to which each zone or subzone (i.e., portion of a zone) belongs. The message latency requirements for a given zone (or portion of that zone) are specified in Table 3. The “Priority” column in Table 2 below is a reference to allowable IEEE 802.1p levels for the associated Tier. Table – Zone Prioritization Tiers Tier Priority Message Latency Req’t # Zone or Subzone Roles in this Zone or Subzone 1 4-7 LR-1 Local Portion of Protection Zone Protection Zone, without Protection App from Other Substation 2 4-7 LR-1 Protection Zone Protection App, Actuator, Sensor, and Protection App from Other Substation 3 1-3 LR-2 Control Portion of Local Substation Autonomy Zone Local Substation Autonomy Zone, without Monitoring App and without Local Substation Information Repository 4 1-3 LR-2 Control & Monitoring Portion of Substation Autonomy Zone Local Substation Autonomy Zone, without Local Substation Information Repository 5 1-3 LR-2 Substation Autonomy Zone Control App, Actuator, Sensor, Protection App, Monitoring App, and Substation Information Repository 6 1-3 LR-3 Local Portion of Supervisory Control Zone Supervisory Control Zone, without Proxy and without Command & Control Application 7 1-3 LR-3 Supervisory Control Zone Substation Control Authority, Substation User Interface, and Command & Control Application 8 1-3 LR-3 Substation Portion of Field Visibility and Control Zone Field Visibility &Control Zone, without Distribution Asset 9 1-3 LR-3 Field Visibility & Control Zone Proxy, Other Substation Proxy, and Distribution Asset 10 0 LR-4 Enterprise Visibility Zone Proxy and Business/Analysis Application/Repository Table – Zone Latency Requirements for Messages Message Latency Req’t # Zone(s) Message Latency Requirements LR-1 Protection Zone Messages between roles located within this zone must satisfy latency requirements for the applicable performance class of Type 1, Type 4, and Type 6 messages as outlined in IEC 61850-5, Section 13 (Message Type 1 - fast messages, Type 4 - raw data messages, Message Type 6 - time synchronization messages, Performance Classes P1, P2, or P3).
Communication Analysis Process The analyses of role-based failure modes in this profile are based on potential deviations from the expected behavior of individual substation automation roles. The expected behavior of each role is characterized and formally specified by the role’s state machine diagram. However, since the role-based failure analyses consider only the behavior of the individual roles in isolation, then even in aggregate they paint only a partial picture of the ways in which anomalous behavior of the SA system as a whole can arise. Therefore role-based failure analyses alone are not sufficient. To garner a more complete picture of the failure modes to which an SA system can be subject, complementary failure analyses are needed based on both the communications between roles and on the five zones specified in the SA architecture diagram. This section considers failure analyses based on communication between roles. A zone-based failure analysis is considered in the next section. A communication failure analysis attempts to capture the anomalous behavior (in terms of failure modes) that can be associated with communications between roles. To determine the failure modes associated with communications between roles, this profile begins by considering the most basic act of communication: “Role A sends message M to role B.” Below are listed four essential communication objectives for the action “Role A sends message M to role B.” Underneath two of the objectives are specific corollaries that are implied by the objectives. M should arrive at B in a timely fashion M should arrive M should arrive at B unaltered M should not be delivered to any role other than B M should arrive at B unobserved M should not originate from any role other than A Figure – Communication Objectives
Table – Failure Modes for Security Functions Failure Mode ID Failure Mode Example Security Objective Violated by Failure Mode FS1 Integrity of security information is compromised. Password files are tampered with. Log are corrupted. Security Function Protection FS2 Security information is not available. Forensic information is deleted by an unauthorized user or never collected. Security Function Protection FS3 Confidentiality of security information is violated. Passwords are stored, or transmitted, in clear text. Security Function Protection
AF Authenticator Feedback <Role> shall obscure the feedback of authentication information during the authentication process, for example by masking passwords and providing login failure messages that do not reveal valid user accounts. SG.IA-6 FR23, FS3 AVC Alternate Value Comparison <Role> shall (1) utilize an independent means (alternate data sources and/or computations to derive equivalent values) to validate the integrity of power system information utilized as input for decision making by protection or critical automated control applications, (2) continually compare independently derived results, and (3) have procedures in place to inconsistencies that are deemed to be significant according to organizationally defined criteria. FR25 BPR Backup Power Requirement Components essential for closed loop control functions shall be capable of operating for a minimum of 1 hour upon loss of primary power source. This requirement can be met by the use of a UPS, battery backup, or alternate power source. SG.PE-9 FR24, FC3 CAR Content of Audit Records <Role|device> shall produce audit records for each event with information including 1) date and time of the event, 2) the identity of the user/<role>/component where the event occurred, type of the event, 4) the identity of the user/<role>/component that detected the event, and 5) known