securing networked infrastructure for the energy sector

Accelerating Grid ModernizationMore information available on SGIP.org

Securing Networked Infrastructure for the Energy Sector

November 13, 2014


INTRODUCTION

Tanya Brewer, Senior Information Technology ResearcherNational Institute of Standards & Technology (NIST)SGIP Smart Grid Cybersecurity Committee (SGCC)

Nov. 13, 2014 Securing Networked Infrastructure for the Energy Sector

Presenter

Presentation Notes

I am Tanya Brewer with NIST… [provide your own introduction here]


Smart Grid Interoperability Panelorchestrates the work

behind power gridmodernization

Presenter

Presentation Notes

A few brief words about SGIP for those that may not be fully familiar with our work. Power grid modernization can be thought of like a symphony among utilities, manufacturers, regulators and other stakeholders. SGIP orchestrates interoperability requirements gathering, development of harmonized standards through its Catalog of Standards evaluation process, then facilitates implementation and deployment with stakeholders globally. Without SGIP, integration of interoperable technologies for the global Smart Grid industry would be slower, less efficient and more costly.


• Optimizes resources and time• Avoids proprietary vendor lock-in• Helps build technology roadmaps• Simplifies decision making

SGIP Reduces Risks and Costs

SGIP is a collaborative, transparent, and trusted forum to share standards

information and practical, hands-on knowledge about deployments from

industry experts.


Presenter

Presentation Notes

SGIP keeps commerce and trade flowing by recognizing harmonized standards, a universal architecture to guide design of the modernized electric grid. SGIP enables more efficient and robust open standards by multiple vendors, leading to interoperable products that create more economical solutions. But the business of grid modernization stands to falter if a disparate assembly of components, ideas and procedures don’t work together. Products and solutions built on interoperable standards which have under gone rigorous open evaluation, especially for cybersecurity vulnerabilities, will lower the risk of implementing new grid modernization solutions. Beyond utilities, investors, suppliers, insurers and power customers will be among stakeholders benefiting from emerging Smart Grid commerce, including robust economies, increased power reliability and decreased cost of operation and management.


Agenda

• Introduction Tanya Brewer• Main Presentation Jim McCarthy• Q&A• Closing Tanya Brewer

This meeting, and all SGIP activities, are governed by SGIP By-laws and policies - Intellectual Property Rights Policy and Antitrust Policy.


Presenter

Presentation Notes

Today, we have one core presentation from Jim McCarthy of the National Cybersecurity Center of Excellence. Jim will be taking your questions so please submit them via the “Question” text box located in the GoTo control panel. If time permits, I also plan to give a brief update on NIST’s and the Smart Grid Cybersecurity Committee’s recent activities NEXT SLIDE

http://members.sgip.org/apps/group_public/document.php?document_id=4171&wg_abbrev=sgip-board

http://members.sgip.org/apps/group_public/document.php?document_id=2362&wg_abbrev=sgip-board


Securing Networked Infrastructure for the Energy SectorJim McCarthyNational Cybersecurity Center of Excellence

SGIP Webinar November 13, 2014

Presenter

Presentation Notes

TANYA: So now it is my honor to introduce our main presenter today, Jim McCarthy. Jim is [1-2 sentences of background]. Jim, now to you… JIM: Thank you, Tanya.


ABOUT THE NCCOE



8

STRATEGY

Vision

‣ A secure cyber infrastructure that inspires technological innovation and fosters economic growth

Mission

‣ Collaborate with innovators to provide real-world, standards-based cybersecurity capabilities that address business needs



9

TENETS

Standards-based

Modular

Usable

Repeatable

Open and transparent

Commercially available



10

APPROACH

We seek problems that are:

