6) NIST.SP.800-82r2_Guide to Industrial Control Systems (ICS) Security.pdf

NIST Special Publication 800-82 Revision 2

Guide to Industrial Control

Systems (ICS) Security Supervisory Control and Data Acquisition (SCADA) Systems, Distributed Control Systems (DCS), and Other Control System Configurations such as Programmable Logic Controllers (PLC)

Keith Stouffer

Victoria Pillitteri

Suzanne Lightman

Marshall Abrams

Adam Hahn http://dx.doi.org/10.6028/NIST.SP.800-82r2

This publication is available free of charge from:

NIST Special Publication 800-82 Revision 2

Guide to Industrial Control Systems

(ICS) Security Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control system configurations such as Programmable Logic Controllers (PLC)

Keith Stouffer

Intelligent Systems Division

Engineering Laboratory

Victoria Pillitteri

Suzanne Lightman

Computer Security Division

Information Technology Laboratory

Marshall Abrams

The MITRE Corporation

Adam Hahn

Washington State University

May 2015

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

Willie May, Under Secretary of Commerce for Standards and Technology and Director http://dx.doi.org/10.6028/NIST.SP.800-82r2

This publication is available free of charge from:

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY ii

Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information

Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections.

Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information

Resources.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-82, Revision 2 Natl. Inst. Stand. Technol. Spec. Publ. 800-82, Rev. 2, 247 pages (May 2015)

This publication is available free of charge from:

CODEN: NSPUE2

Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Electronic Mail: nist800-82rev2comments@nist.gov

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY iii

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Abstract

This document provides guidance on how to secure Industrial Control Systems (ICS), including

Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control system configurations such as Programmable Logic Controllers (PLC), while addressing their unique performance, reliability, and safety requirements. The document provides an overview of ICS and typical system topologies, identifies typical threats and vulnerabilities to these systems, and provides recommended security countermeasures to mitigate the associated risks.

Keywords

Computer security; distributed control systems (DCS); industrial control systems (ICS); information security; network security; programmable logic controllers (PLC); risk management; security controls;

supervisory control and data acquisition (SCADA) systems

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY iv

Acknowledgments for Revision 2

The authors gratefully acknowledge and appreciate the significant contributions from individuals and organizations in the public and private sectors, whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. A special acknowledgement to Lisa

Kaiser, Department of Homeland Security, the Department of Homeland Security Industrial Control

System Joint Working Group (ICSJWG), and Office of the Deputy Undersecretary of Defense for

Installations and Environment, Business Enterprise Integration Directorate staff, Daryl Haegley and

Michael Chipley, for their exceptional contributions to this publication.

Acknowledgments for Previous Versions

The original authors, Keith Stouffer, Joe Falco, and Karen Scarfone of NIST, wish to thank their colleagues who reviewed drafts of the original version of the document and contributed to its technical content. The authors would particularly like to acknowledge Tim Grance, Ron Ross, Stu Katzke, and

Freemon Johnson of NIST for their keen and insightful assistance throughout the development of the document. The authors also gratefully acknowledge and appreciate the many contributions from the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of the publication. The authors would particularly like to thank the members of ISA99. The authors would also like to thank the UK National Centre for the Protection of National Infrastructure

(CPNI)) for allowing portions of the Good Practice Guide on Firewall Deployment for SCADA and

Process Control Network to be used in the document as well as ISA for allowing portions of the ISA-

62443 Standards to be used in the document.

Note to Readers

This document is the second revision to NIST SP 800-82, Guide to Industrial Control Systems (ICS)

Security. Updates in this revision include:

Updates to ICS threats and vulnerabilities.

Updates to ICS risk management, recommended practices, and architectures.

Updates to current activities in ICS security.

Updates to security capabilities and tools for ICS.

Additional alignment with other ICS security standards and guidelines.

New tailoring guidance for NIST SP 800-53, Revision 4 security controls including the introduction of overlays.

An ICS overlay for NIST SP 800-53, Revision 4 security controls that provides tailored security control baselines for Low, Moderate, and High impact ICS.