details of the event including location (logical and physical). The system shall have the capability to centrally manage content of audit records generated by individual roles/components. Minimal set of auditable events includes: access (whether central, remote, logical, physical, emergency, authorized, or unauthorized), unsuccessful authentication, change in configuration, and health and resource warnings. The list of auditable events and audit records shall be reviewed periodically. SG.AU-3, SG.AU-15 FS2 CCf Communication Confidentiality <Role> employs FIPS 140-2 compliant cryptographic mechanisms to prevent unauthorized disclosure or modification of management (including electronic authenticator distribution) and configuration data during transmission. Latency induced from the use of cryptographic mechanisms must not degrade the operational performance of <role>. SG.SC-9 FC5
PaM Password Management <Role|device> enforces the use of strong user passwords, in accordance with FIPS 112, and protects user passwords from potential exposure. This includes: 1. Ensuring that passwords cross component boundaries in the clear. 2. Ensuring that passwords are never stored in the clear and that stored password hashes use a cryptographic hash function in accordance with FIPS 180-2. 3. Ensuring that passwords are never included in or allowed to be embedded into tools, source code, scripts, URLs, aliases, or shortcuts. 4. Enforcing password complexity policies (minimum length of at least 10 characters with a combination of lower/upper case, numerals, and special characters). 5. Changing passwords at defined intervals and minimizing reuse. 6. Expiring passwords after defined intervals of inactivity. 7. Protecting the password store from unauthorized modification. SG.AC-21 FR20, FC12, FS3 PC Processor Consumption The <Role's host> shall implement process monitoring and control mechanisms to identify and mitigate processor consumption (e.g., runaway or starved processes) that inhibits the function of any <Role> resident on <Role's host> SG.SC-6 FR28 PDA Portable Device Attachment The system limits attachment of portable devices and media to allow only specifically authorized users to do so. The default state shall disable all access from portable devices and media. Attachment of portable devices and media shall be enabled only where it is necessary for operation and/or maintenance functions. The system prevents the automated execution of code located on portable media. Mobile devices traveling to high risk locations shall be appropriately labeled, hardened, and subsequently sanitized upon return; i.e., such mobile devices shall contain only minimal information required to conduct business during the use period. SG.AC-17, SG.SC-4, SG.MP-3 FR6, FC12 PFP Protection Function Preservation Individual <Protection Applications> shall continue to provide functions designated by the organization as essential to operations in the face of the loss or compromise of any single device, communications link, or message in the overarching protection scheme. SG.SC-22 FZ2, FZ4
PrM Processor Monitoring The system shall provide operator visibility and appropriate alerting for <Role's host's> processor activity, including available CPU capacity and processor use per <Role>. SG.SI-4 FR28 PSI Protection of Security Information The system shall protect all sensitive information involved in the execution of security functions from unauthorized access or action. Sensitive information shall at a minimum include: User Account Information User and Device Privileges Cryptographic Material (including keys, hashes, and certificates) Non-Cryptographic Credential Data (including biologically-based credentials) Audit Records Configuration System Backups Access to all sensitive information be controlled in accordance with Least Privilege (LP - defined herein). Storage of all sensitive information shall be controlled in accordance with Configuration File and Sensitive Data Integrity Check (CFSD) and Software and Firmware Authenticity (SFA). All cryptographic material shall be stored and managed in accordance with NIST 800-57 and FIPS Additionally, storage of User Account Information and Non-Cryptographic Credential Data shall be encrypted using a FIPS 140-2 approved cryptographic module. Transmission of all sensitive information shall be controlled in accordance with Communications Confidentiality (CCf) and Communications Integrity (CI). SG.SC-26, SG.AU-9 FS1, FS2, FS3 PW Process Whitelisting <Role> shall be configured with a process white list to restrict processes to only those necessary to support the <role's> function. FR2, FR26 QSE Quality of Service Enforcement The network shall process all traffic in accordance with the QoS resource reservation identifier (i.e., IEEE 802.1Q Priority Tag). SG.SC-6 FC1
TU Testing Updates Failures and Controls 13 shows the set of security controls that are recommended to address each communication-based failure mode identified in Section . The first three columns correspond to the ID, textual description, and examples of each communication-based failure mode from Table 7. The last two columns correspond to the ID and name of security controls from Table 11. Each failure mode is mapped to one or more security controls; the combination of controls is recommended to mitigate the failure mode (i.e., it does not identify a set of options). Table – Communication-Based Failure Modes and Controls Failure Mode ID Failure Mode Example Control ID Control Name FC1 Message to or from [Role] is blocked, dropped, or delayed because the network is saturated DDoS, Spurious message generation, Authorized network device consuming network resources QSE Quality of Service Enforcement QSS Quality of Service Specification TCF Traffic