American Bar association Section of Science and Technology Law Information Security Committee 2009 Annual Meeting

1. American Bar Association
Section of Science and Technology Law Information Security Committee
2009 Annual Meeting – Lunch Presentation
Wednesday, July 29, 2009
Bob Radvanovsky, CIFI, CISM, CIPS
Jacob Brodsky, PE
Legal and IT Aspects of Securing
Our Critical Infrastructures
Creative Commons License v3.0. 1

2. Presentation disclaimer
• This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you may distribute this message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety tested for children under
the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry on low heat; do not bend,
fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where prohibited, taxed, or otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any warranties; reader assumes full
responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity message; no shoes, no shirt, no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service
center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find objectionable, parental guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down; no purchase necessary; you need
not be present to win; some assembly required; batteries not included; instructions are included; action figures sold separately; no preservatives added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken; call before you dig; not liable for
damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops, discontinue reading; read only with proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and skin and avoid inhaling fumes;
do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or magnetic source; smoking this message could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms persist, consult a physician; may
cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous machinery; possible penalties for early withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read; objects in mirror are closer than
they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes and other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or marred cabinet, missing or altered
serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, mud slides,
forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot, BB's, shrapnel, lasers, napalm, torpedoes, or emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by weight only, contents may
settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or whatever; actual message may differ from illustration on box. This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you may distribute this
message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety tested for children under the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to actual persons,
living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry on low heat; do not bend, fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where prohibited, taxed, or
otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any warranties; reader assumes full responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity message; no shoes, no shirt,
no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find objectionable, parental
guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down; no purchase necessary; you need not be present to win; some assembly required; batteries not included; instructions are included; action figures sold separately; no preservatives
added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken; call before you dig; not liable for damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops, discontinue reading; read only with
proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and skin and avoid inhaling fumes; do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or magnetic source; smoking this message
could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms persist, consult a physician; may cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous machinery; possible penalties for early
withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read; objects in mirror are closer than they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes and
other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this
list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, mud slides, forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot, BB's, shrapnel, lasers, napalm, torpedoes, or
emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by weight only, contents may settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or whatever; actual message may differ from
illustration on box. This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you may distribute this message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety
tested for children under the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry
on low heat; do not bend, fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where prohibited, taxed, or otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any
warranties; reader assumes full responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity message; no shoes, no shirt, no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but
return to an authorized service center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find objectionable, parental guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down;
no purchase necessary; you need not be present to win; some assembly required; batteries not included; instructions are included; action figures sold separately; no preservatives added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken;
call before you dig; not liable for damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops, discontinue reading; read only with proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and
skin and avoid inhaling fumes; do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or magnetic source; smoking this message could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms
persist, consult a physician; may cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous machinery; possible penalties for early withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read;
objects in mirror are closer than they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami, volcanic eruption, earthquake, hurricanes and other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or
marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations, customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky
roof, broken glass, mud slides, forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot, BB's, shrapnel, lasers, napalm, torpedoes, or emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by
weight only, contents may settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or whatever; actual message may differ from illustration on box. This message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; all rights reserved; you
may distribute this message freely but you may not make a profit from it; terms are subject to change without notice; this message has not been safety tested for children under the age of 3; illustrations are slightly enlarged to show detail; intended solely for the private use of our audience; any resemblance to
actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; hand wash only, tumble dry on low heat; do not bend, fold, mutilate, or spindle; your mileage may vary; no substitutions allowed; for a limited time only; this message is void where
prohibited, taxed, or otherwise restricted; caveat emptor; prices may vary in Alaska, Hawaii, and Puerto Rico; message is provided "as is" without any warranties; reader assumes full responsibility; past performance does not predict future results and people can and do lose money; an equal opportunity
message; no shoes, no shirt, no message; quantities are limited while supplies last; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service center; read at your own risk; parental advisory - explicit lyrics; text may contain explicit materials some readers may find
objectionable, parental guidance is advised; keep away from sunlight; keep away from pets and small children; limit one-per-family please; no money down; no purchase necessary; you need not be present to win; some assembly required; batteries not included; instructions are included; action figures sold
separately; no preservatives added; slippery when wet; safety goggles may be required during use; sealed for your protection, do not read if safety seal is broken; call before you dig; not liable for damages arising from use or misuse; for external use only; if rash, irritation, redness, or swelling develops,
discontinue reading; read only with proper ventilation; avoid extreme temperatures and store in a cool dry place; keep away from open flames; avoid contact with eyes and skin and avoid inhaling fumes; do not puncture, incinerate, or store above 120 degrees Fahrenheit; do not place near a flammable or
magnetic source; smoking this message could be hazardous to your health; no salt, MSG, artificial color or flavoring added; if ingested, do not induce vomiting, and if symptoms persist, consult a physician; may cause drowsiness, alcohol may intensify this effect; use caution when operating a car or dangerous
machinery; possible penalties for early withdrawal; offer valid only at participating sites; slightly higher west of the Rockies; allow four to six weeks for delivery; must be 18 to read; objects in mirror are closer than they appear; disclaimer does not cover misuse, accident, lightning, flood, tornado, tsunami,
volcanic eruption, earthquake, hurricanes and other Acts of God, neglect, damage from improper reading, incorrect line voltage, improper or unauthorized reading, broken antenna or marred cabinet, missing or altered serial numbers, electromagnetic radiation from nuclear blasts, sonic boom vibrations,
customer adjustments that are not covered in this list, and incidents owing to an airplane crash, ship sinking or taking on water, motor vehicle crashing, dropping the item, falling rocks, leaky roof, broken glass, mud slides, forest fire, or projectile (which can include, but not be limited to, arrows, bullets, shot,
BB's, shrapnel, lasers, napalm, torpedoes, or emissions of X-rays, Alpha, Beta and Gamma rays, knives, stones, etc.); other restrictions may apply; contest ends 12-31-98; contents measured by weight only, contents may settle in transit; May cause random outbursts of extreme violence, epileptic seizures, or
whatever; actual message may differ from illustration on box.
2

