FOR REVIEW PURPOSES ONLY!

Transcription

1 FOR REVIEW PURPOSES ONLY! THIS EXCERPT FROM AN ISA99 COMMITTEE WORK PRODUCT IS PROVIDED SOLELY FOR THE PURPOSE OF REVIEW IN SUPPORT OF THE FURTHER DEVELOPMENT OF OTHER COMMITTEE WORK PRODUCTS. THIS DOCUMENT MAY NOT BE COPIED, DISTRIBUTED TO OTHERS OR OFFERED FOR FURTHER REPRODUCTION OR SALE. PLEASE CHECK THE ISA WEB SITE FOR THE PUBLISHED VERSION. Copyright by the International Society of Automation. All rights reserved. Not for resale. Printed in the United States of America. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without the prior written permission of the Publisher. ISA 67 Alexander Drive P. O. Box Research Triangle Park, North Carolina USA

2 This page intentionally left blank

3 ISA-TR Security for industrial automation and control systems Part 2-3: Patch management in the IACS environment Approved 1 July 2015

4 ANSI/ISA-TR ISA99 ISA-TR Security for industrial automation and control systems Part 2-3: Patch management in the IACS environment ISBN: Copyright 2015 by ISA. All rights reserved. Not for resale. ISA 67 Alexander Drive P. O. Box Research Triangle Park, NC USA

5 ISA99 3 ANSI/ISA-TR PREFACE This preface, as well as all footnotes and annexes, is included for information purposes and is not part of ISA-TR This technical report has been prepared as part of the service of ISA, the International Society of Automation, toward a goal of uniformity in the fields of industrial automation and instrumentation. To be of real value, this technical report should not be static but should be subject to periodic review. Toward this end, the Society welcomes all comments and criticisms and asks that they be addressed to the Secretary, Standards and Practices Board; ISA; 67 Alexander Drive; P. O. Box 12277; Research Triangle Park, NC 27709; Telephone (919) ; Fax (919) ; E- mail: [email protected]. The ISA Standards and Practices Department is aware of the growing need for attention to the metric system of units in general and the International System of Units (SI) in particular, in the preparation of instrumentation standards. The Department is further aware of the benefits to USA users of ISA standards of incorporating suitable references to the SI (and the metric system) in their business and professional dealings with other countries. Toward this end, this Department will endeavor to introduce SI-acceptable metric units in all new and revised standards, recommended practices and technical reports to the greatest extent possible. Standard for Use of the International System of Units (SI): The Modern Metric System, published by the American Society for Testing and Materials as IEEE/ASTM SI 10-97, and future revisions, will be the reference guide for definitions, symbols, abbreviations, and conversion factors. It is the policy of ISA to encourage and welcome the participation of all concerned individuals and interests in the development of ISA standards, recommended practices and technical reports. Participation in the ISA standards-making process by an individual in no way constitutes endorsement by the employer of that individual, of ISA or of any of the standards, recommended practices and technical reports that ISA develops. CAUTION ISA adheres to the policy of the American National Standards Institute with regard to patents. If ISA is informed of an existing patent that is recommended for use of the standard, it will require the owner of the patent to either grant a royalty-free license for use of the patent by users complying with the standard or a license on reasonable terms and conditions that are free from unfair discrimination. Even if ISA is unaware of any patent covering this Standard, the user is cautioned that implementation of the standard may require use of techniques, processes or materials covered by patent rights. ISA takes no position on the existence or validity of any patent rights that may be involved in implementing the standard. ISA is not responsible for identifying all patents that may require a license before implementation of the standard or for investigating the validity or scope of any patents brought to its attention. The user should carefully investigate relevant patents before using the standard for the user s intended application. However, ISA asks that anyone reviewing this standard who is aware of any patents that may impact implementation of the standard notify the ISA Standards and Practices Department of the patent and its owner. Additionally, the use of this standard may involve hazardous materials, operations or equipment. The standard cannot anticipate all possible applications or address all possible safety issues associated with use in hazardous conditions. The user of this standard must exercise sound professional judgment concerning its use and applicability under the user s particular circumstances. The user must also consider the applicability of any governmental regulatory limitations and established safety and health practices before implementing this standard.

