**PCSRF Conference Call Notes**

Thursday, February 28, 2002 3:00 -- 5:00 PM ET

Hosted by NIST

**Participants**

Al Wavering, Joe Falco and Keith Stouffer (NIST Manufacturing
Engineering Laboratory)

Lois Ferson (ISA)

Joe Weiss (EPRI)

Bill Miller (MaCT)

Michael McEvilley (Decisive Analytics Corp)

Em Delahostria and Dan Carnahan (Rockwell)

Tom Phinney (Honeywell)

Sal Depasquale (Georgia Pacific)

Tony Haynes, Dave Tait, and Mike Fancher (NCMS)\
Mike DeVaney (PNL)

Bill Rush (GTI)

Owen Kean (American Chemistry Council)

**Purpose**

To share status and plans among participants; report on Feb. 15 OHS/CIAO
Interagency meeting on Digital Control Systems and the Feb. 20 Technical
Support Working Group (TSWG) meeting; discuss the sector-specific
workshop template; and plan for next face-to-face meeting additional
invitees, timing, agenda.

## Web Site Updates

The minutes from the past conference calls were added to the web site
recently.

## Participant status updates 

Joe Weiss (EPRI) reported that at the Energy Expo, Riptech presented
that more than half of the cyber-attacks from the mid-east since 9/11
have been aimed at the electric industry. He is currently at a workshop
in Atlanta for cybersecurity for the electric utilities. BCIT (Eric
Byres) is involved in collecting information on cases of cyberattacks
(some accidental/unintentional) of control systems. Most of these
attacks were on PLCs in paper mills. One attack accessed a 5MW turbine
through the energy and building management systems. One attack occurred
during a labor dispute in which all the passwords on the PLCs were
changed which caused the mill to be shut down (the PLCs had still had
their default passwords). Another incident (unintentional) was caused
when an expert system engineer wrote a program to collect sensor data
from the corporate LAN, plant, and field devices. The PLC gateway didn't
have enough bandwidth for this, therefore an intermittent
denial-of-service was created. Joe is trying to get the full report on
this. Joe is trying to piece together an effort to develop intrusion
detection technology for process control.

Bill Rush (GTI) reported that there was a lot of activity with the
AGA/GTI SCADA encryption group. They will be recommending a suite of
algorithms to use for SCADA encryption. They have some initiaql timing
data for an 8-bit microprocessor field device. \[numbers\] The website
for this effort is: <http://gtiservices.org/security/index.shtml>

Michael McEvilley (DAC) reported that yesterday (2/27/02) was the IEEE
inaugural meeting on information assurance. The Protection Profiles will
define criteria that the other organizations will adapt and turn into IA
standards. He was on the steering committee for NIAP on government
developed Protection Profiles (OS, databases,etc.). These PPs are
focusing on product certification and not on systems. What is learned in
this process though should drive the focus on the systems issue.

Tom Phinney (Honeywell) reported that he chairs a standards committee,
IEC/SC 65C, which handles process control communications standards.
There was a meeting 2 weeks ago in Paris at which an agreement was made
as to the venue for giving process industry cyber-protection agreements
IEC document status. There are 4700 pages of standards. Tom talked about
German ProfiSafe and extension of profiles for functional safety and
security issues. Tom is intruducing a New Work Item on cybersecurity
into IEC/SC 65C. This will provide a placeholder for cybersecurity
standards and agreements. Tom also mentioned that there are a lot of
advantages to combining safety and security issues, including
facilitation of consensus building. This is likely to become the
predominant mode of operation.

## Lois Ferson (ISA) reported that ISA is also combining safety and security issues and is working on safety issues with 3 groups (Security, Fieldbus, EMI).

Michael McEvilley commented that procurement/acquisition folks can help
drive the effort of security.

Tom Phinney added that we can't just look at this as a new procurement
issue, but also retrofitting existing systems. If the insurance agencies
get involved with security as a rating issue, the industries will get
involved since there will be a cost driver. Stu Katzke is exploring this
issue with insurance companies. Al Wavering took an action to get an
update from Stu as to the current status of this.

