Professional Documents
Culture Documents
Cyber Security Plan Template
Cyber Security Plan Template
<<date>>
Prepared by:
1 of 63
Table of Contents
Preface...................................................................................................................................... 4 Purpose ................................................................................................................................ 4 Scope .................................................................................................................................... 4 Target Audience.................................................................................................................. 4 Contacts ............................................................................................................................... 4 Using the Template ................................................................................................................. 5 Executive Summary ................................................................................................................ 6 Building a Risk Management Program ................................................................................ 7 Risk Management Program Plan ...................................................................................... 8 Addressing People and Policy Risks ...................................................................................... 9 Cyber Security Policy ......................................................................................................... 9 Cyber Security Policy Plan .............................................................................................. 10 Personnel and Training .................................................................................................... 11 Personnel and Training Plan ........................................................................................... 12 Addressing Process Risks ..................................................................................................... 13 Operational Risks ............................................................................................................. 13 Operational Risk Plan ...................................................................................................... 14 Insecure Software Development Life Cycle (SDLC) Risks ........................................... 15 Secure SDLC Plan ............................................................................................................ 16 Physical Security Risks .................................................................................................... 17 Physical Security Plan ...................................................................................................... 18 Third-Party Relationship Risks ...................................................................................... 18 Third-Party Relationship Plan ........................................................................................ 20 Addressing Technology Risks .............................................................................................. 21 Network Risks ............................................................................................................... 21 Network Security Plan ..................................................................................................... 26 Platform Risks .............................................................................................................. 27 Platform Security Plan ..................................................................................................... 29 Application Layer Risks .............................................................................................. 30 Application Security Plan ................................................................................................ 30 Security Requirements and Controls For Each Smart Grid Activity Type .................... 32 Advanced Metering Infrastructure (AMI) ..................................................................... 32 Advanced Metering Infrastructure Plan ........................................................................ 34 Meter Data Management (MDM) ................................................................................... 35 Meter Data Management Plan ........................................................................................ 36 Communication Systems (COMM)................................................................................. 36 Communication Systems Plan ......................................................................................... 38 Supervisory Control and Data Acquisition (SCADA) ................................................... 38 Supervisory Control and Data Acquisition (SCADA) Plan .......................................... 41 In-Home Display (IHD) / Web Portal Pilots .................................................................. 41
2 of 63
In-Home Display (IHD)/Web Portal Pilots Plan ............................................................ 42 Demand Response over Advanced Metering Infrastructure (AMI) Networks ........... 43 Demand Response over Advanced Metering Infrastructure (AMI) Networks Plan .. 43 Interactive Thermal Storage............................................................................................ 44 Interactive Thermal Storage Plan ................................................................................... 45 Smart Feeder Switching ................................................................................................... 45 Smart Feeder Switching Plan .......................................................................................... 46 Advanced Volt/VAR Control........................................................................................... 47 Advanced Volt/VAR Control Plan .................................................................................. 47 Conservation Voltage Reduction (CVR) ........................................................................ 48 Conservation Voltage Reduction (CVR) Plan................................................................ 49 Appendix A: Reference Documentation ............................................................................. 50 Security Standards ........................................................................................................... 50 National Institute of Standards and Technology Special Publications ........................ 50 Other Guidance Documents ............................................................................................ 52 Appendix B: Glossary ........................................................................................................... 54 Appendix C: Acronyms ........................................................................................................ 60 Appendix D: Minimum Security Requirements ................................................................ 61
3 of 63
Table of Contents
Preface
Purpose
This plan baselines existing cyber securityrelated activities and controls at our organization against the Guide to Developing a Cyber Security and Risk Mitigation Plan. For areas covered by existing processes and/or technologies, the plan briefly documents how and where this is accomplished. For identified gaps, the plan documents current deviation from the recommended security controls and specifies whether to accept or mitigate the risk, the actions needed to close the gaps, the responsible party, and the implementation timeline.
Scope
This plan goes through the cyber security controls that our organization already has in place or plans to implement in order to mitigate the risks introduced by smart grid technologies.
Target Audience
Security team, IT organization, leadership team.
Contacts
The following are the primary individuals who assisted in preparation of the cyber security plan:
Contact
<<list individuals>>
Title
Contact
E-mail Address
4 of 63
Using the Template Each section of the template is divided into two subsections. The first contains a table for identifying best practices and their current use in the cooperative:
Using the dropdown box, select the option that best describes the cooperatives status regarding the best practice. If the cooperative is fully compliant with the best practice, select Yes. If the cooperative is partially compliant with the best practice, select Partial. If the cooperative is not compliant with the best practice, select No. To list documents where the cooperatives implementation of the best practice is described, use the Associated Documentation column. The second subsection contains a table for listing deviations from the recommended best practices (those marked as Partial or No in the first table), decisions to accept or mitigate the risk posed by not implementing the best practices, the person or group responsible for the risks acceptance or mitigation, the estimated completion date (if applicable), and a strategy for mitigating the risk (if applicable).
Again, use this table to list all security activities or controls that are currently either partially in place or not in place. For each identified activity or control, describe the way in which the cooperative does not meet the best practice as captured in the Guide to Developing a Cyber Security and Risk Mitigation Plan. Use the dropdown box to either Accept or Mitigate the risk posed by not implementing the best practice. Assign a person or group responsible for mitigating or accepting the risk posed by not implementing the best practice. Provide an estimated completion date of mitigation in the Estimated Completion Date column, or use n/a for risk acceptance. Describe the strategy that will be used to implement the activity or control, or use n/a for risk acceptance.
5 of 63
Executive Summary
Executive Summary This document provides checklists of security activities and controls designed to help an electric cooperative improve the security posture of its smart grid. The checklists are drawn from the Guide to Developing a Cyber Security and Risk Mitigation Plan and provide a mechanism to baseline existing security activities and controls against recommended best practices, identify gaps, capture the decision for risk acceptance or mitigation, and document an appropriate plan of action. Each section contains tables; filling these will help the electric cooperative to: Identify missing activities and security controls. Consolidate planned activities and controls per topic. Prioritize activity and control implementation. Track activity and control implementation.
