ApplyingISA/IEC62443to

ControlSystems
GrahamSpeake
PrincipalSystemsArchitectYokogawa
Additional
partnerlogos
l

MESAKNOWS

SUSTAINABILITY&ECOEFFICIENCY LEAN METRICS&PERFORMANCEMANAGEMENT

INFORMATIONINTEGRATION SAFETY ASSETPERFORMANCEMANAGEMENT B2MML
QUALITY&COMPLIANCE PRODUCTLIFECYCLEMANAGEMENT AUTOMATION

Doyouknow MESA?

GrahamSpeake
BScElectricalandElectronicsEngineer
g
16yearsexperienceincomputersecurity
12Yearsexperienceinautomationsecurity
p
y
WorkedforFordMotorCompany,ICS,ATOS
OriginandBP
Workedasanindependentconsultanton
financialsecurity
2
MemberofISA,ISCI,ISC
b
f
PrincipalSystemsArchitectatYokogawa

2
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ACRONYMS

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Acronyms
Acronyms

SCADA,DCS,PCN,industrialautomation
SCADA
DCS PCN industrial automation
PLC,embeddedcontroller
Processcontroll
HMI
PI,Historian

4
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Acronyms 2
Acronyms
2

Whitelisting
IDS
IPSS
phising

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Language difficulties
Languagedifficulties

Iamnotintheofficeatthemoment.Sendany
worktobetranslated
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

PROCESS CONTROL
PROCESSCONTROL

7
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

What do we mean by Process Control?

WhatdowemeanbyProcessControl?
Isthisprocesscontrol?

8
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

What do we mean by Process Control?

WhatdowemeanbyProcessControl?
Howaboutthese?

9
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Process Control in this context is:

ProcessControlinthiscontextis:

10
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Level Control Example

LevelControlExample
Variableflowintotank(ratenotunderourcontrol)
Asthelevelinthetankincreases,
thelevelcontrollerprogressively
openstheoutletvalvetomaintain
h
l
l
i i
thelevelinthetank.
Astheleveldecreases,the
controllerclosesthevalve
t ll
l
th
l

Set
Point

Level
Controller

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Control up to 60ss
Controlupto60
Pneumaticsignal
proportionaltothe
tanklevel
kl l

Thumbwheelon
controllerto
determineset
point

Variableflowintotank(ratenotunderour
control)

Pneumaticsignalfrom
controllertovalve

Level
Controller

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Control in the late 60ss&early70

Controlinthelate60
& early 70ss
100

Electricalsignal
proportionalto
thetanklevel

Electroniccontrollerlocatedremote
fromplantincontrolroom.Operatorset
pointentryisstillviathumbwheel
p
y

Electricalsignalfrom
controllertovalve

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

The1970sTheDistributed
C t lS t
ControlSystem
AnOperatorStation,levelindicatedonascreen,operatorchanges
setpointviakeyboardforthefirsttime!

Data Hiway
DataHiway

BasicController

Electricalsignalsto/fromcontroller,
controller handles 8 loop at once
controllerhandles8loopatonce

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

The1970sTheDistributed
C t lS t
ControlSystem
MultipleOperatorStations,oneoperatorcancontrolarefiningunit

DataHiway

BasicController
Basic
Controller
#1

Copyright2012,MESAInternational

BasicController
Basic
Controller
#2

BasicController
Basic
Controller
#32

ThepowerofknowingwhatMESAKNOWS

1980ssTheDCSevolves
1980
The DCS evolves
Businesssystems

Morepowerfulop
stns

LocalControlNetwork
Gateway

Gateway

Gateway

Basic
Controller

Basic
Controller

Process
Manager

Basic
Controller

Basic
Controller

Process
Manager

Basic
Controller

Basic
Controller

Process
Manager

DataHiway
Copyright2012,MESAInternational

DataHiway

Gateway

UniversalControlNetwork
ThepowerofknowingwhatMESAKNOWS

1990ssCOTSarriveonthescene
1990
COTS arrive on the scene
BusinessNetwork

TCP/IP
ProcessControlNetwork
Gatewayto
G
t
t
business
systemsisaPC

OpStnisaPCwitha
VendorPCIcard

LocalControlNetwork

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

2000sEverythingconnected!

