Uploaded byJohn Cusimano, CFSE, CISSP, GICSP
Building Cybersecurity into a Greenfield ICS Project
This document discusses integrating cybersecurity into the lifecycle of a new industrial control system (ICS) project. It recommends conducting a cybersecurity risk assessment early using ISA 62443 methodology. This informs developing cybersecurity requirements and reviewing designs to ensure requirements are met. It also recommends cybersecurity acceptance testing before commissioning to verify secure configurations and robustness. Maintaining security management processes is key after system handover to operations. Benefits include a common understanding of risks addressed and better preparation to manage security long-term. Critical success factors include having achievable goals and clear roles/responsibilities.
More Related Content
Similar to Building Cybersecurity into a Greenfield ICS Project
Building Cybersecurity into a Greenfield ICS Project
- 1. 1 2017 ICSJWG SpringMeeting John Cusimano & Steve Stock aeSolutions Building Cybersecurity into a Greenfield ICS Project
- 2. 2 Agenda • Project justification •Business challenges • Integrating cybersecurity into the ICS project lifecycle • Benefits • Critical Success Factors
- 3. 3 Project Justification • Cybersecuritytop priority for company • Recognize the relationship between process safety and OT cybersecurity • Operate critical infrastructure • Desire to be compliant with industry best practices and standards • Desire to Build Security In (i.e. “Stop the bleeding”) Integrating cybersecurity into the project is far superior to adding security after the fact and will cost less
- 4. 4 Business Challenges • Buyin from senior management • Buy in from project management • Support from EPC, Vendor, SI’s, operations • Minimal impact project schedule
- 5. 5 Typical ICS cybersecuritylifecycle for existing systems Vulnerability / Gap Assessment Risk Assessment Mitigation Plan Implement Maintain & Audit
- 6. 6 Integrating Cybersecurity intothe ICS Project Lifecycle Front-end Engineering Detailed Engineering Construction Commission Run & Maintain CyberPHA Cyber Req Spec Design Review(s) Cyber FAT Cyber SAT Security Management, Monitoring and Incident Response
- 7. 7 ICS Cybersecurity RiskAssessment (Cyber PHA) • Systematic approach • Process defined in ISA 62443-3-2 “Security Risk Assessment and System Design” • Similar to a PHA / HAZOP • Start by partitioning the system into zones and conduits
- 8. 8 ICS Cybersecurity RiskAssessment (Cyber PHA) • Each zone/conduit is assessed to identify threats, vulnerabilities, consequences and risk • Additional countermeasures are defined to address unacceptable risk • Prioritize activities and resources • Document and justify decisions • Risk register and risk profile • Prioritized recommendations and plan • Training and awareness • Successfully applied at numerous PSM regulated companies
- 9. 9 Integrating Cybersecurity intothe ICS Project Lifecycle Front-end Engineering Detailed Engineering Construction Commission Run & Maintain CyberPHA Cyber Req Spec Design Review(s) Cyber FAT Cyber SAT Security Management, Monitoring and Incident Response
- 10. 10 Cybersecurity Requirements Specification •A set of requirements for the system based upon the results of the cybersecurity risk assessment and industry best practices/standards – General security requirements for entire system – Identification of security zones and conduits – Identification of the IACS assets assigned to each zone/conduit – Requirements for how zones/conduit boundaries will be monitored and secured – Requirements for how networks will be monitored and secured – Requirements for how various types of end-points (e.g. operating systems, applications, embedded devices, etc.) will be hardened – Requirements for security management • Organization can have a general ICS cybersecurity specification but a unique spec should be developed for each unique ICS 10
- 11. 11 Security Management Requirements •ICS Asset Management • Access Control • Malware Prevention (antivirus and/or whitelisting) • Patch Management • System Backups • Configuration/Change Management • Network monitoring and intrusion detection • Security incident and event management (SIEM) • Information & Documentation Management
- 12. 12 Integrating Cybersecurity intothe ICS Project Lifecycle Front-end Engineering Detailed Engineering Construction Commission Run & Maintain CyberPHA Cyber Req Spec Design Review(s) Cyber FAT Cyber SAT Security Management, Monitoring and Incident Response
- 13. 13 ICS Cybersecurity DesignReview • Review of design with key stakeholders (e.g. Asset Owner, EPC, System Integrator, etc.) • Review and discuss how cybersecurity requirements are satisfied • Document issues (i.e. gaps) that need to be addressed • Ideally performed following conceptual design and again following detailed design 13
- 14. 14 Integrating Cybersecurity intothe ICS Project Lifecycle Front-end Engineering Detailed Engineering Construction Commission Run & Maintain Cyber Req Spec Design Review(s) Cyber FAT Cyber SAT Security Management, Monitoring and Incident Response CyberPHA
- 15. 15 Cybersecurity Acceptance Testing Thecyber security of a system should be tested and accepted by the operating company prior to delivery and prior to startup • Cybersecurity Factory Acceptance Testing (CFAT) – Performed at the FAT site (e.g. vendor or system integrator) – Performed after functional testing of the system is complete • Cybersecurity Site Acceptance Testing (CSAT) – Performed onsite at the location where the system will be operated – Performed after operational testing is complete – Prior to releasing the system to operations