It is important to note that implementing security activities and controls should be done with care and sufficient planning. The environment will require testing to ensure that changes to controls do not break important functionality or introduce new risks. This document provides cyber security planning support in each of the following categories: People and policy security Operational security Insecure software development life cycle (SDLC) Physical security Third-party relationship Network security Platform security Application security
6 of 63
Building a Risk Management Program No usable system is 100 percent secure or impenetrable. The goal of a risk management program is to identify the risks, understand their likelihood and impact on the business, and then put in place security controls that mitigate the risks to a level acceptable to the organization. In addition to assessment and mitigation, a robust risk management program includes ongoing evaluation and assessment of cyber security risks and controls throughout the life cycle of smart grid component software. The following checklist summarizes security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Rationale Active and visible support from executive management at each stage of planning, deploying, and monitoring security efforts is crucial to success. Have security risk mitigation, resource-allocation decisions, and policy enforcement roll up to a clearly defined executive with the requisite authority. Careful system definitions are essential to the accuracy of vulnerability and risk assessments and to the selection of controls that will provide adequate assurances of cyber security. It is important to understand the assets that may need to be protected, along with their classification (e.g., confidential information, private information, etc.). That way an informed decision can be made as to the controls needed to protect these assets, commensurate with risk severity and impact to the business. To build a threat model, it is important to understand the entry points that an adversary may use to go after the assets of an organization. The threat model then becomes an important component of the risk assessment.
Associated Documentation
Assign responsibility for security risk management to a senior manager. Define the system.
Choose an item.
7 of 63
<<Name of Co-op>> Cyber Security Plan Choose an item. Choose an item. Activity / Security Control Perform a vulnerability assessment. Rationale Realistic assessments of (a) weaknesses in existing security controls and (b) threats and their capabilities create the basis for estimating the likelihood of successful attacks. They also help to prioritize remedial actions. The risk assessment combines the likelihood of a successful attack with its assessed potential impact on the organizations mission and goals. It helps ensure that mitigation efforts target the highest security risks and that the controls selected are appropriate and costeffective for the organization. Appropriate management, operational, and technical controls cost-effectively strengthen defenses and lower risk levels. In addition to assessed risks, selection factors might include the organizations mission, environment, culture, and budget. Effective testing and ongoing monitoring and evaluation can provide a level of confidence that security controls adequately mitigate perceived risks.
Choose an item.
Choose an item.
Risk Management Program Plan The table below outlines the activities and controls that are currently missing from the risk management of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control
Security
Responsible Party
Mitigation Strategy
8 of 63
Addressing People and Policy Risks Training people to adopt security conscious behaviors and establishing policies for maintaining a secure environment go a long way toward improving an organizations overall security posture. The next two sections cover the people and policy dimensions of cyber security. Cyber Security Policy
Choose an item.
Activity / Security Control Assign responsibility for developing, implementing, and enforcing cyber security policy to a senior manager. Ensure that the senior manager has the requisite authority across departments to enforce the policy.
Rationale The development and implementation of effective security policies, plans, and procedures require the collaborative input and efforts of stakeholders in many departments of the organization. Assigning a senior manager to organize and drive the efforts, with the authority to make and enforce decisions at each stage, raises the chances of success. Employees at virtually every organizational level have responsibility for some part of developing or applying security policies and procedures. Defined roles and responsibilities will clarify decisionmaking authority and responsibility at each level, along with expected behavior in policy implementation. Creating a multidisciplinary oversight committee ensures that all stakeholders are represented. An effective security program requires policies and procedures that address a wide range of management, personnel, operational, and technical issues.
Associated Documentation
Choose an item.
roles
and
Choose an item.
9 of 63
<<Name of Co-op>> Cyber Security Plan Choose an item. Activity / Security Control Document a brief, clear, high-level policy statement for each aspect identified. Rationale The high-level policy statements express three things:
A
Choose an item. Choose an item. Choose an item. Reference lower-level policy documents.
framework documents.
to
organize
lower-level
Lower-level policies, plans, and procedures provide the details needed to put policy into practice. and A careful rollout of the program, well-documented policies that are accessible to the personnel they affect, and clearly communicated consequences of violating policies will help ensure compliance. This will help maximize compliance by providing mechanisms to:
plan
Cyber Security Policy Plan The table below outlines the activities and controls that are currently missing from the cyber security policy of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
10 of 63
<<Name of Co-op>> Cyber Security Plan Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date
Personnel and Training Insufficiently trained personnel are often the weakest security link in the organizations security perimeter and are the target of social engineering attacks. It is therefore crucial to provide adequate security awareness training to all new hires, as well as refresher training to current employees on a yearly basis. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Activity / Security Control Adequately vet candidates for hire. Rationale Provide a level of confidence that new hires are trustworthy. Ensure that all personnel have an understanding of sensitive information, common security risks, and basic steps to prevent security breaches. Further, ensure that personnel develop habits that would make them less susceptible to social engineering attacks. Ensure that employees who have electronic or physical access to critical assets know how to handle the assets securely and how to report and respond to cyber security incidents. Associated Documentation
Choose an item.
11 of 63
<<Name of Co-op>> Cyber Security Plan Choose an item. Activity / Security Control Enforce least privilege access to cyber assets and periodically review access privileges. Rationale Ensure that employees have only the privileges they need to perform their jobs.
Personnel and Training Plan The table below outlines the activities and controls that are currently missing from the personnel and training plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
12 of 63
Addressing Process Risks Process gaps leave the door open to an adversary. For instance, failure to conduct a vulnerability assessment of a system when introducing new functionality may allow a security weakness to go undetected. To provide another example, lack of periodic review of system logs may let a breach go undetected. Instituting and following proper security processes is vital to the security of an organization. Operational Risks The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Activity / Security Control Perform periodic risk assessment mitigation, including threat analysis vulnerability assessments. and and Rationale Maintain a fresh picture of the effectiveness of the organizations security control versus threats facing the organization. Prevent unauthorized access to assets, detect unauthorized access to assets, and enforce accountability. Ensure that the redeployment or disposal of cyber assets does not inadvertently expose sensitive information to unauthorized entities. Ensure that system changes do not break security controls established to protect cyber assets. Ensure that the organization is prepared to act quickly and correctly to avert or contain damage after a cyber security incident. Ensure that the organization is prepared to act quickly and correctly to recover critical assets and continue operations after a major disruption. Associated Documentation
Control, monitor, and log all access to protected assets. Redeploy or dispose of protected assets securely. Define and enforce secure change control and configuration- management processes. Create and document incident-handling policies, plans, and procedures. Create and document contingency plans and procedures.