Remote Users

www

System
Server

Supervisory
Controller

Operator
Stations
Engineering
Station

[to plant IT
network]

Remote
Server

PCN
Multi-loop
p
Controller
Direct I/O Module

Other Industrial Devices

2001, Security Arrives

2001,SecurityArrives
Businessnetwork

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Cyber Security Overview

CyberSecurityOverview

ChangingComplianceenvironment
NERC CIP ISO/IEC 17799 API 1164 NIST ISA
NERCCIP,ISO/IEC17799,API1164,NIST,ISA

MoreaggressiveorganizedCyberthreats
aweaponofmassdisruption..
President Obama May 29, 2009
PresidentObamaMay29,2009

Confluenceoftechnologies

Therearefewindustry
experts
IT
Enterprise
Security

Control
Systems

Controlsystemcyber
security
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

OVERVIEW OF ARCHITECTURE
OVERVIEWOFARCHITECTURE

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

TwoTiered
Two
TieredNetworkArchitecture
Network Architecture

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ThreeTiered
Three
TieredNetworkArchitecture
Network Architecture

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

WHY SECURITY?
WHYSECURITY?

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Incident: Sewage Spill in Australia

Incident:SewageSpillinAustralia
BetweenJanuary2000andApril
2000 th M
2000,theMaroochy
h Shiresewage
Shi
treatmentplantinQueensland,
Australiaexperienced47unexplained
faults.
faults
Millionsoflitersofrawsewage
spilledoutintolocalparks,riversand
even the grounds of a Hyatt Regency
eventhegroundsofaHyattRegency
hotel.
Marinelifedied,thecreekwater
turned black and the stench was
turnedblackandthestenchwas
unbearableforresidents,saidJanelle
BryantoftheAustralian
Environmental Protection Agency
EnvironmentalProtectionAgency.
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Incident: Sewage Spill in Australia

Incident:SewageSpillinAustralia
OnOctober31,2001,VitekBodenwasconvictedof26countsof
willfullyusingarestrictedcomputertocausedamageand1count
illf ll
i
ti t d
t t
d
d1
t
ofcausingseriousenvironmentalharm.
Bodenworkedforthecontractorinvolvedintheinstallationofthe
sewage treatment plant in the state of Queensland in Australia He
sewagetreatmentplantinthestateofQueenslandinAustralia.He
leftthecontractorinDecember1999andapproachedtheshirefor
employment.Hewasrefused.
Bodenmadeatleast46attemptstotakecontrolofthesewage
systemduringMarchandApril2000.OnApril23,thedateof
Boden'slasthackingattempt,policewhopulledoverhiscarfound
radioandcomputerequipment.
LaterinvestigationsfoundBoden
Later investigations found Boden'sslaptophadbeenusedatthe
laptop had been used at the
timeoftheattacksandhisharddrivecontainedsoftwarefor
accessingandcontrollingthesewagemanagementsystem.

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Incident:VirusAttacksTrainSignaling
System
InAugust2003,acomputerviruswas
bl
blamedforbringingdowntrainsignaling
df b i i d
t i i li
systemsthroughouttheeasternU.S.The
signalingoutagebrieflyaffectedtheentire
CSXsystem,whichcovers23stateseastof
y
,
theMississippiRiver.
Thevirusinfectedthecomputersystemat
CSXCorp'sJacksonville,Fla.,headquarters,
shutting down signaling dispatching and
shuttingdownsignaling,dispatching,and
othersystemsatabout1:15amEDT,CSX
spokesmanAdamHollingsworthsaid,The
causewasbelievedtobeawormvirus
similartothosethathaveinfectedthe
systemsofmajorcompaniesandagenciesin
recentdays.

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Incident: Gasoline Pipeline Rupture

Incident:GasolinePipelineRupture

InJune1999,a16inchdiametersteelpipelineownedbyThe
Olympic Pipe Line Company ruptured and released about 237 000
OlympicPipeLineCompanyrupturedandreleasedabout237,000
gallonsofgasolineintoacreekthatflowedthroughWhatcomFalls
ParkinBellingham,Washington.
About11/2hoursaftertherupture,thegasolineignitedand
burned about 1 1/2 miles along the creek Two 10 year old boys
burnedabout11/2milesalongthecreek.Two10yearoldboys
andan18yearoldyoungmandiedasaresultoftheaccident.
Eightadditionalinjuriesweredocumented.
AsinglefamilyresidenceandthecityofBellingham'swater
treatmentplantwereseverelydamaged.Olympicestimatedthat
l
l d
d Ol
i
i
d h
totalpropertydamageswereatleast$45million.

