Security Profile for Advanced Metering Infrastructure - Open Smart ...

DHS-2.8.11.3 Requirement Enhancements:
None.
DHS-2.8.11.4 Rationale:
If compromising the components of a cryptographic system is easier than compromising
the cryptography itself, the cryptographic system will only provide protection equivalent
to the protection afforded to the components of that system.
DHS-2.8.12 Use of Validated Cryptography
DHS-2.8.12.1 Requirement:
The organization shall develop and implement a policy governing the use of
cryptographic mechanisms for the protection of AMI system information. The
organization ensures all cryptographic mechanisms comply with applicable laws,
regulatory requirements, directives, policies, standards, and guidance.
DHS-2.8.12.2 Supplemental Guidance:
It is recommended that any cryptographic modules deployed within an AMI system, at a
minimum, should be able to meet the Federal Information Processing Standard (FIPS)
140-2 requirements where technically and economically feasible. Assessment of the
modules must include validation of the cryptographic modules operating in approved
modes of operation. The most effective safeguard is to use a cryptographic module
validated by the Cryptographic Module Validation Program. Additional information on
the use of validated cryptography can be found at http://csrc.nist.gov/cryptval.
DHS-2.8.12.3 Requirement Enhancements:
1. The organization protects cryptographic hardware from physical tampering and
uncontrolled electronic connections.
2. The organization selects cryptographic hardware with remote key management
capabilities.
DHS-2.8.12.4 Rationale:
Validating the implementation of a cryptographic algorithm requires resources that are
beyond the capabilities of most utilities and vendors. Following the NIST guidance
provides assurance that the selected cryptography will provide the required level of
protection.
Security Profile for Advanced Metering Infrastructure Version 1.0
UtiliSec Working Group (UCAIug) December 10, 2009
33