Meeting Minutes

Process Control Security Requirements Forum (PCSRF)

#### Thursday, April 19, 2001 3:30-5:15 PM ET

Conference Call

### Introduction

John Evans welcomed the conference call participants and provided
background information related to NIST funding via the Critical
Infrastructure Protection (CIP) initiative.

Al Wavering reviewed the meeting goals and agenda. The goals of the
meeting were to

1.  Bring everyone up to speed on progress, plans, and current status.

2.  Solicit information needed to define the process control system
    security environment and objectives.

3.  Schedule the date for the next face-to-face meeting.

### Participant Updates and Introductions

Next, we stepped through the list of participants and each person
provided a brief summary of PCSRF-related activities and plans, and
newcomers introduced themselves:

*Al Wavering (NIST MEL):*

-   Two NIST participants attended the Symposium on Requirements
    Engineering for Information Security on March 5-6, 2001 and the
    Government-Industry IT Security Forum: Strategies for the
    Development of Security Requirements and Specifications for
    Computing and Real-Time Control Systems on March 7, 2001 at Indiana
    University -- Purdue university at Indianapolis to gain insight into
    the Common Criteria and IT security requirements issues. A report is
    available at:
    <http://www.isd.mel.nist.gov/projects/processcontrol/minutes.html>

-   Four NIST participants attended a one week training class "Common
    Criteria - Designing a Protection Profile\" on March 26-29, 2001.
    This class, offered by NIAP, covers the use and application of the
    Common Criteria in the development of Protection Profiles (PP) and
    Security Targets (ST).

-   NIST is using this recently acquired knowledge to draft a security
    environment and security objectives as initial steps to the
    Protection Profile writing process. Issues encountered include
    definition(s) of the Target of Evaluation (TOE) for which PP are
    written, and the requirement for more detailed information from the
    process controls industry which is now being requested via a
    questionnaire.

-   NIST visited Honeywell recently, will be visiting Honeywell
    headquarters, Siemens and Invensys.

-   NIST is currently looking into Protection Profiles being developed
    by FAA-MITRE. These PPs could aid in the development of PP's for
    process controls since they address complex real-time systems.

-   NIST is planning several plant tours in order to gain knowledge of
    process controls technology and IT security practices currently in
    use by industry. The first plant tour is scheduled for May 2^nd^ at
    a Georgia-Pacific facility (later postponed). Visits of a refinery
    and a power plant are also in the works.

-   NIST has invited proposals to the the Critical Infrastructure
    Protection Grants Program (CIPGP). "The objective of the CIPGP is
    improvement of the robustness, resilience, and security of
    information in all the critical infrastructures. This will be
    accomplished by funding research leading to commercial solutions to
    those information technology (IT) security problems central to
    critical infrastructure protection that are not being adequately
    addressed. Detailed information is available from the Federal
    Register Notice, or from the web site
    <http://csrc.nist.gov/grants>." This program is geared primarily
    toward university research, but PCSRF member(s) could team with a
    university.

*Sal DePasquale (Georgia-Pacific):*

-   Sitting in for Bob Hayes.

-   Works w/Sandia (Gordon Smith, Jennifer Dupoy, Rolf Carlson).

-   Primary interest is in chemical plant security particularly at the
    application level to provide fail-safe applications in order to
    avoid things such as exothermic reaction. Another interest is how to
    ensure security in the design stage, e.g. by getting the design
    validated by a different engineer from the one who designed it.

*Carlos Mena and Claudia Bond (Georgia-Pacific):*

-   Primary interests include process control security, especially
    firewall security at network level. Plants networks are currently
    shared across business, operations domains---need to segregate them.

-   Also, regarding internal systems, physical security is a big issue
    and a continuing challenge.

-   A non-disclosure agreement must be drafted so that process control
    system architectures can be shared. If information such as this is
    to be posted to the web site, a password protected link is required.
    \[ NIST will look into creating a members-only area on the web site,
    NIST and G-P will exchange non disclosure agreements to try to find
    one that will pass muster\]

-   Attended I4 presentation where Larry Miller presented Dupont
    architecture.

-   Stu will follow up with Dupont to see if Dupont will contribute this
    information to our efforts.

*Bob Morey (CSE):*

-   Met with CIP people, trying to coordinate with Canadian
    industry---some may be very interested in participating.

-   Will be at the ICCC.

*Joe Johnson (Texaco):*

-   Joe is head of Texaco advanced control for refining and has 25 years
    of control systems experience.

-   Began addressing security issues in the early 1980s.

-   Participated in meeting with white hat hacker Mudge (Joe Weiss, Stu
    Katzke also participated). No new ideas came out of it, though.

-   Suggested Texaco's Pembroke operation as a plant tour for NIST.

*Joe Weiss (EPRI):*

-   Presented at several information security conferences.

-   Working with control system vendors (have talked with Honeywell,
    Siemens, Invensys).