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Incident: Gasoline Pipeline Rupture

Incident:GasolinePipelineRupture
OneofthecausesoftheaccidentwasOlympicPipe
LineCompany'spracticeofperformingdatabase
developmentworkontheSCADAsystemwhilethe
systemwasbeingusedtooperatethepipeline.
y
g
p
pp
Shortlybeforetherupture,newrecordsforpump
vibrationdatawereenteredintotheSCADAhistorical
database. The records were created by a pipeline
database.Therecordswerecreatedbyapipeline
controllerwhohadbeentemporarilyassignedasa
computersystemadministrator.
Accordingtotheaccidentreport,thedatabaseupdates
According to the accident report the database updates
ledtothesystem'sbecomingnonresponsiveata
criticaltimeduringpipelineoperations.
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Incident:SasserWormDisrupts
CoastgaurdComputersinUK
d

InMay2004,coastguardstationsaroundtheUKwereseverelydisrupted
afteracomputerwormbroughtdownITsystems.TheSasser wormhitall
19coastguardstationsandtheservice'smainheadquarters,leavingstaff
reliantonpapermapsandpens.
TheMaritimeandCoastguardAgencysaidstaffhadrevertedtomanual
mapreadingassoonasitscomputerizedmappingsystemsstartedtofail.
Coastguardstaffwerestillabletousetelephonesandradiosbutfaxand
telexmachineshadbeenputoutofaction.
l
hi
h db
f i

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Accidental Incidents
AccidentalIncidents
Accidentalincidentsremainaseriousconcern:
Accidental incidents remain a serious concern:
PLCscrashedbyITsecurityaudit.
DCSdatafeedcausesgatewayfailure.
DCS data feed causes gateway failure
DuplicateIPaddresspreventsmachinestartup.
IPaddresschangeshutsdownchemicalplant.
IP dd
h
h t d
h i l l t

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Todayssthreats?
Today
threats?
Targetedattacks
Targeted attacks
Spearphising
Employees
l

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

OVERVIEW OF ISA/IEC STANDARDS

OVERVIEWOFISA/IECSTANDARDS

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Overview

TheSituation
The
Situation
ChlorineTruckLoadingUseCase
Design&RiskManagementProcess
i & ik
Systemsvs.Zones&Conduits
DesignConsiderations
Security Level Vector Discussion
SecurityLevelVectorDiscussion

34
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

The Situation
TheSituation

TheProblem
Withsomanystandardsoutthere,howdoyoupickthebestone?
h
d d
h
h d
k h b
?
Onceyouvepickedasetofstandards,howdoyouapplythem?

SecurityStandards

ISA/IEC62443(13)
ISA/IEC
62443 (13)
ISO/IEC2700x(10+)
ITStandards
NISTFIPSandSP800(7+)
NERCCIP(8)
S
SmartGrid(?)
G id (?)
SectorSpecificStandards

Andthatsjustthesecuritystandards,thentakeintoaccountthe
functionalstandards

Wireless=ISA100.11a,WirelessHART,Zigbee,WiFi,Bluetooth
,
, g
,
,
Safety=ISA84,IEC61508/61511,DO254,OSHA
Management=ISO9000,14000,31000,50001,SixSigma
Andplentyofothers

35
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISA/IEC 62443 Series (Proposed)

ISA/IEC62443Series(Proposed)

36
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Zones and Conduits

ZonesandConduits

37
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Security Standards
SecurityStandards

Securitystandardsgenerallytellyouwhathastobedoneorspecified,but
dont tell you how to go about doing it
donttellyouhowtogoaboutdoingit
Functionalspecifications
Securitycontrols/countermeasures

Somestandardsshowagenericprocess,butleaveituptothereaderto
g
p
,
p
applyitintheircase
Afewusecasesexist,butmanytimestheseare:
Sectorspecific
Onlyapplyincertaincases
O l
l i
t i
Limitedinscope

Veryfewendusersdiscussthedetailsoftheirprocesses
Restrictinformationfrompotentialattackers
p

Almostnovendorsorsystemintegratorsdiscussthedetailsoftheir
processes
Restrictinformationfrompotentialcompetitors

38
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Chlorine Truck Loading Use Case

