S4xJapan Closing Keynote

1. S4 Japan 2014 Closing Remarks Yokogawa Electric Corporation IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 1 - Tatsuaki Takebe All brand or product names in this document are trademarks or registered trademarks of their respective companies.

2. • First Self-destruct program (Richard Skrenta) • First Self-replicate program (Skrenta’s Elk Cloner) • ©Brain Virus developed by two Pakistanis’ • Yale, Cascade, Jerusalem, Lehigh, etc. • Ken Thompson demo first Trojan Horse • Fred Cohen’s VAX Viruses Protocol Weaknesses/Buffer overflow IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 2 - • Apple II Computer • Commodore • Atari • TI-99 • TRS-80 • First Worm developed in Xerox Palo Alto • FBI arrest “414s” Hacker Group • First “Concept” Macro Virus • Stealth virus (Whale) • Variable Encryption (1260) • Morris’ Worm • Robert T Morris fined $10K, 3 years probation • Code Red • Nimda • Philippines’ “I LOVE YOU” virus • Melissa virus ($80m) • Excel Macro Virus (cross platform) • “Solar Sunrise” - Two California Teens attack on 500 Military, Govt, & Private Computer Systems (Vul) • Slammer • Blaster • WeiChia • MyDoom • Sasser • Melissa’s author sentenced 20 months jail • DDoS on 13 “root” servers Standalone Systems – Disk/Diskette Sharing Information Warfare Computer Crimes Trusted Operating Systems (Orange Book) Trusted Network (Red Book) – ITSEC • Phishing attacks proliferated UK Green Book to BS 7799 to ISO 17799 to ISO 27001 Common Criteria (ISO 15408) Insecure Default/Weak Security Techniques/Feature Misuse/Social Engineering • Spyware • Bots • Phishing begins in AOL • “Cuckoo’s Egg” in LBL Cyber Crimes • SPAM Mails Discovery 発見 Experimentation 実験 Criminal Exploitation 非合法利用 197 7 197 8 197 9 198 0 198 1 198 2 198 3 198 4 198 5 198 6 198 7 198 8 198 9 199 0 199 1 199 2 199 3 199 4 199 5 199 6 199 7 199 8 199 9 200 0 200 1 200 2 200 3 200 4 200 5 200 6 • Pharming attacks (DNS poisoning) • Kevin Mitnick arrested, five years imprisonment • ZoTob • WMF Internet World Client-server/PC-LAN Networks Wide Web Web 2.0 By Meng Chow Kang

3. " Attack Sophistication & Intruder Knowledge " Everybody can be an attacker. " Attack tools can be used for the control systems. “Stealth”/Advanced Scanning Techniques Network Management Diagnostics Sweepers Disabling Audits Malicious Code Morphing WWW Attacks Automated Probes/Scans Hijacking Sessions Exploiting Known Vulnerabilities Password Cracking Self-Replicating Code IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 3 - Password Guessing Sniffers BOTS Distributed Attack Tools Denial of Service GUI Packet Spoofing High 1980 1985 1990 1995 2000 2005 2010 Intruder Knowledge Low Attackers Back Doors Zombies Attack Sophistication Lipson, H. F., Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy Issues, Special Report CMS/SEI-2002-SR-009, November 2002, page 10.

4. Security Incidents • From The Repository of Industrial Security Incidents IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 4 - 35 30 25 20 15 10 5 0 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011

5. " Industrial Control Systems Security Coverage TCIP IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> I S C I ISCI I3P SCADA 　　　L　O　G　IIC　　　　　　　　　　　　　　 Achilles Wurld- Tech - 5 - PCSRF A G A Power Oil & Gas Chem Water Transport Comm Req R&D Dev Test Eval Demo Deploy Operation 　SCADA SBIRs CSSP CSSP NSTB ISA | 9 9 API 11６4 FERC、NERC S P | 9 9 ISA CIDX ChemITC Mu Dynamics ICSJWG

6. Critical Infrastructure & Stds IEC ISO/IEC/JTC1 ISO/IEC 15408, 18045, 19790, 24759, 27001, 27002(17799) 62351-‐‑‒1〜～7 62443-‐‑‒1〜～3 NSTB CSSP CPNI(NISCC Tech Note Series) FERC EPRI NERC 国際 International 政府系 Govmtl 業界 Industry 成果 Outcome NIST SP800-‐‑‒82, 53, 30, 18, 37 FIPS 199, 200, 140-‐‑‒2 CMVP, CAVP ISCI I3P LOGIIC API Chemical CIDX 化学薬品 R isk M a p A ccess P o licy T o o l E m era ld D E A D B O L T S ecS S H S M T U Water Sewerage 運輸 IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 6 - AGA a cc CIP-‐‑‒002-‐‑‒X〜～ -‐‑‒009-‐‑‒X API 1164 AGA12 Guidance for Addressing Cyber Security in the Chemical Industry In tellig en t ID S INL Cyber Security Procurement Language for Control Systems IEEE IE E E -1 4 0 2 , 1 6 8 6 DOE 21 Steps to Improve Cyber Security Unite PCSF Organizations & People ISA99 WG1-‐‑‒6 ISA99.01.01,02.01, 03.01, CCEVS,NVLAP(TestLab) Test Specs Test Labs PCSRF SPP-‐‑‒ICS PP Power 電⼒力力 Oil Gas ⽯石油ガス上下⽔水道鉄道 Transport Railroad Telecommunication 通信 Any

7. " Industrial Control Systems Security Coverage IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> I S C I ISCI - 7 - Power Oil & Gas Chem Water Transport Comm Req R&D Dev Test Eval Demo Deploy Operation ISA99 ISA99

9. " ISA 99 organizational structure 㼃㻳㻝㼃㻳㻟㼃㻳㻠㼃㻳㻡㼃㻳㻢㼃㻳㻣㼃㻳㻤㼃㻳㻝㻜 IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 9 - 㼃㼕㼞㼑㼘㼑㼟㼟㻌㻯㼛㼙㼜㼘㼕㼍㼚㼏㼑㻌㻵㼚㼟㼠㼕㼠㼡㼠㼑 9 㼃㻯㻵㻵㻿㻭㻥㻥㻭㻿㻯㻵㻵㻿㻯㻵㻝㻜㻜㻭㼡㼠㼛㼙㼍㼠㼕㼛㼚㻌㻿㼠㼍㼚㼐㼍㼞㼐㼟㻌㻯㼛㼙㼜㼘㼕㼍㼚㼏㼑㻌㻵㼚㼟㼠㼕㼠㼡㼠㼑㼃㻳㻞㼃㻳㻥㼃㻳㻝㻝㻵㻱㻯㻌㻸㼕㼍㼕㼟㼛㼚㼀㼑㼏㼔㼚㼛㼘㼛㼓㼕㼑㼟㻿㼑㼏㼡㼞㼕㼠㼥㻌㻼㼞㼛㼓㼞㼍㼙㼀㼑㼞㼙㼕㼚㼛㼘㼛㼓㼥㻘㻌㻯㼛㼚㼏㼑㼜㼠㼟㻌㼍㼚㼐㻌㻹㼛㼐㼑㼘㼟㼀㼑㼏㼔㼚㼕㼏㼍㼘㻌㻾㼑㼝㼡㼕㼞㼑㼙㼑㼚㼠㼟㻯㼛㼙㼙㼕㼠㼠㼑㼑㻌㻼㼘㼍㼚㼚㼕㼚㼓㻌㼍㼚㼐㻌㻰㼕㼞㼑㼏㼠㼕㼛㼚㻼㼍㼠㼏㼔㻌㻹㼍㼚㼍㼓㼑㼙㼑㼚㼠㻿㼍㼒㼑㼠㼥㻌㻒㻌㻿㼑㼏㼡㼞㼕㼠㼥㻯㼛㼙㼙㼡㼚㼕㼏㼍㼠㼕㼛㼚㻌㼍㼚㼐㻌㻻㼡㼠㼞㼑㼍㼏㼔㼃㼕㼞㼑㼘㼑㼟㼟㻌㼍㼚㼐㻌㻿㼑㼏㼡㼞㼕㼠㼥㻌㻶㼃㻳㼀㻳㻝㼀㻳㻟㼀㻳㻠㼀㻳㻡㻵㻿㻭㻥㻥㻌㻵㻿㻭㻢㻣㻌㻶㼃㻳㻌㼛㼚㻌㼏㼥㼎㼑㼞㻌㼟㼑㼏㼡㼞㼕㼠㼥㻌㼒㼛㼞㻌㼚㼡㼏㼘㼑㼍㼞㻌㼜㼘㼍㼚㼠㼟㻲㼛㼡㼚㼐㼍㼠㼕㼛㼚㼍㼘㻌㻾㼑㼝㼡㼕㼞㼑㼙㼑㼚㼠㼟㼆㼛㼚㼑㼟㻌㼍㼚㼐㻌㻯㼛㼚㼐㼡㼕㼠㼟㻰㼑㼞㼕㼢㼑㼐㻌㻾㼑㼝㼡㼕㼞㼑㼙㼑㼚㼠㼟㻹㼑㼠㼞㼕㼏㼟㻼㼞㼛㼐㼡㼏㼠㻌㻰㼑㼢㼑㼘㼛㼜㼙㼑㼚㼠㻌㻾㼑㼝㼡㼕㼞㼑㼙㼑㼚㼠㼟㻿㼑㼏㼡㼞㼕㼠㼥㼃㼕㼞㼑㼘㼑㼟㼟㻵㻿㻭㻌㻿㼑㼏㼡㼞㼕㼠㼥㻌㻯㼛㼙㼜㼘㼕㼍㼚㼏㼑㻌㻵㼚㼟㼠㼕㼠㼡㼠㼑㻵㻱㻯㻛㻶㼀㻯㻝㻌㻸㼕㼍㼕㼟㼛㼚㻌㻭㼏㼠㼕㼢㼕㼠㼕㼑㼟㻸㼑㼍㼐㼑㼞㼟㼔㼕㼜㼀㻳㻞㼀㻳㻢

12. IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 12 - " ISO/IEC JTC 1/SC 27 SC 27 WG 1 WG 2 WG 3 WG 4 WG 5 ISMS Crypto Security Evaluation Security Control & Services IDMgmnt & Privacy 2700X 15408 19790 24760 29100 29101 ISA 99 IEC TC 65/WG10 SC 22/WG 23 ISA 99 IEC TC 65/WG10

13. IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 13 - " ISO/IEC JTC 1 SC 22 SC 22 WG4 COBOL WG5 Fortran WG9 ADA WG14 C WG17 Prolog WG19 Formal programming languages WG21 C++ WG23 Prog Lang Vul TR24772 SC 27/WG 3

14. Secure IACS and maintain operational security 㻵㼙㼜㼘㻌㼆㼛㼚㼑㼟㻌㻒㻯㼛㼚㼐㼡㼕㼠㼟㻘㻌㻯㼛㼙㼜㻵㼀 IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 14 - 㻿㼠㼍㼞㼠㻻㻷㻫㻱㼚㼐㻼㼍㼠㼏㼔㻌㻹㼍㼚㼍㼓㼑㼙㼑㼚㼠㻿㻭㻸䚷䠚㻩㻿㻭㻸㻱㼢㼍㼘㻌㻿㼥㼟㼠㼑㼙㻌㻾㼕㼟㼗㻿㼡㼎㼟㼥㼟㼠㼑㼙㼟㼆㼛㼚㼑㼟㻌㻒㻌㻯㼛㼚㼐㼡㼕㼠㼟㻱㼢㼍㼘㻌㻿㼥㼟㼠㼑㼙㻌㻻㼜㼑㼞㻚㻌㻿㻭㻸㻾㼑㼠㼕㼞㼑㻌㻿㼥㼟㼠㼑㼙㻹㼍㼗㼑㻌㻻㼜㼑㼞㼍㼠㼕㼛㼚㼍㼘㻌㻿㼑㼏㼡㼞㼕㼠㼥㻌㻼㼛㼘㼕㼏㼥㻯㼔㼛㼛㼟㼑㻌㻿㻭㻸㼆㼛㼚㼑㼟㻌㻒㻌㻯㼛㼚㼐㼡㼕㼠㼟㻻㼜㼑㼞㼍㼠㼑㻌㻿㼥㼟㼠㼑㼙 System Security Compliance Metrics Establishing an Industrial Automation and Control Systems Security Program Operating an industrial automation and control system security program IEC 62443-‐‑‒2-‐‑‒4 practices IACS supplier security policies and Target Security Assurance Levels for ISA 99.01.03 ISA 99.02.01 ISA 99.02.02 ISA 99.02.03 ISA 99.03.02 Zones and Conduits System security requirements and security assurance levels ISA 99.03.03 ISA 99.02.01 ISA 99.03.02 ISA 99.03.02 ISA 99.01.03 ISA 99.03.03 ISA 99.01.03 ISA 99.02.02 ISA 99.02.03 ISA 99.02.01 㻿㼠㼍㼞㼠㻱㼢㼍㼘㻌㻾㼕㼟㼗㻌㼒㼛㼞㻯㼛㼙㼜㻌㻯㼛㼚㼐㼡㼕㼠㼟㻿㼑㼏㻌㻾㼝㼙㼚㼠㼟㻌㼒㼛㼞㻯㼛㼙㼜㻘㻌㻯㼛㼚㼐㼡㼕㼠㼟㻰㼑㼟㼕㼓㼚㻌㻒㻌㻵㼙㼜㼘㻱㼢㼍㼘㻌㻿㻭㻸㻌㼒㼛㼞㻯㼛㼙㼜㻘㻌㻯㼛㼚㼐㼡㼕㼠㼟㻻㻷㻫 ISA 99.04.01 ISA 99.04.02 㻱㼚㼐 IEC 62443-‐‑‒2-‐‑‒4 IEC 62443-‐‑‒2-‐‑‒4 How to fit the entire pieces together?

15. " Compliance " IEC 62443-2-1 ISMS compliance for Asset Owners (62443-2-1 is IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 15 - aligned with ISO/IEC 27001) " IEC 62443-2-4 Vendor/System Integrator Security Maturity

17. ISASecure Levels Communication Robustness Testing IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 17 - Software Development Security Assessment ソフトウェア開発セキュリティ評価 Functional Security Assessment セキュリティ機能評価 Software Development Security Assessment ソフトウェア開発セキュリティ評価 Functional Security Assessment セキュリティ機能評価 Software Development Security Assessment ソフトウェア開発セキュリティ評価 Functional Security Assessment セキュリティ機能評価 LEVEL 1 LEVEL 2 LEVEL 3 Requirements Necessary to Achieve Certification Levels Level 1 Level 2 Level 3 Total Count in Specification SDSA 130 149 170 170 FSA 20 49 82 82 CRT All All All CRT Common Specification plus all 6 Protocol CRT Specifications

18. ISASecure EDSA Certification Program IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> Detects and Avoids systematic design faults • The vendor’s software development and maintenance processes are audited for artifacts for DUT • Ensures the organization follows a robust, secure software development process - 18 - Embedded Device Security Assurance Software Development Security Assurance (SDSA) ソフトウェア開発セキュリティ評価 Functional Security Assessment (FSA) セキュリティ機能評価 Communications Robustness Testing (CRT) 通信堅牢性テスト Detects Implementation Errors/Omissions • A component’s security functionality is audited against its derived requirements for its specified security level • Ensures the product has properly implemented the security functional requirements Identifies vulnerabilities in device networking capabilities • A component’s communication robustness is tested against communication robustness requirements • Tests for vulnerabilities in the 4 layers of OSI Reference Model

19. ISA Security Compliance Institute • Document Structure for Product Evaluation " Similar structure for system evaluation is being discussed now. IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 19 - 19 Tatsuaki Takebe Yokogawa Electric Corp.

