Industrial information system security Part 3 Standards for securing industrial automation systems Martin Naedele, Dick Oyen

Transcription

1 Tutoril Industril informtion system security Prt 3 Stndrds for securing industril utomtion systems Mrtin Nedele, Dick Oyen Prt 2 of this three-prt tutoril on informtion system security in industril networks explined the different types of mlwre nd suggested how n utomtion system could be defended ginst them. This finl instllment looks t vrious inititives tht hve been strted over the lst couple of yers by different groups to crete stndrds nd other forms of guidnce to secure industril utomtion systems. An overview of number of those inititives nd their work products is presented, nd the pproch tken by IEC TC65 WG10 to produce technicl blueprints for securing certin control system scenrios is explined. 4/

2 Industril informtion system security Tutoril Currently there is flood of informtion vilble on informtion system security in generl. On top of this, there re some utomtion vendor white ppers tht explin certin spects of locking down their systems. However, there is serious lck of imprtil nd esily ccessible guidnce on how to systemticlly secure utomtion nd control systems ginst electronic ttcks. There is no doubt tht stndrds in this re would be very beneficil for both utomtion users nd utomtion vendors, thus enbling them to: Estimte the effort required to implement, mintin, nd operte security mechnisms nd processes. Specify the security objectives for their plnt nd the security functionlities nd mesures tht hve to be provided by vendors nd system integrtors. Compre the thret coverge nd cost of offered security solutions. Implement nd operte cost efficient security mechnisms cross multiple plnts nd loctions in the enterprise. Be sure tht their defense ginst IT-bsed threts corresponds to stte-of-the-rt solutions. Vendors nd system integrtors will be ble to: Anticipte security requirements nd develop corresponding functionlity. Crete security rchitectures tht my be reused cross multiple projects nd customers. This reduces costs in proposl writing, engineering, nd the purchsing of third prty security devices nd pplictions. Mjor stndrdiztion inititives The following survey of industril security stndrdiztion inititives is dpted from [1] nd [2]. ISA S99 The intention of the ISA (Instrumenttion, Systems, nd Automtion Society) Committee SP99, Mnufcturing nd Control Systems Security 1) is to crete guidnce documents nd stndrd (S99) on introducing IT security to existing industril control nd utomtion systems. ISA is entitled to produce stndrds for the process industry with ntionl vlidity in the US. Mny ISA stndrds re used interntionlly s best prctices or, such s S88 nd S95, dopted s interntionl stndrds. Stndrds outlining how to systemticlly secure utomtion nd control systems ginst electronic ttcks would be very beneficil for both utomtion users nd utomtion vendors. SP99 strted its work in As first step, it produced two technicl reports tht were published in spring The first report Security Technologies for Mnufcturing nd Control Systems [3] is comprehensive survey of wht is stte-of-the-rt in security technologies nd mechnisms, with comments on their pplicbility for the plnt floor. It covers: uthentiction nd uthoriztion; filtering/blocking/ccess control; encryption nd dt vlidtion; udit, mesurement, monitoring, nd detection; operting systems nd softwre; nd physicl security. Ech technology is evluted with regrd to the following questions: Addressed security vulnerbilities; typicl deployment; known weknesses; use in n utomtion environment; future directions; recommendtions; nd references. The second report Integrting Electronic Security into the Mnufcturing nd Control Systems Environment [4] presents recommendtions for security rchitecture nd describes the dministrtive issues nd processes for introducing security mngement system in industril plnts. The pproch in this report is inspired by ISO/IEC [5]. It contins sections on developing security progrm, policies, risk ssessment, udits nd testing, developing, selecting, nd procuring, countermesures, s well s exmples for policies nd forms. Since the summer of 2004 SP99 hs been working on the S99 stndrd. S99 focuses on: Retrofitting security mechnisms in existing plnts with commercilly vilble components without ctully prescribing specific rchitecture. The processes to operte the underlying mngement system nd dministrtive processes. The ctul security rchitecture nd processes will likely be customized for