American Bar Association             Section of Science and Technology Law Information Security Committee             2009...
Presentation disclaimer•   This message does not reflect the thoughts or opinions of either myself, my company, my friends...
What is a                           “critical infrastructure”?• Represents “…assets of physical and computer-based  system...
Reasons for addressing                           infrastructure issues• Critical infrastructures historically regarded phy...
Issues with our critical                 infrastructures today• Each infrastructure entity is responsible for protecting i...
Assure the systems that                  support the systems• The infrastructure assurance process should:   – Provide a c...
Introducing SCADA and                  control systems …• Most control systems are computer based.• Used by several infras...
Introducing SCADA and                           control systems …• Two kinds of industrial control systems (ICS):     – Di...
What makes a control                 system different?• Conventional data systems (IT) are human oriented.• Control system...
Practical and legal             considerations1. Safety ALWAYS2. Availability of the service3. Security and access control...
Admiralty Law similarity:                      ICS practical concerns•   You CANNOT stop operation of an infrastructure.• ...
Provenance of data is                     extremely important•   Accurate timestamps and source matter are crucial.•   Log...
Provenance of data is                   extremely important• Cryptographic signatures (if applicable, if possible).• Manag...
Factors to consider                     with ICS•   Latency of data events.     – Timing delay between events.•   Sequence...
Public standards for                             control system security• NERC CIP (not considered a complete specificatio...
Public standards for                            control system security• ISA-99     – Currently under complex development....
CS2SAT         NOTE: This particular         version is distributed         from Lofty Perch, Inc.                        ...
Public regulations for                            control systems security• Chemical Facility Anti-Terrorism Standards (CF...
A copy of this presentation may be found at our web site:    http://www.infracritical.com/papers/aba-isc-2009.zip         ...
Upcoming SlideShare
Loading in...5
×

ABA-ISC-2009

162

Published on

American Bar association Section of Science and Technology Law Information Security Committee 2009 Annual Meeting

Published in: Business
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
162
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
2
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Transcript of "ABA-ISC-2009"

