Security Profile for Advanced Metering Infrastructure - Open Smart ...

their protection needs to be determined. Policies and procedures must be developed and
implemented to protect the connection to the business or enterprise information system.
This might include disabling the connection except when specific access is requested for
a specific need, automatic timeout for the connection, etc.
DHS-2.8.18.3 Requirement Enhancements:
None.
DHS-2.8.18.4 Rationale:
External system connections provide a vector of attack into the AMI system, and
therefore must be managed to the appropriate security level to ensure the security of the
AMI system.
DHS-2.8.19 Security Roles
DHS-2.8.19.1 Requirement:
The AMI system design and implementation must specify the security roles and
responsibilities for the users of the system.
DHS-2.8.19.2 Supplemental Guidance:
Security roles and responsibilities for AMI system users must be specified, defined, and
implemented based on the sensitivity of the information handled by the AMI system.
These roles may be defined for specific task and data handled.
DHS-2.8.19.3 Requirement Enhancements:
None.
DHS-2.8.19.4 Rationale:
Defining roles and responsibilities for user ensures alignment with security requirements.
DHS-2.8.20 Message Authenticity
DHS-2.8.20.1 Requirement:
The AMI system must provide mechanisms to protect the authenticity of device-to-device
communications.
DHS-2.8.20.2 Supplemental Guidance:
None
DHS-2.8.20.3 Requirement Enhancements:
Message authentication mechanisms should be implemented at the protocol level for both
serial and routable protocols.
Security Profile for Advanced Metering Infrastructure Version 1.0
UtiliSec Working Group (UCAIug) December 10, 2009
37