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY v

Table of Contents

Executive Summary

1. Introduction ......................................................................................................... 1-1

1.1 Purpose and Scope ................................................................................................1-1

1.2 Audience ................................................................................................................1-1

1.3 Document Structure ...............................................................................................1-2

2. Overview of Industrial Control Systems ........................................................... 2-1

2.1 Evolution of Industrial Control Systems ..................................................................2-1

2.2 ICS Industrial Sectors and Their Interdependencies ...............................................2-2

2.2.1 Manufacturing Industries ............................................................................ 2-2

2.2.2 Distribution Industries ................................................................................. 2-2

2.2.3 Differences between Manufacturing and Distribution ICS ........................... 2-2

2.2.4 ICS and Critical Infrastructure Interdependencies ...................................... 2-2

2.3 ICS Operation and Components .............................................................................2-3

2.3.1 ICS System Design Considerations ............................................................ 2-4

2.3.2 SCADA Systems ........................................................................................ 2-5

2.3.3 Distributed Control Systems ..................................................................... 2-10

2.3.4 Programmable Logic Controller Based Topologies ................................... 2-12

2.4 Comparing ICS and IT Systems Security.............................................................. 2-14

2.5 Other Types of Control Systems ........................................................................... 2-17

3. ICS Risk Management and Assessment ........................................................... 3-1

3.1 Risk Management ..................................................................................................3-1

3.2 Introduction to the Risk Management Process .......................................................3-2

3.3 Special Considerations for Doing an ICS Risk Assessment ....................................3-4

3.3.1 Safety within an ICS Information Security Risk Assessment....................... 3-4

3.3.2 Potential Physical Impacts of an ICS Incident ............................................ 3-5

3.3.3 Impact of Physical Disruption of an ICS Process ........................................ 3-5

3.3.4 Incorporating Non-digital Aspects of ICS into Impact Evaluations .............. 3-6

3.3.5 Incorporating the Impact of Safety Systems ............................................... 3-7

3.3.6 Considering the Propagation of Impact to Connected Systems .................. 3-7

4. ICS Security Program Development and Deployment ..................................... 4-1

4.1 Business Case for Security ....................................................................................4-2

4.1.1 Benefits ...................................................................................................... 4-2

4.1.2 Potential Consequences ............................................................................ 4-3

4.1.3 Resources for Building Business Case ....................................................... 4-4

4.1.4 Presenting the Business Case to Leadership ............................................. 4-4

4.2 Build and Train a Cross-Functional Team ...............................................................4-5

4.3 Define Charter and Scope ......................................................................................4-5

4.4 Define ICS-specific Security Policies and Procedures ............................................4-6

4.5 Implement an ICS Security Risk Management Framework .....................................4-6

4.5.1 Categorize ICS Systems and Networks Assets .......................................... 4-7

4.5.2 Select ICS Security Controls ...................................................................... 4-7

4.5.3 Perform Risk Assessment .......................................................................... 4-8

4.5.4 Implement the Security Controls ................................................................ 4-8

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY vi

5. ICS Security Architecture ................................................................................... 5-1

5.1 Network Segmentation and Segregation ................................................................5-1

5.2 Boundary Protection ...............................................................................................5-3

5.3 Firewalls .................................................................................................................5-4

5.4 Logically Separated Control Network ......................................................................5-6

5.5 Network Segregation ..............................................................................................5-7

5.5.1 Dual-Homed Computer/Dual Network Interface Cards (NIC) ...................... 5-7

5.5.2 Firewall between Corporate Network and Control Network ........................ 5-7

5.5.3 Firewall and Router between Corporate Network and Control Network ...... 5-9

5.5.4 Firewall with DMZ between Corporate Network and Control Network ....... 5-10

5.5.5 Paired Firewalls between Corporate Network and Control Network.......... 5-12

5.5.6 Network Segregation Summary ................................................................ 5-13

5.6 Recommended Defense-in-Depth Architecture..................................................... 5-13

5.7 General Firewall Policies for ICS .......................................................................... 5-14

5.8 Recommended Firewall Rules for Specific Services ............................................. 5-16

5.8.1 Domain Name System (DNS) ................................................................... 5-17

5.8.2 Hypertext Transfer Protocol (HTTP) ......................................................... 5-17

5.8.3 FTP and Trivial File Transfer Protocol (TFTP) .......................................... 5-17

5.8.4 Telnet ....................................................................................................... 5-17

