Seven Strategies to Defend Industrial Control Systems (ICS)

In December 2015 the US National Cybersecurity and Communications Integration Center (NCCIC) -- often referred to as "EN-KICK" -- published a highly readable and brief white paper on Seven Strategies to Defend ICSs.  

This 7-page pdf offers a useful list of seven strategies a company can follow to better protect its industrial control systems.

Not only do they offer a quick, one or two paragraph description of the actions to be taken, but they also offer quick examples of events that could have been possibly prevented if the advice were followed.

The Seven Strategies include:

1. Implement Application Whitelisting
2. Ensure Proper Configuration/Patch Management
3. Reduce Your Attack Surface Area
4. Build a Dependable Environment
5. Manage Authentication
6. Implement Secure Remote Access
7. Monitor and Respond

RECOMMENDATION -- SHOW THIS TO YOUR BOARD OF DIRECTORS AND EXECUTIVE MANAGEMENT -- IT IS AN EASY READ AND MAKES A POINT THAT SECURITY OF ICS SYSTEMS NEEDS TO BE IMPLEMENTED.

###

CRS Insight - Electric Grid Physical Security: Recent Legislation (US)

(Another Hat Tip to our friends at the Federation of American Scientists for posting this CRS document!)

Last week a two-page summary of recent US government legislation focused on electric grid physical security was prepared by Paul W. Parfomak of the Congressional Research Service (CRS).

http://fas.us8.list-manage.com/track/click?u=33c6e6fc9f63792ebcbb7ef9d&id=9c0cfe0fff&e=d0dc8ca93c

The document is a quick read. Besides summarizing the Federal Energy Regulatory Commission (FERC)) / North American Electric Reliability corporation (NERC) efforts on the CIP-014, Physical Security Reliability Standard, the document summarizes some interesting electric grid physical security elements in the Fixing America's Surface Transportation (FAST) Act - P.L. 114-94 and the Energy Policy Modernization Act of 2015 - S. 2012.

Fixing America's Surface Transportation (FAST) Act - P.L. 114-94

• Became law on December 4, 2015
  
• Contains provisions in two sections to facilitate recovery during electric grid emergencies due to physical damage and other causes.
  
• Critical Electric Infrastructure Security (§1104) -- This section provides the Secretary of Energy additional authority to order emergency measures to protect or restore the reliability of critical electric infrastructure or defense critical electric infrastructure during a grid security emergency.  The identification of such a grid emergency would be made by written notice from the President with a concurrent notification from Congress.  This section also allows a) grid owners to recover prudent costs incurred under such emergency measures through rates regulated by FERC, and b) increases protection of critical electrical infrastructure information.
  
• Strategic Transformer Reserve (§1105) -- This section requires the Secretary of Energy -- in consultation with other agencies, the military, and the utility industry -- to submit to Congress within one year a plan for a Strategic Transformer Reserve.

Energy Policy Modernization Act of 2015 - S. 2012

• Includes two sections primarily directed at electric grid cybersecurity but with potential impacts on physical asset protection or recovery.
  
• Cybersecurity Threats (§2001) -- Would provide the Secretary of Energy additional authority to order emergency measures to avert or mitigate a cybersecurity threat upon receiving notice from the President that such a threat exists.  This section is also intended to increase protection of critical electrical infrastructure information.
  
• Cybersecurity Threats (§2002) -- This section would designate the Department of Energy (DOE) as the lead Sector-Specific Agency under Presidential Policy Directive 21 for energy sector cybersecurity.  This bill would require a) DOE to develop a program for modeling and assessing energy infrastructure risks in the face of natural and human-made (physical and cyber) threats, b) DOE to explore alternative structures and funding mechanisms to expand industry participation in the Electricity Information Sharing and Analysis Center (E-ISAC).

Thanks again to Mr. Parfomak for this CRS Insight.

###

CRS Report - Data Security & Breach Notification Legislation: Selected Legal Issues

Thanks to our friends at the Federation of American Scientists, the recently issued Congressional Research Service (CRS) report entitled Data Security and Breach Notification Legislation: Selected Legal Issues has been made available.

https://www.fas.org/sgp/crs/misc/R44326.pdf  (21 Pages)

This is a focused report providing a review of the following:

• Proposed Legislation introduced in the 114th Congress on Data Security and Breach Notification
• Discussion about State Data Breach Laws (very brief)
• Legal Analysis of:
• Preemption of State Laws, Regulations, and Claims should Federal Law(s) be Passed in this Area
• Agency Enforcement of Data Security and Breach Notification Requirements

Some interesting takeaways from this report:

1) 47 US States, the District of Columbia, and three US territories (Guam, Puerto Rico, US Virgin Islands) have enacted data security laws.

2) Alabama, New Mexico, and South Dakota have not enacted breach notification laws.

3) Massachusetts has issued regulations requiring persons who own or license personal information about a Massachusetts resident to "...develop, implement, and maintain a comprehensive information security program..." (201 Mass. Code Regs. 17.03(1))  Such a program must be in writing and contain administrative, technical and physical safeguards appropriate to the size and type of business, available resources, and amount of stored data.  Businesses must also conduct an annual review of security measures.

4) (Excerpt on Federal Preemption of State Data Security Laws - Page 15 )

5) (Excerpt on Agency Enforcement - Page 19)

Overall, this is an interesting read on the implications of possible Federal legislation in the domain of data breach laws primarily addressed by US state laws.

