ELECTRICITY SECTOR PERSPECTIVE Critical Infrastructure Protection by jal11416

VIEWS: 0 PAGES: 19

									ELECTRICITY SECTOR PERSPECTIVE
   Critical Infrastructure Protection




            Michehl R. Gent
          President and CEO
North American Electric Reliability Council
                      Topics

•   About NERC
•   Critical Infrastructure Protection
•   ESISAC
•   Control Systems
•   Cyber Security Standards
•   Security Guidelines



2
              What is NERC?
• NERC was formed in 1968
• NERC's mission is to ensure that North American
  bulk electric system reliable, adequate & secure
• NERC is a voluntary self-regulatory organization,
  relying on reciprocity, peer pressure and mutual
  self-interest
• The House and Senate have passed energy
  legislation that would give NERC authority to
  enforce compliance with reliability standards
• Legislation must now go to conference
3
          What Does NERC Do?
•   Develops reliability standards
•   Enforces compliance with reliability standards
•   Provides education and training resources
•   Conducts assessments, analyses and reports
•   Facilitates information exchange and
    coordination
•   Supports reliable system operation and planning
•   Certifies reliability service organizations and
    personnel
•   Administers procedures for conflict resolution
•   Coordinates critical infrastructure
    protection of the bulk electric system
4
    North American Interconnections




5
    NERC Governance & Structure

• Board of Trustees                   Board of Trustees

  • 9 independent
                                 Staff           Stakeholders
    members + president
• 10 Member Regions
• Standing Committees     Operating
                          Committee
                                          Planning
                                         Committee
                                                            CIPC

  • Regional and sector
    representation
                               Standards          Compliance
  • Subject matter            Authorization       Certification
    expertise                  Committee          Committee
    Critical Infrastructure Protection
•   Physical Security
•   Cyber Security
•   Industry-wide
•   Standards
•   Guidelines
•   Communications
•   Coordination
•   Interdependencies
7
               Critical Assets
    “Those facilities, systems, and equipment,
    which, if destroyed, damaged, degraded,
    or otherwise rendered unavailable, would
    have a significant impact on the ability to
    serve large quantities of customers for an
    extended period of time, would have a
    detrimental impact on the reliability or
    operability of the bulk electric system, or
    would cause significant risk to public
    health and safety.”

8
            Electricity Sector ISAC
• Electricity Sector Information
    Sharing & Analysis Center
• Share information with industry,
    DHS & other agencies about real
    and potential threats and
    vulnerabilities
• Analyze data and information for
    trends, cross-sector
    dependencies, specific targets
• Maintain situational awareness of
    all hazards
• Coordinate with other ISACs
9
        Control Systems in the Electricity Sector

                        EMS               ICCP             Interconnected
      System
                                                               System
     Operations                    Load-Gen Balance          Operations
       Center                       State Estimation           Center
                                    System Analysis
                       SCADA
                                        Alarming
                                     User Interface


       Telecom



                                                        Protective
      Generating       RTU              BTG
                                                         Relays
          or
     Transmission
        Station
                                     Transmission
                    Data Sensors                       DCS and PLC
                                        Control



10
            Securing Control Systems
NERC is working with industry and government to:

     •   Assess risks and vulnerabilities
     •   Develop standards and guidelines
     •   Evaluate vulnerabilities and solutions
     •   in a test bed environment
     •   Secure legacy systems
     •   Secure new systems
     •   Recognize and protect against attacks
     •   Mitigate attacks on control systems
     •   Conduct outreach and workshops

11
      Cyber Security Standard 1200
     1. Cyber Security Policy         10. Information Protection
     2. Critical Cyber Assets         11. Training
     3. Electronic Security           12. Systems Management
        Perimeter                     13. Test Procedures
     4. Electronic Access Controls    14. Electronic Incident
     5. Physical Security Perimeter       Response Actions
     6. Physical Access Controls      15. Physical Incident
     7. Personnel                         Response Actions
     8. Monitoring Physical Access    16. Recovery Plans
     9. Monitoring Electronic
        Access



12
     Permanent Cyber Security Standard
• Builds upon Cyber Security Standard
  1200
• Requires critical cyber assets related to
  the reliable operation of the bulk
  electric systems be identified and
  protected
• Includes process control and SCADA
  assets critical to grid reliability
• Provides additional detail to clarify
  technical requirements and compliance
  requirements



13
                  Security Guidelines
• Communications         •   Cyber IT Firewalls
• Emergency Plans        •   Cyber Intrusion Detection
• Employment             •   Cyber Risk Management
                         •   Protecting Sensitive Info
  Background Screen
                         •   Securing Remote Access:
• Physical Security          Process Control Systems
• Threat Response        •   Incident Reporting
     • Physical          •   Physical Security – Substations
     • Cyber
                         •   Patch Management for
• Vulnerability/Risk         Control Systems
  Assessment             •   Control System – Business
• Continuity of Business     Network Electronic
  Process                    Connectivity
• Cyber Access Control

14
Securing Remote Access
● Address demonstrated vulnerabilities
● New technology created threat
● “Smart” protective devices
● Alternative solutions in guideline




15
Patch Management
● Identified need
● Created by open
  technology revolution
● Control system asset
  inventory
● Risk assessment
● Documentation
● Testing

16
Control System-Business System Connectivity

● Identified need
● Architectures are critical
● Defense in depth
● Compartmentalization
● Security-centric
● Well understood
     information flow


17
                 Related Activities
• Common Vulnerabilities of Control Systems list
• National SCADA Test Bed
     • Recommendations to the common vulnerabilities
     • AGA-12: Cryptographic Protection of SCADA
       Communications
• Communications ISAC
     • Interdependencies
     • Next Generation Networks
• Exercises
     • Cyber Storm
     • National Critical Infrastructure Exercise
• ElectroMagnetic Pulse
18
               Contacts

     NERC: 609-452-8060
     ESISAC: 609-452-1422

       Referenced materials and this
       presentation are available at:
         http://www.esisac.com


19

								
To top