13 of 63
<<Name of Co-op>> Cyber Security Plan Choose an item. Activity / Security Control Train employees in incident handling and contingency plans. Rationale Ensure that personnel responsible for responding to cyber incidents or major disruptions have a firm grasp of response plans and can execute them under stress.
Operational Risk Plan The table below outlines the activities and controls that are currently missing from the operational risk plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
14 of 63
Insecure Software Development Life Cycle (SDLC) Risks Secure software is a product of a secure software development process. If the organization develops software internally, it should make sure that it does so by leveraging security activities during the various phases of software development. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Activity / Security Control Document misuse / abuse cases. Rationale Think of ways in which system functionality can be abused so that protections can be built in to prevent that abuse. Explicitly call out security requirements of the system so that software can be designed, implemented, and tested to ensure that these requirements have been met. Enumerate the ways in which an adversary may try to compromise the system so that the system can be designed from the get-go to resist such attacks. Compare the systems architecture against a threat model to ensure that sufficient security controls are in place to prevent successful attacks. Ensure that developers use defensive programming techniques when implementing the system in order to avoid introducing security weaknesses. Associated Documentation
15 of 63
Choose an item.
Rationale Ensure that software complies with security implementation guidelines, that security controls are properly implemented, and that the implementation itself does not introduce any new security risks. Run through top risks identified during the threat modeling and architecture risk analysis processes to ensure that the system has been designed and implemented in a way that mitigates these risks. Gain assurance from a qualified third party that the software built by your organization is secure. Provide the teams deploying and operating the software in production with whatever knowledge they need in order to ensure that software security requirements are met.
Associated Documentation
Choose an item.
Secure SDLC Plan The table below outlines the activities and controls that are currently missing from the Secure SDLC of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
16 of 63
Physical Security Risks Physical security measures aimed at protecting critical infrastructure of the smart grid are of paramount importance and form a key element of the overall security strategy. While other controls need to exist for defense in depth in case the adversary is successful in gaining physical access, physical security concerns should not be underestimated. The following checklist summarizes the various security best practices and controls that you should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Activity / Security Control Document, implement, and maintain a physical security plan. The organization must document and implement the technical and procedural controls for monitoring physical access at all access points at all times. All physical access attempts (successful or unsuccessful) should be logged to a secure central logging server. Physical access logs should be retained for at least 90 days. Each physical security system must be tested at least once every three years to ensure it operates correctly. Testing and maintenance records must be maintained at least until the next testing cycle. Outage records must be retained for at least one calendar year. Rationale Ensure that physical security is considered in a structured manner that can be tracked. Ability to detect unauthorized access attempts. Take appropriate action if unauthorized access occurred. Ability to detect unauthorized access attempts. Take appropriate action if unauthorized access occurred. Ability to perform historical analysis of physical access. Ensure that proper physical security posture is maintained. Ability to understand what was tested and improve testing procedures. Ability to investigate causes of outages and tie them to unauthorized physical access. Associated Documentation
17 of 63
Physical Security Plan The table below outlines the activities and controls that are currently missing from the physical security of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
Third-Party Relationship Risks The security posture and practices of cooperative vendors and partners may introduce risks into the electric cooperative organization. If a cooperative acquires software from a vendor that did not pay attention to security during the softwares development, that introduces a risk. If a cooperative utilizes a service from a provider that does not take proper precautions to safeguard the data that the cooperative places in its possession, that introduces a risk. Such risks must be managed. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item.
Activity / Security Control Perform due diligence on each vendor and partner organization to understand its business, financial, and security track record.
Rationale Verify the business, financial, and security reputation of your vendor / partner organization.
Associated Documentation
18 of 63
Choose an item.
Activity / Security Control Ask the right questions during the request for proposal (RFP) process to understand the security posture and practices of the partner organization, and in particular whether their offerings meet your organizations security requirements. Compare the security policies and procedures of a third party against your organizations own security policy to ensure compliance. Review the hiring practices and personnel background checks of your vendors and partners to ensure that they comply with your organizations policies. Conduct periodic audits and monitoring of the third-party organization to ensure adherence to their security policies and procedures. For software purchases, request a trusted independent third-party review, to include a report outlining the discovered security weaknesses in the product. Ensure that service level agreements (SLAs) and other contractual tools are properly leveraged so that vendors and partners live up to their obligations. For instance, if a breach occurs at a partner organization, there needs to be a provision to have your organization notified of the full extent of the breach as soon as the information is available.
Rationale Ensure that the security practices of the vendor / partner organization comply with your own organizations security policy. Ensure that the purchased product / service meets your organizations security requirements.
Associated Documentation
Choose an item.
Make sure that your vendor / partner organizations background checks during hiring process are consistent with your own. If people who work at your vendor / partner are not trustworthy, neither is anything they produce. Make sure that your vendor / partner complies with their own security policies and procedures. Increase the likelihood that the product supplied by your vendor / partner is secure.
Seek a contractual obligation that helps your organization transfer some of the security risks.
19 of 63
Activity / Security Control Request evidence from software vendors that their SDLC makes use of building security in activities. Ask your organizations vendors and partners about the process that they use to ensure the security of the components and services that they receive from their own suppliers in order to ascertain appropriate due diligence.
Rationale Ensure that the product supplied to your organization by your vendor / partner has been designed and built with security in mind. Ensure that none of the third-party components that your vendor / partner used in its product or service introduces security weaknesses.