‣ Broadly relevant

‣ Technology-based

‣ Addressable with multiple commercially available technologies



11

REFERENCE DESIGNS

Use cases

‣ Sector-specific challenges

‣ Identified through industry engagement

Building blocks

‣ Technology-specific challenges

‣ Identified through public engagement



12

MODEL

Engage‣ Work with community of interest to define problem

Explore‣ Map security characteristics to standards, controls and best practices

‣ Circulate drafts and incorporate feedback

Partner‣ Invite technology vendors to collaborate in our labs

Build‣ Collaborate on design components

‣ Incorporate feedback from experts in technology community

Show‣ Demonstrate reference designs



13

MODEL

Form small communityof interest

Provide input andfeedback to NCCoE

Expandcommunityof interest

Submit feedback on use cases to

NCCoE

Offer insightson use cases

CommunityOf Interest

Support deployment, revision and maintenance of products as part of the

practice guide

Collaborate to develop reference designs

Evangelize on behalf of reference design and practice guide

Deploy, test and provide feedback on the reference design

Provide regular feedback on use case builds

TechnologyPartners Submit letters

of interest

Speak at sector-

specific events

Work withCOI to identify cybersecurity challenges

Hostsector-specific

workshop

Review & circulate

pre-release use cases

Revise & publish

draft use cases

Revise use cases &

invite participation

from technology

partners

Receivetechnology

partners letters

of interest

Demonstrate reference designs

Discussimprovements &

modifications

Publish reference

design and practice guide

Develop composed reference

design

Formbuild

teamsSign

CRADAsHost

partner day


14

CORE PARTNERS



IDENTITY AND ACCESS MANAGEMENT



16

OVERVIEW

Goals

‣ Authenticate individuals and systems

‣ Enforce authorization control policies

‣ Unify IdAM services

‣ Protect generation, transmission and distribution

Business value

‣ Reduce costs

‣ Increase efficiency



17

DESIRED SOLUTION CHARACTERISTICS

‣ Authentication

‣ Authorization

‣ Access control

‣ Federation

‣ Provisioning

‣ Do not break the grid



18

EXAMPLE COMPONENT LIST

‣ Services for authenticating and authorizing users based on identity, role, third-party affiliation (e.g., federation) or other attributes (e.g., attribute based access control)

‣ Services for authenticating and authorizing devices

‣ Identity and access governance capability that translates human-readable access needs into machine-readable authorizations

‣ Services for whitelisting applications



19


‣ ICS equipment, such as remote terminal units (RTUs), programmable logic controllers (PLCs) and relays, along with associated software and communications equipment (e.g., radios, encryptors)

‣ Physical access control devices that use standard communication interfaces

‣ Security incident and event management (SIEM) or log analysis software for monitoring access management events

‣ “Bump-in-the-wire” devices for augmenting OT with authentication, authorization, access control, encrypted communication and logging capabilities



20

SILOS

IT network OT network Physical system



21

THE IT-OT DIVIDE



22

COLLABORATORS



NEXT STEPS



24

NEXT STEPS

NCCoE: ‣ Finalize build architecture

Users and other interested parties: ‣ Participate in a use case community of interest



SITUATIONAL AWARENESS



26

OVERVIEW

Goals

‣ Improve OT availability

‣ Unify visibility across silos

‣ Detect anomalous conditions and remediate them

‣ Investigate events leading to anomalies and share findings

Business value

‣ Improves ability to detect security breaches or anomalous behavior

‣ Increases probability that investigations of attacks or anomalous system behavior will reach successful conclusions

‣ Improves accountability and traceability

‣ Simplifies regulatory compliance



27


‣ Data visualization and analysis capabilities that help dispatchers and security analysts view control system behavior and network and physical security events as a cohesive whole

‣ Analysis and correlation capabilities that help dispatchers and security analysts understand and identify security events and predict how those events might affect control system operation

‣ Scalability sufficient to meet the needs of a large metropolitan utility

‣ Mechanisms that ensure the accuracy and integrity of data collected from remote facilities

‣ Ability to collect logs, traffic and operational data from a variety of sources including servers, ICS equipment, networking equipment, security appliances, issue tracking systems and mobile devices



28


‣ Ability to allow dispatchers and security analysts to easily automate common and repetitive investigative tasks

‣ Built-in information sharing capabilities that allow dispatchers and security analysts to easily share and acquire new threat indicators, correlation rules, mitigations and investigative techniques

