ISA SP-99 Manufacturing and Control Systems Security

Transcriptie

1 ISA SP-99 Manufacturing and Control Systems Security IT Security in de industrie, 11 mei 2006 Standards Certification Education & Training Publishing Conferences & Exhibits Bianca Scholten, ISA Netherlands Section +31 (0)

2 Scope of Security Standards Purdue reference Model Levels Level 5 Level 4 Level 3 Level 2 Level 1 Company Management Data Presentation Company Production Assignment Scheduling Supervision Operational & Production Supervision Supervisor s Console Supervisor s Console Operator s Console Controllers Company Management Information Company Production Scheduling Assignment Production Scheduling & Operational Management Inter-Area Coordination Supervisory Control Direct Digital Control Process IT Security Policies and Practices (ISO 17799) Common technologies, policies and practices Process Safety (ISA 84, IEC 61508, IEC 61511) Mfg Security Policies and Practices (ISA 99) 2

3 Production and control systems Level 4 Level 3 Business Planning & Logistics Plant Production Scheduling, Operational Management, etc Manufacturing Operations Management Dispatching Production, Detailed Production Scheduling, Reliability Assurance, Establishing the basic plant schedule - production, material use, delivery, and shipping. Determining inventory levels. Time Frame Months, weeks, days 3 -Work flow / recipe control to produce the desired end products. Maintaining records and optimizing the production process. Time Frame Days, Shifts, hours, minutes, seconds Level 2 Level 1 Batch Control Continuous Control Discrete Control 2 -Monitoring, supervisory control and automated control of the production process 1 -Sensing the production process, manipulating the production process Level 0 0 -The actual production process 3

4 Comparison of Objectives Industrial Automation & Control Systems General Purpose Information Technology Systems Availability Confidentiality Integrity Integrity Confidentiality Availability Priority 4

5 Part 1 Concepts, Models and Terminology Part 2 Establishing a Manufacturing and Control Systems Program Part 3 - Operating a Manufacturing and Control SystemsSecurity Program Part 4 - Specific Security Requirementsfor Manufacturing and Control Systems 5

6 ISA SP-99 Part 1 General Concepts and Intentions What is included in SP-99 Part 1: Manufacturing and Control Systems security terms A Common Model for specifying security requirements for Manufacturing and Control Systems program The standard is not specific to vendors, customers, or any particular aspect of Manufacturing and Control Systems security 6

7 ISA SP-99 Part 2 Activity 1 Develop a Business Case Activity 2 Obtain Leadership Commitment, Support, and Funding Activity 3 Define the Charter and Scope of M&CS Security for Your Company Activity 4 Form a Team of Stakeholders Activity 5 Raise Staff Cyber Security Capability Through Training Activity 6 Characterize the Key M&CS Risks Activity 7 Define the Corporate Risk Tolerance Level Activity 8 Establish High-Level Cyber Security Policies that Support the Risk Tolerance Level Activity 9 Perform a Screening Assessment Activity 10 Organize for Security Activity 11 Prioritize Systems and Conduct a Detailed Security Assessment 7

8 ISA SP-99 Part 2, continued Activity 12 Develop Detailed M&CS Cyber Security Policies & Procedures Activity 13 Define Standard Set of M&CS Security Risk Mitigation Controls Activity 14 Develop Integrated Cyber Security Management System Plan Activity 15 Quick Fix Activity 16 Charter, Design, & Execute Cyber Security Risk Mitigation Projects Activity 17 Refine and Implement Cyber Security Management System Activity 18 Adopt Continuous Improvement Operational Measures 8

9 Lid worden van ISA Wist u dat ISA wereldwijd de grootste instrumentatie-, systemen en industriële automatiserings organisatie is. ISA leden ieder jaar gratis een van de internationaal erkende ISA standaarden mogen downloaden, met een waarde van rond de honderd dollar, zoals ISA-84, ISA-88, ISA-95 en ISA-99. ISA-leden toegang hebben tot een nationaal en internationaal netwerk van instrumentatie leveranciers, software leveranciers, consultants, systeem integratoren en eindgebruikers. ISA-leden zeer goed op de hoogte worden gehouden van alle laatste nieuwtjes rond publicaties, standaardisatie, certificering, beurzen, congressen en trainingen op het gebied van instrumentatie, systemen en automatisering. ISA-leden gratis toegang hebben tot de hoog gewaardeerde seminars die ISA-Netherlands section regelmatig organiseert, bijvoorbeeld het voorjaarsseminar op raderboot de Majesteit door de haven van Rotterdam. ISA-leden zonder verdere kosten Automatie (het IA vakblad voor België en Nederland) en InTech (het informatieve maandblad van ISA) ontvangen. ISA-leden gemiddeld 20% korting krijgen op het uitgebreide aanbod van ISA publicaties, waaronder standaarden, boeken, studiemateriaal, DVDs en software (zie ISA-leden 5 % korting krijgen op ISA cursussen die in Nederland en België worden gegeven over de standaarden ISA-84, ISA-88, ISA-95. ISA leden voor al deze voordelen slechts 85 dollar per jaar betalen! 9