Cyber security: A roadmap to secure solutions


Published on

For many companies, Cyber Security is achieved solely through the application of technological solutions to software and hardware challenges. Schneider-Electric takes a more holistic approach with a program built around complete product lifecycles and encompassing safety, maintenance and security. Discover Schneider-Electric's cyber security vision, from understanding how secure functionality is engineered into products through the tools and support available to manage updates and patches, plus specific procedures for handling potential vulnerabilities. A software and hardware ecosystem is only as strong as its weakest component, and Schneider-Electric is working to strengthen this through StruXureware and the evolution of platforms.

Published in: Technology
  • BioSSL? is a unique 2nd generation fingerprint authentication security system for financial transactions in a global financial environment that deals with trillions of $$ transactions on an annual basis. Because the finger print images are not saved on the servers, the most required safety measure to safeguard the clients interests from the hackers, it becomes an unique product. BioSSL replaces the password with unique features of the user’s identity. * Only the user controls his password. * His unique biometric features are his password. * His password can never be revealed or re-engineered. * No hacker, phishing or web criminal behaviour can use the data.
    Are you sure you want to  Yes  No
    Your message goes here
  • We can help strengthen cyber-security with our new and patented anti-hacking device called Titan! Learn more at
    Are you sure you want to  Yes  No
    Your message goes here
No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • What is Cybersecurity:Threats attack vulnerabilities and caninclude: Internal threats External threatsPotential risks: Safety of personnel (injury, fatality) Production and financial loss Loss of sensitive dataKey Security Principles:Confidentiality – Prevent disclosure of private information. Integrity – Data cannot be modified without authorization. Availability – The information must be available when it is needed.
  • Hackers are not sitting still, as new mitigations are put in place, hacker find a new pathway inPeople/Employees can be a vulnerability soft spot – a trained and aware person is a less vulnerable person
  • Effective Cybersecurity cannot be addressed as an afterthought
  • Schneider Electric’s IRP is defined as a Corporate Directive and ProcedureIRP Tools: 8 Disciplines (8D) used to determine root cause Common Vulnerability Scoring System (CVSS) is used to prioritize the vulnerabilitiesIRP Tracking of activities:Issue to Prevention (I2P)Incorporates the 8D process
  • Cyber security: A roadmap to secure solutions