Associated Documentation
Third-Party Relationship Plan The table below outlines the activities and controls that are currently missing from the third-party relationship policy of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
20 of 63
Addressing Technology Risks Information technology (IT) is at the heart of the smart grid. As its spreading use helps the smart grid achieve higher operational efficiencies, it also makes the electrical grid more vulnerable to cyber security attacks. It is therefore important to ensure that the way in which IT is used does not inadvertently provide new avenues of attack to an adversary. Further, IT itself should be applied to institute security controls that will help guard the smart grid ecosystem against successful attacks, as well as enhance the systems ability to detect, isolate, and recover from breaches of security. Network Risks Networks are the communication pipes that connect everything together, enabling the flow of information. Networks are at the heart of the smart grid because without the information flow that they enable, smart behavior is not possible. For instance, a system load cannot be adjusted if information from smart meters does not find its way to the SCADA system. Therefore, the energy savings that result from adjusting a load cannot be realized, unless an action is taken based on reliable information that made its way from the smart meters to the SCADA via a communications network. On the other hand, if an adversary is able to tamper with meter data in a way that cannot be detected and to thus feed incorrect data to the SCADA, an incorrect action may be taken by the grid, resulting in undesired consequences. The following checklist summarizes the various security best practices and controls that you should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Activity / Security Control Restrict user-assigned devices to specific network segments. Firewalls and other boundary security mechanisms that filter or act as a proxy for traffic moving from network segment to another of a different security level should default to a deny all stance. Rationale Least privilege segmentation. through network Associated Documentation
21 of 63
Activity / Security Control Requests for allowing additional services through a firewall or other boundary protection mechanism should be approved by the information security manager. The flow of electronic communications should be controlled. Client systems should communicate with internal servers; these internal servers should not communicate directly with external systems, but should use an intermediate system in your organizations DMZ. The flow of traffic should be enforced through boundary protection mechanisms. Protect data in transit.
Associated Documentation
Preserve the confidentiality and integrity of data in transit. Ensure that data is routed to the right parties.
22 of 63
Choose an item.
Activity / Security Control Use technologies like firewalls and virtual local area networks (VLANs) to properly segment your organizations network in order to increase compartmentalization (e.g., machines with access to business services like e-mail should not be on the same network segment as your SCADA machines). Routinely review and test your firewall rules to confirm expected behavior. Separate development, environments. test, and production
Associated Documentation
Avoid production data leaks into test environments. Have controls in place around access to and changes in the production environment. Secure data in transit.
Ensure channel security of critical communication links with technologies like Transport Layer Security (TLS). Where possible, implement Public Key Infrastructure (PKI) to support two-way mutual certificate-based authentication between nodes on your network. Ensure that proper certificate and key management practices are in place. Remember that cryptography does not help if the encryption key is easy to compromise. Ensure that keys are changed periodically and that they can be changed right away in the event of compromise. Ensure confidentiality of data traversing your networks. If channel-level encryption is not possible, apply data-level encryption to protect the data traversing your network links.
Choose an item.
Ensure that cryptographic protection is not undermined through improper certificate or key management.
Choose an item.
23 of 63
Choose an item.
Activity / Security Control Ensure integrity of data traversing your networks through use of digital fingerprints and signed hashes. If TLS is not used, ensure that other protections from man-in-the-middle attacks exist. Use time stamps to protect against replay attacks. Ensure availability of data traversing your networks. If a proper acknowledgement (ACK) is not received from the destination node, ensure that provisions are in place to resend the packet. If that still does not work, reroute the packet via a different network link. Implement proper physical security controls to make your network links harder to compromise. Ensure that only standard, approved, and properly reviewed communication protocols are used on your network. Use intrusion detection systems (IDSs) to detect any anomalous behavior on your network. If anomalous behavior is encountered, have a way to isolate the potentially compromised nodes on your network from the rest of the network. Ensure that sufficient number of data points exist from devices on your network before the smart grid takes any actions based on that data. Never take actions based on the data coming from network nodes that may have been compromised.
Associated Documentation
Choose an item.
Use proven protocols that have been examined for security weaknesses. Detect intrusions.
Choose an item.
24 of 63
Choose an item.
Activity / Security Control Ensure that all settings used on your network hardware have been set to their secure settings and that you fully understand the settings provided by each piece of hardware. Do not assume that default settings are secure. Disable all unneeded network services.
Associated Documentation
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item.
Routinely review your network logs for anomalous / malicious behavior via automated and manual techniques. Ensure that sufficient redundancy exists in your network links so that rerouting traffic is possible if some links are compromised. Before granting users access to network resources, ensure that they are authenticated and authorized using their own individual (i.e., nonshared) credentials. Limit remote access to your networks to an absolute minimum. When required, use technologies like Virtual Private Networks (VPNs, IPSec) to create a secure tunnel after properly authenticating the connecting party using their individual credentials. In addition to a user name and password, also use an RSA ID-like device to provide an additional level of authentication. Implement remote attestation techniques for your field devices (e.g., smart meters) to ensure that their firmware has not been compromised
Detect intrusion.
Enforce accountability.
Choose an item.
of
25 of 63
Choose an item.
Activity / Security Control Require a heartbeat from your field equipment at an interval known to the piece of equipment and to the server on your internal network. If a heartbeat is missed or comes at the wrong time, consider treating that piece of equipment as compromised / out of order and take appropriate action. Ensure that the source of network time is accurate and that accurate time is reflected on all network nodes for all actions taken and events logged. Document the network access level that is needed for each individual or role at your organization and grant only the required level of access to these individuals or roles. All exceptions should be noted. All equipment connected to your network should be uniquely identified and approved for use on your organizations network.
Associated Documentation
Maintain control over access to network resources and keep it to a necessary minimum. Control hardware that gets connected to your organizations network.
Network Security Plan The table below outlines the activities and controls that are currently missing from the network security plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item.
26 of 63
Responsible Party
Mitigation Strategy
Platform Risks Each accessible host on the organizations network is a potential target for attack. Adversaries will try to compromise these hosts via methods that cannot be mitigated through network security controls alone. It is imperative to ensure that platform software running on the organizations hosts is secure, including (but not limited to) operating system software, database software, Web server software, and application server software. Together these form a software stack on top of which the organizations custom applications run. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Activity / Security Control Ensure latest security patches are applied to all software running on your network hosts. Ensure the latest antivirus / antimalware software runs regularly. Ensure that all unneeded services and interfaces (e.g., USB) are turned off on these hosts. Ensure that the hosts run only services and applications that are absolutely necessary. Ensure that system logs are checked regularly and any abnormalities investigated. Run software to monitor for file system changes. Rationale Patch known weaknesses so that they cannot be exploited. Detect known viruses and/or malware. Associated Documentation
Detect intrusions / attack attempts (both external and internal). Detect system malware unauthorized changes. infections and
27 of 63
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item.
