1
Q
What are the three phases of the IACS lifecycle?
A
Assess, Develop & Implement & Maintain
2
Q
A zone is assigned a target security level (SL-T) during the … phase?
A
Assess
3
Q
Countermeasures are implemented to meet the Target Security Level (SL-T) during the … phase?
A
Develop & Implement
4
Q
During the … phase, you ensure the achieved security level (SL-A) is better then or equal to the Target Security Level (SL-T)?
A
Maintain
5
Q
What are the three areas of the Assess phase?
A
High-Level Cyber Risk Assessment
Allocation of IACS Assets to Security Zones or Conduits
Detailed Cyber Risk Assessment
6
Q
What are the continuous processes?
A
Cybersecurity Management System: Policies, Procedures, Training & Awareness (IEC 62443-2-1)
Periodic Cybersecurity Audits (IEC 62443-2-1)
7
Q
What are the four areas of the Develop & Implement Phase?
A
Cybersecurity Requirements Specification (ISA 62443-3-2)
Design and engineering of Cybersecurity countermeasures (ISA 62443-3-3)
Design and development of other means of risk reduction
Installation, commissioning and validation of Cybersecurity countermeasures
8
Q
What are the two areas of the Maintain Phase?
A
Cybersecurity Maintenance Monitoring and Management of Change (ISA 62443-2-1)
Cyber Incident Response & Recovery
(ISA 62443-2-1)
9
Q
Venn Diagram
A
10
Q
How does an Asset Owner use ISA/IEC 62443-2-1?
A
Asset Owner selects risk assessment methodology, assigns roles and responsibilities, ensures appropriate training, resources, etc.
11
Q
How does an Asset Owner and ISP use ISA/IEC 62443-3-2
A
Asset Owner and Integration
Service Provider use this part
to assess the risks of the
(SuC) System under
Consideration and meet with
the different ZCR’s (Zone and
Conduit Requirements)
12
Q
How does an Asset Owner and ISP use ISA/IEC 62443-3-3?
A
Asset Owner and Integration
Service Provider use this part as a
guidance to bridge from risk
assessment outcome towards
system related security
requirements based on assigned
SL-T (Security Level Target).
13
Q
How does a Product Supplier use ISA/IEC 62443-3-3?
A
Product Suppliers use this part to
understand what needs to be
developed to meet the needs of
the market for a specific type of
system.
14
Q
How does a Product Supplier use ISA/IEC 62443-4-1 and ISA/IEC 62443-4-2?
A
Product Supplier uses these
parts to understand the
requirements placed on
control system components
for specific security
capability levels (SL-C) and
develop the components
accordingly.
15
Q
What is a SuC (System Under Consideration)?
A
An SuC (System Under Consideration)
consists of multiple IACS assets
ranging from tens of assets to
hundreds or thousands of them
16
Q
What is the Necessary Information that needs documenting to perform a Risk Assessment? (Prepare phase)
A
- Define the goals of the Risk Assessment
- Clearly document the IACS and associated assets
- Develop a common, up-to-date understanding of the IACS
- Regulations, policies, etc.
– Government
– Industry
– Company - Gather and organize information such as architecture
diagrams, devices, configurations, known vulnerabilities - Define roles and responsibilities
- Establish training requirements
17
Q
What are the Key Components to gather in the prepare phase?
A
- System architecture diagrams
– Physical
– Functional - Network diagrams
– Segments
– Networking components - Asset inventory
- Criticality assessment
- Process flow
- Data flow
- Business processes
18
Q
What is the purpose of System Architecture Diagrams?
A
*Illustrate the components of
the system
* Illustrate connectivity
* Illustrate physical location
19
Q
What are some System Architecture Diagrams Recommendations?
A
- All IACS functionality is graphically represented on at least one
IACS Architecture drawing - Present the information following the ISA-62443-1-1 Reference
Model
– Based on the ISA-95 - Include images/pictures of the IACS hardware components to
provide context and assistance in identifying the equipment
on site - Color code or use different line types for different networks
and network segments
20
Q
How many ISA-95 Functional Layers?
A
5 = (0,1,2,3,4)
21
Q
What is ISA 95 Level 0?
A
Level 0 — The physical process — Defines the actual physical processes.
22
Q
What is ISA 95 Level 1?
A
Level 1 — Intelligent devices — Sensing and manipulating the physical processes. Process, sensors, analyzers, actuators and related instrumentation.
23
Q
What is ISA 95 Level 2?
A
Level 2 — Control systems — Supervising, monitoring and controlling the physical processes. Real-time controls and software; DCS, human-machine interface (HMI); supervisory and data acquisition (SCADA) software.
24
Q
What is ISA 95 Level 3?
A
Level 3 — Manufacturing operations systems — Managing production workflow to produce the desired products. Batch management; manufacturing execution/operations management
systems (MES/MOMS); laboratory, maintenance and plant performance management systems; data historians and related middleware. Time frame: shifts, hours, minutes, seconds.
25
What is ISA 95 Level 4?
Level 4 — Business logistics systems — Managing the business-related activities of the manufacturing operation. ERP is the primary system; establishes the basic plant production schedule, material use, shipping and inventory levels. Time frame: months, weeks, days,
shifts.
26
ISA95 Level 3 and below is the ... domain?
Control
27
Level 1-2-3 Functions (Control Domain) are critical to what?
