Japan Computer Emergency Response Team Coordination Center

電子署名者 : Japan Computer Emergency Response Team Coordination Center
DN : c=JP, st=Tokyo, l=Chiyoda-ku, email=office@jpcert.or.jp, o=Japan ComputerEmergency Response Team Coordination Center, cn=Japan Computer Emergency Response
Team Coordination Center
日付 : 2010.03.09 10:15:34 +09'00'

Control Systems Security:
Australian Government Activities
Dr. Jason Smith
Asst. Director, Operations
CERT Australia
Attorney-General’s Department

Topics:
1. Context and aims of AustralianGovernment activities.
2. Summary of key activities and theiroutcomes
3. Recent developmentsContext
CIP National
Strategy (2004)
E-Security Review(2008)• Business – Government partnership required• Information sharing and support central to strategy• Examined the Australian Government’s cyber security policy, programs
and capabilities with the aim of developing a new AustralianGovernment policy framework for cyber security

evident that the sophistication of our modern
PM National Security • ``…increasingly
community is a source of vulnerability in itself.’’• Cyber security acknowledged as a top national security priority
Statement (2008)

Cyber Security
Strategy (2009)• Articulates the overall aim and objectives of the AustralianGovernment’s cyber security policy• Sets out the strategic priorities that the Australian Government will
pursue to achieve these objectives.

General Aims

Provide guidance and facilitate informationsharingIncrease comprehension of risks and accessto effective mitigation strategies
Provide operational support

INFORMATION SHARING

Trusted Information Sharing
Network for Critical
Infrastructure ProtectionIT Security Expert Advisory
Group (ITSEAG) Commissions development of guideline documents forowners and operators of CI http://www.tisn.gov.au–

SCADA Security Advice for CEOs–Infrastructure information in the public domain – a guide tomitigating security risks
Risk Management Framework for SCADA
Diesel Fuel and Backup Generators – Issues for CEOs andRisk Managers
etc–––IT Security Expert Advisory
Group (ITSEAG)SCADA Community of Interest (CoI): A Working Group of the ITSEAG
 Peer to Peer and cross sector network
 Meets quarterly– Issues of common interest– Relationships for cross organisational & international
incident responses– Program of work to develop a resilience framework

IT Security Expert Advisory
Group (ITSEAG)SCADA Practitioner / Vendor Forum: Hosted by Government 2008 and 2009
 Invitation only – SCADA practitioner inviting one ormore of their vendors
 Promote better understanding of practitioner needs /vendor constraints– Key message from vendors ``If you don’t demand security,
we will not provide it’’

RISKS AND MITIGATIONSRisks andMitigations
 Critical Infrastructure Protection Modeling and Analysis(CIPMA) Computer Network Vulnerability Assessment (CNVA)
 Cyberstorm Exercises National Security Science and Technology (NSST) Research
Support for National Security (RSNS) Program Idaho National Labs Advanced Cyber Security Training andWorkshop

Critical Infrastructure
Protection Modelling andAnalysis (CIPMA) World leading computer modelling activity commenced in 2004
 Funded $AUD16 Million / 4 years (to 2013)
 Models and examines complex relationships andinterdependencies in critical infrastructure Five sectors currently engaged-Banking and financeCommunications
EnergyWater services
Transport

Critical Infrastructure
Protection Modelling andAnalysis (CIPMA)

Strong business-government partnership: Modelling and analysis of potential tsunami
impacts  oil and gas pipeline redesign forincreased resilience.
 Modelling and analysis used to expose
interdependencies and inform business
continuity management exercise construction.