ChlorineTruckLoadingUseCase
SettingtheStage
ISA99istryingtouseasingleusecasethroughouttheentire
seriestoshowhoweachpartofthestandardfitsintothe
process
Whilethechlorinetruckloadingexampleisrelatedtothe
Whil th hl i t k l di
l i l t d t th
chemicalindustry,theconceptspresentedcouldrelatetoany
industry
Theexampleallowsforsomewhatmorerealisticdiscussionsof
The example allows for somewhat more realistic discussions of
riskthaninanITfocused,DHSfocused,orpurelyhypothetical
example

Usecaseinearlydevelopmentandideaphase
y
p
p
Willtakequitealongtimetocompleteentireusecase
Differentpartsofusecasewillprobablyemergeatdifferent
times
39
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ChlorineTruckLoadingUseCase:
TheNarrative
h

PharmaceuticalCompanyXYZCorp

Wantstostartproducingnewproduct(FixItAll)
d
d
(
ll)
Noroomfornewproductionplantatexistingfacilities
Chemicalprocessrequiresrelativelysmallamountsofchlorine
Existingfacilityproduceschlorineinlargeenoughquantities
g
yp
g
g q

XYZCorp considerstheiroptions
Conductsbusinessassessmentofbuildingnewfacility
Existingfacilitiesallnearspacecapacity
Newfacilityhasgoodaccesstoroads
N f ili h
d
d
Landissuitableandavailable
Existingchlorineproductionfacilityover50milesaway
Considersoptionsfortransportingchlorine
p
p
g
Pipeline
Rail
Truck

40
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ChlorineTruckLoadingUseCase:
ThePlan
h l
Buildtruckloading/unloadingfacilities
Loading@existingfacility,unloading@newfacility
Unmannedexceptduringloading/unloadingoperations
Hazardouschemicalrequiresspecialhandling&safety

Generationsofequipment
G
ti
f
i
t
Existingfacilityuseslegacyequipment(brownfield)
Newfacilitydesignedwithcurrenttechnology(greenfield)

Facilitymonitoring&control
Facility monitoring & control
Unmanned centralizedmonitoring@controlcenter
Manned&operational localcontrolwithbothlocal&centralized
monitoring

Attachedtobusinesssystems
Billing&logistics
Inventorytracking
y
g
41
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ChlorineTruckLoadingUseCase:
DesignConsiderations
d
Systemsneeded
Syste s eeded

SafetyInstrumentedSystem(SIS)
BasicProcessControlSystem(BPCS)
Controlcenter
PlantDMZ
Enterprisesystems

LevelofSISintegrationwithBPCS?
Airgapped
Ai
d
Interfaced
Integrated
42
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

InitialDesignProcess:
IdentifytheControlAssets
d
f h
l
ProcessEquipment

PumpController
Transmitters
BlockandControlValves

BPCS&SIS

FunctionalSafetyPLC
ControlPLC
EngineeringWorkstation(s)
InstrumentAssetManagementSystem
HumanMachineInterface(s)

C t lC t
ControlCenter

ControlCenterWorkstations

PlantDMZ

DataHistorian

Enterprise
i

EnterpriseWebServer
EnterpriseWLAN
BusinessLogisticsSystem
Billing S stem
BillingSystem

43
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

NOW WHAT???
NOWWHAT???

44
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Design Process
DesignProcess
Nowthatthebusinesscaseandsomeinitialdesign
ideashavebeenputdown,wheredoyougofrom
here?
A. Designthecontrolsystemwithoutworryingaboutthe
g
y
y g
security?
B. Designeverythingsosecurethatitbecomesunusable?
C Throwinfirewallseverywhere?
C.
Throw in firewalls everywhere?
D. Conductadetailedriskassessmentatthedevicelevel?
E. Conductamultistageriskassessmentstartingwiththe
top level and working down to the low level as the design
toplevelandworkingdowntothelowlevelasthedesign
progresses?

