SCG ID 10-040 US Navy Afloat Control Systems Cyber SCG.PDF

FOR OFFICIAL USE ONLY

U.S. NAVY AFLOAT CONTROL SYSTEMS CYBER SECURITY

CLASSIFICATION GUIDE (SCG), SCG ID# 10-040

Naval Sea Systems Command

DISTRIBUTION STATEMENT C: Distribution authorized to U.S. Government agencies and their contractors (Critical Technology and Vulnerability Information) (19 April 2016). Other requests for this document shall be referred to Commander, Naval Sea Systems Command.

HANDLING AND DESTRUCTION NOTICE: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document. (Note:

Refer to DoDM 5200.01-V3 for destruction requirements).

This document contains information that may be exempt from mandatory disclosure under the Freedom of Information Act.

PREPARED BY:

LCDR Matthew R. Legler NA VSEA Cybersecurity Program Manager 1333 Isaac Hull Avenue, S.E Washington, DC 20376 Telephone Number: 202-781-3623 Email: matthew.legler@navy.mil

REVIEWED BY:

William B. AslJon, Director NA VSEA Office of Security Programs 1333 Isaac Hull A venue, S.E Washington, DC 20376 Telephone Number: 202-781 -2320 Email: william.ashton@navy.mil

APPROVED BY:

Victor Foulk, Director of Security Naval Nuclear Propulsion Program

V ADM William H. ilari es NA VSEA Commander

FOR OFFICIAL USE ONLY

ii

/3 /4e:f 2o7 6 Date

/ 3 Mil 2o1'4 Date

Date

Date

SECTION 1 - IDENTIFYING DATA:

ID: 10-040

SU: U.S. Navy Afloat Control Systems Cyber

PR: NAVSEA 05

CA: NAVSEA 00

OD: 20160419

CD: 20160419

RD: 20210419

SECTION 2 - GENERAL INSTRUCTIONS:

1. Purpose. To document original classification decisions governing cybersecurity information for shipboard control systems.

Applicability includes shore based control systems that support the development, integration, training on, and testing of shipboard control systems (e.g., prototypic test facilities). This document applies to control systems under the technical cognizance of Naval Sea Systems Command (NAVSEA) and the Naval Nuclear Propulsion Program (NAVSEA 08). Systems under the cognizance of Strategic Systems Programs are excluded.

2. Authority. This SCG is issued in accordance with reference (g). This guide constitutes authority and may be cited as the basis for classification, downgrading, or declassification of information and material involved in control systems.

3. Classification Challenges. If at any time, any of the security classification guidance contained herein is challenged, the items of information involved shall continue to be protected at the level prescribed by this guide until such time as a final decision is made on the challenge by the Original Classification Authority (OCA). Classification challenges must be addressed to the PR formally.

Informal questioning of classification is encouraged, before resorting to a formal challenge, and will be directed to:

Commander, Naval Sea Systems Command 1333 Isaac Hull Avenue, S.E.

Washington, D.C. 20376 Attention: NAVSEA 05 Office of the Chief Engineer

Individuals who challenge the classification levels will not be subject to retribution. All formal challenges will be reviewed by an impartial official or panel and decision rendered as soon as possible. At any point in the challenge process, if the information is found not to be under NAVSEA control, the challenged information will be transmitted to the appropriate agency and the challenger notified.

3.1 Formal Challenges. Formal challenges to classification must include sufficient description of the information being challenged to permit identification of the information and its classifier with reasonable effort. Challenges made by DoD personnel should also include the reason why the challenger believes the information is improperly or unnecessarily classified. Every effort should be made to maintain all formal challenges at the same classification level as the security classification guidance.

3.2 Pending Challenges. Pending a final decision, handle and protect the item(s) of information involved at the highest present or recommended protection level. Users of this guide are encouraged to assist in improving and maintaining the currency, adequacy and functionality of this guide.

