Security Levels in ISA-99 / IEC 62443isa99.isa.org/.../ISA-99-Security_Levels_Proposal.pdf · Security Levels in ISA-99 / IEC 62443 Summary Pierre Kobes Assessment of the security

Security Levels in ISA-99 / IEC 62443

Summary

Pierre Kobes

Assessment of the security protection of a plant A Security Protection Level has to be assessed in a plant in operationA Protection Level requires both:

The fulfillment of the policies and procedures by the asset owner according to a Security Management System (Series 2)andThe fulfillment of a Security Level of the solution operated by the asset owner to control the plant (Series 3)

Proposal:Assess the fulfillment of the policies and procedures according to the CMMI modelAssess the functional capabilities of the solution according to the SLsDefine Protection Levels (PLs)as a combination of both

Assessment of the security capabilities of control systems and componentsThere is no direct relationship between Capability SLs as currently defined and component capability levelsThere is no contribution of levels of the product development process to component capability levelsProposal:

Control Systems:Assess the functional capabilities according to the Capability SLs (already described in the SAL vector concept). No explicit requirements to the components.

Components: Specify the product development requirements without any levelAssess the fulfillment of the product development requirements according to the CMMI modelAssess the functional capabilities of the component according to the Component Feature LevelsDefine Component Capability Levels (CCLs) as a combination of both


Outline

Pierre Kobes

1. ISA-99 / IEC 62443 documents addressing policies and procedures vs. functional requirements

2. Assessment of protection levels of a plantSolution vs. control systemPlant life cycle and product developmentRequirements for the protection of a plantThe SLs concept is coherent for a solution and a control systemProposal for Protection Levels (PLs)

3. Assessment of security capabilities of control systems and componentsNo direct relationship between capability SLs and Component Capability Levels (CCL)No contribution of levels of the Product Development Requirements to the CCLProposal for Componet Capability Levels (CCLs)

4. Summary if ISA-99 / IEC 62443 relevant document for the various assessments types


ComponentSystemPolicies and proceduresGeneral

1-1 Terminology, concepts and models

1-2 Master glossary of terms and abbreviations

3-3 System security requirements and security

assurance levels

3-1 Security technologies for IACS

2-3 Patch management in the IACS environment

2-2 Operating an IACS security program

2-1 Establishing an IACS security program

1-3 System security compliance metrics

4-2 Technical security requirements for IACS

products

4-1 Product development requirements

IEC 62443 / ISA-99

DefinitionsMetrics

Requirements to the security organization and

processes of the plant owner and suppliers

Requirements to a secure system

Requirements to secure system components

2-4 Certification of IACS supplier security policies

and practices

Functional requirements Processes / procedures

WIB M-2784 2.0

ISA-99 / IEC 62443 covers requirements on processes / procedures as well as functional requirements

Pierre Kobes

3-2 Security assurance levels for zones and

conduits






assurance levels







products


IEC 62443 / ISA-99

DefinitionsMetrics






and practices


ISA-99 / IEC 62443 covers requirements on processes / procedures as well as functional requirements


conduits

Pierre Kobes


Outline

Pierre Kobes





Independent of plant environment

Plant environment


A solution is a deployed control system to fulfill the protection requirements of a plant

Product supplier

ControlSystem

HMIsPC devices

NetworkDevices

Software

develops

PLCs

as a combination of

System Integrator Solution

deploys thecontrol system to

ISA-99IEC 62443

Part 3-2Zones andConduits

Part 3-3System

requirements

Required protection levelof the plant

Series 4

Components

Series 4

Pierre Kobes

Asset Owner specifies

AssetOwner

SystemDesign

FATSAT Commissioning Operation

MaintenanceProjectphases

Phase

Deliverableof a

phase

Product supplier Productdevelopment

Control System

HMIsPC devices

NetworkDevices

SoftwarePLCs

as a combination of

SystemIntegrator

Solutiondeployment

Solution SolutionSolution

Projectapplication

ConfigurationUser MgmntSecuritysettings

…

Plant operation

Solution

Pierre Kobes


All stakeholder are involved in the protection of the plant during plant life cycle

Projectapplication


…

Securitysettings

Operationalpolicies andprocedures

Securitysettings


Asset Owner Requirementspecification


Protection Level


Pierre Kobes

Asset Owner

Has the appropriate policies and procedures in place

-> Security Management Systemto operate in a secure fashion a solution

Fulfills the functional capabilities required by the target protection level of the plant

-> Security LevelSolution

operates

Plant

controls

+

ISA-99IEC 62443

Series 2

Policiesand

Procedures

A Security Protection Level has to be assessed in a plant in operation

Series 3

System

A Protection Level requiresFulfillment of policies and procedures

ANDFulfillment of a Security Level of the solution

AssetOwner

OperationMaintenance

Phase

Deliverableof a

phase

Plant operation

Solution

Pierre Kobes


An assessment of the protection level is mainly relevant in a plant in operation

Protection Level

Asset Owner has the appropriate policies and procedures in place


Solution fulfills the functional capabilities required by the target protection level of the plant

-> Security Level

+Securitysettings


Commissioning

Solution

Securitysettings


System


assurance levels

IEC 62443 / ISA-99

SL 1 Protection against casual or coincidental violation

SL 2 Protection against intentional violation using simple means

SL 3 Protection against intentional violation using sophisticated means

SL 4 Protection against intentional violation using sophisticated means with

extended resources

The concept of SL is coherent within Part 3-2 and Part 3-3:1. Part 3-2: asset owner / system integrator define zones and conduits with target SLs2. Part 3-3: product supplier provides system features according to capability SLs3. In the project design phase capability SLs are deployed to match target SLs