Control and Filtering ENS Emergency Network Segmentation EI Endpoint Isolation Network underprovisioned; network over-allocated (e.g., addition of devices/functionality over time) NM Network Monitoring FC2 Message to or from [Role] is blocked, dropped, or delayed because of interference on the network medium Insufficient ratio, electromagnetic interference ESP Protection FC3 Message to or from [Role] is blocked, dropped, or delayed because a device or service in the network infrastructure is not available or functional Incorrect firmware update, DNS not available CSM Concurrent Session Management RIS Remote Interactive Sessions SD Session Duration ULA Unsuccessful Login Attempts NOC Network Operations Continuity BPR Backup Requirement FC4 Message to or from [Role] is inappropriately Incorrect configuration. Traffic is getting to a router or SIn Systems Inventory CuC Current Configuration
blocked by a network device switch, but protocol parameters are incorrect (e.g., frame size, baud rate, data rate). AAM Automated Account Management AE Access Enforcement LP Least Privilege CrM Credential Management FC5 Unauthorized device views messages through unauthorized access to transmission medium (logical or physical access) Wiretap, wireless snooping, incorrect network configuration, unauthorized use of communication port CCf Communication Confidentiality RIS Remote Interactive Sessions SD Session Duration ULA Unsuccessful Login Attempts NAE Network Access Enforcement LFCA Limited Field Component Access CrM Credential Management FC6 Message delivered to unintended (additional) recipients due to misuse of broadcast or multicast protocol Incorrect network configuration TCF Traffic Control and Filtering CuC Current Configuration FC7 Inappropriate connection between networks allows information to leak between domains Unauthorized bridge between networks established in end device, cable inadvertently installed between switches in separate networks. TCF Traffic Control and Filtering FC8 Message is delayed or exposed to unintended recipients because network infrastructure routes traffic over inappropriate path Network device advertising incorrect network, duplicate IP address, network device message to wrong interface, incorrect metrics in router configuration TCF Traffic Control and Filtering CuC Current Configuration SNAR Secure Name / Address Resolution FC9 Network accepts a message from an unauthorized source Rogue device attaches to network NAE Network Access Enforcement EI Endpoint Isolation ID Intrusion Detection IW Interaction Whitelisting CrM Credential Management
Table 17 provides list of NIST IR 7628 requirements for which the controls in this profile provide only partial or no coverage, along with the level of coverage and reasons for the gaps. Table - NIST IR 7628 Requirement Gaps NISTIR Category NIST IR 7628 Requirement ID NIST IR 7628 Requirement Name Notes SG.AC SG.AC-2 Remote Access Policy and Procedures Policy SG.AC SG.AC-14 Permitted Actions without Identification or Authentication Not needed in SA SG.AC SG.AC-18 Use of External Information Control Systems Organizational SG.AC SG.AC-20 Publicly Accessible Content SG.AT All Awareness and Training Organizational SG.AU SG.AU-1 Audit and Accountability Policy and Procedures Policy SG.AU-2 Auditable Events Organizational SG.AU-4 Audit Storage Capacity Organizational SG.AU-5 Response to Audit Processing Failures Audit processing not SG.AU-6 Monitoring, Analysis, and Reporting Organizational SG.AU-7 Audit Reduction and Report Generation Business need, no specific SA implications SG.AU-10 Audit Record Retention Organizational SG.AU-11 Conduct and Frequency of Audits Organizational SG.AU-12 Auditor Qualification Organizational SG.AU-13 Audit Tools Organizational SG.AU-14 Security Policy Compliance Organizational SG.CA SG.CA-1 Security Assessment and Authorization Policy and Procedures Organizational SG.CA-2 Security Assessments Organizational SG.CA-3 Continuous Improvement Organizational SG.CA-5 Security Authorization to Operate Organizational SG.CA-6 Continuous Monitoring Organizational SG.CM SG.CM-1 Configuration Management Policy and Procedures Organizational SG.CM-4 Monitoring Configuration Changes Organizational (NOTE: CFSD facilitates coverage) SG.CM-9 Addition, Removal, and Disposal of Equipment Organizational
SG.IR-10 Grid Information System Backup Organizational (NOTE: CKIM, SR, and PSI facilitate technical capabilities here) SG.IR-11 Coordination of Emergency Response Organizational SG.MA SG.MA-1 Grid Information System Maintenance Policy and Procedures Organizational SG.MA-2 Legacy Smart Grid Information System Upgrades Organizational SG.MA-3 Grid Information System Maintenance Organizational SG.MA-4 Maintenance Organizational SG.MA-5 Maintenance Personnel Organizational SG.MA-6 Remote Maintenance Organizational (NOTE: Not recommended and not in scope for SA) SG.MA-7 Timely Maintenance Organizational SG.MP SG.MP-1 Media Protection Polcy and Procedures Organizational SG.MP-2 Media Sensitivity Level N/A SG.MP-3 Media Marking N/A SG.MP-4 Storage N/A SG.MP-5 Media Transport N/A SG.MP-6 Sanitization and Disposal Organizational SG.PE SG.PE-1 Physical and Environmental Security Policy and Procedures Organizational SG.PE-2 Physical Access Authorizations Organizational SG.PE-4 Monitoring Physical Access Organizational SG.PE-5 Visitor Control Organizational SG.PE-6 Visitor Records Organizational SG.PE-7 Physical Access Log Retention Organizational SG.PE-8 Emergency Shutoff Protection Organizational SG.PE-10 Delivery and Removal Organizational SG.PE-11 Alternate Work Site Organizational SG.PE-12 Location of Smart Grid Information System Assets Organizational + N/A SG.PL All Planning Organizational SG.PM All Security Program Management Organizational