  1. 1. American Bar Association Section of Science and Technology Law Information Security Committee 2009 Annual Meeting – Lunch Presentation Wednesday, July 29, 2009Bob Radvanovsky, CIFI, CISM, CIPSJacob Brodsky, PELegal and IT Aspects of Securing Our Critical Infrastructures Creative Commons License v3.0. 1
  2. 2. Presentation disclaimer• This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you may distribute this message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety tested for children under the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry on low heat; do not bend, fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where prohibited, taxed, or otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any warranties; reader assumes full responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity message; no shoes, no shirt, no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find objectionable, parental guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down; no purchase necessary; you need not be present to win; some assembly required; batteries not included; instructions are included; action figures sold separately; no preservatives added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken; call before you dig; not liable for damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops, discontinue reading; read only with proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and skin and avoid inhaling fumes; do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or magnetic source; smoking this message could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms persist, consult a physician; may cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous machinery; possible penalties for early withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read; objects in mirror are closer than they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes and other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, mud slides, forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot, BBs, shrapnel, lasers, napalm, torpedoes, or emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by weight only, contents may settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or whatever; actual message may differ from illustration on box. This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you may distribute this message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety tested for children under the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry on low heat; do not bend, fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where prohibited, taxed, or otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any warranties; reader assumes full responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity message; no shoes, no shirt, no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find objectionable, parental guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down; no purchase necessary; you need not be present to win; some assembly required; batteries not included; instructions are included; action figures sold separately; no preservatives added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken; call before you dig; not liable for damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops, discontinue reading; read only with proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and skin and avoid inhaling fumes; do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or magnetic source; smoking this message could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms persist, consult a physician; may cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous machinery; possible penalties for early withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read; objects in mirror are closer than they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes and other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, mud slides, forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot, BBs, shrapnel, lasers, napalm, torpedoes, or emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by weight only, contents may settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or whatever; actual message may differ from illustration on box. This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you may distribute this message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety tested for children under the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry on low heat; do not bend, fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where prohibited, taxed, or otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any warranties; reader assumes full responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity message; no shoes, no shirt, no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find objectionable, parental guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down; no purchase necessary; you need not be present to win; some assembly required; batteries not included; instructions are included; action figures sold separately; no preservatives added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken; call before you dig; not liable for damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops, discontinue reading; read only with proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and skin and avoid inhaling fumes; do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or magnetic source; smoking this message could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms persist, consult a physician; may cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous machinery; possible penalties for early withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read; objects in mirror are closer than they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes and other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, mud slides, forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot, BBs, shrapnel, lasers, napalm, torpedoes, or emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by weight only, contents may settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or whatever; actual message may differ from illustration on box. This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you may distribute this message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety tested for children under the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry on low heat; do not bend, fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where prohibited, taxed, or otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any warranties; reader assumes full responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity message; no shoes, no shirt, no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find objectionable, parental guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down; no purchase necessary; you need not be present to win; some assembly required; batteries not included; instructions are included; action figures sold separately; no preservatives added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken; call before you dig; not liable for damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops, discontinue reading; read only with proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and skin and avoid inhaling fumes; do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or magnetic source; smoking this message could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms persist, consult a physician; may cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous machinery; possible penalties for early withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read; objects in mirror are closer than they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes and other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, mud slides, forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot, BBs, shrapnel, lasers, napalm, torpedoes, or emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by weight only, contents may settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or whatever; actual message may differ from illustration on box. 2