Computer Network
Vulnerability Assessment(CNVA) Program

Grants scheme:– commenced in 2005

– subsidies to critical infrastructure organisations, including
GBEs– to undertake independent assessments of their critical ICT
networks and systems, including process control systems.
– 32 Assessments, total cost AUD$4.4Million

Computer Network
Vulnerability Assessments

Cyber Storm
Exercises Large scale cyber security exercise sponsored by U.S.
DHS.
 March 2008 CSII
- 56 Australian organisations (across government andbusiness) involved- International involvement by US, UK, NZ, Canada Late September 2010 CSIII- Australia participating- International Watch and Warning Network (IWWN) alsoparticipating

National Security Science andTechnology (NSST) Research
Support for National Security(RSNS) Administered by the Department of the Prime Minister andCabinet
 Support short-term requirements while developing long-term
capabilities
 Exemplar projects since 2007
– Incident response in control systems environments– A general forensic model for process control and SCADA systems– Critical infrastructure resilience: an ICT governance approach– Forensic readiness for control systemsINL Advanced Cyber
Security Training
Hosted by DHS Control System Security Program 5 day program provides intensive hands-on training for the protection
and securing of control systems from cyber attacks
 Based on a red-team / blue-team exercise
 Conducted within an actual control systems
environment

INL Advanced Cyber
Security Training Australian Government provides a grant of up to$AUD5000
 Delegations sent in 2007, 2008, and 2009
 Australia-only event held in November 2009
 Approximately 60 people from industry haveattended so far

OPERATIONAL SUPPORTCurrent
ArrangementsCyber Security Strategy: released November 2009 outcome of the E-Security review 2008
 details government objectives and strategic priorities
for achieving them announced new capabilities- CERT Australia- Cyber Security Operations Centre (CSOC)CERTAustralia
 Better coordinate Australia's cyber event response
arrangements
 Provide a single POC for cyber security
information domestically & internationally Incorporate a number of current activities
including GovCERT.au & it’s services

 Complement the Cyber Security Operations Centre(CSOC) within Dept. of Defence

CERTAustraliaInformation Exchanges
 Outcome of the E-Security Review 2008

 Based on forums conducted in the UK andUSA
 Currently have three, covering Control
Systems, telecommunications & banking &financeCERTAustralia
Control System Information Exchange A closed forum for the exchange of sensitive technicalinformation between the Australian Government and owners
and operators of critical control systems

 Discussion focused on technical threats and vulnerabilities seen
within and attributed across industry sectors
 Membership guidelines require participants to undergo a policecheck Information exchanged includes up to Red level under theTraffic Light Protocol

CSOC
Established as an initiative of the 2009 Defence
Whitepaper to provide Australian Government with:
 All-source cyber situational awareness Enhanced operational responses to cyber security
events of national importance- Government and critical private sector systems

 Ability to identify and analyse sophisticated cyberattacks targeting government systems or systems ofnational interestSummary

Provide guidance and facilitate information
sharingIncrease comprehension of risks and accessto effective mitigation strategies
Provide operational support

http://www.ag.gov.au/cybersecurity
http://www.cert.gov.au
info@cert.gov.au
1300 172 499

Cyber Security
Strategy
Objectives:
Objective One: All Australians are aware of cyber risks, secure their computers and take steps to protect their identities, privacy and finances
onlineObjective Two: Australian businesses operate secure and resilient information and communications technologies to protect the integrity of theirown operations and the identity and privacy of their customers
Objective Three: The Australian Government ensures its information and communications technologies are secure and resilient
Strategic Priorities:
Threat Awareness and Response – improve the detection, analysis, mitigation and response to sophisticated cyber threats, with a focus on
government, critical infrastructure and other systems of national interest
Cultural Change – educate and empower all Australians with the information,confidence and practical tools to protect themselves online
Business-Government Partnerships – partner with business to promote security and resilience in infrastructure, networks, products and services
Government Systems – model best practice in the protection of government ICT systems, including the systems of those transacting withgovernment online
International Engagement – promote a secure, resilient and trusted global electronic operating environment that supports Australia’s nationalinterests
Legal and Law Enforcement – maintain an effective legal framework and enforcement capabilities to target and prosecute cyber crime
Knowledge, Skills and Innovation – promote the development of a skilled cyber security workforce with access to research and development todevelop innovative solutions