6 ANSI/ISA-TR ISA99 The following people served as active members of ISA99 Working Group 06 since 2011 for the preparation of this technical report and the patch reporting format: Name Company Contributor Reviewer William Bill Cotter WG/TG co-chair Florian Ott WG/TG co-chair Donovan Tindill WG/TG co-chair, Editor 3M Siemens AG Honeywell / Matrikon X X X Michael Coden Editor NextNine Inc, and MIT-(IC)3 Marc Ayala aesolutions X Bruce Billedeaux Maverick Technologies X Eric Boice Honeywell X Dennis Brandl BR&L Consulting X Seth Carpenter Honeywell X Eric Cosman ISA, ARC, ISA99 Committee Co-Chair X Ratna Kanth Dittakavi ABB X Earl Eiland New Mexico Institute of Mining and Technology Jim Gilsinn Kenexis, ISA99 Committee Co-Chair X Tom Good DuPont X Erik Goode Bruce Honda Weyerhaeuser X Larry McArthur Glenn Merrell Freelance Consulting X Susan Peterson GE Oil & Gas X Tom Phinney IEC Liaison X X Michael Piccalo Industrial Defender X Charley Robinson ISA X Ragnar Schierholz ABB X Walter Sikora Industrial Defender X Graham Speake NISCC/CPNI Liaison Yokogawa Tatsaki Takebe Yokogawa Electric X Randy Woods Dow X X X X X

7 ISA99 5 ANSI/ISA-TR CONTENTS PREFACE... 3 FOREWORD... 9 INTRODUCTION Scope Normative references Terms, definitions, abbreviated terms, acronyms and conventions Terms and definitions Abbreviated terms and acronyms Industrial automation and control system patching Patching problems faced in industrial automation and control systems Impacts of poor patch management Obsolete IACS patch management mitigation Patch lifecycle state Recommended requirements for asset owner Recommended requirements for IACS product supplier Exchanging patch information Introduction Patch information exchange format Patch compatibility information filename convention VPC file schema VPC file element definitions Annex A (Informative) VPC XSD file format A.1 VPC XSD file format specification A.2 Core component types A.2.1 Overview A.2.2 CodeType A.2.3 DateTimeType A.2.4 IdentifierType A.2.5 IndicatorType A.2.6 TextType Annex B (Informative) IACS asset owner guidance on patching B.1 Annex organization B.2 Overview B.3 Information gathering B.3.1 Inventory of existing environment B.3.2 Tools for manual and automatic scanning B.3.3 IACS product supplier contact and relationship building B.3.4 Supportability and product supplier product lifecycle B.3.5 Evaluation and assessment of existing environment B.3.6 Classification and categorization of assets/hardware/software B.4 Project planning and implementation B.4.1 Overview... 41

8 ANSI/ISA-TR ISA99 B.4.2 Developing the business case B.4.3 Establishing and assigning roles and responsibilities B.4.4 Testing environment and infrastructure B.4.5 Implement backup and restoration infrastructure B.4.6 Establishing product supplier procurement guidelines B.5 Monitoring and evaluation B.5.1 Overview B.5.2 Monitoring and identification of security related patches B.5.3 Determining patch applicability B.5.4 Impact, criticality and risk assessment B.5.5 Decision for installation B.6 Patch testing B.6.1 Patch testing process B.6.2 Asset owner qualification of security patches prior to installation B.6.3 Determining patch file authenticity B.6.4 Review functional and security changes from patches B.6.5 Installation procedure B.6.6 Patch qualification and validation B.6.7 Patch removal, roll back, restoration procedures B.6.8 Risk mitigation alternatives B.7 Patch deployment and installation B.7.1 Patch deployment and installation process B.7.2 Notification of affected parties B.7.3 Preparation B.7.4 Phased scheduling and installation B.7.5 Verification of patch installation B.7.6 Staff training and drills B.8 Operating an IACS patch management program B.8.1 Overview B.8.2 Change management B.8.3 Vulnerability awareness B.8.4 Outage scheduling B.8.5 Security hardening B.8.6 Inventory and data maintenance B.8.7 Procuring or adding new devices B.8.8 Patch management reporting and KPIs Annex C (Informative) IACS product supplier / service provider guidance on patching C.1 Annex organization C.2 Discovery of vulnerabilities C.2.1 Vulnerability discovery and identification within the product C.2.2 Vulnerability discovery and identification within externally sourced product components C.3 Development, verification and validation of security updates C.4 Distribution of cyber security updates... 63

9 ISA99 7 ANSI/ISA-TR C.5 Communication and outreach BIBLIOGRAPHY Figure 1 Patch state model Figure 2 VPC file schema Figure 3 VPC file schema diagram format Figure B.1 IACS patch management workflow Figure B.2 Planning an IACS patch management process Figure B.3 Sample responsibilities chart Figure B.4 Patch monitoring and evaluation process Figure B.5 A patch testing process Figure B.6 A patch deployment and installation process Table 1 Patch lifecycle states Table 2 VPC XSD PatchData file elements Table 3 VPC XSD PatchVendor file elements Table 4 VPC XSD Patch file elements Table 5 VPC XSD VendorProduct file elements Table A.1 CodeType optional attributes Table A.2 DateTimeType optional attributes Table A.3 IdentifierType optional attributes Table A.4 IndicatorType optional attributes Table A.5 TextType optional attributes Table B.1 Sample product supplier profile Table B.2 Communication capabilities Table B.3 Sample software categorization Table B.4 Responsibility assignment definitions Table B.5 Sample severity based patch management timeframes... 50

10 ANSI/ISA-TR ISA99 This page intentionally left blank.

11 ISA99 9 ANSI/ISA-TR FOREWORD This technical report is part of a multipart standard that addresses the issue of security for industrial automation and control systems (IACS). It has been developed by Working Group 06 of the ISA99 committee. This technical report describes a format for the exchange of information about the status of patches and their applicability, and providing guidance on planning and building a patch management program within asset owner and IACS product supplier organizations.

