Securing Networked Infrastructure for the Energy Sector

Accelerating Grid Modernization
More information available on SGIP.org
Securing Networked Infrastructure
for the Energy Sector
November 13, 2014

INTRODUCTION
Tanya Brewer, Senior Information Technology Researcher
National Institute of Standards & Technology (NIST)
SGIP Smart Grid Cybersecurity Committee (SGCC)
Nov. 13, 2014 Securing Networked Infrastructure for the Energy Sector

Smart Grid Interoperability Panel
orchestrates the work
behind power grid
modernization

• Optimizes resources and time
• Avoids proprietary vendor lock-in
• Helps build technology roadmaps
• Simplifies decision making
SGIP Reduces Risks and Costs
SGIP is a collaborative, transparent, and
trusted forum to share standards
information and practical, hands-on
knowledge about deployments from
industry experts.

Agenda
• Introduction Tanya Brewer
• Main Presentation Jim McCarthy
• Q&A
• Closing Tanya Brewer
This meeting, and all SGIP activities, are governed by SGIP By-laws and policies - Intellectual Property Rights Policy and Antitrust Policy.

Securing Networked Infrastructure for
the Energy Sector
Jim McCarthy
National Cybersecurity Center of Excellence
SGIP Webinar
November 13, 2014

ABOUT THE NCCOE

8
STRATEGY
Vision
‣ A secure cyber infrastructure that inspires technological innovation
and fosters economic growth
Mission
‣ Collaborate with innovators to provide real-world, standards-based
cybersecurity capabilities that address business needs

9
TENETS
Standards-based
Modular
Usable
Repeatable
Open and transparent
Commercially available

10
APPROACH
We seek problems that are:
‣ Broadly relevant
‣ Technology-based
‣ Addressable with multiple commercially available technologies

11
REFERENCE DESIGNS
Use cases
‣ Sector-specific challenges
‣ Identified through industry engagement
Building blocks
‣ Technology-specific challenges
‣ Identified through public engagement

12
MODEL
Engage
‣ Work with community of interest to define problem
Explore
‣ Map security characteristics to standards, controls and best practices
‣ Circulate drafts and incorporate feedback
Partner
‣ Invite technology vendors to collaborate in our labs
Build
‣ Collaborate on design components
‣ Incorporate feedback from experts in technology community
Show
‣ Demonstrate reference designs

13
MODEL
Form small community
of interest
Provide input and
feedback to NCCoE
Expand
community
of interest
Submit feedback
on use cases to
NCCoE
Offer insights
on use cases
Community
Of Interest
Support deployment, revision and
maintenance of products as part of the
practice guide
Collaborate to develop reference
designs
Evangelize on behalf
of reference design
and practice guide
Deploy, test and
provide feedback on
the reference design
Provide regular feedback on use case builds
Technology
Partners
Submit letters
of interest
Speak at
sector-
specific events
Work with
COI to identify
cybersecurity
challenges
Host
sector-
specific
workshop
Review &
circulate
pre-release
use cases
Revise &
publish
draft use
cases
Revise use
cases &
invite
participation
from
technology
partners
Receive
technology
partners
letters
of interest
Demonstrate
reference designs
Discuss
improvements &
modifications
Publish
reference
design and
practice
guide
Develop
composed
reference
design
Form
build
teams
Sign
CRADAs
Host
partner day

14
CORE PARTNERS

IDENTITY AND ACCESS
MANAGEMENT

16
OVERVIEW
Goals
‣ Authenticate individuals and systems
‣ Enforce authorization control policies
‣ Unify IdAM services
‣ Protect generation, transmission and distribution
Business value
‣ Reduce costs
‣ Increase efficiency

17
DESIRED SOLUTION CHARACTERISTICS
‣ Authentication
‣ Authorization
‣ Access control
‣ Federation
‣ Provisioning
‣ Do not break the grid

18
EXAMPLE COMPONENT LIST
‣ Services for authenticating and authorizing users based on identity, role,
third-party affiliation (e.g., federation) or other attributes (e.g., attribute based
access control)
‣ Services for authenticating and authorizing devices
‣ Identity and access governance capability that translates human-readable
access needs into machine-readable authorizations
‣ Services for whitelisting applications

19
‣ ICS equipment, such as remote terminal units (RTUs), programmable logic
controllers (PLCs) and relays, along with associated software and
communications equipment (e.g., radios, encryptors)
‣ Physical access control devices that use standard communication
interfaces
‣ Security incident and event management (SIEM) or log analysis software
for monitoring access management events
‣ “Bump-in-the-wire” devices for augmenting OT with authentication,
authorization, access control, encrypted communication and logging
capabilities