Generally,theISA99approachbeginswithE
45
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ModifiedISO/IEC27005Risk
ManagementProcess
ISA99,WorkingGroup2
workingonmodified
ki
difi d
ISO/IEC27005risk
managementprocess
U
Usesbasicshellfrom27005
b i h ll f
27005
Modifiesitformultistage
riskassessmentprocess
Discussesjumpinpoint
Discusses jump in point
Relatesriskmanagement
processtooverallcyber
security management
securitymanagement
systemdesignprocess
Businessplanning
Changemanagement
Decommissioning
46
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Systems vs. Zones & Conduits

Systemsvs.Zones&Conduits
SystemsZones
Conductingasystembreakdownmaygivesomeindicationoffuture
zones,butthereisnodirectonetoonecorrelationbetweenthetwo
Systems=Collectionsofequipment/assetsthatlogicallyfunction
together to perform at least one task
togethertoperformatleastonetask
Zones=Collectionsofequipment/assetsthatlogicallyhavesimilar
securityrequirements

Systembreakdownhelpstoidentifydifferentsetsofequipment
d i
duringtheriskassessmentphase
h ik
h
Zonesarecreatedaftertheriskassessmentphasebasedonthe
particularsecurityrequirementsforthatsetofequipment/assets
Conduitsareaspecialkindofzonecontainingacommunication
C d it
i l ki d f
t i i
i ti
channel

47
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

DesignConsiderations:SISAirGapped
vs Interfaced vs Integrated
vs.Interfacedvs.Integrated

48
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

SecurityLevelVector
Discussion
i
i
IndustrialSecurityIsnt
AlwaysAboutDeath&
y
Dismemberment
Somesecurityconceptsdont
fitintothatmodel

UsetheFoundational
h
d
l
RequirementstoEngineer
theSystemSecurity
Id
Identification&
tifi ti &
AuthenticationControl
UseControl
SystemIntegrity
y
g y
DataConfidentiality
RestrictedDataFlow
TimelyResponsetoEvents
ResourceAvailability
49
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

SecurityLevelVector
Discussion
i
i
Howwilltheswitchesaffect
the security of the BPCS &
thesecurityoftheBPCS&
SIS?
Highavailabilityisfairly
common
Uncommonforswitchesto
havegoodaccesscontrol
(natively)
Confidentialitydepends,is
SNMPenabledANDsecured?
Ifswitchfailscompletely,what
h
happenstosystemintegrity?
i
i ?
Whataboutintermittent
failures,orbadports? What
aarethesafetyimplications?
e t e sa ety p cat o s
50
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

SecurityLevelVector
Discussion
i
i
Now,whataboutother
components?
Howdoeachofthe
component capabilities
componentcapabilities
rollintoasystem
capability?
Mathematical/Additive?
/
Qualitativeassessmentof
capabilities?
p

Howdocapabilities
relatetoachieved
securitylevels?
i l l?
51
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

SecurityLifecycles
Product
Development
Lifecycle

System
Integration
Lifecycle

System/Project
Lif
Lifecycle
l

52
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Security Lifecycle
SecurityLifecycle
Business
Planning

Detail
Planning
Facility
Planning

Construction

Implementation

Facility
Operations

Startup&
Commissioning

Facility
Decommissioning

Product
Supplier

Engineering
Entity

Asset
Owner
53
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISASECURITYCOMPLIANCE
ISA
SECURITY COMPLIANCE
INSTITUTE(ISCI)ORGANIZATION
54
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

An ISA Owned Organization

AnISAOwnedOrganization
Automation
Standards
Compliance
Institute

ISA

ISA Security Compliance Institute

Interest Group

Industrial
Interoperability

Wireless

Other Interest
Groups

Governing Board

Technical Steering
g
Committee

Working
g
Groups

55
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISA Security Compliance Institute (ISCI)

ISASecurityComplianceInstitute(ISCI)
WhoWeAre
ConsortiumofAssetOwners,Suppliers,andIndustryOrganizationsformedin
2007undertheISAAutomationStandardsComplianceInstitute(ASCI):
Mission
i i
Establishasetofwellengineeredspecificationsandprocessesforthetesting
andcertificationofcriticalcontrolsystemsproducts
Decreasethetime,cost,andriskofdeveloping,acquiring,anddeploying
controlsystemsbyestablishingacollaborativeindustrybasedprogram
among asset owners suppliers and other stakeholders
amongassetowners,suppliers,andotherstakeholders

56
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISCI Member Companies

ISCIMemberCompanies

ISCImembershipisopentoallorganizations
Strategicmembershiplevel
b h l l
Technicalmembershiplevel
Informationalmembershiplevel

Currentmembership

Chevron
Egemin
exida
ExxonMobil
Honeywell
Invensys
Siemens
Yokogawa
IPA
ISA99/ISCI J i W ki G
ISA99/ISCIJointWorkingGroupLiaison
Li i

