Cyber Security Strategy and Roadmap Template
Cyber Security Strategy and Roadmap Template
by Annabelle Lee, Chief Cyber Security Specialist, Nevermore Security
1 CYBER SECURITY STRATEGY OVERVIEW
The current power grid consists of both legacy and next generation technologies. These new components operate in conjunction with legacy equipment that may be several decades old and provide no cyber security controls. In addition, industrial control systems/supervisory control and data acquisition (ICS/SCADA) systems were originally isolated from the outside world. Sensors would monitor equipment and provide that information to a control room center. As networking technology has advanced and become more accessible, utilities have made decisions to integrate systems. This integration is necessary to take advantage of the new technology that is being deployed.
To adequately address potential threats and vulnerabilities, and develop an effective cyber security strategy, the utility needs to have a current architecture that includes the system assets, communication links, and connections to external systems. Knowing the system boundaries and the assets that are within the boundary may be used to determine what needs to be protected. Currently, with the increase in wireless communications and the connection of Industrial Internet of Things (IIoT) devices, the overall attack surface has increased.
A cyber security strategy includes an integrated strategy to reduce cyber risks by addressing high-priority objectives and activities that will be pursued over the next few years to reduce the risk of energy disruptions due to cyber incidents. Because of the constantly changing threat and technology environments related to the digital infrastructure, the typical time frame for the activities in the strategy is one to three or five years.
In addressing cyber security, achieving 100% security of all systems against all threats is not possible. The number of resources (including funds, staff, and technology) are limited and all systems cannot and should not be protected in the same manner. Risk-based methods should be used to make decisions and prioritize activities. Because threats will not diminish, energy delivery systems must be designed and operated so they can continue to perform critical functions during and after an attack. Finally, cyber security features should not interfere with the energy delivery functions of the devices and components they are meant to protect.
The purpose of this document is to specify a cybersecurity strategy and roadmap template that may be used by utilities. This document is NOT an attempt to develop new guidance but rather document the diverse existing guidance that is available to the electric sector.
Cyber Security Risk Management and Risk Assessment Methodology Template
Cyber Security Risk Management and Risk Assessment Methodology Template
by Annabelle Lee, Chief Cyber Security Specialist, Nevermore Security
1 Risk Management Overview
The current power grid consists of both legacy and next generation technologies. These new components operate in conjunction with legacy equipment that may be several decades old and provide no cyber security controls. In addition, industrial control systems/supervisory control and data acquisition (ICS/SCADA) systems were originally isolated from the outside world. Sensors would monitor equipment and provide that information to a control room center. As networking technology has advanced and become more accessible, organizations have made decisions to integrate systems. This integration is necessary to take advantage of the new technology that is being deployed. With the increase in the use of digital devices and more advanced communications and information technology (IT), the overall attack surface has increased.
Cyber security must address deliberate attacks launched by disgruntled employees and nation states as well as non-malicious cyber security events such as user errors. Because organizations, including utilities, do not have unlimited resources such as personnel and funds, cyber security must be prioritized with the other components of enterprise risk. Risk is the potential for an unwanted impact resulting from an event. Cyber security risk is one component of enterprise risk management, which addresses many types of risk (e.g., financial, mission, public perception).
In addition, to adequately address potential threats and vulnerabilities, cyber security must be included in all phases of the system development life cycle, from the design phase through implementation, operations and maintenance, and disposition/sunset. Cyber security must be constantly assessed and revised to address evolving threats, vulnerabilities, and security incidents.
The purpose of this document is to specify a risk management and risk assessment template that may be used by utilities. This also includes the selection and tailoring of cyber security requirements and measures/controls. This document is NOT an attempt to develop new guidance but rather document the diverse existing guidance that is applicable to the electric sector.
Recommendations for the European Commission on a European Strategic Framework and Potential Future Legislative Acts for the Energy Sector
Energy Diplomacy:
USAID and USEA Enhancing Cybersecurity in Eastern Europe
co-author
“UCSI is advancing a rational approach to cyber capital expenditures with a risk-based assessment methodology specific to Eastern Europe’s technology and business practices.”
