sans scada summit 2008 control systems security in … · sans scada summit 2008. control systems...

Enhancing control systems security in the energy sectorNSTB

SANS SCADA SUMMIT 2008

Control Systems Security in the Energy Sector

Hank KenchingtonU.S. Department of Energy

Control Systems are critical to our Nation’s economy, health and safety, and quality of life

Natural Gas PipelinesCrude Oil Pipelines

Sources: Canadian Association of Petroleum Producers & North American Electric Reliability Corporation

Electricity Interconnections

Presenter

Presentation Notes

Electricity: - ~210,000 Miles of Electrical Transmission lines - 950,000 Megawatts (net summer capacity)‏ - Over 3,100 Electric Utilities Oil & Gas: North American pipeline companies are constructing, planning and designing 40,210 miles of oil and gas pipelines. (Source: Pipeline & Gas Journal) http://goliath.ecnext.com/coms2/gi_0199-6196612/P-GJ-s-2007-worldwide.html More than 3 million miles of oil & gas pipelines (Source: North American Transportation Statistics Database) http://nats.sct.gob.mx/nats/sys/tables.jsp?i=3&id=24 ~1,000,000 wells (Source: EIA)‏ More than 2,000 petroleum terminals (Source: EIA)‏

VisionIn 10 years, control systems for critical applications will be designed, installed, operated, and maintained to survive an intentional cyber assault with no loss of critical function.

VisionIn 10 years, control systems for critical applications will be designed, installed, operated, and maintained to survive an intentional cyber assault with no loss of critical function.

Roadmap – framework for public-private collaboration

•

Industry-driven

•

Near, Mid, and Long-term

•

Public-Private Working Group to coordinate implementation

•

ieRoadmap - enables implementation (hosted on pcsforum.org)

Key Strategies and Selected Milestones

Develop andIntegrate Protective

Measures

Detect Intrusion & Implement

Response StrategiesSustain SecurityImprovements

Sustain SecurityImprovements

Measure and Assess Security

PostureMilestonesMilestones MilestonesMilestones MilestonesMilestones MilestonesMilestones

50% of asset owners & operators performing self-

assessments of their control systems using consistent criteria (2008) ‏

Fully automated security state and common response of control system networks (2015)‏

Secure connectivity between business systems and control systems within corporate network (2009) ‏

Secure control system architectures produced with built-

in, end-to-end security (2015)‏

Cyber incident response is part of emergency operating plans at 30% of control systems (2008)‏

Self-configuring control system network architectures are in production (2015) ‏

Compelling, evidence-based business case to increase private investment in control system security (2007) ‏

Cyber security awareness, outreach, and education programs integrated into energy sector operations (2015) ‏

Public-private Working Group to coordinate Roadmap implementation

Electric SectorCoordinating Council

Oil & Natural Gas SectorCoordinating Council

Government Coordinating Council for Energy

CIPAC

Energy Sector Control

Systems Working Group

Critical Infrastructure Partnership Advisory Council

NisourceEl PasoBP

AmerenCanada -

ISOEntergyCenterpoint

ieRoadmap – “weapon of mass collaboration”1

•

On-line Roadmap Mapping Tool

•

Hosted by Process Control Systems Forum (PCSF) ‏

•

>70 projects mapped by 10 organizations

www.pcsf.org/roadmap

Facilitates collaboration and measures progress

1“Wikinomics, How Mass Collaboration Changes Everything”, Tapscott

and Williams

DOE National SCADA Test Bed

Key Program Areas•

Assess energy control systems vulnerabilities/ develop mitigation recommendations

•

Outreach and awareness•

Integrated Risk analysis•

Develop advanced,

secure control systems technologies

Purpose: Support industry and government efforts to enhance cyber security of control systems

in energy sector

…established 2003

INL

SNL

PNNL

ORNL

ANL

“..the only reliable way to measure security is to examine how it fails”

Bruce Schneier, Beyond Fear

1.

