Catalog of Control Systems Security: Recommendations for Standards Developers

Recommendations

Info

DISCLAIMER This report was prepared as an account of work sponsored by an agency of the U.S. Government. Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for any third party’s use, or the results of such use, or any information, apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.
ACKNOWLEDGMENT This document was developed by the U.S. Department of Homeland Security to help facilitate the development of control systems cybersecurity industry standards. The original author team consisted of representatives from the Department of Homeland Security Control Systems Security Program (CSSP), National Institute of Standards and Technology (NIST), Argonne National Laboratory (ANL), Idaho National Laboratory (INL), Oak Ridge National Laboratory (ORNL), Pacific Northwest National Laboratory (PNNL), and Sandia National Laboratories (SNL). For additional information or comments, please send inquires to the Control Systems Security Program at cssp@hq.dhs.gov with the word “Catalog” in the subject line. iii
Page 1: Catalog of Control Systems Security
Page 7 and 8: CONTENTS ACKNOWLEDGMENT ...........
Page 9 and 10: 2.8.8 Communication Integrity .....
Page 11 and 12: 2.15 Access Control ...............
Page 13 and 14: ACRONYMS AC access control AGA Amer
Page 15 and 16: Catalog of Control Systems Security
Page 17 and 18: 2. RECOMMENDATIONS FOR STANDARDS DE
Page 19 and 20: 2.1.1 Security Policy and Procedure
Page 21 and 22: 5. The organization’s security po
Page 23 and 24: 2.3.1 Personnel Security Policy and
Page 25 and 26: Exit interviews ensure that individ
Page 27 and 28: 2.3.8.3 None Requirement Enhancemen
Page 29 and 30: 2.4.3 Physical Access Control 2.4.3
Page 31 and 32: 2.4.5.4 References NIST SP 800-53r3
Page 33 and 34: 2.4.10 Emergency Lighting 2.4.10.1
Page 35 and 36: 2.4.15 Alternate Work Site 2.4.15.1
Page 37 and 38: 2.4.18.2 Supplemental Guidance Phys
Page 39 and 40: 2. Formal, documented procedures to
Page 41 and 42: 2. Documents attempts to obtain con
Page 43 and 44: 3 Trustworthy software development
Page 45 and 46: 2.5.12 Supply Chain Protection 2.5.
Page 47 and 48: 2. Employs compensating measures to
Page 49 and 50: 2.6.3 Configuration Change Control
Page 51 and 52: during specified times making unaut
Page 53 and 54:
5. In high security situations, it
Page 55 and 56:
or shortcuts. Known legacy componen
Page 57 and 58:
2.7.2 Control System Security Plan
Page 59 and 60:
2.7.5 Planning Process Training 2.7
Page 61 and 62:
2.7.9.2 Supplemental Guidance The o
Page 63 and 64:
c. The roles, responsibilities, coo
Page 65 and 66:
where shared resources are manipula
Page 67 and 68:
5. The control system denies networ
Page 69 and 70:
of protection mechanisms within a c
Page 71 and 72:
2.8.14.3 Requirement Enhancements T
Page 73 and 74:
NRC RG 5.71 C.3.1.3, C.3.1.4, App.
Page 75 and 76:
2.8.22.4 References NIST SP 800-53r
Page 77 and 78:
2.8.27.3 Requirement Enhancements N
Page 79 and 80:
2.8.32.3 None Requirement Enhanceme
Page 81 and 82:
2.9.2.2 Supplemental Guidance The o
Page 83 and 84:
3. Access and control policies, to
Page 85 and 86:
2.9.10.2 Supplemental Guidance The
Page 87 and 88:
Page 89 and 90:
maintenance activities use approved
Page 91 and 92:
Page 93 and 94:
demonstrate management’s commitme
Page 95 and 96:
2.11.4 Security Training Records 2.
Page 97 and 98:
Page 99 and 100:
(e.g., full-scale business continui
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
2.12.15 Alternate Control Center 2.
Page 107 and 108:
NERC CIPS CIP 009-3 B.R1 through R5
Page 109 and 110:
2.13.3 Media Classification 2.13.3.
Page 111 and 112:
API 1164r2 Annex A NERC CIPS CIP 00
Page 113 and 114:
2.14.1 System and Information Integ
Page 115 and 116:
and procedures. The organization co
Page 117 and 118:
12. The organization makes provisio
Page 119 and 120:
3. The organization employs central
Page 121 and 122:
2.14.11 Error Handling 2.14.11.1 Re
Page 123 and 124:
2.15.1 Access Control Policy and Pr
Page 125 and 126:
NRC RG 5.71 App. B.1.2 2.15.4 Ident
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Such bypass may be via a physical s
Page 133 and 134:
2.15.15.2 Supplemental Guidance Inf
Page 135 and 136:
NRC RG 5.71 App. B.4.3, App. B.4.7
Page 137 and 138:
2.15.20.4 References NIST SP 800-53
Page 139 and 140:
Remote access to control system com
Page 141 and 142:
employing such technology by assign
Page 143 and 144:
CAG CC-4, CC-5 API 1164r2 7.3, 8, A
Page 145 and 146:
2.15.31.3 Requirement Enhancements
Page 147 and 148:
Page 149 and 150:
In general, audit record processing
Page 151 and 152:
2.16.11.3 Requirement Enhancements
Page 153 and 154:
2.16.15 Audit Generation 2.16.15.1
Page 155 and 156:
as part of the general security pol
Page 157 and 158:
Page 159 and 160:
Page 161 and 162:
API 1164r2 Annex B.4.1.2 NERC CIPS
Page 163 and 164:
2. Documents the security categoriz
Page 165 and 166:
4. Shares information obtained from
Page 167 and 168:
d. Is approved by a senior official
Page 169 and 170:
Page 171 and 172:
2.19.9.2 Supplemental Guidance An o
Page 173 and 174:
3. CONCLUSIONS This document presen
Page 175 and 176:
Term Definition Authorization The r
Page 177 and 178:
Term Definition Cybersecurity The p
Page 179 and 180:
Term Definition Information Technol
Page 181 and 182:
Term Definition Monitor To measure
Page 183 and 184:
Term Definition Records The recordi
Page 185 and 186:
Term Definition Security Policies S
Page 187 and 188:
Term Definition Thin Nodes Informat
Page 189 and 190:
International Electrotechnical Comm
Page 191 and 192:
Department of Energy DOE M 205.1-8,
Page 193 and 194:
pertinent source documents as neces
Page 195 and 196:
2.4.7 2.4.8 Physical Access Log Ret
Page 197 and 198:
2.6.10 2.6.11 2.7.1 2.7.2 2.7.3 2.7
Page 199 and 200:
2.8.27 Operating System- Independen
Page 201 and 202:
2.12.2 2.12.3 2.12.4 2.12.5 2.12.6
Page 203 and 204:
AGA12-1 AGA12-2 FIPS 140-2 API 1164
Page 205 and 206:
2.16.16 Monitoring for Information
show all

Catalog of Control Systems Security: Recommendations for Standards Developers

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?