-   At the PCIS (Partnership for Information Security) meeting, met with
    Dick Clarke, John Tritek. Extensive conversations, lots of interest.
    Led to meeting with Mudge. Even really smart IT experts are not
    process controls experts and that this is an important issue. They
    are not familiar with the special requirements of process control
    systems.

-   Has participated in Open Group, OMG has started to look at security
    in real-time systems.

-   Interested in reference implementation of Linux security kernel
    (allows you to define your own security policy) and how it can be
    used in control systems. (He is sending information on this to Jerry
    Fitzpatrick.)

-   Exploring approaches for process control security: make data
    transfer secure; layered integrity.

-   Attended RSA conference---real-time applications and requirements
    are not on the radar screen of any vendors there.

-   To participate in a video conference with ARL and several
    universities regarding exploratory projects for IT security for
    military systems.

*Jeff Dagle (PNNL):*

-   Performs vulnerability assessments for electric and natural gas
    utilities, including topics such as SCADA security and
    authentication of control signals without full encryption.

-   Sits on the Nuclear Energy Regulatory Commission CIP working group.

-   Will be talking with Siemens soon and will share his presentation
    with this group.

-   DOE labs are participating in IEC WG15 effort that deals with
    transmission and distribution issues (SCADA).

*Lois Ferson (ISA):*

-   Working to promote IT security among ISA members.

-   There have been several articles in the ISA Journal, as well as in
    online publications (see PCSRF web site links).

-   Explored interest in information security among members of
    productivity dialog group---there is some support, but need for
    education on the issue remains.

-   Will host two panel sessions at the ISA conference in Houston, Nov.
    2001 to address technical issues and what vendors have available.
    Jay Abshire will participate.

-   Expecting to host a technical conference series in late 2001.

*Stu Katzke (NSA):*

-   Continues to spread the word and help create community of interest
    through outreach programs.

-   Attended RSA conference.

-   Will participate in ARL videoconference.

*Jerry Fitzpatrick (NIST EEEL):*

-   Has experience with electric power systems metrology---to leverage
    towards the development of security requirements for SCADA systems.

-   Completed class "Common Criteria - Designing a Protection Profile\".

-   Participates in standards efforts, interested in aligning security
    work with these and vice-versa.

*William Miller (MaCT):*

-   Gave presentations at I4 and RSA conferences; Sent out the
    presentation to be posted on the private area of the web site

-   Interesting product announced at the RSA conference: Network
    Interface Card with embedded firwewall. MaCT will be trying it out.

-   Will be presenting at the IATF Forum on Documenting User
    Requirements June 14, 2001 at NIST.

-   From the I4 conference: Risk assessment and policy issues in many
    cases have not been addressed at the plant level.

-   Concerns include exposures and vulnerabilities resulting from:
    moving to ethernet from proprietary buses, wireless communications,
    connection of ERP systems with production systems, problems with the
    software design and implementation process itself.

-   Legacy issues are also a concern: control systems currently in place
    are likely to be there for 10 or more years.

*Keith Stouffer (NIST MEL):*

-   Completed class "Common Criteria - Designing a Protection Profile\".

-   Working to draft Security Environment/Security Objectives

-   Established and maintains PCSRF web site, email list

*Joe Falco (NIST MEL):*

-   Attended the Symposium on Requirements Engineering for Information
    Security/ Government-Industry IT Security Forum.

-   Completed class "Common Criteria - Designing a Protection Profile\".

-   Working to draft Security Environment/Security Objectives

### Action Item Status

Al Wavering walked through the action items from the last meeting, which
were:

1.  Distribute meeting actions and minutes 4/20/01 Wavering

2.  Respond to PCSRF request for information[^1], send 5/4/01 All

information to Keith Stouffer (<keith.stouffer@nist.gov>)

3.  Send points of contact for invitees to next meeting to 5/4/01 See
    assignments in list

> John Evans (<jevans@nist.gov>) below

4.  Send points of contact for related efforts (listed below) 5/4/01 All

> to John Evans

5.  Identify key vendor points of contact with knowledge of 5/4/01 All

> architectures, email to John Evans

6.  Draft request-for-participation letter to be sent out under 5/4/01
    Evans

> PCSRF/NIAP letterhead, email to Joe Weiss

7.  Exchange non-disclosure agreements 5/4/01 Evans, Bond

8.  Add password protected participants-only area to web site; 5/11/01
    Stouffer

post individual contact info, other sensitive information

9.  Add software vendors to vendor landscape document 5/11/01 Stouffer,
    Falco---input from others requested

10. Draft security environment for next meeting 6/6/01 Stouffer, Falco
    with input from group

11. Draft security objectives for next meeting 6/6/01 Stouffer, Falco
    with input from group

12. Conduct face-to-face meeting at NIST 6/13/01 All

Status of action items:

NIST has begun to draft the security environment and security
objectives, and is soliciting information needed to do this from the
PCSRF participants. A questionnaire has been prepared that indicates the
information sought. The questionnaire is available at:
<http://www.isd.mel.nist.gov/projects/processcontrol/questionaire_041901.htm>.