specific plnts. IAONA The Industril Automtion Open Networking Allince (IAONA) is n interest group of industril communiction system users nd mnufcturers. Its Joint Technicl Working Group Security 2) hs developed Security Dt Sheet which is intended to serve s templte for utomtion system nd Tble 1 Secutity inititives CIDX ( ) cretes procedurl security guidnce for the chemicl industry. Its work is ligned with ISA SP99. CIDX is mostly ctive in North Americ. NAMUR ( provides guidnce on secure usge of networking technology for the process industry. NAMUR is mostly ctive in Germny/Europe. NERC ( ) is the North Americn self-regultion uthority for power utilities. Complince with NERC 1200 nd successor CIP stndrds on security mngement with their strong focus on processes nd documenttion is compulsory for North Americn power utilities. CIGRE ( the Interntionl Council on Lrge Electric Systems ddresses IT security considertions in number of its working groups. PCSRF ( ), the Process Control Security Requirements Forum, promotes security certifiction of future control system components ccording to ISO/IEC ( Common Criteri ). It is driven by the US Ntionl Institute of Stndrds nd Technology, the US ntionl ISO/IEC certifiction uthority. PCSF ( ), the Process Control System Forum, ws estblished 2004 s met-inititive to promote informtion shring between ll the other inititives on the topic. 70 4/2005

3 Industril informtion system security Tutoril device vendors to document the security nd communiction relted fetures nd requirements of their individul products. This informtion cn serve s vluble input for the utomtion security rchitect s he designs nd configures the necessry security mechnisms for the plnt. The benefit of such Security Dt Sheet is tht it collects, t single loction, concise security relevnt informtion tht is otherwise often hrd to obtin from vendor literture. IEC In erly 2004 the IEC Technicl Sub- Committee 65C (Digitl Communictions), through its working group WG13 (Cyber Security), strted to ddress security issues - within the IEC stndrd for field buses nd other industril communiction networks. These issues re outlined in new prt 4 entitled Digitl dt communictions for mesurement nd control Profiles for secure communictions in industril networks. Wht becme evident during this work ws tht security issues in the utomtion system cnnot be solved by protecting communiction lone nd by looking only t the field level. Insted, the working group strted to specify stte-of-the-rt secure reliztions of certin common utomtion networking scenrios, such s dil-up remote ccess. These descriptions, clled requirement sets, contin product independent specifiction of technicl mechnisms in the context of best-prctice security rchitecture, s well s guidnce on the configurtion nd opertion of these mechnisms. The pproch is described in greter detil below. Consequently, the work of the group ws moved to TC65 WG10 to lign the ctul nd necessry work with the IEC committee mndte. The completed stndrd IEC 62443, entitled Security for industril process mesurement nd control Network nd system security is expected in The finl voting for interntionl vlidity will tke plce during the first hlf of Some other security inititives re briefly described in Tble 1. Security mngement on the plnt floor ccording to ISA S99 The ISA SP99 technicl report TR [3], Security Technologies for Mnufcturing nd Control Systems provides guidnce on the pplicbility of brod nd inclusive rnge of security technologies. Its dvice comes from the combined experience of security experts from utomtion system vendors nd users. As the informtion presented is nlyticl in 1 Cyber Security Mngement System. Pln 1. Importnce of Cyber Security in Business 2. Scope of Cyber Security Mngement System 3. Security Policy 4. Orgniztionl Security 5. Personnel Security 6. Physicl nd Environmentl Security Do 7. Risk Identifiction, Clssifiction, nd Assessment 8. Risk Mngement nd Implementtion 9. Incident Plnning nd Response 10. Communictions, Opertions, nd Chnge Mngement 11. Access Control 12. Informtion nd Document Mngement 13. System Development nd Mintennce 14. Stff Trining nd Security Awreness 15. Complince Check 16. Business Continuity Pln 17. Monitoring nd ing CSMS Act 18. Mintining nd Implementing Improvements nture, it is not normtive stndrd ginst which complince cn be mesured. The reder determines the pplicbility of the informtion to the specific cse. It is n excellent document for those strting to determine security mesures nd those with experience. TR