###

Self-Development for Cyber Warriors

Because of my 15+ years in cyber security and roles in cyber security management I am often asked about career development and ideas on ways to advance their positions to CISO-level jobs.  I often suggest looking at certifications and experience as being the best starting points; however, I recently came across a really useful document from the Small Wars Journal written by Gregory Conti, James Caroland, Thomas cook and Howard Taylor.

http://smallwarsjournal.com/sites/default/files/893-conti.pdf

In 2011, Conti, et al wrote Self-Development for Cyber Warriors (screen shot above).  You can download the full article at http://smallwarsjournal.com/sites/default/files/893-conti.pdf .

Although this is intended for current military personnel advancing in the US Cyber Command there are many good -- no, EXCELLENT -- ideas written down to guide someone to becoming a smarter and more valuable cyber security professional.

Some key elements of this 34-page document include:

• Key Categories of Cyber Expertise
• Professional Reading (Books, Sci-fi)
• Technology News, Magazines and Blogs
• Cyber Warfare Journal and Magazine Articles
• Doctrine and Policy
• Professional Societies and Local Gatherings
• Academic, Military, Government and Hacker Conferences
• Videos and Podcasts
• Movies
• Training, Education, Certification and Self-Study

Starting on page 26 the authors provide five different "Self-Development Roadmaps" for military officers and NCOs in different stages of their cyber careers.  Regardless of the focus on the military career elements, the Roadmaps offer some great ideas for the new cyber student up to the more seasoned cyber expert.  You may want to look over the Roadmaps for ideas and then build your own.

Lastly, Table 12 offers a "heat map" if you will of various topics and based on which Cyber Workforce you are in (or want to be in) you can gauge the importance of various sectors and areas of specialization.  An excerpt of the table is included below:

Overall, I wish I had this resource when I was just starting out in the field.  And, even though this was written in 2011, the guidance is timeless and can provide a super foundation for your and your cyber-co-workers' career growth.

Well done to Messrs. Conti, Caroland, Cook and Taylor!  Thanks for the contribution to the cyber society!

###

Control Engineering 2015 Cyber Security Study

Yesterday I posted a review of the recent SANS State of Industrial Control Systems Survey.  You can find that posting here.

Today I'd like to tell you about another interesting and equally disconcerting survey about the status of today's industrial control system security posture.

Each year Control Engineering Magazine conducts a survey of its readers to evaluate cyber security implementation, resources and training for industrial control systems.  Their 2015 Cyber Security report was issued this June.  A summary of the study posted by Control Engineering is located here.

The Control Engineering report is essentially in presentation format and has a collection of graphs and data relative to the data collected.  It is a pretty easy and quick read and offers similar data to the SANS Survey.

Statistics and Findings

The Control Engineering analysis included data collected from 284 respondents in the first quarter of 2015.  The report includes the following summary findings:

1.  Threat Levels:  47% of respondents perceive their control systems to be "moderately" threatened by cyber attacks.  25% say theirs is "highly" threatened and 8% are at the "severe" threat level.

2.  Most Concerning Threat:  Their responses included:

• 35% view the most concerning threat is malware from a random source
• 18% worried about loss of intellectual property
• 8% fear attacks from "hacktivists" with political or environmental agendas.

3.  Most Vulnerable System Components:  The components of most concern include:

• Connections to other internal systems (SANS is similar)
• Computer assets running commercial operating systems (Same as SANS)
• Network devices
• Wireless communication devices and protocols
• Connections to the field SCADA networks

4.  Vulnerability Assessments:  39% of those surveyed said their last vulnerability assessment was performed within the last six months (Good!); while 16% have never executed one (Not So Good).

5.  Publicly Reporting Incidents:  66% of those surveyed say publicly reporting cyber-related incidents would benefit the industry.  36% agree that the biggest problem with public reporting is the fear of losing consumer confidence.

6.  Resources Used to Monitor Control System Cyber Security Events:

• Anti-virus software (99%)
• Network logs (89%)
• Firewall logs (89%)
• Intrusion Detection/Prevention (84%)
• Whitelisting (76%)

Overall....

Overall this is a useful survey to examine and as I noted for the SANS ICS Security Survey, these reports should be reviewed and digested by security professionals responsible for ICS security and shared with their executive management to show them that security is a concern and should be theirs, too.

###

New ICS Primer from ISACA

Industrial Control Systems (ICS) security continues to gain momentum and awareness in the cyber community.  ISACA has recently published its own version of ICS security awareness (cover of the document is below).

ISACA has published Industrial Control Systems: A Primer for the Rest of Us which can be obtained for no charge (registration is required) at www.isaca.org/ics 

If you are not familiar with ISACA (www.isaca.org) it has been around since 1969 and has about 115,000 constituents in 180 countries.  You may recognize ISACA as supporting COBIT and also the Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) certifications.

As you glance through the 19-page document you will recognize most of the graphics used come from either NIST 800-82, Guide to Industrial Control Systems (ICS) Security by Keith Stouffer, et al, or adapted from the ICS-CERT Advisories located at: https://ics-cert.us-cert.gov/advisories-by-vendor

One graphic that I especially liked was on page 13, Figure 7, showing a mind-map of Cybersecurity Threat Agents developed by our friends at the European Union Network and Information Security Agency (ENISA).  A copy of the graphic is below and can also be located at http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-threat-landscape/enisa-threat-landscape-2014

So, the good news is we have another primer to pass along to our bosses and IT managers/technicians  to help them better understand what ICS security involves.  There are a few good ideas in the document such as a list of ICS Components (Pages 4-5) and other references back to the NIST 800-82 document for more details.