20
SILOS
IT network OT network Physical system

21
THE IT-OT DIVIDE

22
COLLABORATORS

NEXT STEPS

24
NEXT STEPS
NCCoE:
‣ Finalize build architecture
Users and other interested parties:
‣ Participate in a use case community of interest

SITUATIONAL AWARENESS

26
OVERVIEW
Goals
‣ Improve OT availability
‣ Unify visibility across silos
‣ Detect anomalous conditions and remediate them
‣ Investigate events leading to anomalies and share findings
Business value
‣ Improves ability to detect security breaches or anomalous behavior
‣ Increases probability that investigations of attacks or anomalous system
behavior will reach successful conclusions
‣ Improves accountability and traceability
‣ Simplifies regulatory compliance

27
‣ Data visualization and analysis capabilities that help dispatchers
and security analysts view control system behavior and network
and physical security events as a cohesive whole
‣ Analysis and correlation capabilities that help dispatchers and
security analysts understand and identify security events and
predict how those events might affect control system operation
‣ Scalability sufficient to meet the needs of a large metropolitan
utility
‣ Mechanisms that ensure the accuracy and integrity of data
collected from remote facilities
‣ Ability to collect logs, traffic and operational data from a variety of
sources including servers, ICS equipment, networking
equipment, security appliances, issue tracking systems and
mobile devices

28
‣ Ability to allow dispatchers and security analysts to easily
automate common and repetitive investigative tasks
‣ Built-in information sharing capabilities that allow dispatchers
and security analysts to easily share and acquire new threat
indicators, correlation rules, mitigations and investigative
techniques
‣ Customizable interfaces that allow users to tailor the system
to meet specific business needs
‣ Automated report generation to aid utilities in demonstrating
compliance with relevant standards
‣ Intuitive user interfaces that are appropriate for utility
dispatchers with limited network security expertise or security
analysts with limited expertise in electric power

29
‣ ICS equipment, such as RTUs, PLCs and relays, along with
associated software and communications equipment (e.g.,
radios, encryptors)
‣ SIEM or log analysis software
‣ “Bump-in-the-wire” devices for augmenting OT with encrypted
communication and logging capabilities
‣ Software for collecting, analyzing, visualizing and storing
operational control data (e.g., historians, outage management
systems, distribution management systems, human-machine
interfaces)
‣ Products that ensure the integrity and accuracy of data
collected from remote facilities

31
NEXT STEPS
NCCoE:
‣ Invite vendors to submit letters of interest that will result in CRADAs
Users and other interested parties:
‣ Participate in a use case community of interest

Next
energy_nccoe@nist.gov240-314-6800
9600 Gudelsky Drive
Rockville, MD 20850
http://nccoe.nist.gov

QUESTIONS?

Cybersecurity Update
• Cloud Computing Considerations in the Smart Grid has now
been published for SGIP Members to view and download.
– http://members.sgip.org/apps/org/workgroup/sgip-
mmc/download.php/5953/latest
– Available to public in February 2015.
• Other resources at SGIP.org/Publications
– Framework for Improving Critical Infrastructure Cybersecurity
Core Mapping to National Institute of Standards and Technology
(NIST) Interagency Report (IR) 7628 Exclusive to Members
– Cybersecurity User's Guide (NISTIR 7628) - Smart Grid Cyber
Security Implementation Guidelines 30 pages
• Information on the SGIP Smart Grid Cybersecurity
Committee may be found at SGIP.org/SGCC

SGIP Reminders
• Next week on November 20: Another Free Webinar – “What’s
New with the Interoperability Process Reference Manual?” and
the Smart Grid Testing & Certification Committee
• December 8-9: Winter Members Meeting in Portland
– Conference on Transactive Energy also in Portland that week.
• Webinars & Publications on SGIP.org under “Information
Knowledge Base”
• Stay in Touch
– Twitter: @SGIPNews
– Join our LinkedIn Group: https://www.linkedin.com/groups/Smart-
Grid-Interoperability-Panel-SGIP-4145498
– Sign up for SGIP Newsletter, The Conductor

THANK YOU FOR YOUR PARTICIPATION
A FOLLOW-UP EMAIL WILL BE SENT WITH LINK TO
RECORDING AND SUPPORTING MATERIALS

Securing Networked Infrastructure for the Energy Sector

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (8)

Similar to Securing Networked Infrastructure for the Energy Sector

Similar to Securing Networked Infrastructure for the Energy Sector (20)

More from Smart Grid Interoperability Panel

More from Smart Grid Interoperability Panel (6)

Recently uploaded

Recently uploaded (20)

Securing Networked Infrastructure for the Energy Sector