Participants are requested to provide the information sought to the
extent that they can. This will depend upon the type of organization,
among other things. The issue was raised that some of the information
requested might require a non-disclosure agreement to be in place to
ensure that it was only available to PCSRF participants. NIST and
Georgia-Pacific will explore non-disclosure agreements and see if a
common form can be developed. NIST will also add a password-protected
area to the web site that would contain sensitive information to be made
available only to the PCSRF group.

Another issue regarding the questionnaire is that information on
incidents (in general, and IT security related incidents, in particular)
is difficult to come by. All plants have incidents, but may not
recognize an incident as having been caused by an IT security problem. A
database of anomalous behavior would be useful (e.g., ask how many times
have you had a system failure due to any cause, and then try to identify
the cause of the failure). Instrumentation of plants to identify IT
attacks would help determine how significant the information security
problem is and how it is changing. Unfortunately, few plants are set up
to monitor such things.

**Vendor Landscape Document**

A draft vendor landscape document provided by Joe Weiss was discussed.
Joe went over the document and emphasized that it was a first cut, and
comments and additions were welcome. One topic of discussion was whether
software vendors and 2d/3^rd^ tier suppliers should be included. Joe
Johnson pointed out that that's where the bulk of the vulnerabilities
lie (communications between layers). NIST will add some of these vendors
to the list. There are many, however, so it won't be comprehensive. It
was mentioned that hacking into PLCs themselves was less likely to a
concern than breaking into higher levels and gaining access through
systems connected to the business side of an organization. This is
because PLC protocols and components are not nearly as widely used and
familiar to controls non-practitioners as those used in business IT
systems.

There was considerable discussion regarding the varying degrees of
thoroughness with which control system vendors (hardware and software)
specify and set operating system and other configuration settings to
result in a secure system. Some vendors do an outstanding job at this,
and at working with the vendors of the infrastructural components to
make sure that the overall configuration will be secure. However, other
vendors have not invested a similar level of effort in this area. An
open question is whether or not we might be able to work with the
leaders in this area to develop best practices that could be followed
more broadly in the market. Some felt that since the leaders have
invested significant resources to make their product more robust, they
would not be willing to share that information and effectively give up
some of their competitive advantage.

### Next Meeting Date

The group discussed William Miller's proposal to hold the next
face-to-face meeting at NIST in conjunction with the Information
Assurance Technical Framework Forum (IATFF). The IATFF will be held
Thursday, June 14^th^. The group decided to hold the next meeting on
Wednesday, June 13^th^ (later changed to June 15^th^). The meeting will
be an all-day workshop to review, discuss, and edit the straw security
environment and security objectives, which are to have been distributed
a week in advance.

**Revised Action Item List**

1.  Distribute meeting actions and minutes 4/20/01 Wavering

2.  Respond to PCSRF request for information[^2], send 5/4/01 All

information to Keith Stouffer (<keith.stouffer@nist.gov>)

3.  Send points of contact for invitees to next meeting to 5/4/01 See
    assignments in list

> John Evans (<jevans@nist.gov>) below

4.  Send points of contact for related efforts (listed below) 5/4/01 All

> to John Evans

5.  Identify key vendor points of contact with knowledge of 5/4/01 All

> architectures, email to John Evans

6.  Draft request-for-participation letter to be sent out under 5/4/01
    Evans

> PCSRF/NIAP letterhead, email to Joe Weiss

7.  Exchange non-disclosure agreements 5/4/01 Evans, Bond

8.  Add password protected participants-only area to web site; 5/11/01
    Stouffer

post individual contact info, other sensitive information

9.  Add software vendors to vendor landscape document 5/11/01 Stouffer,
    Falco---input from others requested

10. Draft security environment for next meeting 6/6/01 Stouffer, Falco
    with input from group

11. Draft security objectives for next meeting 6/6/01 Stouffer, Falco
    with input from group

12. Conduct face-to-face meeting at NIST 6/13/01 All

# 

# 

# Related efforts

# Department of Energy laboratories

IEC TC57

TCT

International Information Integrity Institute (I4)

European Security Forum (ESF)

OPC

ISA

Call to Governance

PKI Forum

National Petroleum Council

NERC

International Security Management Association (ISMA)

Invitees to next meeting (and responsible invitor):

Forest Products Security Council (Bob Hayes)

Electric power (Joe Weiss/Jeff Dagle)

Cement and mining (Bill Miller)

Water (Joe Weiss)

Chemical (Joe Weiss)

Steel, pharmaceuticals (Stu Katzke, via screening of I4)

[^1]: (at
    <http://www.isd.mel.nist.gov/projects/processcontrol/questionaire_041901.htm>)

[^2]: (at
    <http://www.isd.mel.nist.gov/projects/processcontrol/questionaire_041901.htm>)