###

Cyberwarfare and Cyberterrorism - Excellent CRS Report

In my life in security I try to monitor several topics.  Two topics I'm often checking -- usually through Google News Alerts -- are cyberwarfare and cyberterrorism.  This week I came across an excellent summary report from the Congressional Research Service on this very topic.

This 12-page summary document is an excellent overview of these topics and also provides some comparisons between cyberterrorism, cybercrime, cyberespionage, cyberwarfare, and cybervandalism.

The document can be downloaded at: http://fas.org/sgp/crs/natsec/R43955.pdf 

A high level view of the key headings in the document (below) will give you a view of the document and its contents.

• Executive Summary
• Introduction
• The Cyberwarfare Ecosystem: A Variety of Threat Actors
• Cyberwarfare
• Rules of the Road and Norm-Building in Cyberspace
• Law of Armed Conflict
• Council of Europe Convention on Cybercrime
• United Nations General Assembly Resolutions
• International Telecommunications Regulations
• Other International Law
• Cyberterrorism
• Use of the Military: Offensive Cyberspace Operations

Overall, this is an excellent and fairly rapid read on this contemporary subject and I'd recommend it be viewed by students, policy makers and all cybersecurity professionals.

###

Executive Order Promoting Private Sector Cyber Info Sharing

On February 13, 2015 -- a year plus one day after the President's Executive Order directing NIST to build the new Cybersecurity Framework -- President Obama issued an Executive Order entitled Promoting Private Sector Cybersecurity Information Sharing.

There are seven sections to the four-page Order including:

1. Policy
2. Information Sharing and Analysis Organizations (ISAO)
3. ISAO Standards Organization
4. Critical Infrastructure Protection Program
5. Privacy and Civil Liberties Protections
6. National Industrial Security Program
7. Definitions

Policy

The fundamental aspect of the EO is to emphasis that "...entities must be able to share information related to cybersecurity risks and incidents and collaborate to respond in as close to real time as possible."  

The EO also notes that information sharing must:

• ...be conducted in a manner that protects the privacy and civil liberties of individuals
• ...preserves business confidentiality
• ...safeguards the information being shared, and
• ...protects the ability of the Government to detect, investigate, prevent and respond to cyber threats...

Certainly commendable policy and something the industry has needed/wanted for years.

Information Sharing and Analysis Organizations (ISAOs)

The Order directs the Secretary of the Department of Homeland security to "...strongly encourage the development and formation of..." ISAOs.

The Order offers some details on how the ISAOs should be organized and how their membership can draw on public or private sectors, and offers the option for the ISAOs to be formed as for-profit or nonprofit entities.

The National Cybersecurity and Communications Integration Center (NCCIC) is ordered to engage in "...continuous, collaborative, and inclusive coordination with ISAOs on the sharing of information..."

ISAO Standards Organization

The Secretary of DHS is orderd to "...enter into an agreement with a nongovernmental organization to serve as the ISAO Standards Organization (SO), which shall identify a common set of voluntary standards or guidelines for the creation and functioning of ISAOs under this order."

Observations and Questions

It is commendable that President Obama has stepped forward -- again -- to help raise awareness and take action relative to the issue of cyberthreats to our country, economy and its businesses and citizens.  However, a question continues to be raised with this Executive Order.  That question really is ... "Aren't we already doing this with Information Sharing and Analysis Centers (ISACs)?"

ISACs have been around since May 1998 and were established under the auspices of Presidential Decision Directive 63 (PDD-63) signed by President Clinton.  If you look at the National Council of ISACs website you will note that the definition of an ISAC is:

ISACs are trusted entities established by Critical Infrastructure Key Resource (CI/KR) owners and operators to provide comprehensive sector analysis, which is shared within the sector, with other sectors and with the government. ... Services provided by ISACs include risk mitigation, incident response, alert and information sharing.  The goal is to provide users with accurate, actionable, and relevant information.

And in another white paper on the subject, a description of an ISAC includes the following:

By definition, an ISAC is a trusted, sector-specific entity which performs the following functions: 

• provides to its constituency a 24/7 secure operating capability that establishes the sector’s specific information sharing/intelligence requirements for incidents, threats and vulnerabilities; 
• collects, analyzes, and disseminates alerts and incident reports to it membership based on its sector focused subject matter analytical expertise; 
• helps the government understand impacts for its sector; 
• provides an electronic, trusted capability for its membership to exchange and share information on cyber, physical and all threats in order to defend the critical infrastructure; and 
• share and provide analytical support to government and other ISACs regarding technical sector details and in mutual information sharing and assistance during actual or potential sector disruptions whether caused by intentional, accidental or natural events. 

Isn't an ISAC filling part of the role of the ISAO discussed in the Executive Order?  Can't ISACs continue with their current roles and capture the essence and elements of the Executive Order?

The idea of establishing a new bureaucracy and hierarchy of ISAOs that essentially parallel the current ISAC structure and functions does not appear to be very efficient and could lead to more confusion, increased bickering and "turf wars" and finally not help or encourage effective information sharing to better protect our country, economy, businesses or citizens.  At a minimum it is highly recommended that the Department of Homeland Security take time to compare the efforts of the ISACs to the Executive Order and build upon current efforts and not try to push through a distracting, parallel effort.

###

ENISA Publishes Cyber Threat Analysis of 2014

Our friends at the European Union Agency for Network and Information Security (ENISA) has published the ENISA Threat Landscape 2014 on 27 January 2015.  The report includes some details on developments made in 2014 relative to the top cyber threats and emerging threat trends - mainly in the cyber arena.