3. What is a
“critical infrastructure”?
• Represents “…assets of physical and computer-based
systems that are essential to the minimum operations
of the economy and government.”(1)
• These assets include (but are not limited to):
– Telecommunication systems
– Energy distribution
– Banking & financial systems
– Transportation
– Water treatment facilities
– etc … there are a total of 14 infrastructure sectors.
1. ”Critical Infrastructure: Homeland Security and Emergency Preparedness”, 1st Edition, Radvanovsky, 2006.
3

4. Reasons for addressing
infrastructure issues
• Critical infrastructures historically regarded physically and logically
interdependent systems … until 9/11.
• Advances in IT systems and efforts to improve efficiencies of these
systems, infrastructures have become increasingly automated and
interlinked.
• Improvements created new vulnerabilities(2)
• Equipment failure
• Human error
• Natural causes (weather, drought, corrosion, locusts…)
• Physical and computer-related attacks
2. ”Critical Infrastructure: Homeland Security and Emergency Preparedness”, 1st Edition, Radvanovsky, 2006.
4

5. Issues with our critical
infrastructures today
• Each infrastructure entity is responsible for protecting its
own infrastructure; little to no cross cooperation.
• Each infrastructure entity needs to have measures that
assure information is valid and accurate
(apply A-I-C principle); most are currently lacking.
• Work should take holistic approach as systems are
interdependent. (the Domino Principle).
5

6. Assure the systems that
support the systems
• The infrastructure assurance process should:
– Provide a consistent testing and evaluation framework of each
infrastructure sector.
– Perform vulnerability assessments regularly against physical
and computer systems to deter, prevent, detect, and protect.
– Expedite process to validate holistic systems.
• Assurance processing applies to both public and private sectors.
6

7. Introducing SCADA and
control systems …
• Most control systems are computer based.
• Used by several infrastructure sectors (and their industries) to
monitor and control sensitive processes and physical functions.
• Functions to provide safety controls and security.
• Primary role to ensure operations continuity within a plant.
• Control system abilities vary from simple to complex.
7

8. Introducing SCADA and
control systems …
• Two kinds of industrial control systems (ICS):
– Distributed Control Systems (DCS) are typically used
within a single process or plant, or used over a
smaller geographic area, possibly even a single site
location.
– SCADA systems are typically used for larger-scale
environments that may be geographically dispersed
in an enterprise-wide distribution operation.(3)
3. ”Critical Infrastructure: Homeland Security and Emergency Preparedness”, 1st Edition, Radvanovsky, 2006.
8

