Response and recovery methods for severe cyber security incidents need traceable integration within incident management systems, which should be offered as a tool-set within the Executive Order 13636 Cybersecurity Framework. NERC FERC CIP CIP-009 IMS NFPA 1600 CYBER SECURITY CISA CISSP PMP Response and recovery methods for severe cyber security incidents need traceable integration within incident management systems, which should be offered as a tool-set within the Executive Order 13636 Cybersecurity Framework. NERC FERC CIP CIP-009 IMS NFPA 1600 CYBER SECURITY CISA CISSP PMP

1. 1
Integration of cyber security incident response within
holistic incident management systems to
strengthen resiliency of the nation’s critical infrastructure
Part two of a series
June 2013
Author: Dave Sweigert, M.Sci., CISSP, CISA, PMP
ABSTRACT
Response and recovery methods for severe cyber security incidents need
traceable integration within incident management systems, which should be
offered as a tool-set within the Executive Order 13636 Cybersecurity Framework.
Background
In September 2010, a 30-inch diameter
natural gas pipeline exploded near a
residential neighborhood of San Bruno,
California. A fire followed which quickly
engulfed nearby homes. As the site was
two miles West of San Francisco Airport
initial responders believed a jetliner had
crashed in the area. It took the private
operator, PG&E, 90 minutes to shut off
the gas after the explosion.
Preventing severe incidents caused by
technology is one of the goals of the
White House as expressed in Executive
Order 136361
. E.O. 13636 seeks to
strengthen the protection of Critical
Infrastructure and Key Resources
1
Executive Order -- Improving Critical Infrastructure
Cybersecurity, 2/12/2013. See: Sec. 7. Baseline
Framework to Reduce Cyber Risk to Critical
Infrastructure
(CIKR)2
, albeit via voluntary compliance
with a new Cybersecurity Framework
(CSF)).
E.O. 13636 seeks to “explore the use of
existing regulation to promote cyber
security” while “understanding the
cascading consequences of infrastructure
failures..3
”. This paper intends to meld
both goals to better explore ways in which
existing policy frameworks can be
leveraged to further particularize the CSF
with practical solutions.
2
Critical Infrastructure: Assets, systems and
networks, whether physical or virtual, so vital to the
United States that the incapacity or destruction of
such assets, systems or networks would have a
debilitating impact on security, national economic
security, public health or safety, or any combination
of those matters.
Key resources: Publicly or privately controlled
resources essential to the minimal operations of the
economy and the government.
3
Presidential Policy Directive (PPD) 21