Al Wavering (NIST) reported on the February 15 digital control systems
meeting for United States Government agencies that was convened by
Richard Clarke. There was good Federal Agency representation -- EPA,
DIA, DOE, FDA, FAA, TSWG, CIA, DOT, NIPC, NIJ, NASA, OSHA. Clarke and
Tritak said they viewed control systems security as critical. The safety
vs. security issue was discussed. There was a request to help identify
who should come to the public/private sector meeting that is planned for
April 2. There will be two parts to the meeting - Presentations to make
people aware of the problem; and what to do about it. There was a TSWG
meeting on February 20. TSWG is a State Department program for funding
anti-terrorism R&D. Their October BAA drew 12,500 responses. A new BAA
will be released early March -- see
[http://www.tswg.gov](http://www.tswg.gov/) for additional details.
There are also funding opportunities from NSF as well.

Dave Tait (NCMS) reported that they conducted a discrete manufacturing
workshop in Ann Arbor, MI. There is a need to get companies thinking
about their critical assets. NCMS is collaborating with the Software
Engineering Institute (SEI) to adapt and apply their SEI/OCTAVE
vulnerability assessment tool. Problems are particularly acute for
Tier3/Tier4 suppliers, who have no time to look up and no resources to
address this issue. Tony Haynes (NCMS) reported they have had
discussions with Ford regarding PLC security; they seem to be pretty far
along.

Joe Weiss reported that IEC TC57 is working to have a draft Protection
Profile by the end of FY02 (September 2002) and a final report to IEC by
December 2002 in the form of a TR report.

Sal Depasquale (Georgia Pacific) reported that that he is involved with
the American Chemistry Council (ACC). The ACC has started to develop a
process to assess chemical facilities to determine what risks they have
and which risks that they can accept and which risks they cannot and
therefore have to do something about.

**Sector Workshops:**

We discussed the proposed two-tiered approach to gathering information,
where we will work with industry organizations to hold sector-specific
workshops, and the PCSRF would coordinate and consolidate this
information across sectors. There was agreement that this approach could
avoid some cross-sector communication difficulties and help get the
right people to participate. The straw plan is:

1\) Draft requirements specification document (Jan. 28)

2\) Review and comments from PCSRF (Feb. 8)

3\) Hold PCSRF meeting with EPRI, ISA, API, AGA/IGT, TAPPI, AMWA, NCMS
to plan sector-specific workshops to further develop security
environment; vulnerabilities and threats. (immediately following the
April 2 public-private sector meeting)

4\) Work with these groups to conduct sector-specific workshops.
(April - early May)

5\) PCSRF analyzes and consolidates results into industry-wide
specification, with identification of both common and sector-specific
issues. (late May)

6\) Evaluate progress, plan and conduct round two of workshops focusing
on security objectives and security functional requirements. (June -
July)

7\) Incorporate round two results into specification, review and
comment. (August)

8\) Produce Protection Profile based on specification. (Sept. - Oct.)

The question of when additional vendors would be engaged was raised. The
intent is to include the vendors that serve each sector in the
sector-specific workshops.

A workshop prospectus developed by the National Center for Manufacturing
Sciences (NCMS) was discussed as an example template for the sector
workshops.

Additional work needs to be done to develop model narrative descriptions
(use cases) to use in guiding workshop discussions.

## Next Meeting

The next meeting is planned to be a face-to-face meeting on Wednesday
April 3, 2002 at NIST in Gaithersburg, MD. Additional information on the
next meeting will be posted in the Upcoming Meetings section of the
PCSRF web site when available.

## Action Items

-   All - review the Security Profile Specification (SPS),
    validate/challenge the assumptions stated in the Operational
    Security Environment section, and provide any other comments to
    Michael McEvilley, Al Wavering, or the group at large.

-   Michael McEvilley -- distribute guidance regarding use cases.

-   All -- submit possible use case scenarios for their specific
    industry.

-   NIST and Michael McEvilley will develop a template for
    sector-specific workshops and explore the possibility of conducting
    these with industry organizations.

-   Al Wavering - get an update from Stu Katzke on the status of
    insurance industry efforts