Activity / Security Control Ensure that all access attempts and any elevation of privilege situations are properly logged and reviewed. Ensure that passwords are of sufficient complexity and changed periodically. Ensure that all security settings on your hosts are configured with security in mind. Ensure that shared (nonindividual) passwords are not used to access hosts or applications running on these hosts. Ensure that authentication is required prior to gaining access to any services / applications running on your network hosts and that it cannot be bypassed. Make use of a centralized directory like LDAP to manage user credentials and access permissions. Ensure that users have only the minimum privileges needed to do their job functions. If an elevation of privilege is needed, grant it for the minimum amount of time needed and then return the privileges to normal. Ensure that all software updates are properly signed and come from a trusted source.
Rationale Detect intrusions / attack attempts (both external and internal). Prevent unauthorized access.
Associated Documentation
Enforce the principle of least privilege; prevent unauthorized access; make it easy to change passwords; make it easy to revoke access; make it easy to enforce password complexity.
Choose an item.
Malware protection.
28 of 63
Choose an item.
Activity / Security Control Prevent the ability to change field device settings without proper authentication. Changes to field device settings should be reported and logged in a central location. These logs should be reviewed frequently. If possible, verify the integrity of firmware running on field equipment via remote attestation techniques. Consult with the equipment vendor for assistance. If remote attestation fails, the affected field device should be considered compromised, and should be isolated.
Rationale Maintain confidence in data coming from field devices by ensuring that they have not been tampered with.
Associated Documentation
Choose an item.
Maintain confidence in data coming from field devices by ensuring that they have not been tampered with.
Platform Security Plan The table below outlines the activities and controls that are currently missing from the platform security plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
29 of 63
Application Layer Risks In the platform risks section the discussion focused mainly on operating systems and other software making up the software stack on top of which the organizations custom applications run. If the organization develops or purchases custom software, it is important that the software is developed with security in mind from the get-go to help ensure that it does not contain any software security weaknesses that may be exploited by adversaries to compromise the system. To accomplish this the organization needs to makes its software development process security aware. The software development life cycle (SDLC) activities for doing so are documented in the Insecure SDLC Risks section under Process Risks earlier in this document. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Activity / Security Control Implement security activities and gates into your organizations SDLC (please refer to checklist under Insecure SDLC Risks section for additional details). Request independent party software security assessments of the applications being purchased to gauge the softwares security posture. Rationale Develop software that does not have security weaknesses. Associated Documentation
Choose an item.
Gain confidence that the thirdparty software your organization purchases does not have security weaknesses.
Application Security Plan The table below outlines the activities and controls that are currently missing from the Application Security Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
30 of 63
Activity Control
Security
Responsible Party
Mitigation Strategy
31 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Security Requirements and Controls For Each Smart Grid Activity Type The remainder of this document contains each of the 10 activity types that are part of the National Rural Electric Cooperative Associations (NRECAs) smart grid demonstrations and highlights the security / privacy requirements specific to each. Along with requirements, the sections also contains specific security best practices and controls needed to meet these requirements. Although many of these best practices and controls have already been noted earlier in this document, the goal here is to specifically highlight security attributes for each smart grid activity type. It is important to note that some of these security controls are outside the direct control of your organization, but instead are under control of your organizations hardware and software vendors. When that is the case, it is important to choose your vendors wisely and leverage the RFP process to ask the vendors the right questions and gather the right evidence in order to convince your organization that the procured products meet security requirements. Advanced Metering Infrastructure (AMI) The following checklist summarizes the various security best practices and controls that you should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Activity / Security Control Ask software and hardware (with embedded software) vendors for evidence (e.g., third-party assessment) that their software is free of software weaknesses. Perform remote attestation of smart meters to ensure that their firmware has not been modified. Rationale Ensure that smart meters and their data are not compromised. Associated Documentation
Choose an item.
Ensure that smart meters and their data are not compromised.
32 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Choose an item.
Activity / Security Control Make use of the communication protocol security extensions (e.g., MultiSpeak security extensions) to ascertain the integrity (including origin integrity) of smart meter data. Establish and maintain secure configuration management processes (e.g., when servicing field devices or updating their firmware). Ensure that all software (developed internally or procured from a third party) is developed using securityaware SDLC. Apply a qualified third-party security penetration testing to test all hardware and software components prior to live deployment. Decouple identifying end-user information (e.g., household address, GPS coordinates, etc.) from the smart meter. Use a unique identifier instead. Implement physical security controls and detection mechanisms when tampering occurs.
Rationale Ensure that smart meters and their data are not compromised.
Associated Documentation
Ensure that smart meters and their data are not compromised.
Ensure that smart meters and their data are not compromised.
Ensure that smart meters and their data are not compromised.
Choose an item.
Choose an item.
Ensure that smart meters and their data are not compromised.
33 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity / Security Control Ensure that a reliable source of network time is maintained. Disable the remote disconnect feature that allows shut down of electricity remotely using a smart meter.
Rationale Ensure that timely smart grid decisions are taken based on fresh field data. Prevent unauthorized disruption / shutdown of segments of the electrical grid.
Associated Documentation
Advanced Metering Infrastructure Plan The table below outlines the activities and controls that are currently missing from the Advanced Metering Infrastructure Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control
Security
Responsible Party
Mitigation Strategy
34 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Meter Data Management (MDM) The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Activity / Security Control Data arriving to be stored in the MDM system does not come from a compromised meter. Data arriving to be stored in the MDM system is syntactically and semantically valid. The system parsing the data arriving in the MDM system should make use of all the appropriate data validation and exceptionhandling techniques. The MDM system has been designed and implemented using security-aware SDLC. The MDM system has passed a security penetration test conducted by a qualified third party. Rationale Only data from uncompromised meters is stored in the MDM system. Prevent storing bad data in the MDM system and prevent potentially harmful / malicious data from compromising the system. Prevent storing bad data in the MDM system and prevent potentially harmful / malicious data from compromising the system. Prevent storing bad data in the MDM system and prevent potentially harmful / malicious data from compromising the system. Prevent storing bad data in the MDM system and prevent potentially harmful / malicious data from compromising the system. Associated Documentation
35 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity / Security Control Cleanse data stored in the MDM system from all private information. Gracefully handle denial-of-service attempts (from compromised meters).
Associated Documentation
Protect the MDM system from attacks originating from smart meters.
Meter Data Management Plan The table below outlines the activities and controls that are currently missing from the Meter Data Management Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control
Security
Responsible Party
Mitigation Strategy
Communication Systems (COMM) The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
36 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose
Associated Documentation
Secure communications.
