NIS Breakfast Briefing Secure Your Supply Chain Thursday 6 th September 2018
Agenda Welcome David Duke, Gemserv An Introduction to NIS Ian Davis, Gemserv Case Study – National Energy Generator and Distributor Andy Green, Aprose Introducing NIS into ABP Ewan Duncan, Associated British Ports Gemserv 2
Agenda Welcome David Duke, Gemserv An Introduction to NIS Ian Davis, Gemserv Case Study – National Energy Generator and Distributor Andy Green, Aprose Introducing NIS into ABP Ewan Duncan, Associated British Ports Gemserv 3
NIS Regulation NIS Regulation Breakfast Meeting Ian Davis – Head of Information Security
Agenda Introduction to NIS Essential Service Scoping Extent and complexity of the supply chain Question and answer session Gemserv 5
Network Information Security Regulation Introduction Gemserv 6
Attacks on the Increase 92% 13% 600% Increase in new Overall increase in Increase in IoT downloader reported Attacks* variants* vulnerabilities* 29% 13% 54% Increase in industrial Overall increase in Increase in mobile control system (ICS) reported malware variants* related vulnerabilities* vulnerabilities* Gemserv *Source: Symantec 2018 Internet Security Threat Report 7
Attacks on the Increase Initial Intelligence Stolen Modify systems Future attack Compromise gather credentials OT Gemserv 8
Attacks on the Increase State and state-sponsored threats Motivation Political, diplomatic, technological, commercial, strategic advantage To cause disruption Skill Offensive & destructive cyber capabilities Highly funded Covert operations and attacks Opportunity 24/7 internet connected Inadequate defences Social engineering Gemserv 9
Network Information Security Regulation Raise UK Cybersecurity levels Protect Critical National Infrastructure Gemserv 10
NIS Timeline OES CAF NIS INCIDENTS OFCOM THRESHOLDS 2018 2019 Apr May Jul Aug Sep Nov Jan May CRITICAL CAF CAF 72 HOURS INCIDENTS CAF SYSTEMS FINDINGS Gemserv 11
Cyber Assessment Framework Indicators of Good Practice in the Indicators of Good Practice tables CAF are: in the CAF are not: Intended to help inform expert A checklist to be used in an judgement inflexible assessment process Examples of what an assessor will An exhaustive list covering normally need to consider everything an assessor needs to consider May need to be supplemented in some cases Guaranteed to apply verbatim to all organisations Designed to be widely applicable across organisations Applicability needs to be established Gemserv 12
Cyber Assessment Framework OES’ will benefit from a mature ISMS Audit team to complete self- assessment Expected to take months Continual improvement Gemserv 13
Essential Service Scope 14
Operator of Essential Service Thresholds 250,000 200,000 10M+ Passengers Providers of TLD 2 billion Consumers Consumers healthcare DNS 2M+ DNS 250,000 IXP 50% Gemserv 15
Scope of Essential Service Thresholds Suppliers Transport IT & OT Essential Other CNI, power, Dependencies on Service water, transport, DSP sector ICS Network Processes Physical People Gemserv 16
Scope of Essential Service - Threats ? OT OT Essential Service Gemserv 17
Scope of Essential Service - Risk Treatment Threat Essential Likelihood Service Vulnerability Impact Asset Gemserv 18
Business Impact Analysis Strategy and priority Objective: essential service Criticality, function and operating within threshold processes level Essential Service Recovery time objective (RTO) Tolerable disruption without Recovery point objective dependencies (RPO) Risk assessment Gemserv 19
Extent and Complexity of the Supply Chain
Extent and Complexity of the Supply Chain Essential Service Gemserv 21
Extent and Complexity of the Supply Chain People Skills shortage Supplier culture Leavers and movers Physical equipment Essential Security awareness training Service Phishing and ransomware serious threat Background checks 24/7 day and night shift Gemserv 22
Extent and Complexity of the Supply Chain Technology, IT and OT Network segmentation or air gap Introduction of IoT OT expertise with limited people Incident response / forensics Essential capabilities for OT & IT Service System and components Secure engineering principles Vulnerabilities Gemserv 23