9. What makes a control
system different?
• Conventional data systems (IT) are human oriented.
• Control systems are machine / process oriented:
– Cannot be easily stopped - once stopped, takes a very long
time to re-start; stopping an ICS means loss of revenue.
– However … there is more at stake than financial
considerations; stopping ICS can introduce safety issues.
– Availability and reliability are paramount.
9

10. Practical and legal
considerations
1. Safety ALWAYS
2. Availability of the service
3. Security and access control
4. Regulation and compliance
10

11. Admiralty Law similarity:
ICS practical concerns
• You CANNOT stop operation of an infrastructure.
• You CAN refer to federal investigation reports from NTSB, NRC, or CSB.
• You CAN depose engineers, operators, and technicians once the emergency is no
longer a threat.
• You CANNOT confiscate original data without scheduled outage and/or without
having a duplicate, backup system.
• Prosecution of any offense should occur AFTER the event has been rendered safe,
investigations conducted, and results reported by recognized experts.
11

12. Provenance of data is
extremely important
• Accurate timestamps and source matter are crucial.
• Logs from ICS must be validated.
• Instrumentation needs to be validated AFTER an incident, but before …
– An expert is involved with a control systems background; and,
– Has knowledge in information security w/certification and registration.
• Control systems are NOT at all similar to “personal computers”:
– Real Time Systems (RTS) are operated very differently (see orientation).
– Process controllers are fundamentally similar to embedded systems.
12

13. Provenance of data is
extremely important
• Cryptographic signatures (if applicable, if possible).
• Management methods must be documented.
– Explaining ‘what’ and ‘how’.
• Access to each system must be documented:
– Answers ‘who’, ‘when’ and ‘where.
• Protocols and code must be validated and documented.
– Validates ‘why’.
13

14. Factors to consider
with ICS
• Latency of data events.
– Timing delay between events.
• Sequence of events.
– Order of events.
• Timing of events.
– Duration and speed of events.
• Time of when alarms were reported to plant operators.
– When alarm is reported, that the event took place at its stated time.
14

15. Public standards for
control system security
• NERC CIP (not considered a complete specification by many).
• NIST SP800-53:
“Recommended Security Controls for Federal Information Systems“.(4)
• NIST SP800-82:
“Guide to Industrial Control Systems (ICS) Security”.(5)
4. National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 2,
“Recommended Security Control for Federal Information Systems”, December 2007;
URL: http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf.
5. National Institute of Standards and Technology (NIST) Special Publication 800-82, Final Draft,
“Guide to Industrial Control Systems (ICS) Security”, September 2008;
URL: http://csrc.nist.gov/publications/drafts/800-82/draft_sp800-82-fpd.pdf. 15

16. Public standards for
control system security
• ISA-99
– Currently under complex development.
– Coordinated with ISA-84 safety specifications.
– Considered the most complete and extensive contributed input from the industry.
• Beware of the compliance approach: being compliant is NOT the same as
being secure.(6)
• DHS’s CS2SAT tool is simply just that - only a tool; CS2SAT is NOT a
prosecutable document.(7)
6. “What’s the Difference Between Security and Compliance? - The Long Answers”, Control Global Magazine,
April 2009; URL: http://www.controlglobal.com/articles/2009/SCADAmoreAnswers0904.html.
7. U.S. Department of Homeland Security’s Control System Cyber Security Self-Assessment Tool (CS2SAT),
DHS Control Systems Security Program (CSSP); URL: http://csrp.inl.gov/Self-Assessment_Tool.html.
16

17. CS2SAT
NOTE: This particular
version is distributed
from Lofty Perch, Inc.
17

18. Public regulations for
control systems security
• Chemical Facility Anti-Terrorism Standards (CFATS).(8)
• FISMA recommends NIST SP800-53.(9)
• NERC CIP requires additional work before FERC utilizes it.
8. U.S. Department of Homeland Security, Chemical Facility Anti-Terrorism Standards: Facility Inspections;
URL: http://www.dhs.gov/files/programs/gc_1177001576714.shtm.
9. National Institute of Standards and Technology, Computer Security Division, Computer Security Resource
Center; URL: http://csrc.nist.gov/groups/SMA/fisma/index.html.
18

19. A copy of this presentation may be found at our web site:
http://www.infracritical.com/papers/aba-isc-2009.zip
Questions?
Bob Radvanovsky, (630) 673-7740
rsradvan@infracritical.com
Jacob Brodsky, (443) 285-3514
jbrodsky@infracritical.com
Creative Commons License v3.0. 19