Industrial Control Systems Cybersecurity Strategy, A New Approach
Industrial Control Systems Cybersecurity Strategy, A New Approach
by Annabelle Lee, Nevermore Security
Executive Summary
Threats to Industrial Control Systems (ICS) and Operational Technology (OT) that operate our critical infrastructures are now in daily news media. ICS controls provide automation of operating power plants, oil and natural gas flowing through pipes nationwide, and support critical manufacturing of goods and pharmaceutical products for everyday use. Attacks on these systems can cause interruptions of major critical infrastructures, physical damage, and potentially threaten human health and safety.
The advances in technology and today’s offerings of the Industrial Internet of Things (IIoT) devices expands the attack surface of the ICS with the impact extending to all parts of the organization operating the critical infrastructures, the supply chain, and ultimately the end-use customers. Current cybersecurity solutions today cannot provide comprehensive protection against all the known and unknown threats of the automation components that operate the critical infrastructures, and specifically the energy sector. Particularly with the constantly changing threat and technology environments, this defensive approach results in the critical infrastructures constantly trying to play catch up in cybersecurity. Cyber attacks may be launched, for example, by malicious insiders, via the supply chain, and/or by unauthorized remote access. Attackers only have to be effective once and defenders need to be effective 100% of the time. It is not realistic to be 100% effective in identifying and addressing all known and potential cyber attacks. In addition, with the increasing availability of attack tools and techniques, the end result is that the defenders keep falling further behind in addressing cybersecurity.
This white paper proposes an alternative to the current defensive paradigm. The paradigm proposed in this paper augments this defensive approach and considers cybersecurity from the attacker’s perspective and includes identifying attack surfaces, attack vectors, and impacts. Because it is not possible to mitigate all potential cyber events, the objective is to identify the most common attack paths and mitigate the highest impact cyber events, independent of the specific attack method. This will include known and potential cybersecurity events. The unknown cyber events will be determined based on the impact to the ICS and the reliability of the grid. This paradigm will allow the energy sector to be more proactive in addressing cybersecurity and more resilient in the event of cyber attacks.
Recommendations for the European Commission on a European Strategic Framework and Potential Future Legislative Acts for the Energy Sector
Recommendations for the European Commission on a European Strategic Framework and Potential Future Legislative Acts for the Energy Sector (co-author)
The Commission under the lead of DG Energy is preparing a strategy on cyber security for the whole energy sector to reinforce and to complement the implementation of Directive on security of Network and Information Systems (NIS) at energy sector level and also to foster synergies between the Energy Union and the Digital Single Market agenda. In this respect, the Energy Expert Cyber Security Platform (EECSP) – Expert Group started work in December 2015. This document reflects the work of this Expert Group towards the development of an energy cyber security strategy by analysis of respective cyber security challenges and existing policy papers with the aim to recommend actions for consideration by the European Commission.
- Chapter 3 provides an executive summary highlighting the key analysis results and recommended actions.
- The approach and methodology to derive these recommendations from the EECSP-Expert Group is described in detail in chapter 4.
- Chapter 5 gives a detailed view on the challenges in the energy sector as viewed by the EECSP-Expert Group.
- These has led to a set of strategic areas that need to be addressed by the energy sector; the strategic areas are described in chapter 6.
- Chapter 7 summarizes the existing policy landscape in cyber security for the energy sector at European Union level.
- These policy papers were analyzed in the context of the strategic areas identified in order to identify gaps in the existing policy which are provided in chapter 8.
- A set of recommended actions to be considered by the European Commission are included in chapter 9.
National Institute of Standards and Technology Interagency Report (NISTIR) 7628, Guidelines for Smart Grid Cyber Security
National Institute of Standards and Technology Interagency Report (NISTIR) 7628, Guidelines for Smart Grid Cyber Security (technical lead for the initiative and co-author)
This three-volume report presents a framework that organizations can use to develop effective cybersecurity strategies tailored to their particular combinations of smart grid-related characteristics, risks, and vulnerabilities. Organizations in the diverse community of smart grid stakeholders can use the methods and supporting information presented in this report as guidance for assessing risk and identifying and applying appropriate security requirements. This approach recognizes that the electric grid is changing from a relatively closed system to a complex, highly interconnected environment. Each organization’s cybersecurity requirements should evolve as technology advances and as threats to grid security inevitably multiply and diversify.