You can download a copy of the report (Free) at:  http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-threat-landscape/enisa-threat-landscape-2014

From the Executive Summary of the report, below are some of the "positives and negatives" of today's cyber threat landscape from ENISA's point of view.

Many of the changes in the top threats can be attributed to successful law enforcement operations and mobilisation of the cyber-security community (bolding by Ernie Hayden):

• The take down of GameOver Zeus botnet has almost immediately stopped infection campaigns and Command and Control communication with infected machines.
• Last year’s arrest of the developers of Blackhole has shown its effect in 2014 when use of the exploit kit has been massively reduced.
• NTP-based reflection within DDoS attacks are declining as a result of a reduction of infected servers. This in turn was due to awareness raising efforts within the security community.
• SQL injection, one of the main tools used to compromise web sites, is on the decline due to a broader understanding of the issue in the web development community.
• Taking off-line Silk Road 2 and another 400 hidden services in the dark net has created a shock in TOR community, both at the attackers and TOR users ends.

But there is a dark side of the threat landscape of 2014:

• SSL and TLS, the core security protocols of the internet have been under massive stress, after a number of incidents have unveiled significant flaws in their implementation .
• 2014 can be called the year of data breach. The massive data breaches that have been identified demonstrate how effectively cyber threat agents abuse security weaknesses of businesses and governments.
• A vulnerability found in the BASH shell may have a long term impact on a large number of components using older versions, often implemented as embedded software.
• Privacy violations, revealed through media reports on surveillance practices have weakened the trust of users in the internet and e-services in general.
• Increased sophistication and advances in targeted campaigns have demonstrated new qualities of attacks, thus increasing efficiency and evasion through security defences.

The report does include a summary table of trends (Page 4) that the reader may find useful.  A copy of the table is shown below with some highlights on the areas declining and a note about ransomware.

Lastly, one area the report raises as a new focus is "Cyber-Physical Systems."  These are engineered systems that interact with computing equipment and integrated to control, manage and optimize physical processes.  The areas they mention of concern are power supply, medical systems/healthcare, industrial systems and manufacturing, transportation, telecommunication, etc.  The report includes a table (below) of the Top Emerging (Preliminary) Threats to CPS (Page 67):

Overall, the report is of excellent quality and is a useful summary of the cyber issues of 2014.

###

History of Industrial Controls Cybersecurity -- White Paper

Several months ago Mike Assante -- SANS project lead for Industrial Control
System (ICS) and Supervisory Control and Data Acquisition (SCADA) security -- and I were talking about some ideas for SANS Analyst white papers and an idea surfaced to prepare a white paper introducing the SANS reader to elementary industrial controls theory and to the chronology of ICS cybersecurity.

The paper has finally been posted at SANS and the link is:  http://ics.sans.org/media/An-Abbreviated-History-of-Automation-and-ICS-Cybersecurity.pdf 

Overall it was a fun paper to research and write with some good stories about the first Programmable Logic Controllers (PLCs).  Also, the chronology built by Mike Assante and Tim Conway and included in the paper is a great way to get oriented to the challenges in this domain which are broader than Stuxnet.

Enjoy!

###

Fundamental Skills for Any Security Practitioner

As a consultant, teacher and author I am often asked about the key knowledge, skills and certifications required to be a "successful" CISO or security professional.  The questions are usually around such issues as "Should I get my CISSP or CISM?" etc.

My usual response is often focused on having the "fundamentals" down pat such as understanding the business and having strong communication skills -- especially with upper management and the groups you are supporting.

This past quarter in my Masters of Infrastructure Planning and Management at the University of Washington one of our assigned readings was in my Comprehensive Emergency Planning course (IPM501).  The reading was entitled, "Report of the 2013 Disciplinary Purview Focus Group: Scholarship and Research to Ground the Emerging Discipline of Emergency Management."

Sounds dull, doesn't it?

The report was written by a group of scholars studying the field of emergency management.  Their focus "...was to identify the body of scholarship and research related to emergency management's purview that could ground the discipline, particularly as it relates to the education of students."

The report had some interesting perspectives on the subject; however, my key takeaway -- and worthy of me spending time on this blog -- is Appendix J: Skills Emergency Management Students Should be Able to Demonstrate upon Graduation.

This Appendix lists the following skills -- of which I think any security professional should also have competence:

• Verbal Communication
• Written Communication
• Interpersonal Communication
• Group Communication
• Network Building and Stakeholder Engagement
• Analytical Thinking
• Application of Research in Practice
• Problem Solving
• Decision Making
• Leadership

So, to my friends, students and colleagues who ask me "What skills do I need to possess to be successful in the security field?"  The list to follow is above.....then work on your technical skills such as a CISSP, etc.

Thanks to my professor, Robert Schneider Ed. D. and Director of Emergency Management for Grant County, Washington for this reading requirement...Appendix J made it worth the read.

###

Must Read for CyberWar Students and Spectators

I've just returned from an interesting and exhausting ICS security trip to Nigeria, Egypt and Dubai --- and as I was catching up on my reading I came across an excellent and well-written article regarding nation-state attacks on our critical infrastructure.  Kudos to Mike Riley and Jordan Robertson of Bloomberg!

The article in Bloomberg is UglyGorilla Hack of U.S. Utility Exposes Cyberwar Threat.

Rather than resummarize the article I'd strongly suggest you read it and think about the implications of the content.

It is pretty ugly.

Anyone who thinks we are ahead of the cyber attackers/criminals is sadly mistaken.

As noted by Representative Mike Rogers, R-Michigan: "This is as big a national security threat as I have ever seen in the history of this country that we are not prepared for."

