclusively focused on OT since 2002 Pioneering automation systems management for security, compliance and change management Turnkey technology and service solution Multiple applications, one platform Vendor agnostic Purpose built 10,000+ technology deployments 400+ customers 25+ countries

14 Conclusions As technology leader, ABB fully understands the importance of and its role in Cyber Security for industrial automation and control systems. ABB is actively anticipating the security challenges imposed by the changing landscape of the markets. ABB is constantly adapting its systems to the latest developments in security and is engaging with external partners for security testing and consulting. ABB has been involved in cyber security for control systems for over a decade long before the hype.

15 Contact information Questions, Comments, etc.

16