    1. 1. 1Cyber Security:A Roadmap to Secure SolutionsMike PyleVP Cyber SecurityTweet Live!#SchneiderXE
    2. 2. 2Why Pay Attention to Cybersecurity●Protecting assets against computer or network threats (CIA triad)● Confidentiality: protect against unauthorised data disclosure● Integrity: Ensure data and routines has not been modified or tampered● Availability: Promote system uptime and operational capability●Cyber attacks have “jumped the gap” from virtual to physicalworld resulting in real physical damage to critical assets●Cyber attacks can now put people at risk, cause productiondowntime, create financial loss and can ex-filtrate sensitive data
    3. 3. 3Why Schneider Electric caresFocus of attacks has shifted from the IT world towards criticalinfrastructure. Schneider Electric’s customers may be in the cross hairs ofmany groups looking to harm infrastructure● Cyber warfare● Criminal activities● Revenge● Maliciousness● Send a political message orbuild street creds in the hackercommunityIT SecurityConfidentiality &Integrity firstAvailability importantThousands ofdevicesCross industryregulationsTransaction modelOT SecurityHuman Safety &Reliability firstIntegrity importantMillions of devicesIndustry-specificregulationsReal-time model
    4. 4. 4Key benefitsKey Trends & DriversTerrorismExtortion650% increase in cyber threatsduring the last yearSuccessfully attacking best guardedorganizationsTerrorismExtortionEspionageIT – Information TechnologyOT – Operations TechnologyRegulatory compliance is in a constant state of fluxIncreasing budgetary pressures & fewer resourcesRapid pace of technology evolution – IT/OT convergence
    5. 5. 5DamageMethodSource: TrendMicro – 12 Security Predictions for 2012To: Control Room OperatorsFrom: Help DeskPlease apply the latestpatches to ensure safety ofcomputer systems, click herefor the updates.ShamoonStuxnetDuquScan the InternetSpear phishingInject MalwareMotiveRapid Evolution of ThreatThreat Landscape
    6. 6. 6Case in Point – The Shamoon VirusGoal: Cyber Espionage and Damage.Initially targeted oil and gas operationsin the Middle East● Currently considered the most destructiveattack in the business sector● More than 30,000 computers at an oilcompany replaced● Used to attacked a natural gas firm a fewdays later● Included a routine coded to self-execute,replacing crucial system files with animage of a burning U.S. flag● Overwrote all real data on the machineswith garbage data
    7. 7. 7- Restrict access- Comply withregulations- Assess Threat systems- Protect equipment- Secure localand hosted sites- Harden productsand architectures- Comply withregulations & standards- Define regulations- Mandate security- Drive collaborationIndustry SuppliersICT, energy, transportation &service providersPlanners & DevelopersReal estate developers &urban plannersGovernmentsNational, regional and localcity officialsUtilitiesCity and private electric,water & gas utilitiesNGO’s & AssociationsLocal organizations:citizens, businesses & NGOsOther InfrastructureInternet & MANproviders, banks andtransportationSmart Cities Require Comprehensive SecurityPeople & CommunitiesResponsible stakeholder action & collaboration is a must
    8. 8. 8Compliance & Reporting ArchitectureInformation sharing MonitoringIncreasing Resiliency - Key Focus AreasConnectivityThird Party/Agnostic• Compliant with currentstandards• Assessing upcomingregulations• Follow internal policies & bestpractices• Uniform security acrossproducts• Reinforce weakest link• Tackle security at core ofproduct• Secure communicationsamong products• Use strong authentication toaccess critical systems• Vendors to disclose securityvulnerabilities to utilities• Utilities to disclose criticalbreaches to US Government• Prevent, detect and react tobreaches in real-time• Automatic monitoring tools &human-driven solutions• Vendors cannot create alltechnology layers• Fully test third party modulesto be safe from breaches
    9. 9. 9Value Proposition• Threats surged 17x in 2 years due to devices interconnectivity, IT networks convergence &heterogeneous architectures• Operational networks with many unpatched legacy systems, making them as resilient as weakest link• High levels of awareness and scrutiny by regulators and general publicProblem - Cyber Security & Change Management• Schneider Electric to provide a secure & reliable core offering with additional security products & services• Allow customers to have control over security and compliance, while enhancing operationaleffectiveness, through an extended set of integrated solutionsPositioningSchneider Electric – Our DifferentiationBest of Breed Certified SolutionsIT/OT Expertise &-Domain Knowledge
    10. 10. 10Key Benefits• Protect human life• Avoid loss of service• Avoid loss of productivity• Avoid brand damage• Mitigate and reduce impact on assets• Limit damage on image and society
    11. 11. 11Listen to customer expectations,analyze regulatory mandates andtranslate into documented securityrequirements and implement withinour offersDevelop using propersecurity principles:• Secure by design• Threat model and riskanalysis• Security features areimplemented properly• Secure coding principlesapplied• Mature SDL program withmetricsSecure Product Testing• Robustness & Fuzz testing• Vulnerability Scanning• Penetration Testing• Security feature validationDocument how to securelyinstall, commission, maintain,decommission products tomanage a secure systemSecurity: Built in, not Bolted on..Building secure products and solutions
    12. 12. 12Most Resilient SCADA Solution in the Market• Last 15 years, invested ~$20M on security on OASyS• Currently, investing around $1M yearly on security activities• Dedicated security team● Throughout the years, Schneider Electric has committed to security, by investing over$20 million dollars, to provide safe, resilient and compliant products● We are recognized within the industry as a real-time and secure solutions company• Only firm providing solutions with secure & rapid escalation• Best in class 3rd party integration model (SCADA)• Ability to access external data in a secure manner• World class security technology throughout all our products• Anti-virus support• Separation of Duties support• Multi-factor authentication• We meet and exceed main security standards in the market• NERC Critical Infrastructure Protection (CIP)• NIST Industrial Control Systems Security (SP 800-82)CommitmentCapabilitiesKey TechnologiesStandardsPartnerships
    13. 13. 13Incident Response Plan is Crucial●Objectives:● Respond to events & customer’s concerns● Rapidly & effectively address disclosures●Types of Incidents:● Intentional - deliberate attack on a customer’ssystem●Steal customer’s sensitive information●Disrupt customer’s operations● Unintentional - misuse of a customeroperation using the system● Vulnerability disclosure; only reported as avulnerability; no evidence of disruption of acustomer operationIRP Simplified Conceptual FlowVulnerability/ IncidentReportedAnalyze & ReportAction Plan &ContainCommunicate &PublishMitigate & ResolveCommunicateResolution & Close
    14. 14. 14DIACAP LifecycleDIACAP:: DoD Information Assurance Certification & Accreditation ProcessRequired for all DoD projectsMeeting Customer Requirements
    15. 15. 15Comprehensive Approach to SecurityConsulting, Integration and Managed Security ServicesMonitoring, Compliance, Change Management, Whitelisting, Big Data Security, FirewallsOil & Gas Electric WWW Transportation MMMSchneider Electric’s Core OfferingSecure coding, Encryption, Access, Authorization & Authentication, etc.SecurityServicesSecurityProductsSchneider Electric stands by a safe, reliable and secure core offeringCyber security products & services, increasing prevention, detection & responseProviding portfolio of services through recognized Schneider Electric’s consulting arm & local playersA Defense in-Depth approach offering a combination of physical controls, monitoring and analyticsBuilt-inSecurity
    16. 16. 16Industrial DMZBoundaries Control RoomOperationBusiness SystemsControl NetworkOperation NetworkEnterprise NetworkDevice NetworkMES, WMS, DMS, LMS…SCADA, DCS, Controllers, Local & RemoteCommunications Network Devices…Instruments and Controls, Distributed IO, …EnterprisePerformanceSystemsField DevicesCore OfferingCyber Security Products & ServicesSecurity Products – Partnership EcosystemMonitoringComplianceManagementChangeManagementApplicationWhitelistingIntrusionDetectionSystemFirewallsOutsourcing:ManagedServices,Maintenance&CloudCyber Security ServicesIntegrationConsulting:Assessment&Design
    17. 17. 17For More Information
    18. 18. Schneider Electric 18- Infrastructure Business – Rodrigo Kaschny – March 2012Make the most ofyour energybusiness
    19. 19. Appendix
    20. 20. Schneider Electric 20- Infrastructure Business – Rodrigo Kaschny – March 2012Key TermsDIACAP:DoD InformationAssurance Certification &Accreditation ProcessCoN:Certificate ofNetworthinessDISA:Defense InformationSystems AgencyICS-CERT:Industrial Control SystemCyber EmergencyResponse Team; A part ofthe U.S. Dept. ofHomeland Security US-CERT OrganizationIA:Information AssuranceDAA:Designated ApprovalAuthoritySTIG’s:Security TechnicalImplementation GuidesIRP:Incident Response Plan