Security for Industrial IoT- The Role of Trustworthiness -14th Oct. 2020
Robot Revolution & Industrial IoT Initiative(RRI)
AYAJI furukawa (Toshiba Corporation)

Agenda⁃ RRI(Japan) & PI4(Germany) collaboration, The goal of our activity⁃ White Paper (IIOT Value Chain Security –The Role of Trustworthiness)
2020⁃ Security questionnaires for suppliers⁃ Next Step1

Japan and Germany Collaboration forIndustrial Cyber Security⁃ The goal of our activity is:➢ To identify new security requirements for Industrie 4.0＆ Connected Industries➢ To incorporate trustworthiness in upcoming interconnected economies⁃ PI4.0(Germany) & RRI(Japan) announced three common position papers“Facilitating International Co-operation for Secure Industrial Internet ofThings/ Industrie4.0”(16th March 2017, 16th May 2018, 3rd April, 2019)

PI4.0: Plattform Industrie4.0, RRI: Robot Revolution & Industrial IoT Initiative2

White paper(IoT Value Chain Security -The Role of Trustworthiness)– PI4.0 and RRI had discussed the role of trustworthiness intensively during FY19
and have provided the whitepaper “IIOT Value Chain Security –The role ofTrustworthiness” 2020
– In the future, collaboration activities between RRI and PI4.0 plan to realize theTWP(Trustworthiness Profile) in a demonstrator, which would provide astandardized basis for establishing digitalized trustworthy relationships between
buyers and suppliers.
– On the Japanese side, establish a "Security questionnaires for suppliers"

3

Risks in Connected Industries⁃ Global value networks require comprehensive trustworthiness architectures
covering all entities, regardless of their geographical location.
1)Manufacturer needs to develop products that satisfy rapidly changing customer needs.
2)Manufacturer needs to collaborate with suppliers whose products (components) are required
to develop their products.
3)Manufacturer needs to find appropriate suppliers from all over the world timely through theInternet.

Reference: Whitepaper “IIOT Value Chain Security –The Role of Trustworthiness4

Security questionnaires for suppliers⁃ A template for security in the supply chain as baseline⁃ “Requirement” in the supply chain between the manufacturer and the supplier⁃ The answer for the questionnaire would be useful for the Manufacturer to determine“the supplier’s trustworthiness” and "how supplier’s in the value chain have thesame trustworthiness level”

Global Trusted Security Infrastructure

Supplier B
Supplier A
Trustworthiness:Low

Trustworthiness:HighOnline
Procurement
Digital Agreement
Purchase Order

Manufacturer Y
Trustworthiness:High5

Select requirements in RRI questionnaire from CPSF
The total number of requirements in CPSF are 104
NIST/CSF

METI/CPSF

Identity

15 items
Protect

DetectRespond/
Recovery*CPSF:Cyber/Physical Security Framework (CPSF)
https://www.meti.go.jp/english/press/2019/0418_001.html 6

Select requirements in RRI questionnaire from CPSF

I ．Why we had chosen METI CPSF (Cyber Physical Security Framework) as baseline:• CPSF provides cybersecurity requirements focused on communications between companies
and/or organizations categorized as 3 levels,- The 1st layer ,The 2 nd layer, The 3 rd layer and six elements (organization, people,component, data, procedure and system).

• CPSF provides informative references of other standards(e.g. NIST CSF and IEC 62443) on each requirement andthis information supports our tasks.
• CPSF is enterprise-wide security framework and security
requirements are described for each entity in a company.

The 1st layer (Connections between organizations in physical space)
The 2 nd layer (Mutual connections between cyberspace and physical space)
The Cyber/Physical Security Framework（CPSF）
The 3 rd layer (Connections in cyberspace)https://www.meti.go.jp/english/press/2019/pdf/0418_001a.pdf

7Select requirements in RRI questionnaire from CPSF

II. How we had prioritized requirements and selected 15 requirements is:• Security requirements that we have already achieved in our companies.
• Security requirements that we require for product/system suppliers at least.
• Security controls in operation and management processes or procedures.
(Technical security controls are out of scope because they depend on products)• High(Policy)-level security requirements in the security risk management process.

8Selected 15 security requirements for suppliers from CPSF
Document and manage appropriately the list of hardware and software, and management information
CPS.AM-1(e.g. name of asset, version, network address, name of asset manager, license information) of(Asset Management)
components in the system.
CPS.GV-1(Governance)

Identify

Develop security policies, define roles and responsibilities for security across the organization and otherrelevant parties, and clarify the information-sharing method among stakeholders.

CPS.RA-1
Identify the vulnerability of the organization’s assets and document the list of identified vulnerability with
(Risk Assessment) the corresponding asset.
Confirm the implementation status of the organization’s’ cyber security risk management andCPS.RM-1
communicate the results to appropriate parties within the organization (e.g. senior management). Define(Risk Management the scope of responsibilities of the organization and the relevant parties (e.g. subcontractor), andStrategy)
establish and implement the process to confirm the implementation status of security risk managementof relevant parties.
CPS.SC-1
Formulate the standard of security measures relevant to the supply chain in consideration of the(Supply Chan Risk business life cycle, and agree on contents with the business partners after clarifying the scope of theManagement)
responsibilities.