‣ Customizable interfaces that allow users to tailor the system to meet specific business needs

‣ Automated report generation to aid utilities in demonstrating compliance with relevant standards

‣ Intuitive user interfaces that are appropriate for utility dispatchers with limited network security expertise or security analysts with limited expertise in electric power



29


‣ ICS equipment, such as RTUs, PLCs and relays, along with associated software and communications equipment (e.g., radios, encryptors)

‣ SIEM or log analysis software‣ “Bump-in-the-wire” devices for augmenting OT with encrypted

communication and logging capabilities‣ Software for collecting, analyzing, visualizing and storing

operational control data (e.g., historians, outage management systems, distribution management systems, human-machine interfaces)

‣ Products that ensure the integrity and accuracy of data collected from remote facilities



NEXT STEPS



31

NEXT STEPS

NCCoE: ‣ Invite vendors to submit letters of interest that will result in CRADAs

Users and other interested parties: ‣ Participate in a use case community of interest



Next

[email protected]

9600 Gudelsky DriveRockville, MD 20850

http://nccoe.nist.gov


QUESTIONS?



Cybersecurity Update• Cloud Computing Considerations in the Smart Grid has now

been published for SGIP Members to view and download.– http://members.sgip.org/apps/org/workgroup/sgip-

mmc/download.php/5953/latest– Available to public in February 2015.

• Other resources at SGIP.org/Publications– Framework for Improving Critical Infrastructure Cybersecurity

Core Mapping to National Institute of Standards and Technology (NIST) Interagency Report (IR) 7628 Exclusive to Members

– Cybersecurity User's Guide (NISTIR 7628) - Smart Grid Cyber Security Implementation Guidelines 30 pages

• Information on the SGIP Smart Grid Cybersecurity Committee may be found at SGIP.org/SGCC


http://members.sgip.org/apps/org/workgroup/sgip-mmc/download.php/5953/latest

http://members.sgip.org/apps/org/workgroup/sgip-mmc/download.php/5472/latest

http://sgip.org/NISTIR-7628-User-s-Guide---Smart-Grid-Cyber-Security-Implementation-Guidelines


SGIP Reminders• Next week on November 20: Another Free Webinar – “What’s

New with the Interoperability Process Reference Manual?” and the Smart Grid Testing & Certification Committee

• December 8-9: Winter Members Meeting in Portland– Conference on Transactive Energy also in Portland that week.

• Webinars & Publications on SGIP.org under “Information Knowledge Base”

• Stay in Touch– Twitter: @SGIPNews– Join our LinkedIn Group: https://www.linkedin.com/groups/Smart-

Grid-Interoperability-Panel-SGIP-4145498– Sign up for SGIP Newsletter, The Conductor


Presenter

Presentation Notes

Also I wanted to share a few more SGIP resources We do have our Winter Members Meeting coming up in December. It will be held in Portland at the same time as the international transactive energy conference so members may be able to attend both. SGIP makes a great deal of its information publicly available. For instance, starting tomorrow, you’ll find archived materials from this event on our Webinars page. SGIP encourages you to follow us on Twitter, join our LinkedIn group to discuss Smart grid interoperability related topics like testing or cybersecurity, grid resiliency, transactive energy and the like. We also share updates and information in our free monthly newsletter, The Conductor. If you don’t already subscribe, you can do so at sgip.org.


THANK YOU FOR YOUR PARTICIPATION

A FOLLOW-UP EMAIL WILL BE SENT WITH LINK TO RECORDING AND SUPPORTING MATERIALS


Presenter

Presentation Notes

Thank you again for attending and special thanks to our presenter today, Jim McCarthy. SGIP greatly appreciates your participation. You will be receiving a short survey via email asking about this presentation. SGIP staff will also send out a follow up email to this webinar that will include relevant links and of course, the webinar recording archive. Thank you again.

securing networked infrastructure for the energy sector

Government & Nonprofit

power grid modernization

business of grid modernization

sgip bylaws

sgip activities

modernized electric

global smart grid industry

emerging smart grid

interoperable standards