Read and ponder....

###

NIST SP800-82 Rev 2 - Guide to ICS Security -- Comments Requested

Last week the National Institute of Standards and Technology (NIST) published the initial public draft of Special Publication 800-82, Revision 2, Guide to Industrial Control Systems (ICS) Security.  This particular revision to the highly popular 800-82 versions 0 and 1 is a positive step change in the volume of information contained in the document.

In summary -- and extracted from page iv of the 255-page report -- the updates to this revision include:

• Updates to ICS threats and vulnerabilities
• Updates to ICS risk management, recommended practices, and architectures
• Updates to current activities in ICS security
• Updates to security capabilities and tools for ICS
• Additional alignment with other ICS security standards and guidelines

The report also has added new tailoring guidance for NIST SP800-53, Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, security controls including the introduction of overlays.  Also, the report has added an ICS overlay for NIST SP800-53, Rev $, security controls that provides tailored security controls for Low, Moderate, and High impact ICS.

As a member of the Industrial Controls Security Joint Working Group (ICSJWG) Standards Committee I had the opportunity to review chapter 3, "ICS Risk Management and Assessment," which is a new expansion from the earlier versions.  This chapter alone provides some expanded views of the risks posed by ICS environments.

Appendix C, "Threat Sources, Vulnerabilities and Incidents," is a useful compilation of text and tables covering such topics as ICS Threat Sources, Vulnerabilities and Predisposing Conditions, System Vulnerabilities and a list of documented incidents.

Of note, Appendix F, "References," is an excellent list of 80 different references not only used in developing the document but also would be an excellent resource for the ICS security student or practitioner. However, I am a bit surprised and disappointed that Eric Knapp's Industrial Network Security book was not included since it is one of the best resources published on this topic.

Call to Action

First, if you are interested in Industrial Controls Security, download this new version and put it on your reference shelf for your ICS projects.  It is free and provides even more insight into the ICS arena.

Secondly, if you are an IT Security instructor be sure to show this to your students and perhaps include ICS security as part of your curriculum.  SP800-82 would be an excellent textbook and again it is no charge except for the cost to print.

Thirdly, SP800-82 R2 is out for public comment until July 18, 2014.  If you are so inclined take some time to read the new document and offer your comments via email at nist800-82rev2comments@nist.gov or you can mail them to:

National Institute of Standards and Technololgy

Attn: Computer Security Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8930)

Gaithersburg, MD  20899-8930

Thanks again and happy reading!

 

Two Views of Today's Cyber Risks

This week I've had the chance to view two reports that gave me -- and I expect others -- a powerful view of the cyber challenges we face.  One report was a global view our reliance on the Web and the "...increasing danger of global shocks initiated and amplified by the interconnected nature of the internet."

The second article was a survey done by Control Engineering magazine on the global views of cyber security of the industrial controls domain.  The survey revealed that almost 50% of the respondents perceive the control system threat in their organizations to be at a moderate level, but 25% cite a "high" or "severe" threat level in their systems.

So, rather than provide detailed reviews of each document, let me help aim you to the appropriate links with some summary notes added:

Risk Nexus - Beyond Data Breaches: Global Interconnections of Cyber Risk -- Zurich and Atlantic Council

(LINK) 

This well-written report (30 pages) consistently raises the bar of the global risk relative to our reliance on the Internet and ecommerce in a manner similar to the annual World Economic Forum's Risk Reports.  Perhaps we are so closely connected to the Internet that we put our selves in harm's way relative to our economic -- and maybe even mental well being (?).

One quote that I find especially telling is:

"The internet of tomorrow will both initiate and amplify global shocks in ways for which risk managers, corporate executives, board directors, and government officials may not be adequately prepared."

Finally, take a look at Page 8 of the report...they include 7 aggregations of cyber risk that certainly made me think:

1. Internal IT enterprise (hardware, software, servers, and related people and processes)
2. Counterparties and partners (relationship between competing/cooperating entities, etc.)
3. Outsourced and contract (IT and cloud providers, contract manufacturing)
4. Supply chain (Exposure to a single country, counterfeit or tampered products, risks of disrupted supply chain)
5. Disruptive technologies (internet of things, smart grid, embedded medical devices, driverless cars...)
6. Upstream infrastructure (submarine cables, internet governance and operation)
7. External shocks (major international conflicts, malware pandemics)

At a minimum I'd suggest you pass this report to your Board of Directors and Executive Management so they get a sense of another view of risks that need to be addressed and mitigated.


Control Engineering Cyber Security Study - April 2014 (Registration Required)

(LINK)

Compliments to the Director of Research for Control Engineering, Ms. Amanda McLeman and her colleague Mark Hoske for this summary report.  The report is based on a survey of about 190 respondents from February 7 to March 2, 2014.  So the data is fairly contemporary.

This summary report is a collection of graphs showing the demographics of the respondents as well as the summary results of the questions.

A good summary graph of the Threats considered by the respondents is below:

If you cannot adequately read the graphic above the top three system components the respondents are most concerned about are:

1. Computer assets that are running commercial operating systems
2. Connections to other internal systems
3. Network devices

Finally a summary of key "bullets" from the report include:

• 24% of respondents said they had NEVER performed a systems security vulnerability test
• 25% of those surveyed indicated their computer emergency response team appears well trained and capable
• 41% agreed having industry-required standards without government involvement would improve or enable their efforts to implement proper control system cybersecurity.  (So, maybe the NIST Cyber Security Framework has some hope?)

Thanks for taking the time to read my comments and have a good week!