- 16. 16 Cybersecurity Acceptance Testing •Verification of cybersecurity requirements – Verify security settings were properly configured • OS • Applications/Databases • Network Devices • ICS Devices • Antivirus software – Access controls have been properly established – Security components (e.g. firewalls) were installed and properly configured – Detection systems are operational and able to identify and report events • Cybersecurity robustness testing – Testing designed to discover and identify the weaknesses or vulnerabilities in a system – Test resilience to network attacks (e.g. storms, fuzzing) – Vulnerability scanning – Intrusion testing to verify firewall configuration
- 17. 17 Cybersecurity Acceptance Testing BestPractices • Define the System-Under-Test • Develop a verification and test plan • Collaborate with process FAT/SAT teams • Verify cyber security configuration settings • Perform robustness testing • Document results (i.e. punchlist)
- 18. 19 Integrating Cybersecurity intothe ICS Project Lifecycle Front-end Engineering Detailed Engineering Construction Commission Run & Maintain Cyber Req Spec Design Review(s) Cyber FAT Cyber SAT Security Management, Monitoring and Incident Response CyberPHA
- 19. 20 Security Management Processesmust be Developed and Maintained • ICS Asset Management • Access Control • Malware Prevention (antivirus and/or whitelisting) • Patch Management • System Backups • Change Management • Network monitoring and intrusion detection • Security incident and event management (SIEM) • Information & Documentation Management
- 20. 22 Incident Response • Theincident response lifecycle • Incident analysis / forensics • Planning • Incident Prevention • Detection • Containment • Remediation • Recovery & Restoration
- 21. 23 Benefits of IntegratingCybersecurity into the ICS Project Lifecycle 23 • Common understanding of cyber risk • Common understanding of what needs to be done to secure system and why its important • Verification that security is properly implemented • Operations staff security aware and trained prior to startup • Technically and procedurally better prepared to manage, monitor and respond to security incidents Front-end Engineering Detailed Engineering Construction Commission Run & Maintain Cyber Req Spec Design Review(s) Cyber FAT Cyber SAT Security Management, Monitoring and Incident Response CyberPHA
- 22. 24 Critical Success factors •Have realistic and achievable goals – Demonstrating success is critical for future projects – Have a clear vision on what success looks like • Define roles and responsibilities • Assign an ICS Cybersecurity Lead for the duration of the project • Independent from EPC, vendors, system integrators • Frequent communications with all stakeholders 24
Editor's Notes
- #2 The original title of this presentation was “Cybersecurity Acceptance Testing”. However, as I was developing this presentation I decided to broader the topic to discuss the benefits and challenges of integrating cybersecurity into a greenfield ICS project.
- #3 We have been supporting the CISO of a midstream O&G company for several years in the development of their Corporate Cybersecurity Management Program which covers both IT and OT. We are also in the process of helping them perform cyber assessments of their existing infrastructure. In the meantime, the company is involved in a very large capital project to build a NGL facility. So this presentation is a bit of a case study on that project but also presents some general information on integrating cybersecurity into greenfield ICS project based on our experience in doing so.
- #7 Add resource plan (roles and responsibilities) Involve Operations early
- #8 The standards I mentioned say you have to perform ICS cybersecurity risk assessments but until recently didn’t say “how”. The new 62443-3-2 draft standard documents a process that has been successfully applied by numerous corporations in the process industries – particularly those impacted by PSM regulations. The process is a modification of the HAZOP process hazard analysis methodology. It is a systematic approach that breaks down the ICS system(s) into units and nodes and analyzes the threats, vulnerabilities and consequences to estimate risk using the corporation’s standard risk matrix. Numerous benefits include:
- #9 The standards I mentioned say you have to perform ICS cybersecurity risk assessments but until recently didn’t say “how”. The new 62443-3-2 draft standard documents a process that has been successfully applied by numerous corporations in the process industries – particularly those impacted by PSM regulations. The process is a modification of the HAZOP process hazard analysis methodology. It is a systematic approach that breaks down the ICS system(s) into units and nodes and analyzes the threats, vulnerabilities and consequences to estimate risk using the corporation’s standard risk matrix. Numerous benefits include:
- #10 Add resource plan (roles and responsibilities) Involve Operations early
- #13 Add resource plan (roles and responsibilities) Involve Operations early
- #15 Add resource plan (roles and responsibilities) Involve Operations early
- #20 Add resource plan (roles and responsibilities) Involve Operations early