5.8.5 Dynamic Host Configuration Protocol (DHCP) ......................................... 5-18

5.8.6 Secure Shell (SSH) .................................................................................. 5-18

5.8.7 Simple Object Access Protocol (SOAP) ................................................... 5-18

5.8.8 Simple Mail Transfer Protocol (SMTP) ..................................................... 5-18

5.8.9 Simple Network Management Protocol (SNMP) ....................................... 5-18

5.8.10 Distributed Component Object Model (DCOM) ......................................... 5-19

5.8.11 SCADA and Industrial Protocols ............................................................... 5-19

5.9 Network Address Translation (NAT) ..................................................................... 5-19

5.10 Specific ICS Firewall Issues ................................................................................. 5-20

5.10.1 Data Historians ........................................................................................ 5-20

5.10.2 Remote Support Access ........................................................................... 5-20

5.10.3 Multicast Traffic ........................................................................................ 5-20

5.11 Unidirectional Gateways ....................................................................................... 5-21

5.12 Single Points of Failure ......................................................................................... 5-21

5.13 Redundancy and Fault Tolerance ......................................................................... 5-21

5.14 Preventing Man-in-the-Middle Attacks .................................................................. 5-22

5.15 Authentication and Authorization .......................................................................... 5-24

5.15.1 ICS Implementation Considerations ......................................................... 5-25

5.16 Monitoring, Logging, and Auditing ........................................................................ 5-25

5.17 Incident Detection, Response, and System Recovery .......................................... 5-25

6. Applying Security Controls to ICS ..................................................................... 6-1

6.1 Executing the Risk Management Framework Tasks for Industrial Control Systems 6-1

6.1.1 Step 1: Categorize Information System ...................................................... 6-2

6.1.2 Step 2: Select Security Controls ................................................................. 6-4

6.1.3 Step 3: Implement Security Controls .......................................................... 6-5

6.1.4 Step 4: Assess Security Controls ............................................................... 6-5

6.1.5 Step 5: Authorize Information System ........................................................ 6-5

6.1.6 Step 6: Monitor Security Controls ............................................................... 6-6

6.2 Guidance on the Application of Security Controls to ICS ........................................6-6

6.2.1 Access Control ........................................................................................... 6-8

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY vii

6.2.2 Awareness and Training ........................................................................... 6-13

6.2.3 Audit and Accountability ........................................................................... 6-13

6.2.4 Security Assessment and Authorization ................................................... 6-15

6.2.5 Configuration Management ...................................................................... 6-15

6.2.6 Contingency Planning .............................................................................. 6-16

6.2.7 Identification and Authentication ............................................................... 6-19

6.2.8 Incident Response ................................................................................... 6-25

6.2.9 Maintenance ............................................................................................ 6-27

6.2.10 Media Protection ...................................................................................... 6-27

6.2.11 Physical and Environmental Protection .................................................... 6-28

6.2.12 Planning ................................................................................................... 6-31

6.2.13 Personnel Security ................................................................................... 6-32

6.2.14 Risk Assessment ...................................................................................... 6-33

6.2.15 System and Services Acquisition ............................................................. 6-33

6.2.16 System and Communications Protection .................................................. 6-34

6.2.17 System and Information Integrity .............................................................. 6-38

6.2.18 Program Management.............................................................................. 6-41

6.2.19 Privacy Controls ....................................................................................... 6-41

List of Appendices

Acronyms and Abbreviations ............................................................................ A-1 Appendix A—

Glossary of Terms ............................................................................................ B-1 Appendix B—

Threat Sources, Vulnerabilities, and Incidents .................................................. C-1 Appendix C—

Current Activities in Industrial Control System Security .................................... D-1 Appendix D—

ICS Security Capabilities and Tools .................................................................. E-1 Appendix E—

References ....................................................................................................... F-1 Appendix F—