National Institute of Standards and Technology (NIST) Special Publication 800-53, Rev 5, Security and Privacy Controls for Information Systems and Organizations
National Institute of Standards and Technology (NIST) Special Publication 800-53, Rev 5, Security and Privacy Controls for Information Systems and Organizations (one of the original authors)
This publication provides a catalog of security and privacy controls for federal information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats including hostile attacks, natural disasters, structural failures, human errors, and privacy risks. The controls address diverse requirements derived from mission and business needs, laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
The publication describes how to develop specialized sets of controls, or overlays, tailored for specific types of missions and business functions, technologies, environments of operation, and sector-specific applications. Finally, the consolidated catalog of controls addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms) and an assurance perspective (i.e., the measure of confidence in the security or privacy capability). Addressing both functionality and assurance ensures that information technology products and the information systems that rely on those products are sufficiently trustworthy.
Cybersecurity Procurement Language for Energy Delivery Systems
Cybersecurity Procurement Language for Energy Delivery Systems (co-author)
This document provides baseline cybersecurity procurement language that is the consensus opinion of the document authors and was guided by input from voluntary reviewers representing the Acquirer, Integrator, and Supplier communities. It focuses on the cybersecurity of energy delivery systems (i.e., control systems) and does not attempt to specify or replace cybersecurity-based procurement language for acquisitions involving IT. Considerations for IT cybersecurity are outlined in many standards and guidance documents (e.g., the NIST 800 series of publications). Users of this document have the responsibility of ensuring that actions taken during the procurement process comply with current standards and regulations. In addition to the language included in this document, acquired products and services should conform to the applicable IT security standards and operations technology (OT) standards for energy delivery systems.
This document is designed to provide baseline cybersecurity procurement language for the following:
- Individual components of energy delivery systems (e.g., programmable logic controllers, digital relays, or remote terminal units).
- Individual energy delivery systems (e.g., a SCADA system, EMS, or DCS).
- Assembled or networked energy delivery systems (e.g., an electrical substation [transmission and distribution] or a natural gas pumping station).
Electricity Subsector Cybersecurity Capability Maturity Model, Version 1.1
Electricity Subsector Cybersecurity Capability Maturity Model, Version 1.1 (co-author)
The Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2) can help electricity subsector organizations of all types evaluate and make improvements to their cybersecurity programs. The ES-C2M2 is part of the DOE Cybersecurity Capability Maturity Model (C2M2) Program and was developed to address the unique characteristics of the electricity subsector. The program supports the ongoing development and measurement of cybersecurity capabilities within the electricity subsector, and the model can be used to:
- Strengthen cybersecurity capabilities in the electricity subsector.
- Enable utilities to effectively and consistently evaluate and benchmark cybersecurity capabilities.
- Share knowledge, best practices, and relevant references within the subsector as a means to improve cybersecurity capabilities.
- Enable utilities to prioritize actions and investments to improve cybersecurity.
The ES-C2M2 provides descriptive rather than prescriptive industry focused guidance. The model content is presented at a high level of abstraction so that it can be interpreted by subsector organizations of various types, structures, and sizes.
Appropriate Security Measures for Smart Grids: Guidelines to Assess the Sophistication of Security Measures Implementation
Appropriate security measures for smart grids: Guidelines to assess the sophistication of security measures implementation (contributor)
This document describes a set of security measures which are considered to be appropriate for smart grids. The European Network and Information Security Agency (ENISA) issued this report to assist the Member States and smart grid stakeholders in providing a framework/measurement tool that could be used for:
- Aligning the varying levels of security and resilience of the market operators with a consistent minimum framework;
- Providing an indication of a minimum level of security and resilience in the Member States with regards to the smart grids, thereby avoiding the creation of the “weakest link”;
- Ensuring a minimum level of harmonization on security and resilience requirements for smart grids across Member States and thus reducing compliance and operational costs;
- Setting the basis for a minimum auditable framework of controls across Europe;
- Facilitating the establishment of common preparedness, recovery and response measures and pave the way for mutual aid assistance across operators during crisis;
- Contributing to achieve an adequate level of transparency in the internal market.