###

New Policy Approaches to Address Cyber Threats Impacting the Electric Grid

In February the Bipartisan Policy Center released a report focused on cybersecurity and the North American Electric grid.  At first I was worried that this report would be another collection of the same ol' ideas of leaning on the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards as the panacea -- fortunately, this report is very good and really has some excellent ideas to help protect the electric grid from and during a cyber attack.

In a simple way I'd strongly suggest you skim this report if you are in any way/shape/form involved with electric grid cybersecurity defense, policy, funding or response.

The key areas of discussion in the report include:

• The Existing Landscape for Electric Grid Cybersecurity Governance
• Standards and Best Practices for Cybersecurity
• Information Sharing
• Responding to a Cyber Attack on the North American Electric Grid
• Paying for Electric Grid Cybersecurity

The report is very refreshing and offers some new ideas on ways to defend the grid and respond to cyberattacks.  

One idea that has some merit is the concept of implementing an "Institute" similar to the Institute of Nuclear Power Operations (INPO) that would focus in continuous improvement of cybersecurity of the electric grid.  I sent the following email to one of the Advisory Board members supporting this idea.  In my email I observed:

The Institute of Nuclear Power Operations (INPO) was used as a model agency for oversight of the security of the grid.  I worked at INPO from 1986 to 1992 and when I left I was the Secretary of the Corporation and an evaluation Team Manager.  

Of note, the recently published Cybersecurity Framework (CSF) has an approach very similar to INPO's.  That is the CSF is "performance-based" rather than "compliance-based" which is an approach that INPO pursued.  INPO published a document entitled Performance Objectives and Criteria for Operating and Near-Term Operating Nuclear Plants that really focused on what would be viewed as optimal performance in particular areas (e.g., management, administration, operations, maintenance, etc.) with a collection of criteria that supported the performance objectives (similar to the CSF).  However, the process was not focused on compliance to the performance objectives but instead to how the plant truly performed.

An example to demonstrate this approach would be relative to CIP-008, incident response.  The NERC approach to reviewing CIP-008 is to actually sight the utility's incident response procedure; however, they do not check to see that it actually is a workable, accurate document (i.e., are the phone numbers/email addresses accurate, can it truly be used as written, is it practiced, etc.).  On the other hand the INPO approach would be to view the document but with emphasis on watching the utility perform the incident response process and observe strengths, weaknesses, etc. and highlight areas needing improvement.

In other words the assessment was based on the true performance of the utility; not a simple view of its paperwork -- a serious flaw with the NERC approach (in my opinion).

I am very pleased with the tone, content and ideas put forth in this report and I look forward to the "new" dialogue that surfaces in this domain different from the old, stale ideas that really don't solve the problem for the entire electric grid from generator to transmission line to distribution system to the toaster in your home.

Again, compliments to the authors and advisory group on this report!

###

Useful Industrial Control Security References from ENISA

ENISA - the European Union Agency for Network and Information Security has been quietly building a collection of useful references for industrial control system (ICS) security.  Since 2011 with their publication of Protecting Industrial Control Systems.Recommendations for Europe and Member States, Dr. Konstantinos Moulianos and his staff have done a nice job facilitating development of useful publications for those of us in this domain.

What I'd like to do is to continue to tell you of the other ICS-security-related products that have been published that may be useful references for students and practitioners of ICS security.

In 2011 as ENISA was publishing the referenced document above (and shown in the photo) they also produced five separate Annexes as part of the Recommendations document.  These documents were certainly foundational to the continued expansion of the ENISA ICS Security "product line."  One document I found to be a useful introductory discussion of ICS security was the ENISA document Protecting Industrial Control Systems, Annex I: Desktop Research Results.  Similar to NIST 800-82, Guide to Industrial Control System (ICS) Security, this document is a helpful background "textbook" on the basic issues associated with ICS security, emerging issues, the challenges with securing ICS systems, and known good practices as of 2011.

Later in 2013, ENISA was very busy publishing several useful documents to aid in improving cybersecurity in Europe but of course helping the rest of the world with its guidance and studies.  In particular ENISA facilitated and funded a study on identifying ways to improve on ICS component and system testing in the EU. (I was honored to have been included in the interview process for this study.)  The result was the ENISA document Good Practices for an EU ICS Testing Coordination Capability.  This document certainly raised some awareness on how to proceed in Europe with development of an ICS testing capability but it can also be used in other nations just beginning to  examine their ICS security reviews.

One very useful desk reference that came out of the EU ICS Testing Coordination project was publication of ICS Security Related Working Groups, Standardsand Initiatives (2013).  This particular document is an excellent collection of the various global standards, guidelines and studies conducted that focus on ICS security issues.  This one is a "keeper!"

Finally, in late 2013 the ENISA team was very busy with some white papers and briefings on ICS security issues we are all facing.  The documents and their links are listed below:

• Can we learn from SCADA security incidents? (October 2013)
• Good practice guide for CERTs in the area of Industrial Control Systems - Computer Emergency Response Capabilities Considerations for ICS (Oct 2013) -- useful guide for ICS incident response
• Window of exposure… a real problem for SCADA systems? (Dec 2013) -- excellent demonstration of the challenges with often-delayed patching of ICS systems

I trust you found this an enlightening review of the ENISA ICS Security work since 2011 and I'd suggest you keep them on your mind when looking for ICS security resources and references to help improve and harden your security programs.

Focus on Information Sharing for Cybersecurity

At the end of 2013 I was invited by the NATO Energy Security Centre of Excellence to submit an article regarding the barriers to information sharing and their impact on critical energy infrastructure protection.