System Assessments and Vulnerability Mitigation•

SCADA/EMS System Assessments:

Completed: ABB, AREVA, GE, Siemens In process/planned: Telvent, OSI, Siemens, ABB Consortium,

Teltone

Gauntlet Dial-up Gateway2. Outreach and Awareness

•

Vendor User Groups, training courses -

over 1,600 end-users trained•

Coordinate with Industry groups, e.g. “Mitigation techniques for NERC “Top 10”

vulnerabilities”

•

Coordinate w/other Federal agencies, President’s Council of Advisors on S&T3. Integrated Risk Analysis

•

Modeling/simulation to evaluate end-to-end cyber security effects4. Advanced Technology Development

•

SCADA Protocol Authenticator (serial)‏•

Open Architecture/Interoperable Design for Secure Remote Devices

(IP)•

ANTFARM•

5 new industry-led projects –

over $8MM in federal funding plus private cost-share

NSTB – Summary of Key Activities

More secure SCADA systems in energy market TODAY due to NSTB assessments

314On-Site214Test Bed -

Components239Test Bed -

Systems

PlannedIn ProcessCompletedAssessments

5 Enhanced Systems 4 Enhanced Systems in development 5 Patches (addressing 5 issues) 2 New Perimeter Architectures 21 Installations of One Vendor’s Upgraded Systems 45 Asset Owner Requests for Proprietary Assessment

Reports 82 System Applications Using Downloaded Software Patches

MARKET OUTCOMES:

Utility Consortium demonstrates commitment to cyber security

ABB Consortium to Fund Advanced SCADA Security ResearchHouston, Texas, December 11, 2007

The consortium partners, represent 45 million customers across the U.S. and Australia and include:

• Austin Energy• Detroit Edison• Indianapolis Power & Light Company• ITC Transmission• Kansas City Power & Light Company (KCP&L)• LCRA• New York Independent System Operator (NYISO)• Snowy Hydro Limited• Tri-State G&T Association, Inc.

Industry-led consortium will work with DOE National SCADA Test Bed at Idaho National Laboratory.

Presenter

Presentation Notes

“The formation of this consortium demonstrates the importance we have placed on cyber security,” said Stephen Diebold, Manager Real-time Systems at KCP&L and Chairman of the consortium. “ABB’s ongoing collaboration with DOE/OE’s NSTB has been critical to our continued improvements in providing the best security to customers,” said Phil Beekman, EMS Security Coordinator in the Network Management unit of ABB

U.S. National

Risk

Consequence of InterestSystem ImpactsScenario EffectsPlausible Threats

Threat to Consequence Risk ModelThreat to Consequence Risk Model

Threat Cyber Effects Systems Impact Consequence Risk- Actors/Attack

method- Asset identification

- Vulnerability- Motivation

- Confidentiality- Integrity- Availability- Kinetics (bombs)

- Power Flow- Pipeline Flow

- Local- Regional- National

- Economic- Public Health- Trust in Govt- Safety- Environmental

PossibleThreats

Threat Cyber Effects Systems Impact Consequence Risk- Actors/Attack

method- Asset identification

- Vulnerability- Motivation

- Confidentiality- Integrity- Availability

- Power Flow- Pipeline Flow

- Local- Regional- National

- Economic- Public Health- Trust- Safety- Environmental

Framework for Conducting Control System Cyber Security Analysis Framework for Conducting Control System Cyber Security Analysis

IdentifyThreats

Evaluate impact on

control system

Evaluate physical impacts

Evaluate impact on other CI

Assess and quantify the Risk

Virtual Control Systems Environment

Graphical User

Interface

Communication Network Simulator

(OPNET, Qualnet, NS-2)‏

Simulated Process

Electric Power

Control System Simulator & Device Model Library (e.g.,

PLC) ‏

Visualization Tools for rendering of system-

under-study data

Information Probe

Information Flow

Communication Path

Hardware-in-the-

Loop

Software Library: Visual simulation tools; PCS devices and network modelsHybrid Simulation Library: hardware component interfaces; emulated devicesAnalysis Library: Analysis and result visualization toolsPower Simulation Library: static and dynamic power models

VCSE VCSE ToolTool--BoxBox

Hybrid Control System Simulation Test Bed

Presenter

Presentation Notes

The ability to set up (in days not weeks) a simulation environment of various CS configurations/architectures and components (hybrid or fidelity), at varying levels of complexity (small to large scale); to run a number of scenarios as needed to gather the necessary data (via probe devices) to conduct our analysis; having the necessary tools for analyzing the data; and finally, having the ability to effectively visualize the results of the analysis (all at a lesser cost then conducting this on physical hardware)."

•

Passive network discovery tool to developed by Sandia National Laboratories

•

ANTFARM input –

a database containing network information, including node relationships

•

ANTFARM output –

graphical depiction of the network for easier understanding of the networked system topology.