ICS Overlay ..................................................................................................... G-1 Appendix G—

List of Figures

Figure 2-1. ICS Operation ....................................................................................................... 2-4

Figure 2-2. SCADA System General Layout ........................................................................... 2-6

Figure 2-3. Basic SCADA Communication Topologies ............................................................ 2-7

Figure 2-4. Large SCADA Communication Topology .............................................................. 2-8

Figure 2-5. SCADA System Implementation Example (Distribution Monitoring and Control) ... 2-9

Figure 2-6. SCADA System Implementation Example (Rail Monitoring and Control) ............. 2-10

Figure 2-7. DCS Implementation Example ............................................................................ 2-12

Figure 2-8. PLC Control System Implementation Example .................................................... 2-13

Table 2-1. Summary of IT System and ICS Differences ........................................................ 2-16

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY viii

Figure 3-1. Risk Management Process Applied Across the Tiers ............................................ 3-2

Table 3-1. Categories of Non-Digital ICS Control Components ............................................... 3-6

Figure 5-1. Firewall between Corporate Network and Control Network ................................... 5-8

Figure 5-2. Firewall and Router between Corporate Network and Control Network ................. 5-9

Figure 5-3. Firewall with DMZ between Corporate Network and Control Network ................. 5-10

Figure 5-4. Paired Firewalls between Corporate Network and Control Network .................... 5-12

Figure 5-5. CSSP Recommended Defense-In-Depth Architecture ........................................ 5-14

Figure 6-1. Risk Management Framework Tasks .................................................................... 6-2

Table 6-1. Possible Definitions for ICS Impact Levels Based on ISA99 ................................... 6-3

Table 6-2. Possible Definitions for ICS Impact Levels Based on Product Produced, Industry and Security Concerns ........................................................................................................... 6-4

Figure C-1. ICS-CERT Reported Incidents by Year .............................................................. C-11

Table G-1 Security Control Baselines ..................................................................................... G-3

Figure G-1 Detailed Overlay Control Specifications Illustrated .............................................. G-13

List of Tables

Table C-1. Threats to ICS ....................................................................................................... C-1

Table C-2. Policy and Procedure Vulnerabilities and Predisposing Conditions ........................ C-4

Table C-3. Architecture and Design Vulnerabilities and Predisposing Conditions .................... C-6

Table C-4. Configuration and Maintenance Vulnerabilities and Predisposing Conditions ........ C-6

Table C-5. Physical Vulnerabilities and Predisposing Conditions ............................................ C-8

Table C-6. Software Development Vulnerabilities and Predisposing Conditions...................... C-9

Table C-7. Communication and Network Configuration Vulnerabilities and Predisposing Conditions ....................................................................................................................... C-9

Table C-8. Example Adversarial Incidents ............................................................................. C-10 file:///X:/ITL%20SCADA/800-82%20Revision%202/Final%20release/SP800-82-Rev2-1May2015-kas.docx%23_Toc418257777

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

Executive Summary

This document provides guidance for establishing secure industrial control systems (ICS). These ICS, which include supervisory control and data acquisition (SCADA) systems, distributed control systems

(DCS), and other control system configurations such as Programmable Logic Controllers (PLC) are often found in the industrial control sectors. ICS are typically used in industries such as electric, water and wastewater, oil and natural gas, transportation, chemical, pharmaceutical, pulp and paper, food and beverage, and discrete manufacturing (e.g., automotive, aerospace, and durable goods.) SCADA systems are generally used to control dispersed assets using centralized data acquisition and supervisory control.

DCS are generally used to control production systems within a local area such as a factory using supervisory and regulatory control. PLCs are generally used for discrete control for specific applications and generally provide regulatory control. These control systems are vital to the operation of the U.S.

critical infrastructures that are often highly interconnected and mutually dependent systems. It is important to note that approximately 90 percent of the nation's critical infrastructures are privately owned and operated. Federal agencies also operate many of the ICS mentioned above; other examples include air traffic control and materials handling (e.g., Postal Service mail handling.) This document provides an overview of these ICS and typical system topologies, identifies typical threats and vulnerabilities to these systems, and provides recommended security countermeasures to mitigate the associated risks.

