Contributors - CyberSecurity Malaysia

Common Criteria andNational Cyber Security31.IntroductionBackgroundImagine yourself working as a Systems Engineer for theSupervisory Control and Data Acquisition (SCADA) systemat the largest electricity utility in Malaysia that distributeselectricity to Peninsular Malaysia. Your worst nightmarewould be a blackout of the entire peninsular which staysin the dark for half an hour because ‘someone’ managedto compromise and shut down the SCADA system thatcontrolled the distribution of the electricity. Businesstransactions worth millions of Ringgit Malaysia are lostduring this disaster. Then you find a log entry which showsthat an unauthorized person has managed to log in to yoursystem right after the attacker succeeded in compromisingthe SCADA system. Oopss… too late. Now who should beresponsible for this? Is it you who wrongly configured thesystem? Is it your boss who did not supervise your work?Is it the IT department who poorly managed the networkof your SCADA environment? Or is it the SCADA systemand other product developers who didn’t test their productsufficiently for vulnerability?Of course, at this stage, an investigation or analysis has tobe conducted to determine the cause of the intrusion bythe unauthorized person. The vulnerability may lie in theSCADA system itself or even other systems related to yourSCADA environment which can be used as a platform tocompromise the SCADA system.In September 2008, Idan Ofrat [1], a researcher from C4,a firm specializing in the security of the SCADA system,found that ABB's SCADA Process Communication Unit (PCU)400 could generate buffer overflow in the componentthat handles the IEC60870-5-101 and IEC60870-5-104communication protocols. This vulnerability can beexploited as an arbitrary code execution by unauthorizedattackers. An attacker can use his control over the FrontEnd Processor (FEP) server to insert a generic electric gridmalware that can damage the grid. Fortunately, ABB hasreleased a patch for the bug.Sounds familiar?This analogy may not apply to your working conditionsbut the dreadful implication of having a system thatis vulnerable is the same for all and unbearable to themind. This is where you wish that all critical systems cansecure your assets (information, infrastructure), securethemselves, and have some kind of assurance that theyhave been tested and verified on their security functions.This is where Common Criteria (CC) comes into the picture.What is Malaysia’s National Security vision?As defined in the National Cyber Security Policy, Malaysia’sNational Security vision [2] is to ensure that “Malaysia’sCritical National Information Infrastructure will be secure,resilient and self-reliant. Infused with a culture of security,it will promote stability, social well being and wealthcreation.”What is Malaysia’s National Cyber Security Policy?Referring to the National Cyber Security Policy [2], thispolicy was developed based on a National Cyber SecurityFramework comprising legislation and regulations,technology, public-private cooperation, and institutionaland international aspects. The emphasis is on mitigatingthe risks to the Critical National Information Infrastructure(CNII), which comprises the network information systemsof ten critical sectors. The sectors are National Defenseand Security, Banking and Finance, Information andCommunications, Energy, Transportation, Water, HealthServices, Government, Emergency Services, and Food andAgriculture.According to CNII portal [3], the Critical National InformationInfrastructure (CNII) specifies real and virtual assets,systems and functions that are vital to the country. Wecannot afford any breakdown to CNII as its failure will havean overwhelming impact on national economic strength,image, defense and security, government functions andpublic health and safety.What is Common Criteria?According to Common Criteria Portal [4], Common Criteria(CC) is an internationally recognised standard in theevaluation of security requirements in an ICT product.Based on the Malaysian Security Evaluation Facility (MySEF)website [5], the Common Criteria standard is a blend ofITSEC (European criteria), CTCPEC (Canadian criteria) andTCSEC-Orange Book (US criteria) later known as the USDraft of Federal Criteria (FC). From the Common Criteriaportal [4], the CC is considered the widest available mutualrecognition standard for securing IT products.Simply put, CC is a standard that can be used as aguideline for ICT product developers to ensure the securityfeatures in their products are properly defined, developedand tested. By having a product evaluated under the CCstandard, we are actually implementing preemptive actionin minimizing vulnerabilities in our ICT products.e-Security | CyberSecurity Malaysia | Volume 21 - (Q4/2009)