security profile for openadr - Open Smart Grid - OpenSG - UCA ...

4 860 Security Controls
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
This section defines the set of recommended security controls for OpenADR systems and
components as that satisfy the functionality of the roles and use cases delineated earlier in
this document. Many of the security controls in this document are inspired by and
intended to cover the technical requirements found in NIST IR 7628 as applied to
Demand Response technology and related systems. The controls presented herein may
then, in turn, be satisfied by communications protocol definition-level standards and
manufacturing specifications. This section defines the controls, and assigns the controls
to roles.
4.1 Scope of Security Controls
The scope of network topology of OpenADR systems defined in this document is limited
to the interactions between a paired DR Controlling Entity and DR Resource over a
public (Internet) or private network. The Network Architecture at these points should
follow best practices for securing internal systems. The specific practices are out of scope
of this document. Numerous documents on best practices are available on the NIST
Computer Security Resource Center (http://csrc.nist.gov/publications/index.html), and are
summarized in “Generally Accepted Principles and Practices for Securing Information
Technology Systems” (http://csrc.nist.gov/publications/nistpubs/800-14/800-14.pdf).
Securing internal systems is also addressed by corporate or other organizational policies
that are also out of scope. The process for tailoring security controls to an organization
SECURITY PROFILE FOR OPENADR
Version – 0.02
UCA International Users Group December 15, 2011
50