Extent and Complexity of the Supply Chain Cloud Services Information in transit Stored information Physical access Governance Essential Background checks, user management Service Active monitoring and audit records Remote access, authentication Privileged access External interfaces Gemserv 24
Extent and Complexity of the Supply Chain Supplier Security Baseline Certification ISO 27001 ISO 22301 Cyber Essentials Plus Essential Procurement process Service Security Awareness Training BS7858 Background checks Transparency Contractual agreement Notification Incident response Gemserv 25
In summary The clock is ticking Clear scope is essential How exposed are you to risks from suppliers? Gemserv 26
Agenda Welcome David Duke, Gemserv An Introduction to NIS Ian Davis, Gemserv Case Study – National Energy Generator and Distributor Andy Green, Aprose Introducing NIS into ABP Ewan Duncan, Associated British Ports Gemserv 27
Case Study – National Energy Generator and Distributor Andy Green - Lead Security Consultant
Overview National Energy Company Power Generation Distribution Network Operator Onward connectivity to other EU Power networks Operator of Essential Service (OES) with c450k consumers Need to comply with NIS Directive 29
Organisational Scope Large fibre network covering entire island Distribution sub-stations Interconnector to mainland EU Head-office and remote offices Power Stations Large IT Network OT Infrastructure including SCADA and ICS 30
Cyber Security Risk Assessment Risk Assessment followed the ISO27005 framework Technical Risk Treatment was based the Critical Security Controls Top 20 The CSC20 has ICS alignment guidelines Further aligned with NIST Cyber Security Framework for cyber resilience 31
EU Funding In partnership with the Home Office the risk assessment will be used as evidence for CEF funding Connecting Europe Facility (CEF) is an EU funding programme Objective 2: Capability development of Operators of Essential Services (OES) and Digital Service Providers (DSP) in line with the Security of Network and Information Systems Directive 32
Agenda Welcome David Duke, Gemserv An Introduction to NIS Ian Davis, Gemserv Case Study – National Energy Generator and Distributor Andy Green, Aprose Introducing NIS into ABP Ewan Duncan, Associated British Ports Gemserv 33
“Networked and Information Systems Regulations Introducing NIS R into ABP Ewan Duncan Group Head of Security Associated British Ports
NIS R and cyber security. • ABP Context: • UK’s largest Port Operator • Humber to Silloth • Europe’s largest Cruise Liner operations (Southampton) • Reliance upon a variety of networked and information systems • Regulated by the DfT • Physical Security – PFSIs, vetting, annual audit and inspections (ISPS) • Data Protection • www.abports.co.uk 25/09/2018 35
NIS R and cyber security. • We should be doing this anyway, but it’s forced upon us…. • No different to physical security – threat, risk, vulnerabilities. • NIS Regulation. • Alongside GDPR. • Impact upon Risk Management. • It came late…. • DCMS, Guidance, Direction – now ‘live’. • Cyber Security Code of Practice – not mandatory. • How important is it ? • Difficult to secure ‘buy in’. 25/09/2018 36
NIS R and cyber security. • We should be doing this anyway, but its forced upon us…. • No different to physical security – threat, risk, vulnerabilities. • NIS Regulation. • Alongside GDPR. • Impact upon Risk Management. • It came late…. • DCMS, Guidance, Direction – now ‘live’. • Cyber Security Code of Practice – not mandatory. • How important is it ? • Difficult to secure ‘buy in’ – in a commercial environment.. 25/09/2018 37
NIS R and cyber security. Security of Networked and Information Systems • Does this include: • Cyber Security ? • Physical Security ? • Data Protection ? • Risk Management ? • Physical processes ? 25/09/2018 38
NIS R and cyber security. Security of Networked and Information Systems • Does this include: • Cyber Security ? • Physical Security ? • Data Protection ? • Risk Management ? • Physical processes ? …it does within ABP. 25/09/2018 39
Recommend
More recommend