12 ANSI/ISA-TR ISA99 INTRODUCTION Cyber security is an increasingly important topic in modern organizations. Many organizations involved in information technology (IT) and business have been concerned with cyber security for many years and have well-established information security management systems (ISMS) in place as defined by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), in ISO/IEC and ISO/IEC These management systems provide an organization with a well-established method for protecting its assets from cyber-attacks. Industrial Automation and Control Systems (IACS) suppliers and owners are using commercial-offthe-shelf (COTS) technology developed for business systems in their everyday processes. This provides an increased opportunity for cyber-attack against the IACS equipment, since COTS systems are more widely known and used. There has also been new interest in ICS security research that has uncovered numerous device vulnerabilities as well. Successful attacks against industrial systems may lead to health, safety and environmental (HSE) consequences. Organizations may try to use the business cyber security strategy to address security for IACS without understanding the consequences. While many of these solutions can be applied to IACS, they need to be applied in the correct way to eliminate inadvertent consequences. This technical report addresses the patch management aspect of IACS cyber security. Patch management is part of a comprehensive cyber security strategy that increases cyber security through the installation of patches, also called software updates, software upgrades, firmware upgrades, service packs, hotfixes, basic input output system (BIOS) updates and other digital electronic program updates that resolve bugs, operability, reliability and cyber security vulnerabilities. This technical report introduces to the reader many of the problems and industry concerns associated with IACS patch management for asset owners and IACS product suppliers. It also describes the impacts poor patch management can have on the reliability and/or operability of the IACS. NOTE The format of this technical report follows the ISO/IEC requirements discussed in ISO/IEC Directives, Appendix H of Part 2 [13]1. The ISO/IEC Directives specify the format of this technical report as well as the use of terms like shall, should and may. The use of those terms for the requirements specified in this technical report use the conventions discussed in the ISO/IEC Directives, Appendix H. 1 Numbers in brackets indicate references in the Bibliography.

13 ISA99 11 ANSI/ISA-TR Scope ISA-TR describes requirements for asset owners and industrial automation and control system (IACS) product suppliers that have established and are now maintaining an IACS patch management program. This Technical Report recommends a defined format for the distribution of information about security patches from asset owners to IACS product suppliers, a definition of some of the activities associated with the development of the patch information by IACS product suppliers and deployment and installation of the patches by asset owners. The exchange format and activities are defined for use in security related patches; however, it may also be applicable for non-security related patches or updates. The Technical Report does not differentiate between patches made available for the operating systems (OSs), applications or devices. It does not differentiate between the product suppliers that supply the infrastructure components or the IACS applications; it provides guidance for all patches applicable to the IACS. Additionally, the type of patch can be for the resolution of bugs, reliability issues, operability issues or security vulnerabilities. Note 1 This Technical Report does not provide guidance on the ethics and approaches for the discovery and disclosure of security vulnerabilities affecting IACS. This is a general issue outside the scope of this report. Note 2 This Technical Report does not provide guidance on the mitigation of vulnerabilities in the period between when the vulnerability is discovered and the date that the patch resolving the vulnerability is created. For guidance on multiple countermeasures to mitigate security risks as part of an IACS security management system (IACS-SMS), refer to Annexes B.4.5, B.4.6 and B.8.5 in this Technical Report and other documents in the ISA series. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ANSI/ISA ( ) Security for industrial automation and control systems Part 1-1: Terminology, concepts and models [1] ISA TR Security for industrial automation and control systems, Part 1-2: Master glossary of terms and abbreviations [2] ANSI/ISA ( ) Security for industrial automation and control systems Part 2-1: Establishing an Industrial Automation and Control Systems Security Program [1]

