Building Insecurity Lisa Kaiser Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)
Insecurity How do I Specify it Buy it Test it Deploy it Regret it Apologize for it
Specifying Insecurity Ignore security entirely Specify inappropriate standards Use vagueness Demand particular technology solutions
Buying Insecurity Never mention security Don t put it in writing Listen when they say We ll secure it later Cheaper is always more secure New is more secure
Testing Insecurity Never test Check only sunny day scenarios Rely on vendor assurances Use only cheap security experts Use your firewalls
Deploying Insecurity Don t plan Use default passwords Bypass all the security Never do SAT Ignore security alarms and alerts Photo courtesy of Kristian Ovaska, 2003
Regretting Insecurity Begin with RFQ Ignore any breaches Shoot the Messenger Apply quick-fixes Use the Blame-game
Apologizing for Insecurity Leave the organization Distract customers Avoid responsibility Attack the messengers Use the press Blame us
However» If you re NOT trying to Building Insecurity, but instead which to Build In Security» Try this to achieve your goal:
Cyber Security Evaluation Tool (CSET ) R Stand-alone software application Self-assessment using recognized standards Tool for integrating cybersecurity into existing corporate risk management strategy CSET Download: http://ics-cert.us-cert.gov/downloading-and-installing-cset 10
CSET Standards R Requirements Derived from Widely Recognized Standards NIST Special Publication 800-53 Consensus Audit Guideline (CAG) NERC Critical Infrastructure Protection (CIP) Recommended Security Controls for Federal Information Systems Rev 3 and with Appendix I, ICS Controls Criteria Evaluation Recommendations based upon National Security Association (NSA) Cyber Attack Phases Reliability Standards CIP-002 through CIP-009, Revisions 3 and 4 DoD Instruction 8500.2 Information Assurance Implementation, February 6, 2003 NIST Special Publication 800-82 Guide to Industrial Control Systems (ICS) Security, June, 2011 NRC Reg. Guide 5.71 Cyber Security Programs for Nuclear Facilities, January 2010 CFATS RBPS 8- Cyber Transportation Security Agency Pipeline Guidelines Chemical Facilities Anti-Terrorism Standard, Risk-Based Performance Standards Guidance 8 Cyber, 6 CFR Part 27 DHS TSA guidance for the pipeline industry 11
CSET R Capabilities What the CSET CAN do: Provide a consistent means of evaluating a control system network as part of a comprehensive cybersecurity assessment Specify cybersecurity recommendations Report using standards-based information analysis Provide a baseline cybersecurity posture What the CSET CAN T do: Validate accuracy of user inputs Ensure compliance with organizational or regulatory cybersecurity policy & procedures Ensure implementation of cybersecurity enhancements or mitigation techniques Identify all known cybersecurity vulnerabilities 12
Assessment Team A TEAM of participants is required to perform a successful assessment Type of Participant Control Systems Engineer Configuration Manager Operations Manager IT Network Specialist IT Security Officer Risk Analyst or Insurance Specialist Knowledge Control systems Systems management Business operations IT infrastructure Policy & procedures Risk 13
Assessment Process Organize the Team Add Assessment Information Select the Mode and Standards Determine the Security Level Build the Network Diagram Answer Questions Analyze Results 14
Context Specific Help 15
Starting Screen 16
Assessment Info Main Window 17
Standards Screen Assessment Modes 18
Questions and Standards 19
Questions and Standards 20
General SAL Determination 21
NIST SAL Determination 22
Diagramming Tool 23
Diagram Maximized Screen Space 24
Questions Screen 25
Question Information 26
Comments, Marked and Alternates 27
Component Questions 28
Component Overrides 29
Analysis Screen 30
Analysis Detail Screens 31
Analysis Detail - Example 32
Question Filters 33
Hardcopy Reports 34
Resource Library 35
Resource Library - Search 36
CSET 6.0 Enhancements New/Updated Standards NEI 08-09 Rev 6 NISTIR 7628 Ver 1 (August 2010) INGAA Ver 1 (January 31, 2011) NIST SP800-53 Appendix J Rev 4 NIST SP800-82 Rev 1 (May 2013) CNSSI ICS Overlay Update New Evaluation Capabilities Merging Comparison Aggregation Trending 37
Trending Sample Screen CSET Assessment Aggregation -- Trending Mode 60 50 40 30 20 10 0 80 60 40 20 0 Overall Trends Top 5 Most Improved Areas 2011 2012 2013 Top 5 Areas of Decline 2011 2012 2013 Environmental Security Components Standards Overall Access Control Account Management Audit and Accountability Communication Protection Configuration Management Incident Response Info Protection Information and Document Management Maintenance Access Control Account Management Audit and Accountability Communication Protection Configuration Management Personnel Physical Security Plans Policies & Procedures General Privacy Procedures Risk Management and System Integrity System Protection System and Services Training 80 30 30 80 25 20 80 65 80 75 45 50 80 30 30 80 25 20 80 65 80 80 30 30 80 65 80 80 30 30 80 25 20 75 45 50 80 65 80 75 45 50 80 30 30 80 25 20 0 20 40 60 80 100 2013 2012 2011
Aggregation Sample Screen CSET Assessment Aggregation Comparison Mode Site Total Questions Yes No Answered Site A 560 300 260 Site B 342 300 42 Site C 268 152 116 Components Standards Overall Site C Site B Site A SAL Level 66 81 76 70 75 65 Site A Site B Site C 70 75 71 Access Control Account Management Audit and Communication Configuration Continuity Environmental Incident Response Info Protection Information and Portable/Mobile/Wir Privacy Procedures Remote Access Risk Management SIS Software System Integrity System Protection System and Training 0 50 100 Site C Site B Site A Sort By Best Access Password Policies Procedures Access Password Policies Procedures Access Password Policies Procedures Site A 20 Site C 20 30 30 Sort By Worst 50 50 60 80 0 50 100 0 50 100 Site B 3 2 1 25 0 50 100
CSET 6.0 Enhancements (cont.) New/Updated Functionality Inventory Lists Security Plans YouTube Tutorials Updated Diagramming Tool 40
Key Contact Information Lisa Kaiser Lisa.Kaiser@dhs.gov Download CSET http://ics-cert.us-cert.gov/downloading-and-installing-cset 41