Initially, ICS had little resemblance to traditional information technology (IT) systems in that ICS were isolated systems running proprietary control protocols using specialized hardware and software. Many

ICS components were in physically secured areas and the components were not connected to IT networks or systems. Widely available, low-cost Internet Protocol (IP) devices are now replacing proprietary solutions, which increases the possibility of cybersecurity vulnerabilities and incidents. As ICS are adopting IT solutions to promote corporate business systems connectivity and remote access capabilities, and are being designed and implemented using industry standard computers, operating systems (OS) and network protocols, they are starting to resemble IT systems. This integration supports new IT capabilities, but it provides significantly less isolation for ICS from the outside world than predecessor systems, creating a greater need to secure these systems. The increasing use of wireless networking places ICS implementations at greater risk from adversaries who are in relatively close physical proximity but do not have direct physical access to the equipment. While security solutions have been designed to deal with these security issues in typical IT systems, special precautions must be taken when introducing these same solutions to ICS environments. In some cases, new security solutions are needed that are tailored to the

ICS environment.

Although some characteristics are similar, ICS also have characteristics that differ from traditional information processing systems. Many of these differences stem from the fact that logic executing in ICS has a direct effect on the physical world. Some of these characteristics include significant risk to the health and safety of human lives and serious damage to the environment, as well as serious financial issues such as production losses, negative impact to a nation’s economy, and compromise of proprietary information. ICS have unique performance and reliability requirements and often use operating systems and applications that may be considered unconventional to typical IT personnel. Furthermore, the goals of safety and efficiency sometimes conflict with security in the design and operation of control systems.

ICS cybersecurity programs should always be part of broader ICS safety and reliability programs at both industrial sites and enterprise cybersecurity programs, because cybersecurity is essential to the safe and reliable operation of modern industrial processes. Threats to control systems can come from numerous sources, including hostile governments, terrorist groups, disgruntled employees, malicious intruders, complexities, accidents, and natural disasters as well as malicious or accidental actions by insiders. ICS security objectives typically follow the priority of availability and integrity, followed by confidentiality.

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

Possible incidents an ICS may face include the following:

Blocked or delayed flow of information through ICS networks, which could disrupt ICS operation.

Unauthorized changes to instructions, commands, or alarm thresholds, which could damage, disable, or shut down equipment, create environmental impacts, and/or endanger human life.

Inaccurate information sent to system operators, either to disguise unauthorized changes, or to cause the operators to initiate inappropriate actions, which could have various negative effects.

ICS software or configuration settings modified, or ICS software infected with malware, which could have various negative effects.

Interference with the operation of equipment protection systems, which could endanger costly and difficult-to-replace equipment.

Interference with the operation of safety systems, which could endanger human life.

Major security objectives for an ICS implementation should include the following:

Restricting logical access to the ICS network and network activity. This may include using unidirectional gateways, a demilitarized zone (DMZ) network architecture with firewalls to prevent network traffic from passing directly between the corporate and ICS networks, and having separate authentication mechanisms and credentials for users of the corporate and ICS networks. The ICS should also use a network topology that has multiple layers, with the most critical communications occurring in the most secure and reliable layer.

Restricting physical access to the ICS network and devices. Unauthorized physical access to components could cause serious disruption of the ICS’s functionality. A combination of physical access controls should be used, such as locks, card readers, and/or guards.

Protecting individual ICS components from exploitation. This includes deploying security patches in as expeditious a manner as possible, after testing them under field conditions; disabling all unused ports and services and assuring that they remain disabled; restricting ICS user privileges to only those that are required for each person’s role; tracking and monitoring audit trails; and using security controls such as antivirus software and file integrity checking software where technically feasible to prevent, deter, detect, and mitigate malware.

Restricting unauthorized modification of data. This includes data that is in transit (at least across the network boundaries) and at rest.

Detecting security events and incidents. Detecting security events, which have not yet escalated into incidents, can help defenders break the attack chain before attackers attain their objectives. This includes the capability to detect failed ICS components, unavailable services, and exhausted resources that are important to provide proper and safe functioning of the ICS.