*CPSF description(need to revise as questionnaire description)

https://www.meti.go.jp/english/press/2019/pdf/0418_001b.pdf

9Selected 15 security requirements for suppliers from CPSFCPS.AC-1
Establish and implement procedures to issue, manage, check, cancel, and monitor identification(Identify Management &and authentication information of authorized goods, people, and procedures.
Access Control)
Provide appropriate training and education to all individuals in the organization and manage theCPS.AT-1
record so that they can fulfill assigned roles and responsibilities to prevent and contain the(Awareness &Training)occurrence and severity of security incidents.
CPS.DS-1(Data Security)
Protect

If the organization exchanges protected information with other organizations, agree in advance on
security requirements for protection of such information.

CPS.IP-1
Introduce and implement the process to manage the initial setting procedure (e.g., password) and(Information Protection
setting change procedure for IoT devices and servers.
Process & Procedures)
CPS.IP-9
Include items concerning security (e.g., deactivate access authorization and personnel screening)(Information Protection
when roles change in due to personnel transfer.
Process & Procedures)

CPS.MA-1(Maintenance)

Discuss the method of conducting important security updates and the like on IoT devices andservers. Then, apply those security updates with managed tools properly and in a timely manner
while recording the history.
Introduce IoT devices having a remote update mechanism to perform a mass update of different
software programs (OS, driver, and application) through remote commands, where applicable.

10Selected 15 security requirements for suppliers from CPSF

CPS.AE-1
Establish and implement the procedure to identify and manage the baseline of network operations and(Anomalies & Events) expected information flows between people, goods, and systems.

DetectRespond/Recover

CPS.CM-1(Security ContinuousMonitoring)

Conduct network and access monitoring and control at the contact points between corporate networks
and wide area networks.

CPS.DP-1(Detection Process)

Clarify the role and responsibility of the organization as well as service providers in detecting security
events so that they can fulfill their accountabilities.

CPS.RP-1(Response Planning)(Recovery Planning)

Develop and implement previously the procedure of response after detecting incidents (securityoperation process) that includes the response of Organization, People, Components, System toidentify the content of response, priority, and scope of response taken after an incident occurs.

11Additional requirements

MarketNeeds

Order

SupplyEnhancement of Product Value

ProductManufact
uring

Dev.
Dev.
Env.

Logistics

Procurement

IACS
Requirements

Order

Operation&maintenance

Organization

Manufacturer
SupplyEnhancement of Product Value

Product
Manufact
uring

Dev.
Dev.
Env.

Procurement

IACS

I ．We added additional requirements-development,-development environment,-procurement,-Operation & maintenance(O&M)
from the view point of product life cycle.
e.g.) IEC 62443 2-1,2-4,4-1

Logistics

Operation&maintenance

Organization

Supplier*IACS(Industrial Automation and Control System)*Dev.(Development)*Env.(Environment)
Selected category for questionnaire

II. How we had selected additional
requirements is-already implemented by us-appropriate to request the requirements tosuppliers-not technical but managing/operational-not too specific but moderately general

12Questionnaire in-practice- Example
Category(5) Manufacturing site security - 1

Security requirement

Have you created a list of the hardware and software that make up the system and its management
information? And is it properly managed?

evidence1)Including, but not limited to, an electronic or written list of assets,2)including asset names, versions, network addresses, administrative responsibility,licensing information, and locations; operational policies,3)including transportable media; asset bail line configuration and audit rules; automatic
asset discovery and removal mechanisms; and more.
Assets are identified, listed and prioritized according to their priority.

１
Example: Answer

Maturitylevel

２□Implemented □Planned to be implemented □Not applicable

Maintain the asset list by regularly reviewing and updating it. Control and limit the use ofportable media. Prohibit the removal of highly sensitive data.
□Implemented □Planned to be implemented □Not applicable

３The asset list is updated in real time. Regular audits for compliance with the organization'sdefined baseline structure. A mechanism is in place and operational to automatically detect
and remove unauthorized assets.
□Implemented □Planned to be implemented □Not applicable13Collaboration activities between RRI and PI4.0◆ In the future, collaboration activities between RRI and PI4.0 plan to realize the TWP
in a demonstrator, which would provide a standardized basis for establishingdigitalized trustworthy relationships between buyers and suppliers.
Trustworthiness Profile
To be filled by the Buyer

To be filled by the SupplierSupplier s Information

Buyer s Information
Contact Partner:*Contact Partner s Unique Identifier:Contact Partner:*Contact Partner s Unique Identifier:Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Trustworthiness Expectations

Trustworthiness Capabilities

Additional Information Expected Validity

Supplier
Self
Conformance

Proof/
Proof/ Evidence

Proof Expiry Date

Conform:

Self-Assessment

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY*Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY*Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

ISO/IEC 62443-4-2

Upload/Attach*ISO 27001

Upload/Attach

NIST SP 800

Upload/Attach

Common Criteria

PSS Supplier QuestionnaireRRI Security questionnaires
for suppliers
would be incorporated
Reference Request-for-work

Digital Signature

3rd party*Time Stamp

Digital Certificate (If required)

Reference TW Expectations

Quote/Bid Reference

Digital Signature

Additional Information

Time Stamp

Digital Certificate (If required)

Reference: Whitepaper “IIOT Value Chain Security –The role of Trustworthiness.

14

Next Step
⁃ RRI is developing security questionnaires for suppliers in FY2020 based on
Cyber/Physical Security Framework issued by METI, Japan.
⁃ RRI expects the questionnaire would be standardized and the answer for
the questionnaire would be evaluated and digitally signed by 3rd party
security certification bodies.

15Thank you very much!
ayaji2.furukawa@toshiba.co.jp