Catalog of Control Systems Security: Recommendations for Standards Developers

Recommendations

Info

2.5.6.4 References NIST SP 800-53r3 SA-6 CAG CC-2 API 1164r2 3.8 NRC RG 5.71 App. B.1.1, App. B.1.16, App. B.1.17, App. B.1.19, App. B.3.14, App. C.11.6 2.5.7 User-Installed Software 2.5.7.1 Requirement The organization implements policies and procedures to enforce explicit rules and management expectations governing user installation of software. 2.5.7.2 Supplemental Guidance If provided the necessary privileges, users have the ability to install software. The organization’s security program identifies the types of software permitted to be downloaded and installed (e.g., updates and security patches to existing software) and types of software prohibited (e.g., software that is free only for personal, not government or corporate use, and software whose pedigree with regard to being potentially malicious is unknown or suspect). 2.5.7.3 Requirement Enhancements None 2.5.7.4 References NIST SP 800-53r3 SA-7 CAG CC-2 API 1164r2 3.8, Annex A NRC RG 5.71 App. C.3.7, App. C.13.1 2.5.8 Security Engineering Principles 2.5.8.1 Requirement The organization applies control system security engineering principles in the specification, design, development, and implementation of the system. 2.5.8.2 Supplemental Guidance The application of security engineering principles is primarily targeted at new development control systems or control systems undergoing major upgrades and is integrated into the system development life cycle. For legacy control systems, the organization applies security engineering principles to system upgrades and modifications, to the extent feasible, given the current state of the hardware, software, and firmware components within the system. 2.5.8.3 Requirement Enhancements 1. The organization adopts software development standards and practices for trustworthy software throughout the development life cycle. 2. Trustworthy software reduces common design and coding errors that affect security, such as: a. Unsafe buffer and string management b. Languages that have unsafe buffer operations. 28
3 Trustworthy software development employs commercially available tools including a robust set of data validation and software quality assurance. 2.5.8.4 References NIST SP 800-53r3 SA-8 CAG CC-7, CC-16 API 1164r2 Annex A NRC RG 5.71 C.C.8.1, C.8.4, C.10.2, C.10.3, C.12.3 2.5.9 Outsourced Control System Services 2.5.9.1 Requirement The organization: 1. Requires that providers of external control system services employ security controls in accordance with applicable laws, directives, policies, regulations, standards, guidance, and established service-level agreements 2. Defines government oversight and user roles and responsibilities with regard to external control system services 3. Monitors security control compliance by external service providers. 2.5.9.2 Supplemental Guidance Third-party providers are subject to the same control system security policies and procedures of the organization. All the contractors’ equipment conforms to the same requirements as the organization’s internal systems. Appropriate organizational officials need to approve outsourcing of control system services to third-party providers (e.g., service bureaus, contractors, and other external organizations). The outsourced control system services’ documentation includes service provider and end-user security roles, responsibilities, and any service-level agreements. Service-level agreements define the expectations of performance for each required security control, describe measurable outcomes, and identify remedies and response requirements for any identified instance of noncompliance. 2.5.9.3 Requirement Enhancements None 2.5.9.4 References NIST SP 800-53r3 PS-7, SA-9 API 1164r2 1.2, Annex A NRC RG 5.71 App. B.1.1, App. B.1.2, App. B.1.21, App. B.1.22, App. C.5.2 2.5.10 Developer Configuration Management 2.5.10.1 Requirement The organization requires that control system developers/integrators implement and document a configuration management process that (1) manages and controls changes to the system during design, development, implementation, and operation; (2) tracks security flaws; and (3) includes organizational approval of changes. 2.5.10.2 Supplemental Guidance None 29
Page 1 and 2: Catalog of Control Systems Security
Page 3: ACKNOWLEDGMENT This document was de
Page 7 and 8: CONTENTS ACKNOWLEDGMENT ...........
Page 9 and 10: 2.8.8 Communication Integrity .....
Page 11 and 12: 2.15 Access Control ...............
Page 13 and 14: ACRONYMS AC access control AGA Amer
Page 15 and 16: Catalog of Control Systems Security
Page 17 and 18: 2. RECOMMENDATIONS FOR STANDARDS DE
Page 19 and 20: 2.1.1 Security Policy and Procedure
Page 21 and 22: 5. The organization’s security po
Page 23 and 24: 2.3.1 Personnel Security Policy and
Page 25 and 26: Exit interviews ensure that individ
Page 27 and 28: 2.3.8.3 None Requirement Enhancemen
Page 29 and 30: 2.4.3 Physical Access Control 2.4.3
Page 31 and 32: 2.4.5.4 References NIST SP 800-53r3
Page 33 and 34: 2.4.10 Emergency Lighting 2.4.10.1
Page 35 and 36: 2.4.15 Alternate Work Site 2.4.15.1
Page 37 and 38: 2.4.18.2 Supplemental Guidance Phys
Page 39 and 40: 2. Formal, documented procedures to
Page 41: 2. Documents attempts to obtain con
Page 45 and 46: 2.5.12 Supply Chain Protection 2.5.
Page 47 and 48: 2. Employs compensating measures to
Page 49 and 50: 2.6.3 Configuration Change Control
Page 51 and 52: during specified times making unaut
Page 53 and 54: 5. In high security situations, it
Page 55 and 56: or shortcuts. Known legacy componen
Page 57 and 58: 2.7.2 Control System Security Plan
Page 59 and 60: 2.7.5 Planning Process Training 2.7
Page 61 and 62: 2.7.9.2 Supplemental Guidance The o
Page 63 and 64: c. The roles, responsibilities, coo
Page 65 and 66: where shared resources are manipula
Page 67 and 68: 5. The control system denies networ
Page 69 and 70: of protection mechanisms within a c
Page 71 and 72: 2.8.14.3 Requirement Enhancements T
Page 73 and 74: NRC RG 5.71 C.3.1.3, C.3.1.4, App.
Page 75 and 76: 2.8.22.4 References NIST SP 800-53r
Page 77 and 78: 2.8.27.3 Requirement Enhancements N
Page 79 and 80: 2.8.32.3 None Requirement Enhanceme
Page 81 and 82: 2.9.2.2 Supplemental Guidance The o
Page 83 and 84: 3. Access and control policies, to
Page 85 and 86: 2.9.10.2 Supplemental Guidance The
Page 87 and 88: 2.10.1.4 References NIST SP 800-53r
Page 89 and 90: maintenance activities use approved
Page 91 and 92: 2.10.8.3 Requirement Enhancements N
Page 93 and 94:
demonstrate management’s commitme
Page 95 and 96:
2.11.4 Security Training Records 2.
Page 97 and 98:
2.12.1.4 References NIST SP 800-53r
Page 99 and 100:
(e.g., full-scale business continui
Page 101 and 102:
2.12.9.2 Supplemental Guidance The
Page 103 and 104:
Page 105 and 106:
2.12.15 Alternate Control Center 2.
Page 107 and 108:
NERC CIPS CIP 009-3 B.R1 through R5
Page 109 and 110:
2.13.3 Media Classification 2.13.3.
Page 111 and 112:
API 1164r2 Annex A NERC CIPS CIP 00
Page 113 and 114:
2.14.1 System and Information Integ
Page 115 and 116:
and procedures. The organization co
Page 117 and 118:
12. The organization makes provisio
Page 119 and 120:
3. The organization employs central
Page 121 and 122:
2.14.11 Error Handling 2.14.11.1 Re
Page 123 and 124:
2.15.1 Access Control Policy and Pr
Page 125 and 126:
NRC RG 5.71 App. B.1.2 2.15.4 Ident
Page 127 and 128:
Page 129 and 130:
2.15.8.3 Requirement Enhancements N
Page 131 and 132:
Such bypass may be via a physical s
Page 133 and 134:
2.15.15.2 Supplemental Guidance Inf
Page 135 and 136:
NRC RG 5.71 App. B.4.3, App. B.4.7
Page 137 and 138:
2.15.20.4 References NIST SP 800-53
Page 139 and 140:
Remote access to control system com
Page 141 and 142:
employing such technology by assign
Page 143 and 144:
CAG CC-4, CC-5 API 1164r2 7.3, 8, A
Page 145 and 146:
2.15.31.3 Requirement Enhancements
Page 147 and 148:
Page 149 and 150:
In general, audit record processing
Page 151 and 152:
2.16.11.3 Requirement Enhancements
Page 153 and 154:
2.16.15 Audit Generation 2.16.15.1
Page 155 and 156:
as part of the general security pol
Page 157 and 158:
Page 159 and 160:
Page 161 and 162:
API 1164r2 Annex B.4.1.2 NERC CIPS
Page 163 and 164:
2. Documents the security categoriz
Page 165 and 166:
4. Shares information obtained from
Page 167 and 168:
d. Is approved by a senior official
Page 169 and 170:
Page 171 and 172:
2.19.9.2 Supplemental Guidance An o
Page 173 and 174:
3. CONCLUSIONS This document presen
Page 175 and 176:
Term Definition Authorization The r
Page 177 and 178:
Term Definition Cybersecurity The p
Page 179 and 180:
Term Definition Information Technol
Page 181 and 182:
Term Definition Monitor To measure
Page 183 and 184:
Term Definition Records The recordi
Page 185 and 186:
Term Definition Security Policies S
Page 187 and 188:
Term Definition Thin Nodes Informat
Page 189 and 190:
International Electrotechnical Comm
Page 191 and 192:
Department of Energy DOE M 205.1-8,
Page 193 and 194:
pertinent source documents as neces
Page 195 and 196:
2.4.7 2.4.8 Physical Access Log Ret
Page 197 and 198:
2.6.10 2.6.11 2.7.1 2.7.2 2.7.3 2.7
Page 199 and 200:
2.8.27 Operating System- Independen
Page 201 and 202:
2.12.2 2.12.3 2.12.4 2.12.5 2.12.6
Page 203 and 204:
AGA12-1 AGA12-2 FIPS 140-2 API 1164
Page 205 and 206:
2.16.16 Monitoring for Information
show all

Catalog of Control Systems Security: Recommendations for Standards Developers

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?