Use proven communications protocols with built-in security capabilities. Ensure confidentiality where appropriate. Ensure proper segmentation. Have a network testing. of data
Secure communications.
Secure communications.
network
Promote compartmentalization, least privilege, isolation, fault tolerance. Receive greater assurance communications are secure. Fault tolerance. that
Secure communications.
Secure communications.
37 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Rationale
Associated Documentation
Secure communications.
key
management
Secure communications.
Communication Systems Plan The table below outlines the activities and controls that are currently missing from the Communication Systems Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
Supervisory Control and Data Acquisition (SCADA) The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
38 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity / Security Control Appoint a senior security manager with a clear mandate. Conduct personnel awareness training. security-
Associated Documentation
Help improve the people aspect of security. Make your SCADA environment more difficult to compromise.
Apply basic network and system IT security practices (e.g., regular security patches, run antivirus, etc). Ensure that software running in the SCADA environment (e.g., either internal or external) has been built with security in mind and reviewed for security by a qualified third party. Enforce the principle of least privilege granting user access to SCADA resources Ensure proper physical security controls. Perform monitoring and logging, and ensure that people can be held accountable for their actions.
Supplement IT security controls with physical controls. Achieve intrusion detection, forensic analysis, holding people accountable.
39 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity / Security Control Avoid taking critical decisions without confirmation. control human
Associated Documentation
Avoid taking critical control decisions based on too few data points. Avoid taking critical control decisions based on data points from compromised field devices or based on data that has been tampered with. Ensure proper network segmentation in the SCADA environment. Ensure sufficient fault tolerance and redundancy in the SCADA environment. Develop and test business continuity and disaster recovery plans. Use individual (rather than shared) user login accounts with strong passwords. Ensure that all hardware authentication settings have been changed from their default values.
Avoid taking erroneous actions at the SCADA level. Avoid taking erroneous actions at the SCADA level.
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item.
Segregate critical control systems from the rest of your organizations corporate environment to promote compartmentalization. Plan for failure and continuation of operations. Plan for failure and continuation of operations. Prevent unauthorized promote accountability. access and
40 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Supervisory Control and Data Acquisition (SCADA) Plan The table below outlines the activities and controls that are currently missing from the Supervisory Control and Data Acquisition (SCADA) Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
In-Home Display (IHD) / Web Portal Pilots The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Activity / Security Control Ensure that the software running on IHDs is free of weaknesses, especially if it is remotely exploitable. Ensure the integrity of data shown on users IHDs. Rationale Ensure that attackers cannot remotely control the IHDs of users. Associated Documentation
41 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity / Security Control If the IHD can send data upstream (an unusual configuration), ensure the integrity of such communication. Ensure the anonymity and privacy of data (where appropriate) pertaining to electricity usage patterns such that it cannot be tied back to the consumer. Perform remote the attestation of IHDs to alert the control center when unauthorized firmware updates occur.
Associated Documentation
of
users
Choose an item.
Know when IHDs have been tampered with and should no longer be trusted.
In-Home Display (IHD)/Web Portal Pilots Plan The table below outlines the activities and controls that are currently missing from the IHD and Web Portal Pilots Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
42 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Demand Response over Advanced Metering Infrastructure (AMI) Networks The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Activity / Security Control Same activities and security controls as those described in the AMI section above. Authenticate and validate all control signals coming from the control center to the smart meters. Provide consumers a feature to turn off remote control of in-house electric devices via smart meters. Since this capability would likely lead to some consumers turning off DM when conditions are extreme, such as in an extended heat wave, measures must be implemented to protect against this, such as disabling the turn-off function during such times. Prevent unauthorized control of electric devices in the consumers home. Consumers should have a choice and also default overwrite ability if their smart meters become compromised. Rationale Associated Documentation
Demand Response over Advanced Metering Infrastructure (AMI) Networks Plan The table below outlines the activities and controls that are currently missing from the Demand Response over Advanced Metering Infrastructure (AMI) Networks Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
43 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity Control
Security
Responsible Party
Mitigation Strategy
Interactive Thermal Storage The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Activity / Security Control Ensure that the software running on the device controlling electric water heaters is free of software weaknesses, especially if they are remotely exploitable. Request third-party security assessment of all software used to control electric water heaters. Conduct a security penetration test. Rationale Ensure that attackers cannot remotely control the electric water heaters of users. Associated Documentation
Ensure that attackers cannot remotely control the electric water heaters of users. Ensure that attackers cannot remotely control the electric water heaters of users. Ensure that attackers cannot remotely control the electric water heaters of users.
44 of 63
Build in a mechanism to authenticate and validate control signals for electric water heaters.
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity / Security Control Build safeguards into the operation of electric water heaters (e.g., to prevent them from rising above a certain temperature, etc.). Provide a manual override mechanism whereby users can prevent their electric water heaters from being controlled remotely.
Associated Documentation
Interactive Thermal Storage Plan The table below outlines the activities and controls that are currently missing from the Interactive Thermal Storage Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
Smart Feeder Switching The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
45 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item.
Activity / Security Control Ensure that the software controlling smart feeder switching is free of security weaknesses. Implement physical security controls and detection mechanisms when tampering occurs. Perform sufficient authentication and validation of all control data used to reconfigure the electrical distribution network. Ensure that a human(s) has to review and authorize any electrical distribution network reconfiguration. Build safeguards into the hardware.
Rationale Prevent unauthorized electrical power grid reconfiguration. Prevent unauthorized electrical power grid reconfiguration. Prevent unauthorized electrical power grid reconfiguration. Prevent unauthorized electrical power grid reconfiguration. Ensure safe behavior when failures occur.
Associated Documentation
Smart Feeder Switching Plan The table below outlines the activities and controls that are currently missing from Smart Feeder Switching Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control
Security
Responsible Party
Mitigation Strategy
46 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Advanced Volt/VAR Control The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Activity / Security Control Ensure that the software controlling distribution feeders is free of security weaknesses. Implement physical security controls and detection mechanisms when tampering occurs. Perform sufficient authentication and validation of all control data bound for distribution feeders. Design automatic control systems to operate with a human in the loop when time permits. Be sure that safeguards are built into the hardware. Rationale Prevent unauthorized control of distribution feeders. Prevent unauthorized control of distribution feeders. Associated Documentation
Prevent unauthorized control of distribution feeders. Prevent unauthorized control of distribution feeders. Ensure safe behavior in case failures occur.