14 ISA99 65 ANSI/ISA-TR BIBLIOGRAPHY NOTE This bibliography includes references to sources used in the creation of this technical report as well as references to sources that may aid the reader in developing a greater understanding of cyber security as a whole and developing a management system. Not all references in this bibliography are referred to throughout the text of this technical report. The references have been broken down into different categories depending on t he type of source they are. References to other parts, both existing and anticipated, of the ISA series: [1] ANSI/ISA ( ), Security for industrial automation and control systems, Part 1-1: Terminology, concepts and models [2] ISA TR , Security for industrial automation and control systems, Part 1-2: Master glossary of terms and abbreviations [3] ISA , Security for industrial automation and control systems, Part 1-3: System security compliance metrics [4] ISA TR , Security for industrial automation and control systems, Part 1-4: IACS security lifecycle and use-case [5] ANSI/ISA ( ), Security for industrial automation and control systems, Part 2-1: Establishing an Industrial Automation and Control Systems Security Program [6] ISA TR , Security for industrial automation and control systems, Part 2-2: Implementation guidance for an IACS security management system NOTE This technical report is ISA-TR Security for industrial automation and control systems, Part 2-3: Patch management in the IACS environment [7] IEC , Security for industrial automation and control systems, Part 2-4: Installation and maintenance requirements for IACS suppliers [8] ISA-TR , Security for industrial automation and control systems, Part 3-1: Security technologies for IACS [9] ISA , Security for industrial automation and control systems, Part 3-2: Security levels for zones and conduits [10] ANSI/ISA , Security for industrial automation and control systems, Part 3-3: System security requirements and security levels [11] ISA , Security for industrial automation and control systems, Part 4-1: Product development requirements [12] ISA , Security for industrial automation and control systems, Part 4-2: Technical security requirements for IACS components Other standards references: [13] ISO/IEC Directives, Part 2, Rules for the structure and drafting of International Standards [14] ISO 639-1:2002 Codes for the representation of names of languages -- Part 1: Alpha-2 code [15] ISO :2006 Codes for the representation of names of countries and their subdivisions -- Part 1: Country codes

15 ISA-TR (TR ) ISA99 [16] ISO :2007 Codes for the representation of names of countries and their subdivisions -- Part 2: Country subdivision code [17] ISO 4217:2008 Codes for the representation of currencies and funds [18] ISO 8601:2004 Data elements and interchange formats -- Information interchange -- Representation of dates and times [19] ECE/TRADE/C/CEFACT/2009/24 Codes for Units of Measure used in International Trade [20] ECE/TRADE/C/CEFACT/2009/25 Codes for Passengers, Types of Cargo, Packages and Packaging Materials (with Complementary Codes for Package Names) Other documents and published resources: [21] Good Practice Guide: Manage Third-Party Risk, Centre for Protection of National Infrastructure (CPNI) [22] Good Practice Guide: Patch Management, Centre for Protection of National Infrastructure (CPNI) [23] Recommended Practice for Patch Management of Control Systems, United States Department of Homeland Security (DHS) [24] Cyber Security Procurement Language for Control Systems, United States Department of Homeland Security (DHS) [25] Common Industrial Control System Vulnerability Disclosure Framework, Industrial Control Systems Joint Working Group (ICSJWG) [26] Cross-Sector Roadmap for Cybersecurity of Control Systems, Industrial Control Systems Joint Working Group (ICSJWG) [27] Security Update Guide, Second Edition, Microsoft [28] Security Guidelines for the Electricity Sector: Patch Management for Control Systems, North American Electric Reliability Council (NERC) Control Systems Security Working Group (CSSWG) [29] NIST Special Publication , Creating a Patch and Vulnerability Management Program [30] NIST Special Publication Guide to SCADA and Industrial Control Systems Security Websites: [31] Microsoft Update Management Process, available at < [32] United Nations, Centre for Trade Facilitation and Electronic Business (UN/CEFACT), available at < [33] Electronic Business using extensible Markup Language (ebxml), available at < [34] Organization for Production Technology, available at < [35] Microsoft Manufacturing Users Group (MsMUG), Automation Federation, available at <

16 ISA99 67 ANSI/ISA-TR [36] Industrial Control Systems Cyber Security Alerts, Bulletins, Tips, United States Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), available at < [37] Patch Management and WSUS Mailing List, Shavlik Technologies, LLC, available at < [38] Security Configuration Guides, National Security Agency (NSA), available at < [39] Open-Source Vulnerability Database, available at < [40] SANS Internet Storm Center, available at < [41] Massachusetts Institute of Technology Interdisciplinary Consortium for Improving Critical Infrastructure Cybersecurity, IACS cyber security research available at <

17

18 Developing and promulgating technically sound consensus standards and recommended practice is one of ISA s primary goals. To achieve this goal the Standards and Practices Department relies on the technical expertise and efforts of volunteer committee members, chairmen and reviewers. ISA is an American National Standards Institute (ANSI) accredited organization. ISA administers United States technical Advisory Groups (USTAGs) and provides secretariat support for International Electrotechnical Commission (IEC) and International Organization for Standardization (ISO) committees that develop process measurement and control standards. To obtain information on the Society s standards program, please write: ISA Attn: Standards Department 67 Alexander Drive P.O. Box Research Triangle Park, NC ISBN: