**PCSRF Target Definition Workshop Minutes**

Wednesday, December 5, 2001 -- Thursday, December 6, 2001

Hosted by NIST

**Participants:**

Joe Weiss - EPRI

Bill Miller - MaCT

Ali Quraishi - AGA

Bill Rush, John Kinast - GTI

Michael McEvilley - DAC

Paul Oman - Schweitzer Engineering Labs

Joe Bergmann - The Open Group

Sam Bowser - The Aerospace Corporation

Tom Phinney, Kevin Driscoll - Honeywell Labs

Lois Ferson - ISA

David Saunders - Westin

Diana McCormick - Fairfax County Water Authority

Tom Schneider - KeySpan Energy

Mike Foreman - Columbia Gas Transmission Corp.

Al Wavering, Joe Falco, Keith Stouffer, Fred Proctor, Jerry Fitzpatrick,
Eric Simmon - NIST

**Purpose:** To learn more about the Common Criteria (CC) approach
through a CC primer and identify the Target of Evaluation for the
requirements/Protection Profile that will be developed.

## Support Contractor

A support contract has been awarded to Decisive Analytics Corp. to help
the PCSRF develop security requirements for process control systems.
Michael McEvilley will be the PI. The SOW has been posted to the
Documents section of the web site.

## Web Site Updates

In addition to the support contractor SOW, several items have been added
to the web site recently. These include:

-   A Table of Related Activities has been added. This includes
    organizations and activities such as the Partnership for Critical
    Infrastructure Security, IEC TC57 WG15, Center for Internet
    Security, etc. Participants were requested to suggest additions to
    this table.

-   The Generic Process Control Diagram has been updated to include
    suggested changes.

```{=html}
<!-- -->
```
-   The Power Point slides that Tom Phinney presented during the
    December 6 meeting.

-   The Power Point slides that Michael McEvilley presented during the
    Common Criteria primer.

### December 5 Overview

The meeting was moved from NIST to the Hyatt Regency - Capitol Hill to
allow bilateral participation between the PCSRF meeting and a SCADA
Encryption Workshop sponsored by the American Gas Association (AGA),
Institute for Gas Technology (IGT), and Edison Electric Institute (EEI).
During the morning, PCSRF participants joined the AGA session. Among the
morning presentations was one delivered by Kevin Driscoll of Honeywell
Labs on their Beep-Beep encryption algorithm The Beep-Beep algorithm was
presented as being 2 -- 40 times faster than AES, 25 -- 200 times faster
than 3DES, and 1000 times faster than PKI. It was noted that the
Beep-Beep algorithm can not perform replay protection. Replay protection
has to be performed by the protocol.

In the afternoon, Michael McEvilley from Decisive Analytics Corp started
a primer on the process of developing security requirements and how the
Common Criteria can be applied to this process. He explained the CC
specification philosophy which is a framework for the specification of a
security problem and for the specification of a security solution. The
CC concept of a Protection Profile (PP) was presented.

Protection Profiles are security specifications that include:

Context Information

Introduction

Target of Evaluation (TOE) Description

Environmental Information

Assumptions

Threats

Policies

Statement of Goals (Objectives)

Functional Requirements

Assurance Requirements

Rationales

### December 6 Overview

## Michael McEvilley continued the CC primer in the morning, setting the tone for the Target Definition Workshop discussions. The PP development process was presented. A critical issue is the scope and bounding of the problem. The TOE has to be defined as well as the TOE's physical and IT environments.

During the discussions, an agreement was made that for the PP developed
from this exercise to be of any use, it has to be used in the
procurement of process control systems.

After some discussion led by Michael and Al Wavering, the Target of the
PP was determined to be a general process control system which includes
the following components:

Controller

Transmitter (sensor)

Actuator (drives, valves, etc.)\
Communications (internal to the system and external to the system)

Human Machine Interface (HMI)

Transmitter and Actuator include the intelligent interfaces that provide
digital communications functions and other capabilities, such as
calibration.

These components are indicated in the shaded areas of the revised
control system diagrams on the following page.

It was decided to address industrial control systems in general, since
SCADA and DCS systems have much in common and differ primarily in the
distances between system components, the mechanisms used to communicate
between them, and the degree of physical protection of both the
components and the communications links.

![](media/image1.png){width="6.104166666666667in"
height="4.2555555555555555in"}

![](media/image2.png){width="6.197916666666667in"
height="4.373611111111111in"}

A significant amount of discussion focused on whether there is a common
requirement for systems to transition to a known (safe) state upon
security function failure. The consensus was that this was not a
requirement that was common across all systems---it is only required if
a system is already configured to transition to a safe state upon other
types of failures. That is, adding security functions should not affect
whether a system requires and uses fail-safe capability. The requirement
for fail-safe operation is driven by process characteristics (amount and
volatility of hazardous materials, operating pressures and temperatures,
etc.) and applicable regulations.

## Tom Phinney developed some slides during the discussions characterizing the threats to process control systems and presented them. These slides as well as the CC primer slides are posted on the web site in the Documents section <http://www.isd.mel.nist.gov/projects/processcontrol/documents.html>

## New Action Items

Tom Phinney will submit a copy of his presentation to be posted to the
PCSRF website

Michael McEvilley will assemble the information gathered during the
workshop and draft a security environment and objectives document.

## Next Meeting

The next meeting will be a conference call on Wednesday, January 30 from
1:30 -- 3:30 EST. Additional information on how to participate in the
call will be posted in the Upcoming Meetings section of the PCSRF
website.