* The function is critical to plant safety
* The function is critical to plant reliability
* The function is critical to plant efficiency
* The function is critical to product quality
* The function is critical to maintaining regulatory compliance.
– Usually, product or environmental related
– This includes such factors as safety, environmental, and cGMP
compliance (FDA, EPA, USDA, OSHA, …)
28
Key overview of Network Diagrams
* Detail how the network is physically and logically constructed
* Individual routers, switches, firewalls are shown symbolically
* Switch port assignments are identified
* VLANS are documented
* May or may not show hosts (e.g. devices plugged into
switches)
29
Briefly learn the network icons
30
Taxonomy of Asset / Components
*Host Devices
* Embedded Devices
* Network Devices
* Software Applications
31
Key overview of Asset Inventory?
*Facilities should maintain a list or database of all IACS and SCADA hardware (physical and virtual) and software
* Compiled through documentation and site survey
* Automated tools can be used to gather this data
* Automated tools should be carefully tested to ensure they do not impact system availability or integrity and do not introduce security
vulnerabilities
32
What should a hardware asset inventory include? (high level)
Hardware inventory should include:
– Computers (e.g., servers, workstations)
– Network equipment (e.g., switches, routers and firewalls)
– Automation devices (e.g., PLCs, DCSs, VFDs, RTUs, etc.)
* List should include all devices with Ethernet connection and an
IP address
* Devices with routable serial protocols (e.g. ControlNet,
Profibus, Modbus TCP, etc.) should also be included
33
What are the attributes that should be recorded for all hardware devices? (Detailed inventory)
The following attributes should be recorded for all hardware devices:
– Device or System Name
– Asset ID
– Device Type
– Function
– Network interface(s)
– Network address(es)
– Manufacturer
– Model
– Serial Number
– Operating system and version (if applicable)
– Firmware versions (if applicable)
– Responsible organization/individual
– Physical Location
– Notes
34
For virtual hardware, what are the attributes that should be captured in the hardware inventory?
*Virtual machines (VMs) should also be documented
* The following attributes should be recorded for all virtual hardware:
– VM name
– VM Type
– Function
– Network interface(s)
– Network address(es)
– Host Name/ID
– Host type
– Operating system and version
– Responsible organization/individual
– Custodian(s) (Admin)
– Notes
35
What should a software asset inventory include? (high level)
Software inventory should include:
– Firmware
– Operating systems
– Databases
– Applications
(FODA)
36
What are the attributes that should be recorded for all software devices? (Detailed inventory)
At a minimum, the following attributes should be recorded for all software:
– Software Name
– Software type (e.g. OS, application, database, firmware, etc.)
– Function
– Host Name
– Host type (physical or virtual, server or workstation, network device, controller, etc.)
– Vendor
– Version
– Responsible organization/person
– License information
– # of Licenses
– Location of License
– License Expiration Date
– Update/Patch Process
37
Name the different types of Asset Inventory Tools?
* Network management tools
* Software Asset Management (SAM) tools
* Configuration management tools
38
Examples of Network Management Tools (Asset Inventory)
* Solarwinds
* Spiceworks
* Open-AudIT
* Lansweeper
* OpenNMS
* WhatsUpGold
* Siemens PRONETA
* Hirschmann HiVision
* Moxa Mxview
* Nozomi
* Claroty
39
Examples of Software Asset Management Tools (SAM)
* Microsoft Assessment and Planning Toolkit (MAP)
* Microsoft System Center
* IT Asset Tool
* System Information for Windows (SIW)
* WinAudit
* Spiceworks
* Microsoft Software Inventory Analyzer (MSIA)
40
Examples of Configuration Asset Management Tools
* Rockwell - AssetCentre
* PAS - Integrity
* Auvesy-MDT - Octoplant
41
What is a walkthrough?
* Visual inspection of the system
* Physical security review
* Compare drawings with actual
installation
* Observe operating environment
* Interview operational personnel
42
When preparing for a risk assessment a ... approach is preferred?
Combined Approach Preferred
Asset Owner and Integration Service Provider will understand the SuC better by combining different approaches:
* Documentation Analysis
* Assisted Analysis with tools
* Walk through the plant
43
What is a Threat Source?
* The Threat Source is the entity that can manifest a threat.
* It may be a person or a group of people or it may be an object
such as hardware or software.
* It may even be an environmental event such as a fire or flood.
* When identifying the threat source, it is helpful to identify some
of the characteristics of the source such as its location,
capability and motivation.
44
What are the factors that affect the Threat Environment?
* There are several factors that may affect the threat
environment of a SUC, including the geo-political
climate, the physical environment and the sensitivity
of the system.
45
How can threats be identified?
– ICS-CERT (https://www.us-cert.gov/ics)
– Enisa(https://www.enisa.europa.eu/)
– Local Government
– Industry specific ISAC (Information Sharing and Analysis Center)
– IACS Product suppliers
– Anti-Malware vendors
– Industry advisory groups
46
What are the Common Threat Sources?
* Authorized internal personnel
* Authorized 3rd party
* Unauthorized internal personnel
* Unauthorized external person (hacker)
* Malware
* Equipment
* Environment
47
What is a threat vector?
The Threat Vector is the means the threat source may utilize to
compromise the zone or conduit.
48
What are the four Common Threat Actions?
Spoofing
Tampering
Information Disclosure
Denial of Service
49
What is spoofing?