Maintaining functionality during adverse conditions. This involves designing the ICS so that each critical component has a redundant counterpart. Additionally, if a component fails, it should fail in a manner that does not generate unnecessary traffic on the ICS or other networks, or does not cause another problem elsewhere, such as a cascading event. The ICS should also allow for graceful degradation such as moving from "normal operation" with full automation to "emergency operation" with operators more involved and less automation to "manual operation" with no automation.

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

Restoring the system after an incident. Incidents are inevitable and an incident response plan is essential. A major characteristic of a good security program is how quickly the system can be recovered after an incident has occurred.

To properly address security in an ICS, it is essential for a cross-functional cybersecurity team to share their varied domain knowledge and experience to evaluate and mitigate risk to the ICS. The cybersecurity team should consist of a member of the organization’s IT staff, control engineer, control system operator, network and system security expert, a member of the management staff, and a member of the physical security department at a minimum. For continuity and completeness, the cybersecurity team should consult with the control system vendor and/or system integrator as well. The cybersecurity team should coordinate closely with site management (e.g., facility superintendent) and the company’s Chief

Information Officer (CIO) or Chief Security Officer (CSO), who in turn, accepts complete responsibility and accountability for the cybersecurity of the ICS, and for any safety incidents, reliability incidents, or equipment damage caused directly or indirectly by cyber incidents. An effective cybersecurity program for an ICS should apply a strategy known as “defense-in-depth,” layering security mechanisms such that the impact of a failure in any one mechanism is minimized. Organizations should not rely on “security by obscurity.”

In a typical ICS this means a defense-in-depth strategy that includes:

Developing security policies, procedures, training and educational material that applies specifically to the ICS.

Considering ICS security policies and procedures based on the Homeland Security Advisory System

Threat Level, deploying increasingly heightened security postures as the Threat Level increases.

Addressing security throughout the lifecycle of the ICS from architecture design to procurement to installation to maintenance to decommissioning.

Implementing a network topology for the ICS that has multiple layers, with the most critical communications occurring in the most secure and reliable layer.

Providing logical separation between the corporate and ICS networks (e.g., stateful inspection firewall(s) between the networks, unidirectional gateways).

Employing a DMZ network architecture (i.e., prevent direct traffic between the corporate and ICS networks).

Ensuring that critical components are redundant and are on redundant networks.

Designing critical systems for graceful degradation (fault tolerant) to prevent catastrophic cascading events.

Disabling unused ports and services on ICS devices after testing to assure this will not impact ICS operation.

Restricting physical access to the ICS network and devices.

Restricting ICS user privileges to only those that are required to perform each person’s job (i.e., establishing role-based access control and configuring each role based on the principle of least privilege).

Using separate authentication mechanisms and credentials for users of the ICS network and the corporate network (i.e., ICS network accounts do not use corporate network user accounts).

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

Using modern technology, such as smart cards for Personal Identity Verification (PIV).

Implementing security controls such as intrusion detection software, antivirus software and file integrity checking software, where technically feasible, to prevent, deter, detect, and mitigate the introduction, exposure, and propagation of malicious software to, within, and from the ICS.

Applying security techniques such as encryption and/or cryptographic hashes to ICS data storage and communications where determined appropriate.

Expeditiously deploying security patches after testing all patches under field conditions on a test system if possible, before installation on the ICS.

Tracking and monitoring audit trails on critical areas of the ICS.

Employing reliable and secure network protocols and services where feasible.

The National Institute of Standards and Technology (NIST), in cooperation with the public and private sector ICS community, has developed specific guidance on the application of the security controls in

NIST Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information

Systems and Organizations [22], to ICS.

While many controls in Appendix F of NIST SP 800-53 are applicable to ICS as written, many controls require ICS-specific interpretation and/or augmentation by adding one or more of the following to the control:

ICS Supplemental Guidance provides organizations with additional information on the application of the security controls and control enhancements in Appendix F of NIST SP 800-

53 to ICS and the environments in which these specialized systems operate. The Supplemental

Guidance also provides information as to why a particular security control or control enhancement may not be applicable in some ICS environments and may be a candidate for tailoring (i.e., the application of scoping guidance and/or compensating controls). ICS

Supplemental Guidance does not replace the original Supplemental Guidance in Appendix F of

NIST SP 800-53.

