2006 International Control Systems Security and Standards Coordination
Workshop Agenda

# Introduction

The agenda focuses on recommended practices, standards, and metrics
applicable to cyber security of critical infrastructure control systems;
a draft copy is attached. The agenda is being developed but the draft is
available.

# Purpose and Expected Benefit

The purpose of this workshop is to share information between a variety
of international consensus standards organizations and industry groups
working on a common topic, i.e., enhancing the security of cyber control
systems used to operate and control critical infrastructure against
cyber events. This workshop will provide an opportunity to develop
cooperative working relationships, leverage experience and prior
successful achievements, and minimize redundant or non-productive
efforts. Based on a successful meeting, this workshop is expected to be
an annual event.

# Workshop Structure and Mechanics

The workshop will be held as a one and one-half day set of meetings.
During the first two hours, formal presentations will be delivered to
establish the technical basis and topical scope of the workshop.

Following the opening presentations, there will be four topical,
simultaneous break-out sessions. The choice of "four" is based on an
assumption of approximately 80 participants. The topics are:

-   International Control System Cyber Security Issues

-   International Coordination, Collaboration, and Cooperation on
    Control System Cyber Security

-   Control System Cyber Security Standards

-   Control System Cyber Security Metrics

On Thursday the break-out sessions will be in two hour blocks of time.
Each session will have a leader and begin with a formal presentation. A
facilitator will be provided for each session. This will be followed by
several informal presentations and a facilitated discussion period.

The facilitators will capture key presentation ideas, questions and
answers following presentations, and key comments during the discussion
period. The facilitators will also encourage the group to identify key
problems, key issues, suggested resolution approaches, future actions,
and individuals who will form future working groups.

The concept of future working groups is to have a small team of 3 or 4
individuals who will maintain communication via phone and/or email to
work towards resolving issues and problems. It is recognized that these
working groups will be unfunded at first, but they should work towards
obtaining funded efforts in the future. The key idea is to maintain
international collaboration.

On Friday morning each break-out session will meet and resolve open
questions and prepare a summary conclusion. A final full-session meeting
will be held where the summaries will be presented and discussed.

The objective is to initiate small, committed working groups that will
continue to function during the next few years with the annual workshop
to bring relevant groups and individuals back together.

The driver for this meeting is the need for consistent, complementary
information sharing and collaboration to address cyber security to
control systems. Since cyber security is a worldwide concern, it is
important to have international cooperation on potential solutions. The
following is a proposed agenda.

## Thursday August 10, 2006

> 7:45 - 8:00 Workshop objectives and structure (Joe Weiss - KEMA)
>
> 8:00 -- 8:15 Introduction - United States Control System Security
> Program, Initiatives, and International Perspective (Hun Kim - DHS)
>
> 8:20 -- 8:30 CSSP Recommended Practices (Trent Nelson - INL)
>
> 8:30 -- 9:30 Approaches and status of various standards efforts (10
> minutes each)

-   US Standards Strategy (Keith Stouffer -NIST)

-   Other Countries -- (Erik Sandstrom - Vattenfall)

> 9:30-9:40 Cyber Risk and Metrics -- How do we measure risk. How
> metrics are used in other national and international standards.
> (George Beitel - INL)
>
> 9:40 -- 9:50 Current problems and issues within the international
> community and how do we address redundancy in standards, information
> sharing and sharing opportunities, and conflicting standards,
> requirements, and lack of metrics (Joe Weiss)
>
> **9:55 -- 10:10 Break**
>
> 10:15 -- 10:20 Instructions on break-out session mechanics
>
> 10:20 -- 12:00 Breakout sessions

-   International Control System Cybersecurity Issues -- (TBD -- Lead)

```{=html}
<!-- -->
```
-   International Coordination and Collaboration (TBD -- Lead)

-   Standards Identification and Documentation of Needs (Bryan Singer -
    Lead) - Develop a hierarchy of standards and guidance documents.
    Perform a gap analysis to determine what is missing and what appears
    to be redundant.

-   Metrics Development (Miles McQueen - Lead) -- Develop a hierarchy of
    metrics needs including minimum benchmarking criteria, how much
    security is enough security, security certifications, etc.

> **12:00 - 1:00 Lunch**
>
> 1:00 -- 3:00 Breakout sessions (continued)

-   Control System Cyber Security Issues

-   International Coordination and Collaboration

-   Standards Coordination

-   Metrics Development

> 3:00 -- 3:20 Break
>
> 3:20 -- 3:40 General Session -- This will be a brief refresher on the
> specific objectives of the workshop. There will be a question and
> answer session to address any modifications required as a result of
> the progress made during the prior sessions.
>
> 3:40 -- 5:00 Breakout sessions (continued)

-   Control System Cyber Security Issues

-   International Coordination and Collaboration

-   Standards Coordination

-   Metrics Development

## Friday August 11, 2006

> 8:00-10:00 Breakout Sessions - Discussions of recommendations by each
> group

-   Control System Cyber Security Issues

-   International Coordination and Collaboration

-   Standards Coordination.

-   Metrics Development

> **10:00 -- 10:15 Break**
>
> 10:15 - 11:00 Summary development by each group

-   Control System Cyber Security Issues

-   International Coordination and Collaboration

-   Standards Coordination

-   Metrics

> 11:00-12:00 Summary and recommendations from each group to all
> attendees.
>
> 12:00 Lunch and conclusion