continues to be updted but its content will not be covered by the S99 stndrds. As of October of this yer, drfts of two of the four prts of the S99 stndrd re lmost redy for public review. Prt 1 defines terms nd describes the models used in discussing security in utomtion systems. Prt 2 dvises how cyber-security mngement system (CSMS) cn be estblished. There re 18 key elements in CSMS which re structured in life cycle tht is constntly repeted through four phses: Pln, Do, Check, nd Act. The CSMS is provided by the Chemicl Industry Dt Exchnge (CiDX) [7], which dpts the four phses of the British Stndrd BS :2002 [6] to utomtion systems nd defines the 18 key elements. The CSMS nd its elements re shown in 1. Its cyclic nture is implicit in step 18 in which the security progrm itself is modified ccording to lessons lerned in the course of the preceding elements. Pln phse: Security plnning begins with mking business cse so tht top mngement cn set cler top-level policy tht mndtes the security progrm. Orgniztionl Security is plnned nd this tkes into ccount ll of the deprtments nd people tht re involved with the control system. It identifies roles nd estblishes responsibilities reltive to security. Security reltes to people: those who hve ssets to protect, those who re expected to protect them, nd those who might compromise those ssets. Personnel Security defines personnel policies to estimte nd mintin the trustworthiness of those who re given greter ccess to the ssets. Physicl nd Environmentl Security must lso be plnned. Cyber security is 4/

4 Industril informtion system security Tutoril bsed on n ssumption tht there re substntil (not bsolute) brriers ginst physicl ttck. Security risks re identified, clssified, nd ssessed in the plnning phse. Detiled instructions bout how to do this is provided in S99 nd the mteril tht it references. Do phse Risk ssessment leds directly into the Do Phse. Using the risk ssessment, security resources cn be efficiently pplied to rel vulnerbilities. Procedures re estblished tht pln the response to potentil incidents. Response plnning must include when it becomes necessry to notify government officils of significnt thret to the community. Overll mngement policies nd procedures re estblished to cover communictions, system opertions, nd chnge mngement. Access control defines the privileges tht ccompny specific roles. It lso defines the procedures tht limit people s ccess to ctivities nd informtion to which they re privileged. Authentiction mens re determined which will ensure tht prticulr user (person or softwre) hs the necessry ccess uthoriztion. Informtion nd Document Mngement identifies the security clssifiction of dt nd specifies sfegurds. Security issues of developing nd mintining the system re lso hndled by policies nd procedures. Stff must be trined in the relevnt security procedures nd ll personnel should undertke regulr refresher courses on generl security precutions. Complince of deprtments nd personnel to the security policies nd procedures must be mesured through continuous monitoring, nd periodiclly, through udits. Complince must lso tke into ccount externl requirements such s those of customers, contrctul prtners, nd regultory gencies. Check phse The Check Phse includes developing Business Continuity Pln nd following it. This pln estblishes how the compny will operte through incidents tht result in serious dmge, plnt outge, nd possibly community ctstrophe. The lessons lerned from the CSMS ctivities re reviewed in the Check Phse. Act phse As the CSMS is cyclic process, the security progrm is revised ccording to the review in the Check Phse. S99 Prt 2 provides more detils s well s 19 steps for estblishing 2 Modulr security rchitecture. Ech cn be mpped to certin components of the utomtion system nd its network. ECI SED Stndlone device IRA Remote ccess client (e.g. mintennce) IOC Remote control center (e.g. bckup, or different plnt) Semi-public network (e.g. enterprise network) Public network (e.g. Internet) PSM PEC Service lptop CNH Control center/hmi ULCC Control network (control center upper level) ACI Appliction servers Control servers LLCC Control network (control center lower level) utomtion cell utomtion cell AFD controller controller FC Control network (field level) 72 4/2005