  3. 3. What is a “critical infrastructure”?• Represents “…assets of physical and computer-based systems that are essential to the minimum operations of the economy and government.”(1)• These assets include (but are not limited to): – Telecommunication systems – Energy distribution – Banking & financial systems – Transportation – Water treatment facilities – etc … there are a total of 14 infrastructure sectors.1. ”Critical Infrastructure: Homeland Security and Emergency Preparedness”, 1st Edition, Radvanovsky, 2006. 3
  4. 4. Reasons for addressing infrastructure issues• Critical infrastructures historically regarded physically and logically interdependent systems … until 9/11.• Advances in IT systems and efforts to improve efficiencies of these systems, infrastructures have become increasingly automated and interlinked.• Improvements created new vulnerabilities(2) • Equipment failure • Human error • Natural causes (weather, drought, corrosion, locusts…) • Physical and computer-related attacks2. ”Critical Infrastructure: Homeland Security and Emergency Preparedness”, 1st Edition, Radvanovsky, 2006. 4
  5. 5. Issues with our critical infrastructures today• Each infrastructure entity is responsible for protecting its own infrastructure; little to no cross cooperation.• Each infrastructure entity needs to have measures that assure information is valid and accurate (apply A-I-C principle); most are currently lacking.• Work should take holistic approach as systems are interdependent. (the Domino Principle). 5
  6. 6. Assure the systems that support the systems• The infrastructure assurance process should: – Provide a consistent testing and evaluation framework of each infrastructure sector. – Perform vulnerability assessments regularly against physical and computer systems to deter, prevent, detect, and protect. – Expedite process to validate holistic systems.• Assurance processing applies to both public and private sectors. 6
  7. 7. Introducing SCADA and control systems …• Most control systems are computer based.• Used by several infrastructure sectors (and their industries) to monitor and control sensitive processes and physical functions.• Functions to provide safety controls and security.• Primary role to ensure operations continuity within a plant.• Control system abilities vary from simple to complex. 7
  8. 8. Introducing SCADA and control systems …• Two kinds of industrial control systems (ICS): – Distributed Control Systems (DCS) are typically used within a single process or plant, or used over a smaller geographic area, possibly even a single site location. – SCADA systems are typically used for larger-scale environments that may be geographically dispersed in an enterprise-wide distribution operation.(3)3. ”Critical Infrastructure: Homeland Security and Emergency Preparedness”, 1st Edition, Radvanovsky, 2006. 8
  9. 9. What makes a control system different?• Conventional data systems (IT) are human oriented.• Control systems are machine / process oriented: – Cannot be easily stopped - once stopped, takes a very long time to re-start; stopping an ICS means loss of revenue. – However … there is more at stake than financial considerations; stopping ICS can introduce safety issues. – Availability and reliability are paramount. 9
  10. 10. Practical and legal considerations1. Safety ALWAYS2. Availability of the service3. Security and access control4. Regulation and compliance 10
  11. 11. Admiralty Law similarity: ICS practical concerns• You CANNOT stop operation of an infrastructure.• You CAN refer to federal investigation reports from NTSB, NRC, or CSB.• You CAN depose engineers, operators, and technicians once the emergency is no longer a threat.• You CANNOT confiscate original data without scheduled outage and/or without having a duplicate, backup system.• Prosecution of any offense should occur AFTER the event has been rendered safe, investigations conducted, and results reported by recognized experts. 11
  12. 12. Provenance of data is extremely important• Accurate timestamps and source matter are crucial.• Logs from ICS must be validated.• Instrumentation needs to be validated AFTER an incident, but before … – An expert is involved with a control systems background; and, – Has knowledge in information security w/certification and registration.• Control systems are NOT at all similar to “personal computers”: – Real Time Systems (RTS) are operated very differently (see orientation). – Process controllers are fundamentally similar to embedded systems. 12
  13. 13. Provenance of data is extremely important• Cryptographic signatures (if applicable, if possible).• Management methods must be documented. – Explaining ‘what’ and ‘how’.• Access to each system must be documented: – Answers ‘who’, ‘when’ and ‘where.• Protocols and code must be validated and documented. – Validates ‘why’. 13
  14. 14. Factors to consider with ICS• Latency of data events. – Timing delay between events.• Sequence of events. – Order of events.• Timing of events. – Duration and speed of events.• Time of when alarms were reported to plant operators. – When alarm is reported, that the event took place at its stated time. 14
  15. 15. Public standards for control system security• NERC CIP (not considered a complete specification by many).• NIST SP800-53: “Recommended Security Controls for Federal Information Systems“.(4)• NIST SP800-82: “Guide to Industrial Control Systems (ICS) Security”.(5)4. National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 2, “Recommended Security Control for Federal Information Systems”, December 2007; URL: http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf.5. National Institute of Standards and Technology (NIST) Special Publication 800-82, Final Draft, “Guide to Industrial Control Systems (ICS) Security”, September 2008; URL: http://csrc.nist.gov/publications/drafts/800-82/draft_sp800-82-fpd.pdf. 15
  16. 16. Public standards for control system security• ISA-99 – Currently under complex development. – Coordinated with ISA-84 safety specifications. – Considered the most complete and extensive contributed input from the industry.• Beware of the compliance approach: being compliant is NOT the same as being secure.(6)• DHS’s CS2SAT tool is simply just that - only a tool; CS2SAT is NOT a prosecutable document.(7)6. “What’s the Difference Between Security and Compliance? - The Long Answers”, Control Global Magazine, April 2009; URL: http://www.controlglobal.com/articles/2009/SCADAmoreAnswers0904.html.7. U.S. Department of Homeland Security’s Control System Cyber Security Self-Assessment Tool (CS2SAT), DHS Control Systems Security Program (CSSP); URL: http://csrp.inl.gov/Self-Assessment_Tool.html. 16
  17. 17. CS2SAT NOTE: This particular version is distributed from Lofty Perch, Inc. 17
  18. 18. Public regulations for control systems security• Chemical Facility Anti-Terrorism Standards (CFATS).(8)• FISMA recommends NIST SP800-53.(9)• NERC CIP requires additional work before FERC utilizes it.8. U.S. Department of Homeland Security, Chemical Facility Anti-Terrorism Standards: Facility Inspections; URL: http://www.dhs.gov/files/programs/gc_1177001576714.shtm.9. National Institute of Standards and Technology, Computer Security Division, Computer Security Resource Center; URL: http://csrc.nist.gov/groups/SMA/fisma/index.html. 18
  19. 19. A copy of this presentation may be found at our web site: http://www.infracritical.com/papers/aba-isc-2009.zip Questions? Bob Radvanovsky, (630) 673-7740 rsradvan@infracritical.com Jacob Brodsky, (443) 285-3514 jbrodsky@infracritical.com Creative Commons License v3.0. 19
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×