Assante Pressing NERC Cyber Security Program Forward -Tim Roxey appointment and NERC Alerts changes

Updated 3/29/2009
Michael Assante continues making program progress at NERC since his appointment in August 2008 into a newly formed Chief Security Officer (CSO) position. His focus- establishing Critical Infrastructure Protection (CIP) as one of the mainstream functions at NERC alongside continuing standards development, compliance and enforcement, and reliability assessment programs. Some notable developments:

• The recent appointment of Tim Roxey as NERC as Manager of Critical Infrastructure Protection.
  - Mr. Roxey has extensive commercial nuclear power physical and cyber security program experience.
  - He instrumentally promoted and supported the commercial nuclear power industry initiative addressing cyber with NEI 04-04 Cyber Security Program for Power Reactors as a NRC endorsed “acceptable method” - well ahead of related further regulatory framework development and guidance now firming up. I had an excellent learning opportunity working with Tim Roxey and team as an active Computer Security Standing Committee member back in 2006. The focus then was getting NEI 04-04 packaged up into rollout templated, presentation form for the fall 2006 NITSL workshop.
  - He extensively helped assess and address Aurora vulnerability mitigations- working with NEI to help ensure commercial nuclear generation stepped up and robustly addressed the issue. Tim Roxey also effectively provided congressional testimony on actions taken and completion status - a stark contrast to FERC and NERC testimony.
  - Bottom Line: Tim Roxey's solid industry experience, connections, dedication and savvy add up to a very good move for NERC.

  
  

• A new NERC CIP Alert Communication Process.
  - Communication will use specific email subject lines/levels:
  _ ADVISORY: (Title) - No Response Required
  _ RECOMMENDATION: (Title) - Response Required.
  _ ESSENTIAL ACTION: (Title) - Response Required.
  - Entities acknowledgement required in 24 hours if issue rated higher than Advisory. Grace period on this requirement extends to March 31, 2009 after which responses received after the 24-hour acknowledgement period will be noted as late or non-responsive. Additionally, more sensitive acknowledgement response information may need to be sent via paper until more secure electronic communication facilities established.
  - New alert handling signifiers will future clarify distribution restrictions.
  _ PUBLIC (Green): No Restrictions. Will be posted to NERC’s website alert page.
  _ PRIVATE (Yellow): Restrict to Internal Use and Necessary Consultants / Third-Party Providers
  _ SENSITIVE (Red): Internal Use Only (Do Not Distribute Outside Your Company)
  _ CONFIDENTIAL (Black): Limited Internal Distribution Decided Upon by an Officer of the Company
  - An “alerts manual” instructions book will be developed and released by March 31, 2009 to help entities better understand, organize, and train staff to support the alerts process.
  - More background: Alerts Distribution, Reporting & FAQ - Michael Assante & Doug Newbauer Jan 22, 2009
  
  - Update 3/28- On March 24th, Doug Newbauer, Manager of NERC Alerts, indicated that the deadline for mandatory 24 hours response on alerts will be extended: "In response to feed back from registered entities and because NERC is replacing the current Alerts application, NERC is delaying the 24 hour response requirement scheduled to begin April 1, 2009, until the new application is on line and operational."
  - The application is expected to be prepared and released 3Q2009.

Significant, targeted attacks even against ISPs?-Absolutely! (just ask Time Warner)

One might think that larger financial institutions and other entities with directly exploitable financial or personal information remain the major nexus of criminal cyber problems. However, even consumer grade ISPs are increasing facing challenges. Time Warner's drawn out efforts now in the limelight represent just the latest example of an organization scrambling to address service and reputation impacts from a disrupting cyber security attack.

• February 28, 2009
  
  During the past week, hackers have launched a series of attacks on Time Warner Cable's servers. Time Warner Cable is working with law enforcement agencies to resolve these crimes.
  
  As a result of these attacks, you may have experienced a temporary "outage" when attempting to surf the Web, including an intermittent "page cannot be displayed" error message. The outages did not result in services being 100% unavailable; and were limited to sporadic timeouts which appeared to be random events. Some users may have experienced a total disconnect, however. These types of attacks are not uncommon, especially for a network as large as ours. We suspect that the attackers are using "zombie computers," or hijacking unsuspecting subscribers' machines to perpetrate the attack without its owner's knowledge.
  
