【Case study2】
オープンソースプロジェクトにおける産業向けサイバーセキュリティに対する取り組み
Kento Yoshida, CIP security working group chairfrom Renesas Electronics Corporation
OSAKA NDS Embedded Cross Linux Online Forum #12
Feb. 12, 2021

Self introduction～ 2016/12
独立系ソフトウェアハウスにてAE・PL・PMとして次世代スマホ向けプロトコルスタックの開発など多種プロジェクトに従事

31st October 2019 at CIP mini-summit, Lyon, France

2017/1～
ルネサスにてネットワーク検索エンジン（NSE）のソリューション開発に従事
現部署（MPUプロダクト部）に異動後、RZ/Gシリーズのセキュリティ・ソリューション開発に従事
2018年12月のセキュリティWG発足を機にCIPに参画
2020年1月より同WG議長

Osaka NDS Embedded Cross Online Forum #122

The CIP project
andsecurity working group

Osaka NDS Embedded Cross Online Forum #123

What is the “CIP” projectTo establish a “base layer”
of industrial-grade toolingusing the Linux kernel and otheropen source projects

Osaka NDS Embedded Cross Online Forum #124

Osaka NDS Embedded Cross Online Forum #125

What is “OSBL”

open source base layer (OSBL)
Osaka NDS Embedded Cross Online Forum #126

Collaborative development with other OSS projects

Osaka NDS Embedded Cross Online Forum #127

Scope of activities

Osaka NDS Embedded Cross Online Forum #128

IEC 62443 certification

Osaka NDS Embedded Cross Online Forum #129

拡大するサイバー攻撃の脅威
サイバー攻撃の標的は情報資産から制御システムへ▪ IoTの進歩を背景にいままではスタンドアローン型ネットワークであった制御システムがサイバー攻撃の対象に▪ 攻撃者の目的も生産停止やシステムの破壊など物理的な影響に及び、被害規模が拡大▪ 情報資産を守るセキュリティマネジメントから、システムそのものを守るセキュリティマネジメントへ

改ざん、搾取生産停止、破壊

情報系システム（例：ファイルサーバ）

業務系システム（例：経理システム）

制御システム（例：PLC、スマートメーター）

Osaka NDS Embedded Cross Online Forum #12

10

参考：重要インフラの制御システムへの攻撃例「Stuxnet」2010年▪ イランにある核施設の遠心分離器9,000台のうち、約1,000台が破壊された▪ 遠心分離器の制御システムに侵入し、周波数をコントロールしてダメージを蓄積させたメディアを通して管理PCなどに感染

ネットワーク経由でコントローラに感染

短時間に周波数を乱高下させるようコマンド送信

遠心分離器が破壊巧妙化するマルウェアの脅威▪ Stuxnetは、Windowsのショートカットファイルの脆弱性を狙ったマルウェア▪ 複数の技術者が数か月から数年かけて入念に準備（コード量50倍以上）▪ 制御システムの構成を把握して特定の機器をターゲットに絞り込み▪ 感染機器の監視機能を停止させ、強制的に異常操作を実行

運用・保守のみの課題ではない！

機器、システム自体のセキュリティ機能も重要

Osaka NDS Embedded Cross Online Forum #12

11

New shape of industry
Be standard, be open
for cyber security in industry 4.0
Features:▪Evolving continuously without perfection▪Realize new functions by connecting▪Geographically distributed

Osaka NDS Embedded Cross Online Forum #12

12

Advances in cyber security

Framework for Improving Critical
Infrastructure Cybersecurity
version 1.1, issued April 16, 2018

The EU Cybersecurity Act waspublished on June 7, 2019.
A new Era dawns on ENISA

Baseline for Classified
Protection of Cybersecurity,
GB/T 22239-2019, effective
on December 1, 2019

IoT Security Guideline,issued July 2016

Osaka NDS Embedded Cross Online Forum #1213

セキュリティ統一規格として注目を集めるIEC 62443
IEC 62443 に欧米が注目▪ 異なる事業体のFA向けセキュリティ規格を統合した汎用規格としてIEC 62443シリーズが整備・拡大中▪ 米国ISAが制定した規格をANSI・IECが制御システム（IACS）向けのセキュリティ統一規格として採用

FA業界のみでなくBA業界も IEC 62443 に注目▪ Building Control System (BCS) のサプライヤを中心にISASecureのWGがIEC 62443の有効性を検証・確認

IACS

Target ofStandards(General purpose)

Operator

CSMS

SystemComponent

IEC62443SSAEDSA(CSA)