ICS Enhancements (one or more) that provide enhancement augmentations to the original control that may be required for some ICS.

ICS Enhancement Supplemental Guidance that provides guidance on how the control enhancement applies, or does not apply, in ICS environments.

The most successful method for securing an ICS is to gather industry recommended practices and engage in a proactive, collaborative effort between management, the controls engineer and operator, the

IT organization, and a trusted automation advisor. This team should draw upon the wealth of information available from ongoing federal government, industry groups, vendor and standards organizational activities listed in Appendix D—.

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

1-1

1. Introduction

1.1 Purpose and Scope

The purpose of this document is to provide guidance for securing industrial control systems (ICS), including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other systems performing control functions. The document provides a notional overview of ICS, reviews typical system topologies and architectures, identifies known threats and vulnerabilities to these systems, and provides recommended security countermeasures to mitigate the associated risks. Additionally, it presents an ICS-tailored security control overlay, based on NIST SP 800-53 Rev.

4 [22], to provide a customization of controls as they apply to the unique characteristics of the ICS domain.

The body of the document provides context for the overlay, but the overlay is intended to stand alone.

ICS are found in many industries such as electric, water and wastewater, oil and natural gas, chemical, pharmaceutical, pulp and paper, food and beverage, and discrete manufacturing (e.g., automotive, aerospace, and durable goods). Because there are many different types of

ICS with varying levels of potential risk and impact, the document provides a list of many different methods and techniques for securing ICS. The document should not be used purely as a checklist to secure a specific system.

Readers are encouraged to perform a risk-based assessment on their systems and to tailor the recommended guidelines and solutions to meet their specific security, business and operational requirements.

The range of applicability of the basic concepts for securing control systems presented in this document continues to expand.

1.2 Audience

This document covers details specific to ICS. Readers of this document should be acquainted with general computer security concepts, and communication protocols such as those used in networking. The document is technical in nature; however, it provides the necessary background to understand the topics that are discussed.

Relationship to Executive Order 13636 “Improving Critical Infrastructure Cybersecurity”

Recognizing that the national and economic security of the United

States depends on the reliable functionality of critical infrastructure, the President under the Executive Order “Improving

Critical Infrastructure

Cybersecurity” [82] directed NIST to work with stakeholders to develop a voluntary framework for reducing cyber risks to critical infrastructure.

The Cybersecurity Framework

(CSF) [83] consists of standards, guidelines, and best practices to promote the protection of critical infrastructure. The prioritized, flexible, repeatable, performance-based, and cost-effective approach of the Framework will help owners and operators of critical infrastructure to manage cybersecurity-related risk while protecting business confidentiality, individual privacy and civil liberties. The initial CSF, published in February 2014, resulted in a national-level framework that is flexible enough to apply across multiple sectors and for different operational environments. The CSF was developed based on stakeholder input to help ensure that existing work within the various sectors can be utilized within the Framework.

Industrial control system cybersecurity standards, guidelines, and practices can be leveraged to address the CSF functions in the context of an organization’s risk management program.

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

1-2

The intended audience is varied and includes the following:

Control engineers, integrators, and architects who design or implement secure ICS.

System administrators, engineers, and other information technology (IT) professionals who administer, patch, or secure ICS.

Security consultants who perform security assessments and penetration testing of ICS.

Managers who are responsible for ICS.

Senior management who are trying to understand implications and consequences as they justify and apply an ICS cybersecurity program to help mitigate impacts to business functionality.

Researchers and analysts who are trying to understand the unique security needs of ICS.

Vendors that are developing products that will be deployed as part of an ICS.

1.3 Document Structure

The remainder of this guide is divided into the following major sections:

Section 2 provides an overview of ICS including a comparison between ICS and IT systems.

Section 3 provides a discussion of ICS risk management and assessment.