5 Industril informtion system security Tutoril CSMS. Prt 3 ims t providing guidnce on how to operte the CSMS. Technicl security rchitecture bsed on IEC IEC minly ddresses on system level technicl spects of the security rchitecture, nd thus compliments product oriented inititives like IAONA, nd process guidnce provided by SP99 nd NERC. With the ongoing stndrdiztion efforts for Industril IT security processes nd rchitectures, plnt mngers hve rel chnce to implement stte-of-the-rt nd cost-efficient informtion system security. The bsic ide of the IEC pproch is tht of modulr security rchitecture. Ech module corresponds to certin usge or communiction scenrio nd cn be mpped to certin components of the utomtion system nd its network 2. Ech module is represented by requirement set specified in the stndrd. Some of the requirements, s well s the physicl or logicl components they refer to, re common to multiple modules. Security rchitecture modules cn nd should be combined to suit the specific usge nd thret sitution of n utomtion system. The stndrd will provide guidnce on the priority of modules for situtions where complete implementtion of the stndrd is not possible due to budget limittions for initil implementtion nd ongoing mintennce. The requirements will be formulted in wy tht cn be used s the bsis for Requests for Proposls (RFPs) for dt communiction stndrds, nd offers, s well s security udits. They Footnotes 1) 2) should, t the sme time, llow for different technicl solutions. One gol is tht it will be possible to meet the requirements of the stndrd using products nd technologies tht re commercilly vilble tody. The requirements cn lso be pplied to current nd legcy systems nd they cn be scled down for systems where n nlysis hs indicted they represent low risk for both the enterprise nd society. The working group foresees the following modules: Enterprise control net interconnect (ECI): ECI defines the security rchitecture for non-rel-time dtflow between control network nd n enterprise network, preferbly unidirectionl out of the control network. Interctive remote ccess (IRA): IRA detils the security rchitecture needed so tht prts of the control system cn be ccessed remotely (ie, vi telephone dilup or Internet) for perhps engineering or expert dignosis. Inter control center connect (ICC): ICC describes how communictions between fixed control centers over public networks cn be secured. Stnd-lone embedded device (SED): SED outlines the security requirements for n utomtion device tht is not contined in security zone nd for which full-blown security perimeter would not be cost efficient, eg, pole-top Intelligent Electronic Device (IED). Portble engineering computer (PEC): PEC detils how control system cn be protected ginst threts originting from portble computers tht my be moved bck nd forth between public networks nd the control system Portble storge medi (PSM): An utomtion system my be exposed to mlwre infections through storge medi like memory sticks or CDs. PSM explins how this cn be prevented. Automtion cell interconnect (ACI): ACI outlines the security rchitecture required for protected communiction between utomtion cells within control network. Upper Level Control center (ULCC): Prt of control network is connected to opertor worksttions, historins, ppliction servers nd connectivity servers. ULCC dtils network oriented security mechnisms specific to this prt. Lower Level Control center (LLCC): LLCC outlines network oriented security mechnisms in the prt of the control network connected to controllers nd PLCs. Field Control (FC): FC outlines network oriented security mechnisms in the prt of the control network connected to field devices. Control network host (CNH): CNH explins how utomtion worksttions nd servers for opertions nd engineering cn be secured ginst ttcks from insiders nd mlwre, for exmple. Automtion field device (AFD): AFD explins how field devices nd embedded controllers cn be secured. Ech module describes: use cse to which it pplies; threts tht re ddressed or not ddressed; the underlying ssumptions; the requirements; nd the prty (utomtion vendor, system integrtor, or plnt owner) responsible for meeting ech of the requirements. The core prt of ech module is the requirement set nd it contins between 20 nd 50 requirements, depending on the module. Ech requirement consists of normtive sttement, optionlly including scle-down lterntives, rtionle, nd in mny cses one or more ppliction notes. The rtionle is n essentil element, s it enbles the reder to mke n informed decision bout the importnce nd pplicbility of the requirement. The ppliction notes provide technicl guidnce on how the requirement could be relized. The IEC stndrd describes the wht nd why of the security rchitecture, but the how is specific to n individul site nd system nd is therefore left to the engineering judgment of the plnt experts nd the utomtion/it integrtor. Summry With the ongoing stndrdiztion efforts for Industril IT security processes nd rchitectures, specific to control nd utomtion systems, plnts mngers now hve rel chnce to 4/