Designated System
Plant(Petroleum,Chemical)

WIB

Power,Energy

Smart
GridNERC
CIP

NIST
IR7628

RailwayISO/IEC
62278

IEC 61850
IEEE
1686

Note:
International Standard
Local Standard

Cited from “ISA/IEC 62443 STANDARDS AND ISASECURE® CERTIFICATION:APPLICABILITY TO BUILDING CONTROL SYSTEMS” in https://www.isasecure.org/en-US/

Osaka NDS Embedded Cross Online Forum #1214

Linux is acting on many components for IACS
IEC 62443 Part 4
IEC 62443-4-1:
secure product development lifecycle
requirements
IEC 62443-4-2:
technical security requirements for
IACS componentsTarget devices, level:
Embedded and network device, level-3

Osaka NDS Embedded Cross Online Forum #1215

Specification history
EDSA 2010.1

EDSA 2.0.0

CSA 1.0.0

EDSA 3.0.0

ISASecure
ISA 62443-4-2 (Draft)

ANSI/ISA 62443-4-2

ANSI/ISAIEC 62443-4-2 (WD)IEC 62443-4-2 (FD)IEC 62443-4-2 (IS)

IEC
••
•
•

IEC 62443-4-2 (Final Draft) is adopted ISASecure certification program and ANSI/ISA standard.
IEC 62443-4-2 International Standard version was issued in March 2019.
ISASecure certification program changed the program name from EDSA to CSA.
CSA program is available now.

Osaka NDS Embedded Cross Online Forum #1216

Structure for IEC 62443 certification
ANSI
IECISAIEC 62443 certification program
IECEE

Member Bodies(MB)

ISASecure certification program
ISCI

Scheme owner

Representatives, only one MB per country

USEU

ANAB

Scheme owner

APAC

DAkkS

JAB
Accreditation bodies

National Certification Bodies(NCB)

CB Testing Laboratories(CBTL)

Different for eachcertification program

ExidaTÜV
Rheinland

CSSC
Certification bodies

Osaka NDS Embedded Cross Online Forum #1217

Activity ofSecurity working grouptowards IEC 62443

Osaka NDS Embedded Cross Online Forum #1218

Issues to be solved
Security is non-competitive, but cost excessive▪ Certification requires special work such as implementation/evaluation specifications▪ Certification requires necessary and sufficient measures

SufficientInsufficient▪ Risk of re-certification▪ Development schedule delay▪ Adequate cost
▪ Adequate schedule

Excessive▪ Excessive development cost
▪ Market introduction delay

Certification requires a unique how-to▪ To avoid compromising product availability, it is impossible to specifically describe security-related standards▪ Implement what and how much?
▪ Provide evaluation environment in what way? Evaluate what?

Development
Cost

Difficulty

Uncertainty

Osaka NDS Embedded Cross Online Forum #12

19

Security working group’s mission and goal
Provide OSBL compliant with IEC 62443 certification

Development
cost

Difficulty

Uncertainty

Validated
platform

Guideline
andevidence

Complianttesting forevaluation✓✓✓

Osaka NDS Embedded Cross Online Forum #12

20

Progress of the CIP assessment for IEC 62443 part 4
Completed the gap assessment for IEC 62443-4-1, andstarted the gap assessment for IEC 62443-4-2We are in here

Investigation ofIEC 62443-4-1
and 4-2

Gap assessment of CIP
capabilities against 4-1
and 4-2

Certification for
4-1 and 4-2

Osaka NDS Embedded Cross Online Forum #1221

The gap analysis for IEC 62443-4-1
Issue trucking / periodic review / patches,
confirming side effects / security training, analysis/ account management

Identification / version control / roles, responsibility /development environment / vulnerability scanningconfiguration
management

Planning / report / threat mitigation /fuzz / penetration /independence of testersNew, change code review / static analysis /coding standard (guideline)

test
spec / reportrequirement
definition

continuousimprovement

Security requirement / threat model /scope and boundaries / checklist

Defense in depth / review / best practice
Implementation

DesignOsaka NDS Embedded Cross Online Forum #1222

Key challenges to meet IEC 62443-4-1 requirements
Needed special consideration caused not being a productRequirement
definition

Configuration
management•

Version control
with a snapshot oflists of packages•

Create a threat
model for genericrequirements•

Risk assessment toensure fixing open
CVEs•

Scope thecapabilities CIP
intend toimplement

Implementation

Design•Define open
interfaces which
security packages
have, generalmeasures how toensure security fora product supplier••

Considering to use
static analysis tool
when integration
and reporting theresults
Review security
fixes and notify
themTesting•