A|N|T|F|A|R|M

Advanced Network Toolkit For Assessments and Remote Mapping

Recently awarded DOE projects to support Energy Roadmap

1. Hallmark Project -

commercialize Secure SCADA Communications Protocol (SSCP)

-

Schweitzer Engineering Laboratories, Pacific Northwest National Laboratories, CenterPoint Energy

2. Detection and Analysis of Threats to the Energy Sector (DATES) – IDS (network, host, and device level), event correlation framework, and a sector-wide, distributed, privacy-preserving repository of security events for participants to automatically contribute without attribution -

SRI International, ArcSight, Sandia National Laboratory, end-user

(tbd)

3. Audit and Attack Detection Toolkit -

extend capability of existing vulnerability scanning tools (e.g., Nessus et al) to evaluate SCADA security configuration (supports compliance with NERC CIP-005 and CIP-007) and develop templates for a security event monitoring system by mining data in PI Systems -

Digital Bond, Tenable Network Security, OSIsoft, Constellation Energy, PacifiCorp, TVA

4. Lemnos

Interoperable Security Program -

conduct testing, validation, and outreach

to

increase the availability of cost-effective, interoperable security solutions for IP-based communications; foster development and acceptance of standards -

EnerNex Corp., Schweitzer Engineering Laboratories TVA, Sandia National Laboratory

5. Protecting Intelligent Distributed Power Grids against Cyber

Attacks -

develop risk-based critical asset identification system; an integrated and distributed security layer including security agents, distributed security switched managers, and security managers and an optimization technique to establish

the best topology for networking the security components -Siemens Corporate Research, Idaho National Laboratory, Rutgers Center for Advanced Energy Systems

Recent NSTB reports (see NSTB CD)...stop by NSTB booth and pick up your own copy!

•

Measure and Assess Security Posture•

Categorizing Threat: Building and Using a Generic Threat Matrix (SNL)•

Threat Analysis Framework (SNL)•

Security Metrics for Process Control Systems (SNL)•

Develop and Integrate Protective Measures •

Secure SCADA Communication Protocol Performance Test Results (PNNL)•

AGA 12, Part 2 Performance Test Results (PNNL)•

Secure ICCP Integration Considerations and Recommendations (SNL)•

NERC 2007 Top 10 Vulnerabilities/Mitigations (NSTB)•

Security Framework for Control System Data Classification and Protection (SNL)

•

Detect Intrusion and Implement Response Strategies•

OPSAID Initial Design and Testing Report (SNL)•

Sustain Security Improvements•

Framework for SCADA Security Policy (SNL)•

Impacts of IPv6 on Infrastructrure Control Systems (SNL)

Visit Website for more info

•

Roadmap to Secure Control Systems in the Energy Sector

•

ieRoadmap (web-based tool)‏•

System Testing and Assessments•

21 Steps to Secure Control Systems•

Lessons Learned from Cyber Security Assessments of SCADA/EMS Systems

•

Cyber Assessment Methods for SCADA Security

•

A Summary of Control System Security Standards Activities in the Energy Sector

www.oe.energy.gov/randd/css.htm

Presenter

Presentation Notes

On Roadmap websites; Roadmap: Provides a strategic framework to enables industry and government to align their programs and investments to improve cyber security quickly and efficiently On OE Website: Reference Model for Control and Automation Systems in Electrical Power: Supports a structured approach for applying security controls Network Security Infrastructure Testing: Describes investigation into applying IT security solutions in a control environment Proprietary Vendor Assessment Reports: Contain detailed test results and recommendations to SCADA vendor, Information sharing requires agreement between user�and SCADA vendor Training and Control System Security Workshop: Workshops developed and NERC-�certified for continuing education credit, Training structured around new�CIP Standards is planned Lessons Learned: Includes information from ten assessments performed within the DOE and DHS programs from late 2004 through early 2006. ABB SCADA/EMS System: INEEL Baseline Summary Test Report: Contains best practices applicable to users and SCADA vendors Cyber Assessment Methods for SCADA Security: Describes methods used at INL for identifying vulnerabilities, Identifies and describes several open source and commercial tools for assessing SCADA systems AGA 12, Part 2 Performance Test Plan: Detailed test plan to help industry understand performance impacts associated with AGA 12 cryptographic modules in serial communication environments ConC Report: Promotes a strategy of resilience for both the public and private sectors a strategy with clear benefits for our companies’ competitiveness and our nation’s homeland security

NSTB activities directly support Roadmap to Secure Control Systems in the Energy Sector

Hank Kenchington

US Department of Energy

[email protected]

202-586-1878www.oe.energy.gov/randd/css.htm

Enhancing control systems security in the energy sectorNSTB

For more info contact:

sans scada summit 2008 control systems security in … · sans scada summit 2008. control systems...

Documents