Advanced Volt/VAR Control Plan The table below outlines the activities and controls that are currently missing from the Advanced Volt/VAR Control Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
47 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Activity Control
Security
Responsible Party
Mitigation Strategy
Conservation Voltage Reduction (CVR) The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan.
Choose an item. Choose an item. Choose an item. Choose an item. Activity / Security Control Ensure that the software controlling voltage regulators and monitors is free of security weaknesses. Implement physical security controls and detection mechanisms in case tampering occurs. Perform sufficient authentication and validation of all control data bound for voltage regulators and coming from voltage monitors. Ensure that a human(s) has to review and authorize any changes to voltage. Rationale Prevent unauthorized reduction behavior. voltage Associated Documentation
voltage
voltage
voltage
48 of 63
<<Name of Co-op>> Cyber Security Plan: Security Requirements and Controls For Each Smart Grid Activity Type
Choose an item.
Activity / Security Control Be sure that safeguards are built into the hardware.
Associated Documentation
Conservation Voltage Reduction (CVR) Plan The table below outlines the activities and controls that are currently missing from the Conservation Voltage Reduction Plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
Activity Control / Security Existing Guideline Deviation Accept or Mitigate Risk Choose an item. Responsible Party Estimated Completion Date Mitigation Strategy
49 of 63
50 of 63
National Institute of Standards and Technology Special Publication 800-30, Risk Management Guide for Information Technology Systems, July 2002. Risk management, assessment, mitigation. http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf. National Institute of Standards and Technology Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations, August 2009. Security control fundamentals, baselines by system-impact level, common controls, tailoring guidelines, catalog of controls in 18 families. http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf. National Institute of Standards and Technology Special Publication 800-60, Revision 1, Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008. Security objectives and types of potential losses, assignment of impact levels and system security category. http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf. National Institute of Standards and Technology Special Publication 800-82 (Final Public Draft), Guide to Industrial Control Systems (ICS) Security, September 2008. Overview of industrial control systems (ICS), threats and vulnerabilities, risk factors, incident scenarios, security program development. http://csrc.nist.gov/publications/drafts/800-82/draft_sp800-82-fpd.pdf.
51 of 63
National Institute of Standards and Technology Special Publication 800-100, Information Security Handbook: A Guide for Managers, October 2006. Governance, awareness and training, capital planning, interconnecting systems, performance measures, security planning, contingency planning. http://csrc.nist.gov/publications/nistpubs/800-100/SP800-100-Mar07-2007.pdf. National Institute of Standards and Technology Special Publication 800-122 (Draft), Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), January 2009. Identifying, PII, impact levels, confidentiality safeguards, incident response. http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf. National Institute of Standards and Technology Special Publication 800-39(Final Public Draft), Integrated Enterprise-Wide Risk Management: Organization, Mission, and Information System View, December 2010. http://csrc.nist.gov/publications/drafts/800-39/draft-SP800-39-FPD.pdf.
52 of 63
North American Electric Reliability Corporation Critical Infrastructure Protection Standards CIP-002 through CIP-009, 200910. Available at http://www.nerc.com/page.php?cid=2|20: CIP-002-3, Critical Cyber Asset Identification CIP-003-3, Security Management Controls CIP-004-3, Personnel and Training CIP-005-3, Electronic Security Perimeter(s) CIP-006-3, Physical Security of Critical Cyber Assets CIP-007-3, Systems Security Management CIP-008-3, Incident Reporting and Response Handling CIP-009-3, Recovery Plans for Critical Cyber Assets
The CIP standards are also included in the collected Reliability Standards for the Bulk Electric Systems of North America, June 2010, http://www.nerc.com/files/Reliability_Standards_Complete_Set.pdf. North American Electric Reliability Corporation http://www.nerc.com/files/Glossary_12Feb08.pdf. Glossary of Terms Used in Reliability Standards, February 2008,
53 of 63
Appendix B: Glossary
Appendix B: Glossary
Adequate security Authentication Authorization Availability Boundary protection A set of minimum security requirements that the system is expected to meet. Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources. Refers to verifying a users permissions (after the user had been authenticated) for accessing certain resources or functionality. Ensuring timely and reliable access to and use of resources. Monitoring and control of communications at the external boundary of an information system to prevent and detect malicious and other unauthorized communications, through the use of boundary protection devices (e.g., proxies, gateways, routers, firewalls, guards, encrypted tunnels). Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. The unexpected failure or outage of a system component, such as a generator, transmission line, circuit breaker, switch, or other electrical element. Facilities, systems, and equipment that if destroyed, degraded, or otherwise rendered unavailable would affect the reliability or operability of the bulk electric system. Programmable electronic devices and communication networks, including hardware, software, and data. Any malicious act or suspicious event that: Compromises, or was an attempt to compromise, the electronic security perimeter or physical security perimeter of a critical cyber asset. Disrupts, or was an attempt to disrupt, the operation of a critical cyber asset. Electronic security perimeter The logical border surrounding a network to which critical cyber assets are connected and for which access is controlled.
54 of 63
Appendix B: Glossary
Access control based on the identity of the user (typically relayed as a characteristic of the process acting on behalf of that user) where access authorizations to specific objects are assigned based on user identity. Damage to an organizations mission and goals (e.g., the loss of confidentiality, integrity, or availability of system information or operations). The assessed degree (high, medium, or low) of potential damage to the organizations mission and goals. An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of a system or the information the system processes, stores, or transmits, or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. Aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information. A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. (Note: Information systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems.) Guarding against improper information modification or destruction; includes ensuring information nonrepudiation and authenticity. The security controls (i.e., safeguards or countermeasures) of an information system that focus on the management of risk and the management of information system security. Access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, Internet).
55 of 63
Appendix B: Glossary
Nonrepudiation
Protection against an individual falsely denying having performed a particular action. Provides the capability to determine whether a given individual took a particular action, such as creating information, sending a message, approving information, and receiving a message. The security controls (i.e., safeguards or countermeasures) of an information system that are primarily implemented and executed by people (as opposed to systems). The physical, completely enclosed (six-wall) border surrounding computer rooms, telecommunications rooms, operations centers, and other locations in which critical cyber assets are housed and for which access is controlled. A digital computer used for the automation of industrial processes, such as machinery control in factories. The loss of confidentiality, integrity, or availability could be expected to have: (i) a limited adverse effect (FIPS 199, low); (ii) a serious adverse effect (FIPS 199, moderate); or (iii) a severe or catastrophic adverse effect (FIPS 199, high) on organizational operations, organizational assets, or individuals. A user that is authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform.