6 The corporte technicl journl 1 / 2005 The corporte technicl journl 2 / 2005 The corporte technicl journl 3 / 2005 The corporte technicl journl 4 / 2005 Industril informtion system security Tutoril INDEX 2005 implement stte-of-the-rt nd costefficient informtion system security. The stndrdiztion inititives described bove hve so fr been chrcterized by generl recognition tht prgmtic solutions re needed to serve the industry, s well s very constructive collbortion mong utomtion vendors nd end users so tht this objective is chieved. is mjor contributor to vrious security stndrdiztion inititives. The compny offers products nd solutions tht re complint to evolving stndrds, nd provides ssistnce to its customers in pplying these stndrds to specific plnts nd sites. Mrtin Nedele Switzerlnd, Corporte Reserch mrtin.nedele@ch.bb.com Pioneering spirits A revolution in high dc current mesurement pge 6 Tem-mtes: MultiMove functionlity herlds new er in robot pplictions pge 26 Best innovtions 2004 pge 43 1/2005: Pioneering spirits A revolution in high dc current mesurement 6 Form nd Function 11 The perfect cst 14 DryQ Dry nd silent 17 PSGurd contributes to UCTE grid reconnection 22 Tem-mtes 26 Instnt comfort 30 Stisfction gurnteed 33 Pnormic projection 37 Digging into the rchives 40 Best innovtions Don t touch: s new pssive voltge indictor 52 Wireless Ad-hoc networks 54 Autonomic computing 55 Sustinbility Sustinbility is n essentil prt of s business pge 6 Beting the greenhouse effect with emissions trding pge 14 Sfety mngement in process industries the pproch pge 51 3/2005: Sustinbility Sustinbility in 6 Helthy, sfe nd productive 10 Emissions trding 14 SF 6 technology 20 Energy efficiency 22 Networking 28 Not on my wtch 31 Lener, fitter, smrter 36 HVDC 42 Sfety mngement in process industries: Prt 1 47 Prt 2 51 Energy efficiency Green shipping 54 The turbochrger 58 Boosting supply 63 Cut nd dry 66 Unplugged but connected Prt Industril informtion system security Prt 2 74 Dick Oyen US, Corporte Reserch dick.oyen@us.bb.com References [1] Nedele, M.: Stndrdizing Industril IT Security A First Look t the IEC pproch, 10th IEEE Interntionl Conference on Emerging Technologies nd Fctory Automtion (ETFA 05), Ctni, September 2005 [2] Dzung, D., Nedele, M., von Hoff, T., Crevtin, M.: Security for industril communiction systems, Proceedings of the IEEE, Vol. 93 (6), June 2005, pp [3] ISA SP99: Security Technologies for Mnufcturing nd Control Systems, Instrumenttion, Systems, nd Automtion Society, ISA-TR , Mrch 2004, [4] ISA SP99: Integrting Electronic Security into the Mnufcturing nd Control Systems Environment, Instrumenttion, Systems, nd Automtion Society, ISA-TR , April 2004, [5] ISO: Informtion technology Code of prctice for informtion security mngement, ISO/IEC 17799:2000, December 2000, [6] British Stndrds Orgniztion: Informtion security mngement systems Specifiction with guidnce for use, BS :2002, September 2002 [7] Chemicl Industry Dt Exchnge (CiDX): Guidnce for Addressing Cybersecurity in the Chemicl Sector, Version 2.0, December University nd industry coopertion Turning Europe into dynmic nd competitive knowledge-bsed economy pge 6 The importnce of working together with industry: university viewpoints pge 22 Looking hed: The future of power system control pge 35 2/2005: University nd industry coopertion Closing the gp 6 Welcome to our world 10 The MIT experience 14 Leders of tomorrow 18 University co-opertion 22 City of lerning 29 Let s work together 32 Looking hed 35 Vlue for money 39 Root cuse 44 Predictble ssembly 49 Hot stuff 55 Grids united 59 Simulted relity 62 Industril informtion system security Prt 1 66 Innovtion the DNA of business Best innovtions 2005 pge 15 Power lines tht don t spoil the lndscpe pge 25 The mgnetic stbilizer tht sves on zinc pge 60 4/2005: Innovtion The DNA of business Looking bck to look forwrd 6 Fruits of innovtion 9 Best innovtions Grid flexibility 21 Light nd invisible 25 Convergence in the control room 30 Powerful nd stble 33 High voltge ssembly 36 Breking to the front 39 Ironing out resonnces 42 Age is no issue 47 The process copper 51 Control loops: plesure or plgue? 55 Stbilizing influence 60 Live(ly) neighbours 64 Unplugged but connected Prt 2 65 Industril informtion system security Prt /2005