57
Copyright2012,MESAInternational

57

ThepowerofknowingwhatMESAKNOWS

ISASecure Designation
Trademarkeddesignationthatprovidesinstant
recognitionofproductsecuritycharacteristicsand
iti
f
d t
it h
t i ti
d
capabilities.
IndependentIndustrystampofapproval.
SimilartoSafetyIntegrityLevelCertification
(ISO/IEC61508).
58
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ANSI/ACLASSAccreditedConformance
Scheme
h
ISASecure EmbeddedDeviceSecurityAssurance(EDSA)
y
(
)
certificationaccreditedasanISO/IECGuide65conformance
schemebyANSI/ACLASS.ThisincludesbothISO/IEC17025and
ISO/IEC 17011
ISO/IEC17011.
Gotowww.ansi.org/isasecure fordetails.
1.ProvidesglobalrecognitionforISASecure certification
2 Independent CB accreditation b ANSI/ACLASS
2.IndependentCBaccreditationbyANSI/ACLASS
3.ISASecure canscaleonaglobalbasis
4 Ensures certification process is open fair credible and
4.Ensurescertificationprocessisopen,fair,credible,and
59

robust.

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Why Do We Need Secure Devices

WhyDoWeNeedSecureDevices
Increased
IncreasedIndustrialControlSystemexploits
Industrial Control System exploits
andattacks
Stuxnet
Nearly40exploitsreleasedrecently

Hackerconferencesstartingtohavecontrol
g
systemtracks
BlackHat
HackerHalted

ControlsystemsusingstandardITdevices
y
g
60
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISASecureCertification Specification
Process
ISCIboarddefinesscopeandworkprocess
p
p
Technicalsteeringcommitteemanagesworkinggroups
whodraftspecifications
Specificationsreviewedbyexternal3rd partyifrequired
VotedandapprovedbyfullISCIvotingmembership
ApprovedspecificationsadoptedbyISCIGoverning
A
d
ifi ti
d t d b ISCI G
i
Boardandpostedonwebsite
Specificationsdevelopedto
Specifications developed todate
datehavebeendonatedto
have been donated to
ISAforsubmissiontotheISA99StandardsCommittee

61
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISASecureVendorDeviceApproval
Process
VendorsubmitsdevicetoANSIACLASScharted
lab
Chartedlabcompletesthreepartassessment
Physicallyevaluatesdeviceforfunctionalsecurity
h
ll
l
d
f f
l
(FSA)
Conductscommunicationrobustnesstest(CRT)using
(
)
g
ISCI appovedtesttool
Chartedlabcompletesvendoraudit(SDSA)on
software development practices
softwaredevelopmentpractices

Chartedlabissuesfinalassessmentreportand
certificationuponsuccessfultestandaudit
62
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISA 62443/99 Work Products

ISA62443/99WorkProducts

63
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISCI Program Outreach

ISCIProgramOutreach
Websitewww.isasecure.org
ISASecure EDSACertificationSpecificationsand
Program Definition Documents Approved and
ProgramDefinitionDocumentsApprovedand
postedforpublicaccessatwww.isasecure.org
ISCIBoarddonatedEDSAFSAandSDSAtechnical
dd
d
d
h
l
specificationtoISA99CommitteeviaISA99ISCI
JointWorkingGroup
WebinarSeriesthroughout2011
64
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISASECURE EMBEDDEDDEVICE
SECURITYASSURANCEPROGRAM
65
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Embedded Device
EmbeddedDevice
Specialpurposedevicerunningembedded
softwaredesignedtodirectlymonitor,controlor
actuateanindustrialprocess
Examples:

ProgrammableLogicController(PLC)
DistributedControlSystem(DCS)controller
S f t L i S l
SafetyLogicSolver
ProgrammableAutomationController(PAC)
IntelligentElectronicDevice(IED)
DigitalProtectiveRelay
S
SmartMotorStarter/Controller
S
/C
ll
SCADAController
RemoteTerminalUnit(RTU)
Turbinecontroller
Vibrationmonitoringcontroller
Compressorcontroller

66
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

EmbeddedDeviceSecurityAssuranceCertification

Integrated Threat Analysis

(ITA)
SoftwareDevelopmentSecurity
Assurance(SDSA)

DetectsandAvoidssystematicdesignfaults
Thevendorssoftwaredevelopmentandmaintenance
processesareaudited
Ensurestheorganizationfollowsarobust,securesoftware
developmentprocess
DetectsImplementationErrors/Omissions