Operational controls Physical security perimeter Programmable logic controller (PLC) Potential impact
Privileged user
56 of 63
Appendix B: Glossary
Remote attestation
Remote attestation allows for one party to verify that another party with which it is communicating is not running compromised software, firmware, or hardware. The approach holds the potential to identify unauthorized firmware updates and malware infections of the smart grid field devices (e.g., smart meters). Remote attestation includes taking a measurement of the underlying software stack running on the device, signing that measurement with the private key that is stored in the devices TPM (trusted platform module), and sending it to the party requiring attestation information (e.g., SCADA). The design is such that the private key residing in the TPM can only be unsealed if the devices software and hardware had not been modified in an unauthorized fashion. The receiving party can then ascertain that the software stack measurement of the remote device corresponds to the expected configuration by using the public key to verify the signature. Additional information on the TPM and remote attestation can be found here: http://www.trustedcomputinggroup.org/resources/trusted_platform_module_tpm_summary.
Risk
A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. Information-system-related security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the nation. The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the nation, resulting from the operation of an information system. Part of risk management incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis. People and policy risks, process risks, and technical risks. A combination of the likelihood of a damaging event actually occurring and the assessed potential impact on the organizations mission and goals if it does occur.
57 of 63
Risk assessment
Appendix B: Glossary
Risk management
The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the nation, resulting from the operation of an information system. Includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system. Access control based on user roles (i.e., a collection of access authorizations a user receives based on an explicit or implicit assumption of a given role). Role permissions may be inherited through a role hierarchy and typically reflect the permissions needed to perform defined functions within an organization. A given role may apply to a single individual or to several individuals. The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of that information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the nation. The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. A set of high-level criteria for people, process, and technological guidance that relates to security of the organization, its systems, and its data. Requirements levied on an information system that are derived from applicable laws, executive orders, directives, policies, standards, instructions, regulations, procedures, or organizational mission / business case needs to ensure the confidentiality, integrity, and availability of the information being processed, stored, or transmitted. Information whose loss, misuse, or unauthorized access to or modification of, that could adversely affect the organization, its employees, or its customers. A formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements.
58 of 63
Security category
Security control
Appendix B: Glossary
The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system. Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. An alternate definition of threat is an actor / adversary who may carry out an attack against the organization. A specific weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Formal description and evaluation of the vulnerabilities in an information system.
59 of 63
Appendix C: Acronyms
Appendix C: Acronyms CIP DOD DOE DHS EISA FERC ISO NERC NIST RMF Critical Infrastructure Protection Department of Defense Department of Energy Department of Homeland Security Energy Independence and Security Act Federal Energy Regulatory Commission International Standards Organization North American Electric Reliability Corporation National Institute of Standards Risk Management Framework
60 of 63
Appendix D: Minimum Security Requirements The following summaries of minimum security requirements are from NIST FIPS 200, Minimum Security Requirements for Federal Information and Information Systems. Access Control (AC): Organizations must limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) and to the types of transactions and functions that authorized users are permitted to exercise. Awareness and Training (AT): Organizations must: (i) ensure that managers and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or procedures related to the security of organizational information systems; and (ii) ensure that organizational personnel are adequately trained to carry out their assigned information-security-related duties and responsibilities. Audit and Accountability (AU): Organizations must: (i) create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions. Certification, Accreditation, and Security Assessments (CA): Organizations must: (i) periodically assess the security controls in organizational information systems to determine if the controls are effective in their application; (ii) develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational information systems; (iii) authorize the operation of organizational information systems and any associated information system connections; and (iv) monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls. Configuration Management (CM): Organizations must: (i) establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; and (ii) establish and enforce security configuration settings for information technology products employed in organizational information systems. Contingency Planning (CP): Organizations must establish, maintain, and effectively implement plans for emergency response, backup operations, and postdisaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations.
61 of 63
Identification and Authentication (IA): Organizations must identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. Incident Response (IR): Organizations must: (i) establish an operational-incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities; and (ii) track, document, and report incidents to appropriate organizational officials and/or authorities. Maintenance (MA): Organizations must: (i) perform periodic and timely maintenance on organizational information systems; and (ii) provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance. Media Protection (MP): Organizations must: (i) protect information system media, both paper and digital; (ii) limit access to information on information system media to authorized users; and (iii) sanitize or destroy information system media before disposal or release for reuse. Organizations must: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals; (ii) protect the physical plant and support infrastructure for information systems; (iii) provide supporting utilities for information systems; (iv) protect information systems against environmental hazards; and (v) provide appropriate environmental controls in facilities containing information systems. Planning (PL): Organizations must develop, document, periodically update, and implement security plans for organizational information systems that describe the security controls in place or planned for the information systems and the rules of behavior for individuals accessing the information systems. Personnel Security (PS): Organizations must: (i) ensure that individuals occupying positions of responsibility within organizations (including third-party service providers) are trustworthy and meet established security criteria for those positions; (ii) ensure that organizational information and information systems are protected during and after personnel actions such as terminations and transfers; and (iii) employ formal sanctions for personnel failing to comply with organizational security policies and procedures. Risk Assessment (RA): Organizations must periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission of organizational information.
62 of 63
System and Services Acquisition (SA): Organizations must: (i) allocate sufficient resources to adequately protect organizational information systems; (ii) employ system development lifecycle processes that incorporate information security considerations; (iii) employ software usage and installation restrictions; and (iv) ensure that third-party providers employ adequate security measures to protect information, applications, and/or services outsourced from the organization. System and Communications Protection (SC): Organizations must: (i) monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems; and (ii) employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational information systems. System and Information Integrity (SI): Organizations must: (i) identify, report, and correct information and information system flaws in a timely manner; (ii) provide protection from malicious code at appropriate locations within organizational information systems; and (iii) monitor information system security alerts and advisories and take appropriate actions in response.
63 of 63