The actual e-zine was posted today and contains seven well-written articles by some global thought-leaders relative to information sharing, cooperation and security of the energy supply.  The e-zine can be downloaded at: this LINK.  A picture of the Table of Contents is shown below.

This is probably one of the first publications exclusively focused on the subject of information sharing for critical infrastructure protection. I'm very honored to have been invited to participate.  Of note, the conversations in this publication will be especially germane to the dialogue raised by the new release of the NIST Cybersecurity Framework this week -- especially since one of President Obama's objectives in his Executive Order was to improve and increase two-way information exchange to better protect critical assets.

Thanks for reading!

###

2014 World Economic Forum Risk Report - High and Low Lights...

Each year I look forward to reading the annual World Economic Forum (WEF) Risk Report.  The WEF has been publishing these very compelling reports for the past 9 years.  The 2014 Risk Report was published on December 31, 203 and can be found at this LINK.

This year's report maps 31 global risks according to the level of concern, likelihood and impact, and interconnections among them.  Of these risks they identify the Top 10 Risks of Highest Concern and they have also included a fascinating discussion on what they call "Digital Disintegration" which examines cyberspace and its future for the globe.

The graphic below shows the 31 global risks and their categories including how the Top 10 Risks are detailed.

Infrastructure Risks

Of course as I look at the 31 risks, I am very interested in the "critical infrastructure-centric" issues that the WEF survey participants highlighted.  My own personal "Top 10" list includes the following from the list of 31:

• Economic: Failure/shortfall of critical infrastructure
• Environmental:  Greater incidence of extreme weather events
• Environmental:  Greater incidence of natural catastrophes
• Environmental:  Greater incidence of  man-made environmental catastrophes
• Environmental:  Water Crises
• Geopolitical:  Large-scale terrorist attack
• Societal:  Mismanaged urbanization (inadequate infrastructure and supply chains)
• Technological:  Breakdown of critical information infrastructure and networks
• Technological:  Escalation of large-scale cyber attacks
• Technological:  Massive incident of data fraud/theft

Risks in Terms of Likelihood and Impact

On page 17 of this 60-page report there are two tables showing the evolving global risk landscape from 2007 to 2014 based on the World Economic Forum Global Risk Reports.  The referenced table shows a fascinating movement of risk likelihood and impact moving from economic/technological issues to more geopolitical and environmental issues.  Comparisons are shown in the graphic below:

I've starred the two of concern for both likelihood and impact -- that is in the area of cyber -- both attacks and information infrastructure breakdown.  So, in spite of the list of 31 and the top 10 risks shown above, please consider that our digital arena is at risk among the top 5 of 31 risks.

Report Section 2.4: Digital Disintegration

A quote from the report:

While cyberspace has proved largely resilient to attacks and other disruptions so far, its underlying dynamic has always been such that attackers have an easier time than defenders.  There are reasons to believe that resilience is gradually being undermined, allowing this dynamic of vulnerability to become more impactful."

Unfortunately, this quote is consistent with my past writings on "Assumption of Breach" and that the attackers have it easier than the defenders -- just remember my kitchen sieve model where the CISO needs to cover every hole with one hand yet the attackers only need one opening...ugh!

So, as noted in the WEF report cyber risks can be summarized through the acronym CHEW -- crime, hactivists, espionage and war.  However, the WEF report also notes that a large cloud provider could suffer an "...Enron- or Lehman-style failure virtually overnight."  

The report continues to note that environmental triggers could easily play a role in disintegrating our digital backbone through such events as an earthquake devastating Silicon Valley (e.g., San Andreas fault) or a solar super storm could cause major outages of national electric grids, satellites, avionics or signals from global navigation satellite systems.

Hence, our ever expanding reliance on the digital highways and systems may increase the risks to our global economy.

Finally, the WEF report goes on to note:

Increasingly, there is recognition that the growing role of cyberspace is not only a technical and geopolitical concern but also presents serious risks to economic well-being.  While failure of critical online infrastructure represents a systemic risk that could impact global growth, so does a large-scale loss of trust in the Internet.  ... Effective methods for measuring and pricing cyber risks may even lead to new market-based risk management structures, which would help in understanding the systemic interdependencies...that now depend on cyberspace.

Conclusions

As usual, the 60-page report from the World Economic Forum is full of interesting perspectives on the economic, environmental, geopolitical, societal, and technological arenas surrounding global commerce and society.  I would highly suggest you take a minute to download the report and at least page through the many points of discussion in the report and gain a perspective a bit different from your normal cable news channel.  Of course I focused on the infrastructure and cyber issues in this blog; however, I also believe you will gain some very interesting perspectives on the challenges facing our children and the "teetering" issues in our increasingly multipolar world.

###

SANS White Paper -- Cybersecurity Response to Physical Breaches of Unmanned Critical Infrastructure Sites

Our friend Mike Assante -- formerly of Idaho National Labs/National SCADA Test Bed, NERC, and now with SANS -- has coauthored an interesting and informative white paper on responses to physical breaches of unmanned critical infrastructure sites. The cover is shown below.

The whitepaper can be located at: http://tinyurl.com/ldfnzxq

One of the most interesting graphics in the paper (Appendix A, Page 12) is a collection of photos showing the ways/means of the miscreants to tap into the systems with such tools as keystroke loggers, etc.  The page is shown below to whet your appetite for this paper.

Nicely done and "attaboys" to Mike Assante, Scott D. Swartz and the SANS ICS team!