2. 2
Industry check-box attitudes about
cyber-security compliance
Although CSF is voluntary in nature,
some private sector operators of CIKR
have voiced their concern that severe
incidents may require cohesive and
coordinated rapid response and
recovery, which is not addressed by
technology-based standards (see
responses to the U.S. National Institute
of Standards and Technology (NIST),
Request for Information (RFI)4
).
Real CIKR resiliency may require
examination of how an organization’s
response capabilities align with public or
private partners and understanding
those functional interdependencies.
In contrast, the Critical Infrastructure
Protection (CIP)5
Reliability Standards
program (a Bulk Electric System (BES)
industry6
framework) has imposed a fine-
based compliance scheme on the BES
industry. CIP critics complain it is an
administrative-based set of disjointed
standards which foster a “check the box
mentality” and has failed in achieving
tangible “comprehensive and effective
cybersecurity.”7
4 Docket No. 130208119-3119-01, Industry responses to
NIST Request for Information.
5
North American Electric Reliability Corporation’s (NERC)
Critical Infrastructure Protection (CIP) Standards for Cyber
Security
6
http://www.nerc.net/standardsreports/standardssu
mmary.aspx
7
“Utilities are focusing on regulatory compliance instead
of comprehensive security. The existing federal and state
regulatory environment creates a culture within the utility
industry of focusing on compliance with cybersecurity
requirements, instead of a culture focused on achieving
To illustrate, the static CIP standard
009, “Recovery Plans for Critical Cyber
Assets8
”, requires the creation of a
“recovery plan” for “cyber assets”. CIP-
009 does not require integration of such
a stand-alone recovery plan within the
organization’s overall severe incident
response. So, cyber-incident escalation
triggers that activate other response
plans may or may not be addressed.
To be CIP-009 compliant, an entity only
needs a cyber-incident response9
plan
to react to cyber hygiene focused
events; e.g. sabotage reporting,
privilege escalation, security perimeter
breaches, etc. However, a response
team may need visibility into the
cascading consequences caused by
network or system outages on critical
infrastructure and may need to
understand when and how to trigger a
larger response to the unfolding event.
comprehensive and effective cybersecurity. Specifically,
experts told us that utilities focusing on achieving
minimum regulatory requirements rather than designing a
comprehensive approach to systems security. In addition,
one expert stated that security requirements are
inherently incomplete, and having a culture that views the
security problem as being solved once those requirements
are met will leave an organization vulnerable to cyber
attack. Consequently, without a comprehensive approach
to security, utilities leave themselves open to unnecessary
risk.” United States Government Accountability Office,
Electricity Grid Modernization Progress Being Made on
Cybersecurity Guidelines, but Key Challenges Remain to be
Addressed (Report to Congressional Requesters), GAO-11-
117 (Washington, DC: U.S. Government Accountability
Office, January 2011), 23,
http://www.gao.gov/products/GAO-11-117.
8
http://www.nerc.com/files/CIP-009-3.pdf
9
Computer Security Incident Response Capability (CSIRC)
or team (as defined within NIST Special Publication 800-
61)

3. 3
Alignment of the CIP-009 plan with other
planning documents may be a prudent
objective; e.g. integration with the
Emergency Operations Plan (governed
by yet another BES standard, the EOP-
001 Emergency Operations Planning10
standard).
Incident management system (IMS) a
more fully integrated approach
The National Infrastructure Protection
Plan (NIPP) Energy Sector Specific Plan
(2010) states as a goal the need to
achieve “comprehensive emergency,
disaster, and continuity of business
planning”11
.
Severe incident response can be
managed with an incident management
system (IMS) to “direct, control, and
coordinate response and recovery
operations.”12
An approach endorsed by Congress13
and the U.S. Department of Homeland
Security14
is contained in the National
Fire Prevention Association (NFPA)
Standard 1600 (Disaster/Emergency
Management and Business Continuity
Programs); quoted in relevant part:
10
http://www.nerc.com/files/EOP-001-0_1b.pdf
11
2010 Energy Sector-Specific Plan, Page 8
12
National Fire Protection Standard 1600, Standard on
Disaster/Emergency Management and Business Continuity
Programs.
13
Intelligence Reform and Terrorism Prevention Act of
2004
14
June 2010, DHS Secretary Napolitano formally adopts
NFPA 1600 as a standard.
“..An IMS is designed to enable effective
and efficient domestic incident
management by integrating a
combination of facilities, equipment,
personnel, procedures, and
communications operating within a
common organizational structure…”
An IMS creates a response structure
that can respond to dynamic conditions
associated with severe incidents. It
represents a doctrine and set of
principles to organize response activities
and capabilities.
Summary
Cyber-centric response activities can be
integrated within an IMS approach to
guide the creation of a holistic capability
that can respond to severe incidents.
NFPA 1600 may provide private and
public operators with the guidance they
need to integrate cyber-response plans
into a holistic response framework.
About the author: Dave Sweigert is a
Certified Information Systems Security
Professional, Certified Information
Systems Auditor, Project Management
Professional and holds Master’s
degrees in Information Security and
Project Management. He is a
practitioner of IMS principles in his role
as a volunteer Emergency Medical
Technician and has attended more than
500 hours in IMS related training. He
specializes in assisting organizations in
institutionalizing NFPA 1600 into their
cyber response plans.