Section 4 provides an overview of the development and deployment of an ICS security program to mitigate the risk of the vulnerabilities identified in Appendix C.

Section 5 provides recommendations for integrating security into network architectures typically found in ICS, with an emphasis on network segregation practices.

Section 6 provides a summary of the management, operational, and technical controls identified in

NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, and provides initial guidance on how these security controls apply to ICS.

The guide also contains several appendices with supporting material, as follows:

Appendix A— provides a list of acronyms and abbreviations used in this document.

Appendix B— provides a glossary of terms used in this document.

Appendix C— provides a list of ICS threats, vulnerabilities and incidents.

Appendix D— provides a list of ICS security activities.

Appendix E— provides a list of ICS security capabilities and tools

Appendix F— provides a list of references used in the development of this document.

Appendix G— provides an ICS overlay, listing security controls, enhancements, and supplemental guidance that apply specifically to ICS.

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

2-1

2. Overview of Industrial Control Systems

Industrial control system (ICS) is a general term that encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as Programmable Logic Controllers (PLC) often found in the industrial sectors and critical infrastructures. An ICS consists of combinations of control components

(e.g., electrical, mechanical, hydraulic, pneumatic) that act together to achieve an industrial objective

(e.g., manufacturing, transportation of matter or energy). The part of the system primarily concerned with producing the output is referred to as the process. The control part of the system includes the specification of the desired output or performance. Control can be fully automated or may include a human in the loop.

Systems can be configured to operate open-loop, closed-loop, and manual mode. In open-loop control systems the output is controlled by established settings. In closed-loop control systems, the output has an effect on the input in such a way as to maintain the desired objective. In manual mode the system is controlled completely by humans. The part of the system primarily concerned with maintaining conformance with specifications is referred to as the controller (or control). A typical ICS may contain numerous control loops, Human Machine Interfaces (HMIs), and remote diagnostics and maintenance tools built using an array of network protocols. ICS control industrial processes are typically used in electrical, water and wastewater, oil and natural gas, chemical, transportation, pharmaceutical, pulp and paper, food and beverage, and discrete manufacturing (e.g., automotive, aerospace, and durable goods) industries.

ICS are critical to the operation of the U.S. critical infrastructures that are often highly interconnected and mutually dependent systems. It is important to note that approximately 85 percent of the nation's critical infrastructures are privately owned and operated . Federal agencies also operate many of the industrial processes mentioned above as well as air traffic control. This section provides an overview of SCADA, DCS, and PLC systems, including typical topologies and components. Several diagrams are presented to depict the network topology, connections, components, and protocols typically found on each system to facilitate the understanding of these systems. These examples only attempt to identify notional topology concepts. Actual implementations of ICS may be hybrids that blur the line between DCS and SCADA systems. Note that the diagrams in this section do not focus on securing ICS. Security architecture and security controls are discussed in Section 5 and Section 6 of this document respectively.

2.1 Evolution of Industrial Control Systems

Many of today’s ICS evolved from the insertion of IT capabilities into existing physical systems, often replacing or supplementing physical control mechanisms. For example, embedded digital controls replaced analog mechanical controls in rotating machines and engines. Improvements in cost-and performance have encouraged this evolution, resulting in many of today’s “smart” technologies such as the smart electric grid, smart transportation, smart buildings, and smart manufacturing. While this increases the connectivity and criticality of these systems, it also creates a greater need for their adaptability, resilience, safety, and security.

Engineering of ICS continues to evolve to provide new capabilities while maintaining the typical long lifecycles of these systems. The introduction of IT capabilities into physical systems presents emergent behavior that has security implications. Engineering models and analysis are evolving to address these emergent properties including safety, security, privacy, and environmental impact interdependencies.

1 http://www.dhs.gov/critical-infrastructure-sector-partnerships (last updated April 2014) http://www.dhs.gov/critical-infrastructure-sector-partnerships

SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY

2-2

2.2 ICS Industrial Sectors and Their Interdependencies

Control systems are used in many different industrial sectors and critical infrastructures, including manufacturing, distribution, and transportation.

2.2.1 Manufacturing Industries

Manufacturing presents a large and diverse industrial sector with…