Risk assessment

System architecturezones, conduits

Control System features

Capabilty SLs

Target SLs

Solution

Achieved SLs


The concept of SL applies to a solution and a control system


conduits

Independant of plant environment

Plant environment


The concept of SL is coherent within Part 3-2 and Part 3-3

ControlSystem

Solution

ISA-99IEC 62443

Part 3-2Zones andConduits

Part 3-3System

requirements


Pierre Kobes

Risk assessment



Capabilty SLs

Target SLs

Solution

Achieved SLs

SystemDesign

FATSAT

Projectphases

Phase

Deliverableof a

phase

Product supplier Productdevelopment

Control System

SystemIntegrator

Solutiondeployment

SolutionSolution

Projectapplication


…

Pierre Kobes


The SL concept is applicable mainly in the design phase of the plant life cycle

Projectapplication


…


Risk assessment



Capabilty SLs

Target SLs

Solution

Achieved SLs

Protection Level


Pierre Kobes



Solution fulfills the functional capabilities required by the target protection level of the plant

-> Security Level

+

A protection level can only be assessed in plant in operation

ISA-99IEC 62443

Series 2

Policiesand

Procedures

Series 3

System

Assessment type

Assessment of management system (e.g. ISO 9000, ISO

27000…)

CMMI levels are appropriate

Assessment of solution capabilities

Security Levels are appropriate

Protection Level


Pierre Kobes



Solution fulfills the functional capabilities required by the target protection level of the

plant-> Security Level

+

Proposal for the assessment of protection levels

CMMI

SL

PL1

>1

1

+

PL2

>2

2

+

PL3

>3

3

+

PL4

>3

4

+


Outline

Pierre Kobes






Control system features are often realized by a combination of component features

ControlSystem

HMIsPC devices

NetworkDevices

Software

PLCs

ISA-99IEC 62443

Pierre Kobes


(System) Capabilty SLs

Component features

Component Capabilty Levels

contribute to No directrelationship

3-3System

requirements

4-2 Technical security

requirements for IACS products

There no direct relationship betweenComponent Capability Levels and (System) Capability SLs

Control system


Example from Identification and Authentication ControlThere no direct relationship between

Component Capability Levels and (System) Capability SLs

Pierre Kobes

PLC

HMI

Server

Terminal bus

System bus

Firewall

SR 1.1 The control system shall provide the capability to identify and authenticate all users (humans, software processes and devices). This capability shall enforce such identification and authentication on all interfaces which provide access to the control system to support segregation of duties and least privilege in accordance with applicable security policies and procedures.

1

SR 1.1 RE 1 The control system shall provide the capability to uniquely identify and authenticate all users (humans, software processes and devices) 2

SR 1.1 RE 2 The control system shall provide the capability to employ multifactor authentication for human user access to the control system via an untrustednetwork (see 4.12, SR 1.10 – Access via untrusted networks).

3

System Requirement SL

PLC has no user management. Has a managed communication to the HMI and can only be accessed via the HMI device.-> Regarding SR 1.1 the PLC has a low Component Capability Level

Extract of ISA-99.03.03, Draft 4

SR 1.1 RE 3 The control system shall provide the capability to employ multifactor authentication for all human user access to the control system. 4

trusted

trusted

Control system


Example from Identification and Authentication Control

Pierre Kobes

PLC

HMI

Server

Firewall

HMI fulfills only SR 1.1

1

Case 1 SL


HMI fulfills SR 1.1 and RE 1 and has multifactor authentication

4

Case 2 SL


Different capability SLs can be realized with the sameComponent Capabilty Level of the PLC

A requested capability SL does not require a given / minimum Component Capability Level of the Embedded

Devices

Terminal bus

System bus

trusted

trusted

There no direct relationship betweenComponent Capability Levels and (System) Capability SLs


Components Capability Levels are only defined by component features

HMIsPC devices

NetworkDevices

Software

PLCs

ISA-99IEC 62443

Pierre Kobes

Component features

Component Capabilty Levels

4-2 Technical security

requirements for IACS products


Product Development

Levels ?

Product development levels don’t contribute to Component Capability Levels

-> Proposal:Specify the product development requirements without levelsFollow the CMMI approach

Component Capabilty Level


Pierre Kobes

Product Supplier has the appropriate policies and procedures in place

-> Product Development Processto develop the product according to security

requirements

Component fulfills the functional capabilities required by the Component Capability Level

-> Component (Security) Feature Level

+

Proposal for the assessment of Component Capability Levels

CMMI

CFL

CCL1

>2

1

+

CCL2

>2

2

+

CCL3

>3

3

+

CCL4

>3

4

+


Outline

Pierre Kobes












products


IEC 62443 / ISA-99

DefinitionsMetrics



ISA-99 / IEC 62443 documents relevant for the assessment of the protection of a plant

Pierre Kobes

Assessment of theprotection of a plantaccordingto Protection Levels







and practices


assurance levels



conduits








products


IEC 62443 / ISA-99

DefinitionsMetrics



ISA-99 / IEC 62443 documents relevant for the assessment of the control system functional capabilities

Pierre Kobes







and practices


conduits

Assessment of thefunctional capabiltiesof a control systemaccordingto Capabilty SLs


assurance levels








IEC 62443 / ISA-99

DefinitionsMetrics



ISA-99 / IEC 62443 documents relevant for the assessment of the component functional capabilities

Pierre Kobes







and practices


conduits


assurance levels

Assessment of thefunctional capabiltiesof componentsaccordingto Component Capability Levels



products


Documents

Security Levels in ISA-99 / IEC 62443isa99.isa.org/.../ISA-99-Security_Levels_Proposal.pdf · Security Levels in ISA-99 / IEC 62443 Summary Pierre Kobes Assessment of the security