# Presentation: 266178

## IEC TC57 WG15 - SecurityStatus & Roadmap,TC57 Plenary, May 2007

- Frances Cleveland
- Convenor WG15
*Presented at Plenary by Herb Falk*
*US Representative to WG15*

**Notes:**
I do this presentation on behalf of Frances Cleveland, she is unable to attend the General Assembly.

## Scope of WG15 on Security

*Undertake the development of standards for security of the communication protocols defined by the IEC TC 57, specifically the IEC 60870-5 series, the IEC 60870-6 series, the IEC 61850 series, the IEC 61970 series, and the IEC 61968 series. *
*Undertake the development of standards and/or technical reports on end-to-end security issues*.
- Other notes of Interest:
- WG15 started as Adhoc Working 06 in 1997 (this is the WG’s 10 year anniversary).
- 13 Participating Countries, 32 individuals

- WG15 Status October 2005

**Notes:**
The WG15 scope is the security of the IEC TC57 defined protocols and the end-to-end security issues

## IEC 62351:  Data and Communications Security
Part 1:	Introduction
Part 2:	Glossary
Part 3:	Security for profiles including TCP/IP
Part 4:	Security for profiles including MMS
Part 5:	Security for IEC 60870-5 and derivatives
Part 6:	Security for IEC 61850 profiles
Part 7:	Objects for Network Management
Part 8:    Security process for power industry operations

- Part 1:	Introduction
- Part 2:	Glossary
- Part 3:	Security for profiles including TCP/IP
- Part 4:	Security for profiles including MMS
- Part 5:	Security for IEC 60870-5 and derivatives
- Part 6:	Security for IEC 61850 profiles
- Part 7:	Objects for Network Management
- Part 8:    Security process for power industry operations

- Status of Security Documents, May 2007

**Submitted as Technical Specifications in Dec 2006, being finalized by IEC**

**Submitted as DTS ver 2 January 2007. Comments being awaited**

**Working draft, under review and discussion**

**Withdrawn**

- WG15 Status October 2005

**Notes:**
WG15 has elaborated an number of documents in the IEC 62351

1.
 These parts were sumbitted as CDs in May this year
We got comments that were responded to in September and

2.
We submitted CDVs for these parts

3.
For Part 2 the work is ongoing

4.
Part 5 is updated but there is an outstanding issue that may delay the CDV-ing of it. More on that later.

## Security Functions vs. Threats

**Security Functions**** ****vs.**** ****Threats**

**Resource Exhaustion**
**Integrity Violation**

**Planted in System**

**Virus/Worms**
**Trojan Horse**
**Trapdoor**
**Service Spoofing**

**Stolen/Altered**

**Eavesdropping**
**Traffic Analysis**
**EM/RF**
**Interception**
**Indiscretions**
**by Personnel**
**Media Scavenging**

**Listening**

**After-the-Fact**

**Denial of Service**

**Interactions**

**Masquerade**
**Bypassing**
**Controls**
**Authorization**
**Violation**
**Physical**
**Intrusion**
**Man-in-the-Middle**
**Integrity Violation**
**Theft**
**Replay**

**Repudiation**

- WG15 Status October 2005

**Notes:**
We have the requirements on the SECURITY,
we have the THREATS that we see onto the requirements
And we have the ATTACKS

that we see could generate the threats to the requirements.

## Being Addressed by many other bodies

**Security Functions, Threats, and WG15 Work Pattern**

**Unauthorized Modification or Theft of Information**

**Integrity**

**Unauthorized Access to Information**

**Confidentiality**

**Denial of Service or Prevention of Authorized Access**

**Availability**

**Denial of Action that took place, or Claim of Action that did not take place**

**Non-Repudiation**

**Corporate Security Policy and Management**

**Cigre, **
**Utilities**

**Security Management**

**Security Testing, Monitoring, Change Control, and Updating**

**Security Compliance Reporting**

**Security Risk Assessment of Assets**

**Security Policy Exchange**

**Security Attack Litigation**

**During-Attack Coping and Post-Attack Recovery**

**Security Incident and Vulnerability Reporting**

**Firewalls with Access Control Lists (ACL)**

**Intrusion Detection Systems (IDS)**

**Audit Logging**

**Anti-Virus/ Spy-ware**

**IEC62351 Security**** for TASE.2, DNP, 61850**

**Public Key Infrastructure (PKI)**

**Transport Level Security (TLS)**

**Virtual Private Network (VPN)**

**AGA 12-1 “bump-in-the-wire”**

**WPA2/80211.i  for wireless**

**Digital Signatures**

**CRC**

**Symmetric and Asymmetric Encryption (AES, DES)**

**Network and System Management (NSM)**

**Credential Establishment, Conversion, and Renewal**

**Certificates**

**Passwords**

**Authentication**

**Data ****Backup**

- WG15 Status October 2005

**Notes:**
For these possible ATTACKS there is a number  of COUNTERMEASURES.

There is a need for a management of the  countermeasures, that need attention from the Corporate Management and from other national and international bodies, like NERC and CIGRE

## TC57 Security (62351) Roadmap 

***As of May 2007***

**WG19**

- Release

- Time Frame

- Features

| Current Work | NWIPs to be Issued | On-Going Coordination |
| --- | --- | --- |
| Parts 1, 3, 4, 6 – Finalized as TS Standards
Party 2: Glossary – CDV 
Part 5: Security for IEC 60870-5 Protocols – CDV 
Part 7: Network and System Management /MIBs as CD |  |  |
| Activities in 2007 | To be issued 2007 | Current and Future |

-     Remote Changing of Update      Keys for IEC 60870-5
-    Implementation Specification     for IEC 60870-5
-    Conformance testing and    interoperability testing
-    Security for Access to CIM    (Interfaces and RBAC)
-    Role-Based Access Control
-    Security Guidelines for    Telecommunications Security

-    IEC TC65C WG10
-    ISA, CIGRE D2.22
-    EPRI,NERC, PCSF
-    National Labs
-    IEEE PSRC
-    IEEE Security    P1711, P1686,    P1689
-   TC57 WG03
-   TC57 WG07?

- WG15 Status October 2005