Assuming the identity of another user or device
50
What is Tampering?
Making unauthorized changes to a program, configuration or data
51
What is Information Disclosure?
Unauthorized redirection of data
52
What is Denial of Service?
Delaying or blocking the flow of information
53
Authorized support personnel logically accesses the process control zone using an infected laptop that results in a threat vector for
a virus infection
What is the threat actor? What is the threat vector?
TA: Authorized support
TV: Infected laptop
54
What is a Threat Catalog?
A threat catalog enlists the main categories of threat sources and what type of threat they can manifest. It serves as a check list during the Risk Assessment. (Asset owner)
* Criteria for choosing Threat Sources and Actions consistently with
ISA/IEC-62443-3-2 methodology should also be created and approved by the Asset Owner
* Realistic Threat Scenarios will be used during a Detailed Cyber Risk
Analysis to take good decisions that mitigates the intolerable risk, and to determine security levels for each zone and conduit
55
What is a vulnerability?
A vulnerability is any flaw or weakness in a system's design,
implementation, or operation that could be exploited to compromise
the system
56
Broad cases of vulnerabilities are?
Broad classes of vulnerabilities:
– Policy & Procedural
– Architecture & Design
– Configuration & Maintenance
– Physical
– Software
– Communication & Network
57
Give examples of Policy & Procedural Vulnerabilities
Inadequate security policy for the ICS
No formal ICS security training and awareness program
Absent or deficient ICS equipment implementation guidelines
Lack of administrative mechanisms for security policy enforcement
Inadequate review of the effectiveness of the ICS security controls
No ICS-specific contingency plan
Lack of configuration management policy
Lack of adequate access control policy
Lack of adequate authentication policy
Inadequate incident detection and response plan and procedures
Lack of redundancy for critical components
58
Give examples of Architecture & Design Vulnerabilities
Inadequate incorporation of security into architecture and design.
Insecure architecture allowed to evolve
No security perimeter defined
Control networks used for non-control traffic
Control network services not within the control network
Inadequate collection of event data history
59
Give examples of Configuration & Maintenance Vulnerabilities
Hardware, firmware, and software not under configuration management.
OS and vendor software patches may not be developed until significantly after security vulnerabilities are found
OS and application security patches are not maintained or vendor declines to patch vulnerability
Inadequate testing of security changes
Poor remote access controls
Poor configurations are used
Critical configurations are not stored or backed up
Data unprotected on portable device
Passwords generation, use, and protection not in accord with policy
Inadequate access controls applied
Improper data linking
Malware protection not installed or up to date
Malware protection implemented without sufficient testing
Denial of service (DoS)
Intrusion detection/prevention software not installed
Logs not maintained
60
Give examples of Physical Vulnerabilities
Unauthorized personnel have physical access to equipment
Radio frequency and electro-magnetic pulse (EMP)
Lack of backup power
Loss of environmental control
Unsecured physical ports
61
Give examples of Software Vulnerabilities
Improper Data Validation
Installed security capabilities not enabled by default
Inadequate authentication, privileges, and access control in software
62
Give examples of Communication & Network Vulnerabilities
Flow controls not employed
Firewalls nonexistent or improperly configured
Inadequate firewall and router logs
Standard, well-documented communication protocols are used in plain text
Authentication of users, data or devices is substandard or nonexistent
Use of unsecure industry-wide ICS protocols
Lack of integrity checking for communications
Inadequate authentication between wireless clients and access points
Inadequate data protection between wireless clients and access points
63
Give overview of IACS Cybersecurity Vulnerability Assessments
* Exercise to define, identify, and classify the security
vulnerabilities in an industrial control system and its related
network infrastructure
* Evaluate the IACS design, implementation, configuration
as well as its operation and management
* Determine the adequacy of security measures and identify
security deficiencies
* Determine known vulnerabilities for the used components
64
Vulnerability Analysis is the same as Cyber Risk Analysis?
False
65
What are the Types of Cybersecurity Vulnerability Assessments?
* High-level vulnerability assessment
* Passive vulnerability assessment
* Active vulnerability assessment
* Penetration test (hunting for vulnerabilities)
66
What is a High-level Vulnerability Assessment?
* Assessment of an organization's existing operational and technical
cybersecurity practices
* Comparison to industry regulations, standards and best practices
* Feedback on performance relative to industry peers
* Typically involves:
– Interviews with key personnel
– Site walk-throughs
– Examination of drawings
– Examination of sample configurations
– Review of existing polices and procedures
– Completing a questionnaire
* Sometimes called “Gap Assessment”
67
What is a Passive Cybersecurity Vulnerability Assessment?
* Discover network devices using passive means such as:
– Reviewing drawings – documentation analysis
– System walk-throughs
– Traffic analysis
– ARP tables, log reviews, firewall rules, etc.
* Discover vulnerabilities using passive means such as:
– Capture and study actual network traffic
– Collect data from devices (e.g. logs)
– Review configurations
– Research using vulnerability databases
* Understanding the system and the industrial process
* Create or update documentation
68
What is a Active Cybersecurity Vulnerability Assessment?
* Discover network devices using active network scanning tools and
techniques:
– Nmap
– Ping Sweep or ARP Scan
– Advanced IP scanner
– Superscan
– Shodan
* Discover vulnerabilities using active vulnerability scanning tools such as:
– OpenVAS
– Nessus
– Nexpose
* Understanding the system and the industrial process
* Create or update documentation
69
What is Penetration Testing?