  All of us at TWC take these attacks extremely seriously. As previously mentioned, we are working with the appropriate law enforcement agencies that specialize in investigating these types of crimes. We will pursue prosecution of all perpetrators to the fullest extent of the law. We apologize for the inconvenience that these attacks may have caused and encourage you to report any suspicious activity. Instructions for reporting security abuse are located at http://help.rr.com.
  
  Sincerely,
  Time Warner Cable
  
  More: Google News Search: Time Warner Attack

The persistent assault centers on impacting Time Warner’s domain naming system (DNS) services. Given that DNS supports domain name to Internet address resolution functions, e.g., when Internet surfing, an easy mitigation for customers is to use an alternative provider, such as OpenDNS. I've been using both Time Warner and OpenDNS in my home networking environment for years with great results. OpenDNS also helps protect users from visiting known harmful and other inappropriate Internet sites.

Much attention is put on specific, in-scope compliance issues within critical infrastructure organizations. The obvious twist is that even basic, persistent attacks increasingly are a factor in considering overall business risk to service and reputation. Additionally, cyber security problems that affect non-operational, business network settings, also increase the risk of "pivot attacks" creating more serious operational issues that regulators and senior management are acutely concerned with.

From a broader perspective, this issue saliently points out how even narrow, basic attacks can impact an organization and their customers. Critical infrastructure organizations risk even larger potential impacts steming from such issues- driving the need for ongoing cyber security improvements.

Top 10 Reasons to NOT Have a Corporate Cyber Security Program

Updated 8/2/2009
I regularly walk past a humorous list of posted reasons why a corporate project management office is not needed based on Jim Chapman’s 1996 list of “Top 10 Reasons NOT to Use Project Management” Considering the focus on cost and change challenges many IT organizations are facing, this insightful list inspired me to come up with my own Top 10- enjoy:

Top 10 Reasons to NOT Have a Corporate Cyber Security Program

10. Our internal and external customers really love us, so they do not care if company information and systems are appropriately and consistently secured.

9. Corporately organizing to manage cyber security risk is not compatible with our culture, and the last thing we need around this place is change.

8. All cyber security work is easy, with little guidance, direction, or accountability needed, and does not have cost, schedule, or any other significant technical, managerial or operational risks anyway.

7. We are not smart enough to develop an enabling cyber security strategy, program, or architecture without stifling creativity and offending our silos of technical and managerial geniuses.

6. We might have to understand our customers’ requirements and document a lot of stuff for review, input and approval which then would need to be maintained and that is such a bother.

5. Understanding, applying, and maintaining specific, definitive cyber security measures and clearly communicating actual status requires integrity and courage, so they would have to pay me extra.

4. Our bosses will not provide support needed for results; they want us to ensure regulatory and legal requirements, congressional concerns, and other related risks are managed through magic.

3. We would have even lengthier debates and still end up applying arbitrary, overly burdensome cyber security measures to all projects regardless of size, complexity, or risk and that would be stupid.

2. I know there is well-developed cyber security body of knowledge that is applicable to the work I am doing, but it is too hard to understand, apply and help us improve with anyway.

1. We figure it is more beneficial to put increasing time and money into cyber security independently in various areas and accept a growing, uneven and obscure patchwork of results than to have an organized, more transparent company approach.

Disclaimer: While there may be times when one or more of the Top 10 resonate, an effective cyber security program should help clearly refute this list at every opportunity.

There continues to be sporadic debate about whether or not IT Security should be viewed as a profit center versus the cost center realty that the vast majority of practitioners work in, e.g., Mike Rothman’s recent commentary: Compliance is SO a Cost Center. Regardless of how security is organized and executed, the best justification approach around security improvements focuses on business benefit in the form of cost savings or value, centered on mutually well understood reality.

Many organizations are under increasing pressure to deliver more with internal resources, including addressing growing security expectations, and keeping costs contained. While the means and alignment to meaningfully execute and maintain security improvements remains vital, an even more important success factor in my opinion to manage such risk over the long term requires clearly articulating an overall company program. The program - however thick or thin in scope and resourcing - provides the means for ongoing leadership driven attention to risk management, policy, goals, results, preparations, with sufficient transparency and organizational support across various groups, compliance programs, and increasingly interested and engaged management.

Cyber Security Happy New Year 2009 - Perspective and Predictions

Updated 1/31/2009

2008 Perspective - hot stories and list of lists.

• Most Popular Sites Were Hacked in '08 - eWeek, Jan 22, 2009
• More Cyber Security Regulations Recommended - Washington Post, Dec 8, 2008
• Cisco: Cyber Attacks Are Growing More Sophisticated, Targeted, TMCnet, Dec 15, 2008 - more: “Cisco Annual Security Report” for 2008
• US Homeland Security Still Without Cybercrisis Plan, CNET News, Dec 19, 2008

• Top Five Cyber Security Stories - Information Security Magazine, Dec 29, 2008
  1. SQL injection attacks
  2. Hannaford Brothers supermarket breach
  3. Dan Kaminsky and DNS dangers
  4. Microsoft Vista adoption issues
  5. Slowing the spam surge
  Also noted:
  - Linux Kernel attack code worries security experts
  - Microsoft addresses XSS in Internet Explorer
  - New attacks reveal fundamental problems with TCP i.e. sockstress
  - Microsoft releases Out of Cycle Windows patch to stop worm attack

• Top Ten SCADA Security Stories of 2008 - Digital Bond
  1. Vulnerabilities now being discovered by non-control system companies e.g. Core
  2. Process Control System Forum (PCSF) demise
  3. FERC throws NERC under the bus / Congress warms to regulation
  4. Published control system exploit code in form of metasploit module - yikes
  5. Blue Ribbon CSIC cyber security recommendations for Obama
  6. Very active SCADASEC list started
  7. Control System vulnerabilities as “Candy To The Press”
  8. Bandolier Security Audit Files audit hundreds of configuration elements.
  9. CIA FUD quote from Tom Donahue from CIA
  10. Water Sector roadmap progress.
  

2009 Predictions - more hot stories and list of lists.

• Cyber security issues take center stage in 2009, Control Engineering, IL - Jan 5, 2009
• Cyber Crime: The 2009 Mega Threat- CSO Magazine, Dec 16, 2008
• Combating Cyber Crime: Global Network Operates 24/7, FBI, Jan 14, 2009- “sophistication of our adversaries is growing”
• Hackers to exploit economic downturn in 2009 - VNUNet.com, UK - Jan 20, 2009
• McAfee publishes 2009 threat predictions IT Examiner, India - Jan 21, 2009
• Spam still causing IT headache: reports Computer Business Review, UK - Jan 22, 2009
• Security Expert: Fight Cyber-Crime Through Procurement, Government Technology, CA - Jan 30, 2009

• Top 9 security predictions for 2009, ZDNet Australia, Jan 5, 2009
  1. More bang for the buck: Security consolidation and then some
  2. Information security lockdown e.g. mandatory PCI application firewalls
  3. Web 2.0 vulnerabilities multiply
  4. Bigger pipes, faster speed: Letting in the good, bad and ugly
  5. The next biggest threat to mobile security: 3G
  6. More cash to flow in the digital underground
  7. Let the games begin – more cyber mayhem in the gaming world
  8. Premeditated, targeted attacks on the rise
  9. Law enforcement unite online

• SANS Technology Institute: 2009 Security Predictions – Jan 21, 2009
  Broad mix of contributions: more control system issues, compromise of large PCI compliant company (fulfilled), etc
  
  

Cyber Security Debacle- Update on World Bank 'Unprecedented Crisis'

It’s been months of stonewalling and denials during a series of FOXNews.com reports covering a variety of in-house World Bank scandals including (i) targeted cyber security attacks breaching their most sensitive financial data and (ii) corruption issues with sanctions against at least one supplier determined guilty of wrongdoing. The latest twist, a leading India-based information technology vendor, Satyam Computer Services was barred in February from all business with the bank for a period of eight years — the ban started in September.

Some highlights:

The World Bank provides financial and technical assistance to developing countries, governed by a board of 180+ member nations, with the mission “Working for a World Free of Poverty.”

• "From 2003 through 2008, as FOX News reported, the World Bank paid Satyam hundreds of millions of dollars to write and maintain all the software used by the bank throughout its global information network, including its back-office operations. The engagement scope involved overseeing data that ranged from accounting and personnel records to trust funds administered for many of the world's richest nations."
  
  
• "Satyam was straying badly across the bank's ethical warning lines. In 2005, the bank's chief information officer, Mohamed Muhsin, was ousted after being accused of improperly buying preferential stock options from Satyam, even as he awarded the firm major contracts. A top-secret investigation led to Muhsin being banned permanently from the bank in January 2007. But for reasons that remain unclear, Satyam was allowed to remain in control of the bank's information network until early October 2008"
  
  
• According to FoxNews.com reporting in October, World Bank employees were ordered to change their passwords three times over a three month period as a response to the attacks, which spanned somewhere between 18 and 40 servers in multiple hacks. According to the report, there were six major break-ins in the past year, and that at least five servers containing sensitive data were exposed. FoxNews obtained apparent internal e-mail messages regarding the attacks characterizing a complicated series of events and the agency’s response to them.
  
  
• “In a frantic midnight July 22nd e-mail, e-mail to colleagues, the bank's senior technology manager Rakesh Asthana, referred to the situation as an "unprecedented crisis” and that "the passwords that have been compromised may have accessed data." An e-mail from July 10 explains that a minimum of 18 servers may have been compromised and that five of them contained sensitive data. Yet an Aug. 19 memo from the bank's CIO, Guy-Pierre De Poerck, downplays the severity of the situation. The staff memo says that controls on external Web sites have been tightened, that passwords have been reset, and that RSA SecurID tokens have been deployed for Web mail access. It concludes that "there is no evidence that bank staff personal information is at risk from the recent external attempts."
  Editorial note: Guy-Pierre De Poerck no longer works at World Bank.
  
  
• “It is still not known how much information was stolen. But sources inside the bank confirm that servers in the institution's highly-restricted treasury unit were deeply penetrated with spy software in April. Invaders also had full access to the rest of the bank's network for nearly a month in June and July. In total, at least six major intrusions — two of them using the same group of IP addresses originating from China — have been detected at the World Bank since the summer of 2007.
  
  
• “It may be the worst security breach ever at a global financial institution. And it has left bank officials scrambling to try to understand the nature of the year-long cyber-assault, while also trying to keep the news from leaking to the public."
  
  
• Video Interview: World Bank Hack - FOXNews 10/10/2008

Some thoughts:

While this isn't your typical bank, banking and the financial sector as a whole is known to generally have much better cyber security than most sectors. It’s alarming that this situation drug out for so long after surfacing internally.

Besides the alleged repeated CIO-level inside dealing by a gorilla-scale outsourcer, a more fundamental issue was the abdication by management in addressing information security risks. Having CIOs released from employment and named security leadership temporarily in charge will help. Perhaps large gaps in fundamental information security controls are now finally being addressed. Certainly a lack of programmatic incident handling preparations contributed to the problems before Fox News broke the story.

Before saying “It can’t happen here.”

How well is your incident handling program developed? What happens to you and your organization if or when breached by targeted attacks? What about your increasing exposure with outsourcing and how risk is being managed? How about robust enclaves for your critical systems? Do you really have defense in depth with graded, inside-out protective measures? Are there definitive, complimentary, and auditable MOT controls, i.e., managerial, operational, and technical, in place for your more critical settings that clearly provide and support defense in depth capabilities, i.e., deny, detect, deter, recover? Who is watching the watchers? How is management being kept abreast of status? Are there regular, transparent reviews involving key internal stakeholders? Are there improvement planning cycles involving decision makers and are the plans being completed and results objectively reviewed?

- Think could only happen in the financial sector?

What if emergent problems persisted and pulled you and your information security team deeper into the mix after repeated missteps? How do you ensure that your response is viewed as part of the solution and not increasingly part of the problem? What if your organizational leadership "duck and covers" when pressed by providing a shifting story while investigative reporting eagerly pry out pieces of the truth and report it all?

- Are you just another easy mark?

Just how developed is your incident handling policy and procedures with senior management support to help address when escalating cyber security problems really hit the fan?

- Still comfortable?

More:
- World Bank Besieged By Hackers, Or Not, Information Week, 10/10/2008
- World Bank Removes Chief Information Officer, FOXNews.com, 11/27/2008
- World Bank Admits Top Tech Vendor Debarred for 8 Years, FOXNews.com, 12/24/2008

Clock is Ticking for First Round of Pending Changes to NERC CIP Standards - Comments due Jan 5th

Driven by Cyber Standards Final Rule - FERC Order 706, the first revision to NERC CIPs addressing cyber security requirements for bulk electric operations is out for review and comments by Jan 5th, 2009. This round of changes include removal of significant amount of wiggle room based on "business judgement", includes explicit senior management approval of risk methodology (not just critical assets lists), background checking must be completed before permitting access (not in parallel), and tightens up timeframe requirement for addressing security issues among other changes.

• "Emphasis on Order 706 directive for NERC to address revisions to the CIP standards considering applicable feature of the NIST Security Risk Management Framework among other resources. "
• While this process with NERC CIPs may seem difficult, at least there is the benefit of continuity. Congressional testimony last year and this year raised serious questions about NERC's ability to be an effective ERO for FERC - NERC Aurora handling and arguably misleading testimony creating much of this pain, NERC still not out of the woodshed. Last year testimony also suggested getting rid of CIPs and starting fresh based more on NIST standards as recommended by Mr. Joe Weiss (jump to 2:12:50 for his opening comments in video):
  - “The Cyber Threat to Control Systems: Stronger Regulations are Necessary to Secure the Electric Grid.” - Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology, Oct 17th, 2007 (video/submittals)
  

Better buckle up, this is just the first round of Order 706 driven changes.

• "The SDT met on October 6–8, 2008 and because of the extensive scope and varying complexity of the issues and work in these revisions, the team decided on a multiphase approach for revising this set of standards. This posting of the cyber standards for industry comment only relates to Phase I of the project. "

More:
- Cyber Security (Project 2008-06 Site) - The Cyber Security SDT posted its first draft of revised Cyber Security standards (CIP-002-1-CIP-009-1) for a 45-day public comment period starting November 21, 2008 and ending on January 5, 2009. Both clean and redline versions (zip files) are available for download and review.
- Revised NERC CIP standards out for 45 day comment period, Digital Bond 11/24/2008
- Cyber Standards Final Rule - FERC Order 706, NERC Workshop Presentation (informative 72 slides), 5/13/2008
- Drafted Changes Summary, NERC Comment Form

My Top Cyber Security Sites - Bookmark This!

Last Updated: 1-10-2010

Here's my developing list of top cyber security sites and podcasts with supporting rational.

A. Situational Awareness:

1. US-CERT: United States Computer Emergency Response Team
   This is the very first place I check every day for a quick take on relevant threatscape information - i.e. Current Activity and Alerts. Simple click to drill in on full listing of active national Technical Security Alerts, Bulletins, Vulnerabilities, etc. Clean, well organized site with great coverage of a number of key cyber security topics.
2. DHS Daily Open Source Infrastructure Report
   A must read, great source of daily critical infrastructure protection related news organized by sectors and key assets as defined by the National Infrastructure Protection Plan with linked open source references. e.g. Energy, Nuclear Reactors, Government Facilities, Information Technology, Communications, etc.
3. SANS Internet Storm Center- Handler's Diary
   Especially useful for developing situations- these are the folks that go deep into nitty-gritty details addressing the latest Internet security problems.

B. Program Development:

1. CISOHandbook.com: Resource site for CISO's, CSO's, and security professionals.
   Metrics, tools, opinions, and most importantly access to CISO's, CSO's, experts, and other professionals in the field of security. Shares information, ideas, tips, and techniques for addressing security issues faced by today's professional. Content is free; however, some areas require using a registration logon for access.  Their latest book  goes beyond program centered engagement specifics to provide a deeper understanding into what it takes for longer term results. It explains and underscores what really matters in organizations to ensure security programs - regardless of budget and expertise applied to form them up- do not devolve as many do, like an ice sculpture melting into a useless puddle, while internal areas look on- recommended reading:   CISO Soft Skills: Securing Organizations Impaired by Employee Politics, Apathy, and Intolerant Perspectives 
2. Security Manager's Journal - ComputerWorld
   Since 2002, a regular series of timely security manager articles addressing real world situations very simliar to a number of challenges many organizations face. The specific companies and assorted ghostwriters remain anonomous to help protect sources while gaining insight from often entertaining real-world hard knocks. Think your job is tough?
3. CSO Online - Security and Risk
   A sister publication of CIO Magazine, this is the primary trade magazine many follow with the latest enterprise views: headlines, data protection, identity & access, business continuity, physical security, leadership, and some solid blogs.
4. NIST, Computer Security Division, Computer Security Resource Center
   Regulatory trajectory is promising to get more "NISTy" for critical infrastructure organizations and this site provides a front door to the National Institute of Standards and Technology well regarded Special Publications, related FIPS requirements, and drafts organized by topic clusters, etc. Great complement to an overall framework.
5. CERT's Podcast Series: Security for Business Leaders
   Robust cyber security is increasingly a non-negotiable requirement for organizations. Moving corporate culture forward cooking security in poses challenges that must be overcome. CERT has a well done podcast series addressing key principles and strategies: Governing for Enterprise Security, Measuring Security, Privacy, Risk Management and Resilience, Security Educations and Training, Threats, Trends and Lessons Learned, Tips from the Trenches.

C. Perspectives and Professional Development:

1. KrebsonSecurity: In-depth security news and investigation.
   Brian Krebs worked as a reporter for The Washington Post from 1995 to 2009, authoring more than 1,300 blog posts for the Security Fix blog, as well as hundreds of stories for washingtonpost.com and The Washington Post newspaper, including eight front-page stories in the dead-tree edition and a Post Magazine cover piece on botnet operators.
2. Digital Bond: Control System Security Research and Consulting
   Digital Bond is a control system security research and consulting practice. They have years of security experience from the National Security Agency (NSA), National Labs, large asset owners and leading security equipment providers.perspective. Resources include the well maintained blog, monthly podcast with industry expertise, presentations, annual "S4" research conference proceedings, research, and a solid SCADApedia reference.
3. ITRadio.com.au: Risky Business Podcast with Patrick Gray
   Excellent latest news coverage and regularly featured interviews all professionally done. Great, timely coverage of hot security topics from the experts closest to the action- all done in a way to help ensure those listening are entertained and gain valuable perspective.
4. Manager Tools Podcasts
   Want to become a more effective leader and manager? This weekly podcast helps with fresh tools and easy techniques for real-world settings that go beyond theory into specific actions that can be used right away to improve your performance. A key set of "the basics" provide a strong starting point you can immediately apply and build on!

Helpful input welcome.

FTC Will Delay 'Red Flags' Rule Enforcement for Six Months

Some Good News on FACTA!
Looks like a number of utilities will get a break in enforcement action with FTC granting a six-month delay. However, this repreave is just for FTC enforcement, and won't affect other federal agencies' enforcement of the original Nov 1, 2008 deadline.

>FTC Will Grant Six-Month Delay of Enforcement Action , FTC Announcement
>More on FACTS (Fair and Accurate Credit Transactions Act) - Wikipedia Overview/Links

Microsoft Emergency Security Update (Ouch)- Can't Patch Control Systems?- Sockstress TCP Vulnerability Issues Next?

On Thursday 10/23, Microsoft spiced up our lives with a emergency security update (i.e. Microsoft Security Bulletin MS08-067 – Critical) to address a “wormable” vulnerability specifically exploiting “Server” service via remote network remote procedure calls (RPC). Similar to Blaster, unmitigated vulnerable machines can be directly attacked at a network level and immediately, completely compromised. This particular problem is also extremely exploitable once understood; security firm Immunity was able to craft a working exploit within two hours after the release of the security fix.

Don’t Neglect Control Systems- especially Critical Infrastructure. While many business network environments are going through the test and deployment process (not without some problems – e.g. some reported breakage of IPSEC), there’s also a need to be thinking about critical infrastructure as it increasingly is depending on Microsoft based solutions. These type of problems underscore how the network environment and it’s management infrastructure are such an important and fundamental starting point for establishing and sustaining a defined, effective, defense-in-depth security posture. Many may assume that the environments are well separated by definition; however, when you don’t get the control system network right (or at least sufficient), it undermines everything else being done in the name of security.

Beyond layered network segmentation with strict boundary communication controls as a vital starting point, basics that are increasingly expected include protective network chokepoints (firewalls, gateways, etc), and secure information transfer facilities (DMZs, Data Diodes, NIPS, etc). Other important steps often overlooked include basics such as server system hardening and endpoint protection measures (e.g. AV, HIPS, white listing, etc). As more is done in the name of security, the solutions themselves need to be managed and protected in a scalable manner- perhaps with a distinct network security management environment- also with commensurate protection.

Having well formed mitigations in place in control system settings will help directly address risks from emergent security problems such as this and be in a good position when facing related regulatory scrutiny. Typical business network environments are strikingly different – often quite porous and flat, with less definitive countermeasures- and therefore pressing forward with patches and security updates on a regular basis across a substantial IT foot point. These are very different environments only suited for very specific, understood and controlled interactions - having solid network security controls between the two environments is an essential part a well articulated cyber security architecture.

More- DHS Control Systems Security Program, Idaho National Laboratory offers the following tools:

• Catalog of Control Systems Security: Recommendations for Standards Developers
• Control System Cyber Security Self-Assessment Tool (CS2SAT)
• CSSP Documents
• Critical Infrastructure and Control Systems Security Curriculum
• Cyber Security Procurement Language for Control Systems
• Recommended Practices
  - Control Systems Cyber Security Defense in Depth Strategies
  - Creating Cyber Forensics Plans for Control Systems
  - Good Practice Guide on Firewall Deployment
  - Hardening Guidelines for OPC Hosts
  - Mitigations for Security Vulnerabilities Found in Control System Networks
  - Securing Control System Modems
  - Securing WLANs Using 802.11i (draft)
  - Securing ZigBee Wireless Networks in Process Control System Environments (draft)
  - Using Operational Security (OPSEC) to Support a Cyber Security Culture in Control Systems Environments (draft)
• Training - including several introductory web based courses:
  - Cyber Security for Control Systems Engineers & Operators
  - OPSEC for Control Systems (NEW)

What's Next- Sockstress Issues? How about long standing weaknesses involving TCP network stack vulnerabilities recently gaining attention with "Sockstress" that can be exploited to cause reachable systems to lockup, denial-of-service (DOS)? Indications are that even an attack at one packet per second can take systems down - e.g. dialup Internet. Because this is a state based attack, can't use spoofed packets but even small bot farms are sufficent to carry this attack out.
> Vendors fixing bug that could crash Internet systems Computerworld, Norway - Oct 2, 2008
> SecurityNow! Episode 164: Sockstress - Oct 2, 2008

Cyber Security Awareness Month In Full Force-Threats to Security Never Sleep!

Every year my group helps support a company wide awareness campaign and that coincides with National Awareness month. Videos, games, posters, online question and answers... and of course booty with some great top prizes (ipods, security system, etc). Yes, enthusasim isn't enough- folks need to enage and submit correct answers to be in drawings. As for the goodies being drawn, we continue to get much of it just for the asking from our suppliers ahead of the event (explaining our internal campaign and asking "would they like to help us out", etc ) - no strings.

Nationally, many "free" resources continue to be developed by non-profits and governmental sources. Some the best of these online sources follow and are worth taking note of as this month winds down.

> National Cyber Security Alliance
- Top 8 Cyber Security Practices

1. Protect your personal information. It's valuable.
2. Know who you're dealing with online.
3. Use anti-virus software, a firewall, and anti-spyware software to help keep your computer safe and secure.
4. Be sure to set up your operating system and Web browser software properly, and update them regularly.
5. Use strong passwords or strong authentication technology to help protect your personal information.
6. Back up important files.
7. Learn what to do if something goes wrong.
8. Protect your children online.

> EDUCAUSE's Online Cyber Resource Kit

> MS-ISAC Multi-State Information Sharing and Analysis Center
- webcast, Cyber Security Tool Kit, etc.

> OnGuardOnline.gov
- more information, phamplets, etc

Neat DHS/NCSD Cyber Security Vulnerability Assessment Tool (CSVA) + CS2SAT

Last updated 8-2-2009
DHS’s National Cyber Security Division (NCSD) has been working to develop an objective, comprehensive cyber security vulnerability assessment (CSVA) tool for some time and revving through Betas. Using a simplified methodology, the CSVA is aimed to quickly assess an organization, facility or system’s cyber vulnerabilities and recommend options with extensive helpful explanations and examples. Critical infrastructure sectors are encourage by DHS to use this tool to analyze their cybersecurity posture.

I recently got my hands on and fired up CSVA BETA 5 - some thoughts:

• Best if performed with prepared team and good facilitation. Cyber security knowledgeable folks familiar with the assessment environment can get a running, upfront start.
• An initial determination is made regarding if a Business Network or a Control System is being assessed and adjusts approach- very good!
• Truth over harmony needed here folks - some questions are combination issues and not all the answers to pick from fit well. Pick the most conservative answers and capture views in comments to get through the process.
• Credibility bolstered in assessment process with a virtual informed third-party (DHS/NCSD) cooked in.
• Can save assessment, go back and make adjustments for what ifs or actual improvements and see results.
• Strives to leverage concepts from recognized cybersecurity standards and guidance- e.g. ISO,COBIT, NIST, etc
• Offers great benefit lift ratio for effort required. Being "free" helps too!

Bottom line. The CSVA journey is a short, easy trip and the results are well worth it. The tool offers a solid approach to further develop shared understanding of cybersecurity posture with various stakeholders to build on and prioritize improvements, For more information or a copy of the tool, contact the Critical Infrastructure Protection / Cyber Security Program within the DHS National Cyber Security Division at ncsd_cipcs@hq.dhs.gov
-
Next- the CS2SAT. For those needing to go beyond the CSVA’s high-level approach and focus on more specific risk particulars- factoring in consequences, network topology, requirements, etc - there’s the Control System Cyber Security Self Assessment Tool (CS2SAT) Haven't looked at it yet but planning to give it a whirl at some point - list pricing, e.g., $1800, is waived ("free") for many energy organizations.

Update 8-2-2009 - Per DHS, the CSVA will be integrated into upcoming versions of the CS2SAT . The latest Version 2 of the CS2SAT is now specifically configurable to address NERC CIP, SANS, etc for assessment activities. Works a lot like the CSVA - but focused on control system space for now (until CSVA transitioned). DHS is very committed to the CS2SAT approach- given freely at one day Industrial Control System cyber security courses - worth checking out.

Protecting the Electric Grid from Cyber-Security Threats

On Thursday 9/11/08, the Subcommittee on Energy and Air Quality (of the Committee on Energy and Commerce) held a hearing on the state of Cyber Security with respect to the electric grid. FERC, NERC, and APPA were represented. The focus is taking drafted legislation forward to provide FERC more cyber security emergency authority to address new and often rapidly developing cyber security risks.

Protecting the Electric Grid from Cyber-Security Threats
Subcommittee on Energy and Air Quality
Committee on Energy and Commerce
- 9/11/2008 testimony, audio, and drafted legislation

CSPAN Video now available (requires Realmedia player)

Opening comments emphasized views that the risk is increasing with at least twenty incidents of cyber security problems impacting electric systems service. There’s a strong concern in addressing underlying control systems, vital to reliable service, given growing risk with increasingly interconnectivity and use of widely available technology. The risk picture will continue to be developing with the trends toward Smart Grid and other control system dependent technology developments.

FERC Interviews. Testimony emphasized FERC findings from interviews with 30 utilities – including particular actions taken to address NERC voluntary Aurora Vulnerability advisory in 2007:

• Of the 30, seven were viewed as in full compliance with the advisory.
• All took some steps - one still still using all default passwords, another had a 10 year plan.
• Only 2 went sufficiently far enough to fully address the Aurora vulnerability.
• A number of organizations shrunk scope too small - not sufficiently addressing critical assets/facilities that can affect the bulk electric system.
• Cost estimates addressing the Aurora Vulnerability were not gathered in the process- but viewed as important by the committee with FERC in agreement- more relevant going forward.

The conclusion- self-interest alone is not sufficient for most utilities to take appropriate actions to specifically address the Aurora Vulnerability. This situation fueling strong congressional concerns about how well the regulators and utilities are addressing overall cyber security risk.

Existing FERC/NERC regulatory mechanisms are viewed as insufficient, either lacking enforcement strength (e.g. voluntary NERC Advisories) or take too long following 215 process. APPA emphasized cooperation with FERC staff in developing drafted legislation giving DOE/FERC emergency order making powers address cyber security issues- with still a few remaining points in disagreement.