FunctionalSecurityAssessment
(FSA)

A
Acomponent
componentsssecurityfunctionalityisauditedagainstits
security functionality is audited against its
derivedrequirementsforitstargetsecuritylevel
Ensurestheproducthasproperlyimplementedthesecurity
functionalrequirements
Identifies vulnerabilities in networks and devices
Identifiesvulnerabilitiesinnetworksanddevices

CommunicationsRobustness
Testing(CRT)

Acomponentscommunicationrobustnessistestedagainst
communicationrobustnessrequirements
Testsforvulnerabilitiesinthe4layersofOSIReference
Model

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

ISASecure Levels

SDSA
FSA
CRT

LEVEL 3

Requirements Necessary to Achieve Certification Levels

Level 1 Level 2 Level 3
Total Count in Specification
130
149
170
170
20
49
82
82
All

All

All

CRT Common Specification plus LEVEL 2

all 6 Protocol CRT Specifications

LEVEL 1

SoftwareDevelopment
p
SecurityAssessment
FunctionalSecurity
Assessment

SoftwareDevelopment
SecurityAssessment

SoftwareDevelopment
SecurityAssessment

FunctionalSecurity
Assessment

FunctionalSecurity
Functional
Security
Assessment

CommunicationRobustnessTesting

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

CommunicationsRobustnessTest(CRT)

Measurestheextenttowhichnetworkprotocolimplementationsonanembedded
device defends themselves and other device functions against unusual or
devicedefendsthemselvesandotherdevicefunctionsagainstunusualor
intentionallymalicioustrafficreceivedfromthenetwork.
Inappropriatemessageresponse(s),orfailureofthedevicetocontinueto
adequately maintain essential services, demonstrates potential security
adequatelymaintainessentialservices,demonstratespotentialsecurity
vulnerabilitieswithinthedevice.

CommunicationRobustnessTesting

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

FunctionalSecurityAssessment(FSA)
SecurityFeatureTests

Purpose:
Verificationandvalidationthatthedeviceorsystemundertest
incorporatesaminimumsetofsecurityfeaturesneededtocounteract
commonsecuritythreats
Composition
Setofrequirements,derivedfromexistingreferencestandardsand
traceabletosourcestandard
Oneormoreacceptablesolutions(countermeasures)identifiedfor
eachrequirement
Ifapplicable,procedurestoverifytherequirementhasbeensatisfied
Functional Security Assessment
FunctionalSecurityAssessment

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

SoftwareSecurityDevelopmentAssessment

SecureSoftwareEngineering
Purpose:
Verificationandvalidationthatsoftwareforthedeviceorsystem
undertestwasdevelopedfollowingappropriateengineeringpractices
p
g pp p
g
gp
tominimizesoftwareerrorsthatcouldleadtosecurityvulnerabilities
Composition
Setofrequirements,derivedfromexistingreferencestandardsand
Set of requirements derived from existing reference standards and
traceabletosourcestandard(IEC61508,ISO/IEC15408)
Oneormoreacceptableargumentsidentifiedforeachrequirement

SoftwareDevelopmentSecurityAssessment

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Security Development Lifecycle

SecurityDevelopmentLifecycle
Thisphasespecifiesaprocessforplanningandmanagingsecuritydevelopmentactivitiestoensurethatsecurityisdesigned
intoaproduct.Forexample,thisphaseincorporatesrequirementsthatthedevelopmentteamhaveasecuritymanagement
SecurityManagement
planandthatthedevelopersassignedtotheprojectarecompetentandhavebeenprovidedbasictrainingingoodsecurity
Process
engineeringpracticesandprocesses.Alsoincludesrequirementsthattheprojectteamcreatesandfollowsaconfiguration
managementplan.
Mostvulnerabilitiesandweaknessesinsoftwareintensiveinformationsystemscanbetracedtoinadequateorincomplete
SecurityRequirements
requirements.Thisphaserequiresthattheprojectteamdocumentcustomerdrivensecurityrequirements,securityfeatures
Specification
andthepotentialthreatsthatdrivetheneedforthesefeatures.
Softwarearchitecturefacilitatescommunicationbetweenstakeholders,documentsearlydecisionsabouthighleveldesign,
SoftwareArchitectureDesign
Software
Architecture Design andallowsreuseofdesigncomponentsandpatternsbetweenprojects.Thisphaserequirestheprojectteamdevelopatop
and allows reuse of design components and patterns between projects This phase requires the project team develop a top
levelsoftwaredesignandensuresthatsecurityisincludedinthedesign.
SecurityRiskAssessmentand Thisphaserequirestheprojectteamdeterminewhichcomponentscanaffectsecurityandplanwhichcomponentswillrequire
ThreatModeling
securitycodereviewsandsecuritytesting.Alsorequiresthatathreatmodelbecreatedanddocumentedfortheproduct.
DetailedSoftwareDesign

Thisphaserequirestheprojectteamdesignthesoftwaredowntothemodulelevelfollowingsecuritydesignbestpractices.

DocumentSecurity
Document
Security
Guidelines
SoftwareModule
Implementation&
Verification

Thisphaserequirestheprojectteamcreateguidelinesthatusersoftheproductmustfollowtoensuresecurityrequirements
This
phase requires the project team create guidelines that users of the product must follow to ensure security requirements
aremet.

SecurityIntegrationTesting

Thisphaserequiresthattheprojectteamperformsecurityspecifictestssuchasfuzztestingandpenetrationtesting.

Thisphaserequirestheprojectteamimplementdesignbywritingcodefollowingsecuritycodingguidelines.Itensuresthat
softwaremodulesareimplementedcorrectlybyconductingsecuritycodereviews,staticanalysisandmoduletesting.

SecurityProcessVerification Thisphaserequiresanindependentassessmentthatallrequiredsoftwaredevelopmentprocesseshavebeenfollowed
Thisphaserequirestheprojectteamestablishaprocesstobeabletoquicklyrespondtosecurityissuesfoundinthefieldif
andwhentheyhappen.
Thisphaserequiresthattheprojectteamconfirmthatallsecurityrequirementshavebeenmetpreferablybytestorby
SecurityValidationTesting
analysis.
Thisphaserequirestheprojectteamrespondtosecurityproblemsinthefieldbytakingactiontobothpreventativeand
SecurityResponseExecution
correctiveaction.
SecurityResponsePlanning

72
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

EDSACertificationProcess
Typical Chartered Lab Level of Effort in Man Weeks
Level 1

Level 2

Level 3

1 - 2 weeks

1 - 2 weeks

1 - 2 weeks

1.

CRT test all

accessible TCP/IP
interfaces

2.

Perform FSA on
device and all
interfaces

< 1 week

1 week

1 2 weeks

3
3.

Audit
A
dit suppliers
li
software
development
process

1 week
k

1 2 weeks
k

1 2 weeks
k

4.

Perform ITA and

issue report

1 week

1 week

1 week

3 5 weeks

4 6 weeks

4 10 weeks

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

WHY ISASECURE?
WHYISASECURE?

74
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Benefits
Enduser
End
user

Supplier

Easytospecify
Buildsecurityrequirement
intoRFP
ReducedtimeinFAT/SAT
Knowsecurityleveloutof
i l l
f
thebox

Evaluatedonce
Recognitionforeffort
Buildinsecurity
Productdifferentiator

75
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

WHOTOCONTACTFORMORE
WHO
TO CONTACT FOR MORE
INFORMATION
76
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Who to Contact to Certify Products

WhotoContacttoCertifyProducts
ISASecure EDSACharteredLab
exida
JohnCusimano
DirectorofSecurityServices
Phone:(215)4531720
Fax:(215)2571657
E il j i
Email:jcusimano@exida.com
@ id
Website:http://www.exida.com
77
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Who to contact for CRT Test Tool

WhotocontactforCRTTestTool
http://www wurldtech com
http://www.wurldtech.com
WurldtechSecurityTechnologies,Inc.
ld h S
i
h l i
GregMaciel
A hill S l M
AchillesSalesManager
Phone:(949)3004040
Email: gmaciel@wurldtech com
Email:gmaciel@wurldtech.com

78
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Who to contact for ISCI Membership

WhotocontactforISCIMembership

AndreRistaino
ManagingDirector,ASCI
DirectPhone:9199909222
Fax:9195498288
Email aristaino@isa org
Email:aristaino@isa.org
Website:http://www.isasecure.org
79
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Q&A

Questions?

80
Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS

Copyright2012,MESAInternational

ThepowerofknowingwhatMESAKNOWS