* Begins with an active cybersecurity vulnerability assessment
* Perspective of a malicious actor
* Attempts to exploit known and unknown security vulnerabilities
using exploit tools and techniques
* Validate effectiveness of security countermeasures
* Can be on an individual asset, a zone or an entire SUC (usually known as Red Teaming)
70
Vulnerability Assessment vs. Penetration Testing
Vulnerability Assessment
* Define, identify, and classify security vulnerabilities
* Identify weaknesses
* Report on discoveries
Penetration Testing
* Exploit the vulnerabilities
* Attempt to gain nonauthorized access
* Aggressive tools and techniques to attack and penetrate the system
71
What are the key steps when conducting an IACS High Level Vulnerability Assessment?
* Identify benchmark standards
* Gather information
– Interviews
– Questionnaires
– Drawings
– Site visits
* Compare performance with benchmark standards
– People
– Processes
– Technology
* Document and report results
72
Name the most popular IACS Cybersecurity High Level Vulnerability Assessment Tool
* DHS Cybersecurity Evaluation Tool (CSET)
73
What are the Benefits of CSET?
* Repeatable and systematic approach for assessing an organizations cybersecurity posture
* Evaluation and comparison to existing industry standards and regulations
* Facilitates discussion and input from subject matter experts throughout the organization (e.g. operations, engineering, maintenance, information technology, business, health/safety and Cybersecurity)
* Identifies potential vulnerabilities in the control system design and security policies
* Offers guidelines for IACSs cybersecurity solutions and mitigations
74
What are the Limitations of CSET?
* CSET is only one component of a comprehensive control system security program.
* CSET will not provide a detailed architectural analysis of the network or a detailed network hardware/software configuration review
* CSET has a component focus rather than a system focus
* CSET is not a risk analysis tool, it will not create a detailed risk assessment
* CSET is not intended as a substitute for in-depth analysis of control system vulnerabilities as performed by trained professionals.
* Data and reports generated by the CSET should be managed securely and marked, stored, and distributed in a manner appropriate to their sensitivity
75
What are some categories of consequences?
Categories:
– Health
– Safety
– Environment
– Business continuity
– Reputation
– Information or intellectual property leakage
– Other …
76
Definition of Consequence
the undesirable result of an incident, usually described in terms of health and safety effects, environmental impacts, loss of property, and business interruption costs result that occurs from a particular incident
77
Definition of Impact
a measure of the ultimate loss or harm associated with a consequence. Impact may be expressed in terms of numbers of injuries and/or fatalities, extent of environmental damage and/or magnitude of losses such as property damage, material loss, loss of intellectual property, lost production, market share loss, and recovery costs
78
Learn consequence table
79
Consequence values determined by ...
company's risk appetite
80
Why is Impact values on the same row in a consequence table are
typically valued equally important?
This makes it easier to compare budget requests for different
risks assessments to each-other
81
What is a Cyber Criticality Assessment?
* Assessment of the criticality of an IACS asset, input for risk assessment
– Also called Business Impact Assessment
* Measure of the negative impact should information be unavailable,
unreliable or compromised
* Communicated to employees and contractors
* Methodology for identifying worse case consequences
82
What is the risk equation?
Risk = Threat x Vulnerability x Consequence
83
It is difficult to determine the likelihood of cyber security risk?
True
84
Likelihood is influenced by several factors, such as...
– Target attractiveness
– Attack surface
– Capability of threat actors
– Vulnerabilities in the organization's assets
– Motivation and intent of threat actors
– Geopolitical situation
85
What three things should appear in a likelihood scale?
– A 'slogan' for the likelihood value or level
– Additional information to determine the level for each risk
– Quantification of the likelihood (use this where possible)
86
What is Tolerable risk?
This is the level of risk deemed acceptable to an organization,
sometimes called the organization's risk appetite
87
Who is responsible for determining tolerable risk?
Senior management is responsible for defining the risk tolerance
88
What should be done if a risk is at or below tolerable risk?
Accept the risk
89
What should be done if a risk is above tolerable risk?
* If risk is above tolerable risk:
– Design the risk out
– Reduce the risk
– Transfer or share the risk
– Eliminate or redesign redundant or ineffective controls
90
What are the Benefits of Cyber Risk Assessments?
* Determine what plants/processes need to be addressed first
* Understand the threats and vulnerabilities
* Intelligently design and apply countermeasures (e.g. network segmentation, access controls, hardening, detection, etc.) to reduce risk
* Prioritize activities and resources
* Evaluate countermeasures based upon their
effectiveness of versus their cost/complexity
91
Risk reduction is balanced against the cost of security
measures to mitigate the risk. True or False?
True
92
What are the ISA/IEC 62443-2-1 Risk Assessment Requirements?
4.2.3.1 Select a risk assessment methodology
4.2.3.2 Provide risk assessment background information
4.2.3.3 Conduct a high-level risk assessment
4.2.3.4 Identify the industrial automation and control systems
4.2.3.5 Develop simple network diagrams
4.2.3.6 Prioritize systems
4.2.3.7 Perform a detailed vulnerability assessment
4.2.3.8 Identify a detailed risk assessment methodology
4.2.3.9 Conduct a detailed risk assessment
4.2.3.10 Identify the reassessment frequency and triggering criteria
4.2.3.11 Integrate physical, HSE and Cybersecurity risk
assessment results
4.2.3.12 Conduct risk assessments throughout the lifecycle of the IACS
4.2.3.13 Document the risk assessment
93
ISA/IEC 62443-3-2 Cyber Risk Assessment Process - Review flow diagram
94
What is ZCR 1?
ZCR 1: Identify System Under Consideration (SUC)
95
Overview of ZCR1 ...
* Requirement:
– The organization shall clearly identify the SUC, including clear demarcation of the security perimeter and identification of all access points to the SUC.
* Rationale and supplemental guidance
– Organizations typically own and operate multiple control systems, especially larger organizations with multiple industrial facilities. Any of these control systems may be defined as a SUC. For example, there is generally at least one control system at an industrial facility , but in many cases there are several systems that control various functions within the facility.
– This requirement specifies that SUCs are identified for the purpose of performing Cybersecurity analysis. The definition of a SUC is intended to include all IACS assets that are needed to provide a complete automation solution.
– System inventory, architecture diagrams, network diagrams and dataflows can be used to determine and illustrate the IACS assets that are included in the SUC description.
96
What is ZCR 2?
ZCR 2: Initial Risk Assessment
97
Overview of ZCR 2 ...
* Requirement
– The organization shall perform a Cybersecurity risk assessment of the SUC or confirm a previous initial Cybersecurity risk assessment is still applicable in order to identify the worst case unmitigated Cybersecurity risk that could result from the interference with, breach or disruption of, or disablement of mission critical IACS operations.
* Rationale
– The purpose of the initial Cybersecurity risk assessment is to gain an initial understanding of the worst-case risk the SUC presents to the organization should it be compromised. This is typically evaluated in terms of impacts to health, safety, environmental, business interruption, production loss, product quality, financial, legal, regulatory, reputation, etc. This assessment assists with the prioritization of detailed risk assessments and facilitates the grouping of assets into zones and conduits within the SUC.
98
What is ZCR 3.1?
ZCR 3.1: Establish zones and conduits
99
Overview of ZCR 3.1 ...
* Requirement
– The organization shall group IACS and related assets into zones or conduits as determined by risk. Grouping shall be based upon the results of the initial Cybersecurity risk assessment or other criteria, such as criticality of assets, operational function, physical or logical location, required access (for example, least privilege principles) or responsible organization
* Rationale
– The intent of grouping assets into zones and conduits is to identify those assets which share common security requirements and to permit the identification of common security measures required to mitigate risk. The assignment of IACS assets to zones and conduits may be adjusted based upon the results of the detailed risk assessment. This is a general requirement, but special attention
should be given to the safety related systems including safety instrumented systems, wireless systems, systems directly connected to Internet endpoints, systems that interface to the IACS but are managed by other entities (including external systems) and mobile devices
100
What is ZCR 3.2?
ZCR 3.2: Separate business and IACS assets
101
Overview of ZCR 3.2 ...
* Requirement
– IACS assets shall be grouped into zones that are logically or physically separated from business or enterprise system assets.
* Rationale and supplemental guidance
– Business and IACS are two different types of systems that need to be divided into separate zones as their functionality, responsible
organization, results of initial risk assessment and location are often fundamentally different. It is important to understand the basic difference between business and IACS, and the ability of IACS to impact health, safety and environment (HSE).
102
What is ZCR 3.3?
ZCR 3.3: Separate Safety Related Assets
103
Overview of ZCR 3.3 ...
* Requirement
– Safety related IACS assets shall be grouped into zones that are logically or physically separated from zones with non-safety related IACS assets. However, if they cannot be separated, the entire zone shall be identified as a safety related zone.
* Rationale and supplemental guidance
– Safety related IACS assets usually have different security requirements than basic control system components or systems, and components interfaced to the control system components.
Safety related zones typically require a higher level of security protection due to the higher potential for health, safety and environmental consequences if the zone is compromised.
104
What is ZCR 3.4?
ZCR 3.4: Separate Temporarily Connected Devices
105
Overview of ZCR 3.4 ...
* Recommendation
– Devices that are permitted to make temporary connections to the SUC should be grouped into a separate zone or zones from assets that are intended to be permanently connected to the IACS.
106
What is ZCR 3.5?
ZCR 3.5: Separate Wireless Devices
107
Overview of ZCR 3.5 ...
* Recommendation
– Wireless devices should be in one or more zones that are separated
from wired devices.
108
What is ZCR 3.6?
ZCR 3.6: Separate Devices Connected via External Networks
109
Overview of ZCR 3.6 ...
* Recommendation
– Devices that are permitted to make connections to
the SUC via networks external to the SUC should be
grouped into a separate zone or zones.
110
Overview of Initial Identification of zones and conduits ...
* Establishment of zones and conduits (3.1)
– Group IACS and related assets
– Criticality of assets
– Operational function
– Physical location
– Logical location
* Requirements from ISA/IEC 62443
– Separation of business and control system zones (3.2)
– Separation of safety-critical zones (3.3)
– Separation of temporarily connected devices (3.4)
– Separation of wireless communications (3.5)
– Separation of devices connected via untrusted networks (3.6)
111
What is ZCR4?
ZCR 4: Compare Initial Risk to Tolerable Risk
112
What is the requirement for ZCR4?
* Requirement
– The initial risk determined in subsection 4.3, ZCR 2: Initial Cybersecurity risk assessment, shall be compared to the organization’s tolerable risk. If the initial risk exceeds the tolerable
risk, the organization shall perform a detailed Cybersecurity risk assessment
113
What is ZCR 5?
ZCR 5: Perform a Detailed Cybersecurity Risk Assessment
114
When preparing for a detailed risk assessment you should ...
* Schedule a facilitator
* Establish the team
* Prepare workshop materials
115
What is a facilitator?
A person who has a degree of independence from the design and
operation of the control system, control system networks and related IT systems and has received specialty training for leading Cyber Risk Assessments.
116
When you establish a team for a detailed risk assessment, the team should include ...
The team should include:
– Facilitator trained in Cyber Risk Assessment
– Scribe trained in the software application to be used
– Automation/Controls Engineer(s)
– Network Engineer(s)
– Cybersecurity SME
– Process Safety SME
– Operator(s) with experience operating the process under
consideration
117
What materials should be prepared for detailed risk assessment workshop?
* System architecture diagrams
– Physical
– Functional
* Network diagrams
– Segments
– Networking components
* Asset inventory
* Criticality assessment
* Process flow
* Data flow
* Business processes
118
What is ZCR 5.1?
ZCR 5.1: Identify Threats
119
What is the ZCR 5.1 requirement?
* Requirement
– A list of the threats that could affect the assets contained within the zone or conduit shall be developed.
120
A threat description should include but is not limited to the following:
– a description of the threat source;
– a description of the capability or skill-level of the threat source;
– a description of possible threat vectors;
– an identification of the potentially affected asset(s).
121
What is ZCR 5.2?
ZCR 5.2: Identify vulnerabilities
122
What is the requirement for ZCR 5.2?
* Requirement
– The zone or conduit shall be analyzed in order to identify and document the known vulnerabilities associated with the assets contained within the zone or conduit including the access points.
123
What is ZCR 5.3?
ZCR 5.3: Determine consequence and impact
124
What is the requirement for ZCR 5.3?
* Requirement
– Each threat scenario shall be evaluated to determine the
consequence and the impact should the threat be realized.
Consequences should be documented in terms of the worst case impact on risk areas such as personnel safety, financial loss, business interruption and environment
125
Estimating the worst-case impact of a cyber threat is an
important input in ...
performing the cost/benefit analysis of
security controls
126
What is ZCR 5.4?
ZCR 5.4: Determine Unmitigated Likelihood
127
What is the requirement for ZCR 5.4?
* Requirement
– Each threat shall be evaluated to determine the unmitigated likelihood. This is the likelihood that the threat will materialize
128
How many times is likelihood evaluated during the detailed risk assessment?
Likelihood is evaluated twice during the detailed risk assessment process. It is initially determined without consideration for any existing countermeasures in order to establish the unmitigated risk
129
What is ZCR 5.5?
ZCR 5.5: Determine Unmitigated Cybersecurity Risk
130
What is the requirement for ZCR 5.5?
* Requirement
– The unmitigated Cybersecurity risk for each threat shall be determined by combining the impact measure determined in subclause 4.6.4, ZCR 5.3: Determine consequence and impact, and the unmitigated likelihood measure determined in subclause 4.6.5, ZCR 5.4: Determine unmitigated likelihood.
131
What is ZCR 5.6?
ZCR 5.6: Determine SL-T
132
What is the requirement for ZCR 5.6?
* Requirement
– A SL-T shall be established for each security zone or conduit.
133
What are the Security Level Definitions
ISA 62443-3-3 defines SLs in terms of five different levels (0, 1, 2, 3 and 4), each with an increasing level of security
* SL 0: No specific requirements or security protection necessary
* SL 1: Protection against casual or coincidental violation
* SL 2: Protection against intentional violation using simple means with low resources, generic skills and low motivation
* SL 3: Protection against intentional violation using sophisticated means with moderate resources, IACS specific skills and moderate motivation
* SL 4: Protection against intentional violation using sophisticated means with extended resources, IACS specific skills and high motivation
134
Method for determining the SL-T
Based on a company's risk matrix:
– Specific risk levels justify a certain SL-T
Typically determined based on unmitigated risk
– Countermeasures can be disregarded.
135
What is ZCR 5.7?
ZCR 5.7: Compare Unmitigated Risk with Tolerable Risk
136
What is the requirement for ZCR 5.7?
* Requirement
– The unmitigated risk determined for each threat identified in subclause 4.6.6, ZCR 5.5: Determine unmitigated Cybersecurity risk, shall be compared to the organization’s tolerable risk. If the unmitigated risk exceeds the tolerable risk, the organization shall determine whether to accept, transfer or mitigate the risk.
137
What is ZCR 5.8?
ZCR 5.8: Identify and Evaluate Existing Countermeasures
138
What is the requirement for ZCR 5.8?
* Requirement
– Existing countermeasures in the SUC shall be identified and
evaluated to determine the effectiveness of the countermeasures to
reduce the likelihood or impact
139
The effectiveness of countermeasures are quantified as a ...
Security Level Capability (SL-C)
140
The Security Level Capability (SL-C) of common countermeasures are defined in ...
ISA standard
62443-3-3
141
The goal of countermeasures is to ...
reduce the likelihood aspect of risks
142
What are the 4 Ts of mitigating risk?
– Design the risk out
– Reduce the risk
– Transfer or share the risk
– Eliminate or redesign redundant or ineffective controls
143
What are the Categories of Countermeasures?
Logical Access
Physical Access Controls
Data Flow Controls
Data Integrity Controls
Detection
Policy/Procedure
Hardening
144
What are Logical Access controls?
Manage user authentication and privileges
Examples:
System/device login, network access controls, domain controllers
145
What are Physical Access Controls controls?
Control physical access to critical cyber assets
Examples: Guards, fences, doors, enclosures,
146
What are Data flow Controls controls?
Control the flow of data in, out and within the system
Examples: Firewalls, routers, switches
147
What are Data Integrity Controls controls?
Prevent the corruption or unauthorized disclosure of data
Examples: Encryption, VPN, CRC, whitelisting
148
What are Detection Controls controls?
Detect and alert anomalous or malicious events
Examples: Intrusion detection, SIEM, anti-virus
149
What are Policy & Procedure Controls controls?
Define and enforce appropriate and inappropriate behavior
Examples: Policy documents, procedures, Group Policy settings
150
What are Hardening controls?
Minimize vulnerability by disabling or blocking unnecessary functions
Examples: Uninstalling unnecessary applications, blocking unused ports
151
Bowties visualise the following aspects of risk
– Threats
– Countermeasures (optionally also their effectiveness)
– Activity that could cause damage if control is lost (risk source)
– Consequences
152
What is ZCR 5.9?
ZCR 5.9: Reevaluate Likelihood and Impact
153
What is the requirement for ZCR 5.9?
* Requirement
– The likelihood and impact shall be re-evaluated considering the
countermeasures and their effectiveness.
154
What is MTL?
Mitigated Threat Likelihood
155
The MTL is the ...
The MTL is likelihood of the threat scenario occurring and leading to the final consequence taking into account all protection measures and cybersecurity countermeasures in place.
156
What is ZCR 5.10?
ZCR 5.10: Determine Residual Risk
157
What is the requirement for ZCR 5.10?
* Requirement
– The residual risk for each threat shall be determined by combining the mitigated likelihood measure and mitigated impact values.
158
What is ZCR 5.11?
ZCR 5.11: Compare Residual Risk with Tolerable Risk
159
What is the requirement for ZCR 5.11?
* Requirement
– The residual risk determined for each threat shall be compared to the organization’s tolerable risk. If the residual risk exceeds the tolerable risk, the organization shall determine if the residual risk will be accepted, transferred or mitigated based upon the organization’s policy.
160
What is ZCR 5.12?
ZCR 5.12: Identify Additional Cybersecurity Countermeasures
161
What is the requirement for ZCR 5.12?
* Requirement
– Additional Cybersecurity countermeasures such as technical, administrative or procedural controls shall be identified to mitigate the risks where the residual risk exceeds the organization’s tolerable risk unless the organization has elected to tolerate or transfer the risk.
162
Another means of reducing risk is to ...
reallocate an IACS asset from a lower security to a higher security zone or conduit in order to take advantage of the security countermeasures of the higher security zone or conduit.
163
What is MTLa?
Adjusted Mitigated Threat Likelihood
164
What is ZCR 5.13?
ZCR 5.13: Document and Communicate Results
165
What is the requirement for ZCR 5.13?
* Requirement
– The results of the detailed cyber risk assessment shall be
documented, reported and made available to the appropriate
stakeholders in the organization. Appropriate information
security classification shall be assigned to protect the
confidentiality of the documentation. Documentation shall
include the date each session was conducted as well as the
names and titles of the participants. Documentation that was
instrumental in performing the cyber risk assessment (such
as, system architecture diagrams, PHAs, vulnerability
assessments, gap assessments and sources of threat
information) shall be recorded and archived along with the
cyber risk assessment.
166
Cybersecurity risk assessments are not living documents that may be used for multiple purposes including testing, auditing and future risk assessments.
False
167
Vulnerability Assessment Report should include ...
* Scope of the assessment
* “As found” system architecture
* Assessment details
– Dates/Locations
– Participants
– Vulnerability Assessment Process
* Prioritized summary of findings
* Detailed findings
– Discovered cyber assets
– Policy & Procedural vulnerabilities
– Architecture & Design vulnerabilities
– Configuration & Maintenance vulnerabilities
– Physical vulnerabilities
– Software vulnerabilities
– Communication & Network vulnerabilities
168
Cybersecurity Risk Assessment Report should include ...
* Scope of the risk assessment
* Assessment details
– Dates/Locations
– Participants
– Risk Assessment Process
* Risk profile
* Summary of recommendations
* Detailed findings
– High risk threats
– High risk vulnerabilities
– Prioritized recommendations
– Detailed risk assessment worksheets
169
Cybersecurity Requirements Specification should include ...
* Scope and purpose of the system
* Physical and environmental security requirements
* General cybersecurity requirements
* Zone and Conduit specific requirements
170
What is ZCR 6?
ZCR 6: Cybersecurity Requirements Specification
171
What is the requirement of ZCR 6?
* Requirement
– A Cybersecurity requirements specification (CRS) shall be created to document mandatory security countermeasures of the SUC based on the outcome of the detailed risk assessment as well as general security requirements based upon company or site-specific policies,
standards and relevant regulations
172
A CRS at a minimum should include:
– SUC description
– Zone and conduit drawings
– Zone and conduit characteristics
– Operating environment assumptions
– Threat environment
– Organizational security policies
– Tolerable risk
– Regulatory requirements
173
The Cybersecurity Requirements Specification (CRS) is the input in the next step of the cybersecurity lifecycle (Develop & Implement)
True
* The CRS defines what needs to be done in the Develop & Implement phase
174
What should be included when documenting a SUC?
– Name
– High-level description
– Intended usage
– Architecture diagrams
– Network diagrams
– Security perimeter and Access points
– System inventory
– Dataflows
– Process Flows
175
What are some of the Zone & Conduit Characteristics?
* Accountable organization(s)
* Definition of logical boundary
* Definition of physical boundary, if applicable
* Safety designation
* Connected zones or conduits
* SL-T
* Applicable security requirements
* Applicable security policies
* Assumptions and external dependencies.
– Clean power
– Physical security
– Network security
176
What are some MORE of the Zone & Conduit Characteristics?
* List of logical access points
– Place where electronic information can cross the logical boundary of a zone or conduit.
– Vulnerabilities that can be exploited by threats.
* List of physical access points
– fences, doors and enclosures etc.
– Any place where people can gain physical access to zone or conduit assets.
– Physical access points need to be identified and documented to determine appropriate means of monitoring and preventing unauthorized access.
* List of data flows
– In order to detect anomalies, it is important to identify and document the expected flow of data throughout the system and the flow of data in and out of a zone or conduit.
– Source, Destination, Protocol, Business reason behind it
– ISA-95 models can help in identifying and structuring
* List of assets
– IACS assets contained within each zone or conduit and their classification
– Criticality and business value
– Consider the consequences to other zones/conduits as well as the zone/conduit in question
177
When documenting Threat Environment, you should include ...
– Threat source(s)
– Threat vectors
– Geo-political climate
– Physical environment
178
Name some sources for Threat Intelligence
– ICS-CERT (https://www.us-cert.gov/ics)
– Enisa (https://www.enisa.europa.eu/)
– Local Government
– IACS Product suppliers
– Anti-Malware vendors
– Industry advisory groups
179
What are the inputs into ZCR1?
Initial system architecture diagrams and inventory
Company Polices
Regulations
Tolerable risk guidelines
180
What are the outputs of ZCR1?
Updated system architecture diagrams and inventory with IACS external services and support identified
181
What are the inputs into ZCR2?
Existing PHAs and other relevant risk assessment and corporate risk matrix
182
What are the outputs of ZCR2?
Initial evaluation of risk
183
What are the inputs into ZCR3?
Standards and best practices
Policies
Supplier guidelines
Criticality assessments
Data flows
Functional specifications
184
What are the outputs of ZCR3?
Initial or revised zone and conduit diagram
185
What are the inputs into ZCR4?
ZCR3
186
What are the outputs of ZCR4?
None: Yes/No decision
187
What are the inputs into ZCR5?
ZCR4
188
What are the outputs of ZCR5?
Residual cyber security risk and SL-Ts for each zone and conduit
189
What are the inputs into ZCR6?
Company policies
Regulations
Tolerable risk guidelines
190
What are the outputs of ZCR6?
Cyber security requirement specification (CRS)
191
What are the inputs into ZCR7?
ZCR6
192
What are the outputs of ZCR7?
Asset owner approval
193
What are the inputs & outputs of ZCR5.1?
Inputs: Historical data and other threat information sources
Output: List of threats
194
What are the inputs & outputs of ZCR5.2?
Inputs: Vulnerability assessment, prior audits, vulnerability databases
Output: List of vulnerabilities
195
What are the inputs & outputs of ZCR5.3?
Inputs: Threats, vulnerabilities, existing PHAs, other risk assessments
Output: Assessment of impact
196
What are the inputs & outputs of ZCR5.4?
Inputs: List of threats and vulnerabilities
Output: Assessment of likelihood
197
What are the inputs & outputs of ZCR5.5?
Inputs: Likelihood, impact, corporate risk matrix
Output: Assessment of unmitigated cyber security risk
198
What are the inputs & outputs of ZCR5.6?
Inputs: Corporate risk matrix with tolerable risk
Output: SL-T
199
What are the inputs & outputs of ZCR5.7?
None
"Unmitigated risk exceeds tolerable risk?"
If yes, go to 5.8
If No, go to 5.13
200
What are the inputs & outputs of ZCR5.8?
Inputs: ZCR 5.7
Output: List of countermeasures
201
What are the inputs & outputs of ZCR5.9?
Inputs: [Updated] List of countermeasures
Output: [Updated] Likelihood and impact assessment
202
What are the inputs & outputs of ZCR5.10?
Inputs: [Updated] Likelihood, impact, corporate risk matrix
Output: Residual cybersecurity risk
203
What are the inputs & outputs of ZCR5.11?
Inputs: ZCR 5.10
Output: "Are all residual risks at or below tolerable risk?"
If yes, go to 5.13
If no, go to 5.12
204
What are the inputs & outputs of ZCR5.12?
Inputs: 5.11
Output: [Updated] List of Countermeasures
205
What are the inputs & outputs of ZCR5.13?
Inputs: 5.7 OR 5.11
Output: Detailed risk assessment report