Also, my good friend Andy Bochman wrote about this at his Smart Grid Security Blog.  Thanks, Andy!!

####################

NIST CYBERSECURITY FRAMEWORK - COMMENTS DUE FRIDAY 12/13!

A few weeks ago I prepared a blog for Tofino Security summarizing the key aspects of the DRAFT NIST Cybersecurity Framework.  I guess I hit the target because the blog has been posted on a few other sites and referred to in some Tweets.

(From Cover of National Infrastructure Protection Plan - http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf)

Anyway, as one of my readers, my original submittal for the Tofino blog is posted below.

But, don't forget, NIST has requested comments on the Cybersecurity Framework by Friday, December 13th.

Take care, have a great and safe week, and here is the blog.................Ernie

########################################

You may have heard a bit of buzz in the US national and even international press about the release of the Cybersecurity Framework Draft from the US National Institute of Standards and Technology (NIST).  However, you may not know about its background or what it may mean to you as a control systems manager.  As such, this is intended to give you a high level overview of the genesis of this document and give you some points of reference.

Background

As we realize more and more everyday our national infrastructure – in Canada, the US or any country for that matter – is very important to our economies as well as our own national defense.  Because of concerns over continued cyber attacks on US national infrastructure – such as the electric grid, water systems, transportation networks, banks/financial institutions, critical manufacturing, etc. – President Obama issued Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” on February 12, 2013. 

This document is fondly referred to as the “EO.”

The EO also called for development of a voluntary Cybersecurity Framework to provide a “…prioritized, flexible, repeatable, performance-based, and cost-effective approach” for assisting organizations responsible for critical infrastructure services to thus manage cybersecurity risk.

Critical infrastructure is defined in the EO as “…systems and assets – whether physical or virtual – so vital to the US that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”  Example industry sectors – and the corresponding Federal oversight agency -- considered as “critical infrastructure” include[1]: 

As a follow up to the EO and PPD, NIST was assigned responsibility for development of the Framework in collaboration with industry feedback.  The Framework is intended to provide guidance to an organization on managing cybersecurity risk.  A key objective of the Framework is to encourage organizations to consider cyber security risk as a priority similar to financial, safety and operational risk while factoring in larger systemic risks inherent to critical infrastructure.

In other words, cybersecurity risk and considerations need to be included in the day-to-day discussions at your company or organization as you expand your business, build new facilities, install new equipment and hire new people.

Let’s Talk About the Framework

First, the EO instructed NIST to be the lead in developing the Framework.  As such you can find the Framework DRAFT document and supporting information at www.nist.gov.

And, what does the Framework contain?  The Cybersecurity Framework shall:

• include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks.
• shall incorporate voluntary consensus standards and industry best practices to the fullest extent possible.
• shall be consistent with voluntary international standards when such international standards will advance the objectives of this order.

And, what is the Framework supposed to do?  The Framework:

• shall provide a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls, to help owners and operators of critical infrastructure identify, assess, and manage cyber risk.
  
• shall focus on identifying cross-sector security standards and guidelines applicable to critical infrastructure.
  
• will also identify areas for improvement that should be addressed through future collaboration with particular sectors and standards-developing organizations.
  
• should provide guidance that is technology neutral and enables critical infrastructure sectors to benefit from a competitive market for products and services that meet the standards, methodologies, procedures and processed developed to address cyber risks.  And,
  
• shall include guidance for measuring the performance of an entity in implementing the Cybersecurity Framework.

So, with the guidance above – and with input from industry – the draft of the Framework is intended to provide a common language and mechanism for organizations to:

• Describe their current cybersecurity posture (and a semblance of maturity level)
  
•  Describe their target state for cybersecurity
  
•  Identify and prioritize opportunities for cybersecurity improvement within the context of risk management
  
• Assess progress toward the target state, and
  
•  Foster communications among internal and external stakeholders.

A key aspect of the Framework is that it is not intended to replace an organization’s existing business or cybersecurity risk management process and cybersecurity program.  Instead, the organization can use its current processes and leverage the Framework to identify areas to improve its cybersecurity risk management.  Also, the Framework can be helpful to a company that does not have a currently existing cybersecurity program so they can build in key elements raised by the Framework.

So, What Should You Do with the Framework?

First of all, take a look at the list of the critical infrastructures listed above.  Does your company fall into any of those categories?  If not, is your company substantially reliant on any of those key infrastructures for your success and even existence?  If the answer to either is YES then I’d suggest you take time to read the Framework as it stands and figure out how you can apply it to your current cybersecurity risk management.

Secondly, acquaint your Executive Management and Board Members with the Framework.  Give them a sense of how your company stands today relative to the Framework Implementation Tiers listed.  Use this as a means of highlighting your organization’s “…cybersecurity maturity level…” and if you aren’t at the top, use it to highlight the resources (i.e., people, time and money) you need to raise your game.

Thirdly, take a hard look at the Framework and even “test drive” it as it stands.  Be sure to provide comments back to NIST as described at their page “Request for Comments on the Preliminary Cybersecurity Framework.”  Comments are requested before December 13, 2013.

Final Thoughts

When you read the draft Framework, recognize that it is not a “checklist” or a simple “compliance” item to be fulfilled.  Instead it provides a set of performance objectives for your cybersecurity risk program to achieve for your prioritized list of key assets.  But also, it is not a “how-to” on building a security program.

So, even for our Canadian friends, be sure to take time to look the Framework over. 

---

[1] From the corresponding President Policy Directive (PPD) 21 “Critical Infrastructure Security and Resilience” that was issued at the same time as the EO. Link: http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil