INFORMATION SHARING IN THE ELECTRICITY SUB-SECTOR SEPTEMBER 20, - - PowerPoint PPT Presentation

▶
information sharing
SMART_READER_LITE
LIVE PREVIEW

INFORMATION SHARING IN THE ELECTRICITY SUB-SECTOR SEPTEMBER 20, - - PowerPoint PPT Presentation

Jun 24, 2023 7 likes •199 views

ANNUAL INDUSTRY WORKSHOP NOVEMBER 6-7, 2013 INFORMATION SHARING IN THE ELECTRICITY SUB-SECTOR SEPTEMBER 20, 2013 SCOTT R. MIX, CISSP CIP TECHNICAL MANAGER, NERC TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.ORG 1 UNIVERSITY

slide-1
SLIDE 1

ANNUAL INDUSTRY WORKSHOP NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.ORG

UNIVERSITY OF ILLINOIS | DARTMOUTH COLLEGE | UC DAVIS | WASHINGTON STATE UNIVERSITY

FUNDING SUPPORT PROVIDED BY DOE-OE AND DHS S&T

1

INFORMATION SHARING IN THE ELECTRICITY SUB-SECTOR

SCOTT R. MIX, CISSP

CIP TECHNICAL MANAGER, NERC SEPTEMBER 20, 2013

slide-2
SLIDE 2

2

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

  • The views and opinions expressed in this

presentation are those of the presenter, and do not represent those of the North American Electric Reliability Corporation

slide-3
SLIDE 3

3

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EXECUTIVE ORDER (EO) 13636 AND PRESIDENTIAL POLICY DIRECTIVE (PPD) - 21

  • In February 2013, the President announced two

new policies:

– EO 13636: Improving Critical Infrastructure Cybersecurity

  • Develop a technology-neutral cybersecurity framework
  • Promote and develop incentives for the adoption of

cybersecurity practices

  • Enhance cybersecurity information sharing
  • Strengthen privacy and civil liberties protections
slide-4
SLIDE 4

4

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EO 13636 AND PPD-21

– PPD-21: Critical Infrastructure Security and Resilience

  • Develop a near real-time situational awareness

capability

  • Evaluate and mature the public-private partnership
  • Update the National Infrastructure Protection Plan

(NIPP)

  • Develop a comprehensive research and development

plan

slide-5
SLIDE 5

5

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EO 13636 AND PPD-21

  • NERC and industry experts represent the Electricity Sub-

sector on all implementation working groups:

– Stakeholder Engagement – Cyber-Dependent Infrastructure Identification (CDII) – Planning and Evaluation – Situational Awareness and Information Exchange (SAIE) – Incentives – Framework Collaboration – Assessments: Privacy and Civil Rights and Civil Liberties – Research and Development (R&D)

slide-6
SLIDE 6

6

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EO 13636 AND PPD-21 WORKING GROUPS

  • Cybersecurity Framework Development

– Work with the National Institute of Standards and Technology (NIST) to develop a voluntary, repeatable cybersecurity framework consisting of industry standards, guidelines, and best practices to promote the protection of critical infrastructure

  • Industry contribution via Requests for Information (RFI),

workshops, and working group meetings

  • Status: Final draft was released on October 22; NIST

will open a 45-day public comment period on the Preliminary Framework and plans to release the official framework in February 2014

slide-7
SLIDE 7

7

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EO 13636 AND PPD – 21 WORKING GROUPS

  • CDII

– Collaborate with industry and the Department of Energy to identify critical infrastructure where a cyber incident could result in catastrophic effects

  • Status: The Department of Homeland Security (DHS)

will notify selected entities in fall 2013 that they have cyber dependent infrastructure and provide procedures for appeals from such designation

slide-8
SLIDE 8

8

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EO 13636 AND PPD – 21 WORKING GROUPS

  • Planning and Evaluation

– Update the NIPP to coordinate public-private efforts to improve infrastructure security and resiliency

  • Address international cooperation and

interdependencies, develop policies for coordination, and address global issues such as foreign investment and supply chains

  • Industry contribution via RFIs, writing sessions, and

draft comments

  • Status: Final draft was released on October 22; final

document will go to the White House on November 8

slide-9
SLIDE 9

9

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EO 13636 AND PPD – 21 WORKING GROUPS

  • Incentives

– Direct the study of incentives for participating in the voluntary critical infrastructure cybersecurity program

  • Status: In June 2013, the Department of Treasury, the

Department of Commerce, and DHS issued a report that recommended the Administration analyze six incentive categories to encourage industry participation in the cybersecurity program

  • DHS and Sector-Specific Agencies will socialize

incentive recommendations with the revised NIPP and Cybersecurity Framework

slide-10
SLIDE 10

10

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EO 13636 AND PPD-21 WORKING GROUPS

The remaining working groups continue to meet, but are less active at this time:

  • SAIE is tasked with identifying functional relationships across the Federal

Government and developing a situational awareness capability for critical infrastructure

  • R&D is tasked with developing a critical infrastructure security and resilience

R&D plan

– Revised NIPP and the Cybersecurity Framework will contribute to this plan – Initial plan will be released in early 2014

  • Assessments: Privacy and Civil Rights and Civil Liberties coordinates with

representatives from across the interagency to assess civil rights and civil liberties impacts (government only)

  • Stakeholder Engagement coordinates outreach to stakeholders throughout the

implementation process

  • Voluntary Programs supports the adoption of the Cybersecurity Framework by
  • wners and operators of critical infrastructure and any other interested entities
slide-11
SLIDE 11

11

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

IMPROVING INFORMATION SHARING

  • NERC Critical Infrastructure Protection

Committee (CIPC) Electricity Sector Information Sharing Task Force (ESISTF) report

– Approved by NERC CIPC June 11, 2013 – Endorsed by Electricity Sub-sector Coordinating Council July 11, 2013 – Accepted by NERC Board of Trustees August 15, 2013 – http://www.nerc.com/comm/CIPC/Electricity%20Secto r%20Information%20Sharing%20Task%20For1/Electr icity%20Sector%20Information%20Sharing%20Task %20Force%20Report.pdf

slide-12
SLIDE 12

12

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

INFORMATION SHARING REPORT: PATHS

slide-13
SLIDE 13

13

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

INFORMATION SHARING REPORT: RECOMMENDATIONS

  • 1. Cultivate a trusting information-sharing

environment

  • 2. Promote recognition of the Electricity Sector

Information Sharing and Analysis Center (ES- ISAC) role as the Electricity Sub-sector’s central hub for physical and cyber threat information sharing

  • 3. Reduce complexity and redundancy of the

reporting system

  • 4. Implement technology to encourage

unattributed information sharing

  • 5. Improve information aggregation and

collaborative analysis at the ES-ISAC

slide-14
SLIDE 14

14

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

ES-ISAC ACTIVITIES: COLLABORATION AND COORDINATION

Government Partners

ES-ISAC

Other

ISACs

slide-15
SLIDE 15

15

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

ES-ISAC ACTIVITIES: THE PORTAL

Auto- notice updates via Email IOC Notice Reports, Watchlist Entries, Aggregated Lists, Blacklists Anonymously share security incident information, generates report for your use, VERIS framework (beta) AOO Newsfeed, Weekly Updates, Webinar Notes, NERC Alerts (repost) File download links for auto- informing your security controls with regular updates

slide-16
SLIDE 16

16

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

ES-ISAC ACTIVITIES: INDEX AND AOO

VS

Limited to Asset Owner & ES- ISAC Staff Wider audience, including US and Canadian Government agencies, regions, etc “Read Only” “Read/Write” Actionable Information News-worthy Information

Explicit Information Handling Expectations

slide-17
SLIDE 17

17

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

ES-ISAC ACTIVITIES: BACK END WORKFLOW

CIB

Storage & Processing

Industry reports

Portal

OSInt, etc

blocklists CSVs OpenIOC/ STIX etc

OpenIOC/ STIX etc MongoDB / BSON Node / edge model (relationships)

Looking Glass gephi

WASP

slide-18
SLIDE 18

18

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

ES-ISAC ACTIVITIES: CONTACT INFORMATION

ES-ISAC Portal Are your security points of contact signed up?

Asset Owners and Operators personnel may register a portal user account by visiting https://www.esisac.com/register.aspx Please share malicious activity information via EST (beta) on the portal and further advising via esisac@nerc.com Orlando Stevenson, ES-ISAC Cyber Security Specialist- Critical Infrastructure Office: 202-644-8077, Mobile: 202-360-2365 Orlando.Stevenson@nerc.net

slide-19
SLIDE 19

ANNUAL INDUSTRY WORKSHOP NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.ORG

UNIVERSITY OF ILLINOIS | DARTMOUTH COLLEGE | UC DAVIS | WASHINGTON STATE UNIVERSITY

FUNDING SUPPORT PROVIDED BY DOE-OE AND DHS S&T

19

QUESTIONS

SCOTT R MIX, CISSP CIP TECHNICAL MANAGER, NERC

SCOTT.MIX@NERC.NET 215-853-8204