ELECTRICITY SECTOR CRITICAL INFRASTRUCTURE PROTECTION and ESISAC

1
ELECTRICITY SECTORCRITICAL INFRASTRUCTURE
PROTECTIONand ESISAC

• Presentation to
• Midwest Infrastructure Security Forum
• 07 August 2003

2
Topics

• Electricity Sector
• NERC, CIPAG, ESISAC
• Communications
• Security Guidelines
• Cyber Security Standard
• Process Control Systems Security
• Other Projects

3
The Electricity Sector
6 x10? C1
aGen bTrans cLSE dPSE eRC fCA gGov

3I
Interconnectedness, Interdependencies,
Reliability, Security Guidelines, Standards
Orgs NERC, ESISAC, Other ISACs, APPA, CEA,
EEI, ELCON, EPRI, EPSA, NEI, NAESB, NRECA
Agencies DOE, CIAO, DHS, DOD, FERC, NARUC
NRC, OCIPEP, RUS, USSS
4
Definitions and Description

• APPA American Public Power Association
• CEA Canadian Electricity Association
• CIAO Critical Infrastructure Assurance Office
• DOD Department of Defense
• DOE Department of Energy
• DHS Department of Homeland Security
• EEI Edison Electric Institute
• ELCON Electricity Consumers Resource Council
• EPRI Electric Power Research Institute
• EPSA Electric Power Supply Association
• ES Electricity Sector
• FERC Federal Energy Regulatory Commission
• IAIP Info Analysis, Infrastructure Protection
• ISAC Information Sharing and Analysis Center
• NAESB No. Amer. Energy Standards Board
• NARUC Natl Assoc Reg Utility Commissioners
• NEI Nuclear Energy Institute
• NERC North American Electric Reliability Cncl
• NIPC Natl Infrastructure Protection Center

• The equation
• Summed over millions of Customers
• Entity types that comprise the ES
• Divided by three Interconnections
• Eastern
• Western
• Texas
• Generation, Transmission, Load Serving Entities,
  Purchasing-Selling Entities, Reliability
  Coordinators, Control Areas, Regional
  Transmission Organizations, Independent System
  Operators, Regulators (Canada/US
  Federal/State/Provincial/Local)

5
(No Transcript)
6
CRITICAL INFRASTRUCTURE PROTECTION ADVISORY GROUP
Board of Trustees
NERC Stndg Cmtes MC, OC, PC
US CAN Gov
APPA
CIPAG Physical Security Cyber Security Operations
Policy Development Needs Peer Review
CEA  
EEI  
ESISAC Analysis Communications
NRECA
CIP Task Forces Processes and Practices Developmen
t
Professional Review Recommendations Practices
08 Jun 2003
7
ESISAC Communications
RA
BA
IA
TSP
TOw
TOp
DP
GEN
LSE
PA
PSE
ESISAC
DHS-IAIP
Law Enforce
Other ISACs
RA
BA
IA
TSP
TOw
TOp
DP
GEN
LSE
PA
PSE
Other Federal, State, Provincial Agencies
8
ESISAC Mission

• Receive electricity sector security data
• Analyze security data
• With DHS, other agencies, other ISACs
• Disseminate threat indications, .analyses,
  warnings with interpretations

9
http//www.esisac.com
10

• REPORT INCIDENTS TO
• LOCAL LAW ENFORCEMENT
• Establish and maintain relationship
• LOCAL FBI
• Establish and maintain relationship
• DHS-IAIP IAW Program
• InfraGard CIPIS nipc.watch_at_fbi.gov
• 202-323-3204,5,6
• 888-585-9078
• ESISAC
• CIPIS https//www.nerc.net/registration/
  esisac_at_nerc.com
• 609-452-8060 day
• 609-452-1422 anytime

11
Communication Types

• Incident data for analysis
• From Electricity Sector (ES) entities
• To DHS-IAIP, ESISAC, ES entities as determined by
  inputting entity
• Threat Alerts, Advisories, Warnings, other
  information
• From DHS-IAIP and ESISAC
• To ES entities
• Sector, Area, Type facility, Specific facility

12
IAW Program Reporting Events

• Loss of Generation
• Loss HV Transmission
• Loss of Distribution (NS/EP)
• Loss of Distribution (EPS)
• Loss of Load Center
• Loss of Telecom for System operator
• Loss of Control
• Loss of or Degraded Market Functionality
• Anomalous Non-character System Behavior

• Announced Credible Threats
• Intelligence Gathering Physical Surveillance
• Intelligence Gathering and Operations Cyber
  Surveillance
• Intelligence Gathering Social Engineering
• Security Breaches Affecting IT
• Planting/Pre-Positioning Malicious Code

13
Threat Alert Levels
14
Security Guidelines

• Overview
• Communications
• Emergency Plans
• Employment Background Screen
• Physical Security
• Threat Response
• Physical
• Cyber
• Vulnerability/Risk Assessment
• Continuity of Business Process

• Cyber Access Control
• Cyber IT Firewalls
• Cyber Intrusion Detection
• Cyber Risk Management
• Protecting Sensitive Info
• Securing Remote Access Process Control Systems
• Incident Reporting
• Cyber Security STANDARD

15
Cyber Security Standard

• FERC Proposed Cyber Security Standards July
  2002
• SQL Slammer Worm January 2003
• A word about this!
• NERC Urgent Action Cyber Security Standard
• NERC Permanent Cyber Security Standard

16
Cyber Security Standard

• To whom does it apply?
• To what does it apply?
• What are the requirements?
• How will compliance be measured?

17
Cyber Security Standard

• Requirements
• Cyber Security Policy
• Critical Cyber Assets
• Electronic Security Perimeter
• Electronic Access Controls
• Physical Security Perimeter
• Physical Access Controls
• Personnel
• Monitoring Physical Access
• Monitoring Electronic Access

• Information Protection
• Training
• Systems Management
• Test Procedures
• Electronic Incident Response Actions
• Physical Incident Response Actions
• Recovery Plans

18
Process Control Systems (PCS) Security

• What are PCS?
• The Security Challenge
• Securing PCS
• NERC Guideline
• Next Steps

19
What are PCS?

• PCS control the systems that generate, transmit,
  and distribute electricity. PCS are also called
  Electronic Control and Protection Systems.
• EMS
• SCADA

20
PCS in Electricity Sector
System Operations Center
EMS
ICCP
Interconnected System Operations Center
SCADA
RA
Telecom
Generating or Transmission Station
RTU
Protective Relays
BTG
DCS
Data Sensors
PLC
RA
21
The Security Challenge

• PCS are universal
• PCS operate in real-time
• PCS may not have built-in security features
• Reality of security concern
• Some testing
• Electronic access beyond physical security
  perimeter
• Access within physical security perimeter

22
Securing PCS A First Step

• NERC Guideline - Securing Remote Access to
  Electronic Control and Protection Systems
• Recommends establishing policies and procedures
  for controlling remote access.
• Disable remote access when not in use
• Approve remote access users
• Authenticate users prior to each session
• Manage passwords
• Manage remote access hardware and software
• Use encryption

23
Other ES Initiatives

• Public Key Infrastructure
• Spare Equipment Project
• Critical Infrastructure Interdependencies
• CIP Workshops

24
CIP Workshops Agendas

• Security Guidelines (14)
• Cyber Security Standard
• Vulnerability Assessment Methodologies
• Communications

25
Meeting The Security Challenge Workshops
TY