20. • In order to decrease the chances to be hacked, • You need investments • Attackers need skill, resources to crack the secure system • Let’s make an agreement and grade the level Lvl 4 IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 20 - Attackers’ Skill, Resources, Tools, Time How much security? Investment, Efforts, Tech Level, Assurance Level Chances to get compromised. Lvl 3 Lvl 2 Lvl 1

21. " 62443-3-3 System security requirements and security assurance levels From Draft 3 ISA 62443-3-3(99.03.03) Sep 2011 4. FR 1 Identification and authentication control To prevent unauthorized access to device and/or inquiry of its info To prevent unauthorized operation of device To prevent tampering data To prevent data leakage To prevent unauthorized information leakage To notify security violation to authority and to report forensic evidence To protect the entire NW resources from DoS attacks IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 21 - 5. FR 2 – Use control 6. FR 3 – Data integrity 7. FR 4 – Data confidentiality 8. FR 5 – Restricted data flow 9. FR 6 – Timely response to events 10. FR 7 – Resource availability 21 Tatsuaki Takebe Yokogawa Electric Corp.

22. " 62443-3-3 System security requirements and security assurance levels From Draft 3 ISA 62443-3-3(99.03.03) Sep 2011 4. Identify and authenticate all users (humans, processes and devices), and allow them access to the system or assets. • SL 1 – Identify and authenticate all users (humans, processes and devices) by mechanisms which protect against casual or coincidental access by unauthorized entities. • SL 2 – Identify and authenticate all users (humans, processes and devices) by mechanisms which protect against intentional unauthorized access by entities using simple means. • SL 3 – Identify and authenticate all users (humans, processes and devices) by mechanisms which protect against intentional unauthorized access by entities using sophisticated means. • SL 4 – Identify and authenticate all users (humans, processes and devices) by mechanisms which protect against intentional unauthorized access by entities using sophisticated means with extended resources. IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 22 - 22 Tatsuaki Takebe Yokogawa Electric Corp.

23. " 62443-4-1 Product Development Requirements From Draft 1 Edit 1 ISA-99.04.01 Jun 2011 5. Phase 1 – Security Management Plan (SMP) – SDSA-SMP-1 - Security Management Plan – SDSA-SMP-2 - Action Item Resolution – SDSA-SMP-3 - Documentation of software releases – SDSA-SMP-4 - Development Environment Security Documentation – SDSA-SMP-5 - CM System – SDSA-SMP-6 - Configuration Management Plan – SDSA-SMP-7 - Configuration List IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 23 - 23 Tatsuaki Takebe Yokogawa Electric Corp.

24. " 62443-4-1 Product Development Requirements From Draft 1 Edit 1 ISA-99.04.01 Jun 2011 6. Phase 2 - Security Requirements Specification (SRS) 7. Phase 3 – Software Architecture Design (SAD) 8. Phase 4 - Security Risk Assessment and Threat Modeling IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 24 - (SRA) 9. Phase 5 - Detailed Software Design (DSD) 10. Phase 6 - Document Security Guidelines (DSG) 11. Phase 7 - Module Implementation & Verification (MIV) 12. Phase 8 - Security Integration Testing (SIT) 13. Phase 9 - Security Process Verification (SPV) 14. Phase 10 - Security Response Planning (SPR) 15. Phase 11 - Security Validation Testing (SVT) 16. Phase 12 - Security Response Execution (SRE) 24 Tatsuaki Takebe Yokogawa Electric Corp.

25. Conclusions IAMK014-0411 Copyright © Yokogawa Electric Corporation <20141010> - 25 - • Why standards? • No security is perfect. • Standards are the golden mean agreed upon by the stakeholders. • Compliance/Certification gives assurance if something happens.