Cyclic running
automated test in
LAVA lab•

Define the productsupplier obligation
to run threat
mitigation, fuzz
and penetration

Osaka NDS Embedded Cross Online Forum #1223

Preparing user friendly documents now
Documents compliant with IEC 62443-4-1
User Manual• How to build CIP kernel and core packages• Configuration
Security Capabilities• List of all security packages to meet IEC 62443-4-2 security
features requirements• details of security features which are supported by securitypackages
development process documents• Version controlling• Review policy/cycle• Records• Test report

Can be reused by user certification
Osaka NDS Embedded Cross Online Forum #1224

Essential packages to meet IEC 62443-4-2
Started the gap assessment of security packages
Selected package examples:
FR 1 – Identification and authentication control (IAC) shadow, pam, openssl, openssh, fail2ban
FR 2 – Use control (UC)acl, audit, syslog-ng, chrony

FR 3 – System integrity (SI)openssl, aide

FR 4 – Data confidentiality (DC)openssl, util-linux(ipcrm, ipcs), shred

FR 5 – Restricted data flow (RDF)-FR 6 – Timely response to events (TRE)acl, audit, syslog-ng, bro

FR 7 – Resource availability (RA)nftablesOsaka NDS Embedded Cross Online Forum #1225

Considering > Packaging > Testing

CIP Core
Reference Implementation

Osaka NDS Embedded Cross Online Forum #1226

HARDWARE要件への対応
RZ/G2は産業制御機器向けの高性能な機能に加え、IEC 62443-4-2のSL-3相当の ハードウェアセキュリティをMPU単体で実現。
必要十分なセキュリティ機能を有するRZ/G2でBOMコストを最適化
BOM cost

Additional
secure element

SW
ONLY

RZ/G2
Security strength

INSUFFICIENT

SUFFICIENTEXCESSIVE

SL-3への適合には
HWセキュリティが必須

RZ/G2はSL-3への適合に必要な
HWセキュリティを単体で搭載

セキュリティ専用チップはBOMコストを押し上げる
Osaka NDS Embedded Cross Online Forum #1227

RZ/G IEC 62443 READY ソリューション提供物
ユーザのセキュリティ開発および認証コストを削減するための３つの提供物

Competitive
point
Verified Linux Package（VLP）＆ セキュリティパッケージ
IEC 62443-4-2のSL-3への適合性をISCI認定の第三者認証機関にて評価したセキュリティソフトウェアパッケージ（ライブラリ、ツールなど）でセキュリティ要件の多くをカバー。アプリケーションのセキュリティ開発を強力にサポート。

Competitive
point

Competitivepoint
実装ガイドライン
（CIP SWG 認証ドキュメント）適合性評価レポート

ISCI認定の第三者認証機関が発行した、RZ/G2 Linux向けセキュリティパッ
ケージのIEC 62443-4-2適合性評価レ
ポートを提供。
アプリケーションが対応すべきセキュリティ要件が一目瞭然であり、調査・設計工程の工数を大幅に削減。

アクセス制御の実行やバックアップなど、アプリケーションおよび上位システムにて対応しなければならない多数の要件について、どのような機能が求めらているのか、ルネサスが適合性評
価を通して得た分析結果を実装ガイドとして提供。

Osaka NDS Embedded Cross Online Forum #12

28

Advantages comparison CIP vs Non-CIP(OSS) distributions
Items

CIPNon-CIP(OSS)

Dedicated kernel maintainers for SLTS up to 10 years✓

×IEC-62443-4-x assessed platform by accredited Certification Body✓

×

Close monitoring of CVEs at user and kernel level✓

×

Extended support from Debian ELTS for specific packages✓

×Regular automated testing on multiple SOCs with published test results onKernelCI✓×

Strong support from big players of embedded system industry✓

×

Osaka NDS Embedded Cross Online Forum #1229

Maintaining IEC-62443-4-x certification for long term
Final certification for IEC-62443-4-x
CB defines change control process along with certification

Modifications after IEC-62443-4-x certification
Follow change control process and modify/update certified product

After 3 years CB audits all the past changes
If all changes are found in accordance with change control process, certification isrenewed/invalidated
Osaka NDS Embedded Cross Online Forum #1230

To close

Osaka NDS Embedded Cross Online Forum #1231

The backbone of CIP are the member companies

Osaka NDS Embedded Cross Online Forum #1232

Osaka NDS Embedded Cross Online Forum #1233

Thank you!

Osaka NDS Embedded Cross Online Forum #1234