3.3 Changes. The PR will publish approved changes to this guide once a final determination has been made (if necessary).

4. Reproduction, Extraction, and Dissemination. Authorized recipients of this guide may reproduce, extract, and disseminate the contents of this guide to those individuals with need-to-know for application in the design, development, integration, testing, training, fielding, and operation of naval engineering capabilities originated by NAVSEA. This also applies to industrial activities that implement NAVSEA architectural designs, subject to releasability caveats. Questions regarding need-to-know that cannot be resolved will be forwarded to COMNAVSEA for resolution. Copies of separate guides issued to operating activities in application of this guide shall be sent to the PR.

5. Public Release. The fact that this guide shows certain details of information to be unclassified, including Controlled Unclassified Information (CUI) does not allow automatic public release of this information. In accordance with DoDM 5200.45, SCGs may not be released to the public. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors shall be processed in accordance with DoDD 5230.09, DoDI 5230.29, DoDD

5400.7 and DoDI 5405.3, as applicable. Proposed public disclosures of unclassified cybersecurity related information regarding control systems shall be processed through the Office of Corporate Communications (NAVSEA 00D) for approval.

5.1 Policy. Requests for public release of unclassified, CUI and Distribution Statements protected information submitted under the Freedom of Information Act (FOIA) shall be forwarded by the originating agency to the appropriate approving authority for final Government determination on its releasability. For example, when an approved public release clearance for the unclassified or CUI pages is obtained from the approval release authority, the originating agency will extract the releasable information from the classified document(s) and assign Distribution Statement A (“Approved for Public Release; Distribution is Unlimited”). The assignment of Distribution Statement A shall not be used on classified documents.

5.2 Requests. Contractors personnel shall enter the public release process according to the provisions of the applicable contract governing public release processing (normally through the Contracting Officer’s Technical Representative to NAVSEA 00D).

NAVSEA 00D will assure appropriate coordination with cognizant official public release authority prior to release of any information belonging to other DoD Component that is proposed for public release by civilians, military, or DoD contractor authors.

5.2.1 Prior coordination with NAVSEA 00D is required for replies to queries and/or proposed visits by news media representatives to contractor or operating facilities when the subject of interest involves control systems or equities for which NAVSEA has cognizance.

Prior to being released into the public domain, amendments, additions of new material, or an entire revision of information previously cleared for public release constitutes “new” information that must be submitted for official public release review and approval. The issue of compilation must be considered whenever two previously approved documents, or major portions thereof, are combined. In all cases where potential sensitivity arises from the newly combined information, the material shall be re-submitted for official public release review and approval.

5.3 Information: The term “information” includes, but is not limited to, news articles, contract announcements, advertisements, brochures, photographs, motion picture films, scripts, technical papers, speeches, displays, briefings on any aspect of the NAVSEA control systems. Contractors and participating agencies are responsible for screening information prior to the submission and certifying in their transmittal letters that material is unclassified, technically accurate, and suitable for public release.

5.3.1 Information that appears in the public media without having been officially released by the DoD shall neither be confirmed nor denied until it has been cleared for official public release through the process outlined above. Information that is either classified or identified as requiring protection, in accordance with this SCG, cannot be considered for release into the public domain until approved.

6. Foreign Disclosure. Any disclosure to foreign officials of cybersecurity information classified by this guide shall be in accordance with the procedures set forth by the NAVSEA Office of Security Programs, NAVSEA 00P5 or with specific approval of COMNAVSEA and/or Director, NAVSEA 08 for Naval Nuclear Propulsion Information (NNPI). Foreign disclosure will be in compliance with, National Disclosure Policy, DoDD 5230.11, and OPNAVINST N9210.3 if applicable to NNPI. Foreign disclosure of classified and/or CUI are not permitted except as authorized in an approved for release by a Designated Disclosure Authority (DDA), Delegation of Disclosure Authority Letter or equivalent.

7. Definitions.

DEFINITION

Adversary An individual, group, organization, or government that conducts or has the intent to conduct detrimental activities against a control system.

Cyber Attack Cyberspace actions that create various direct denial effects in cyberspace (i.e., degradation, disruption, or destruction) or manipulation that leads to denial that is hidden or that manifests in the physical domains. In the context of this SCG, this also includes intrusions that, while not causing a denial effect, are indicative of a vulnerability that could be later used to cause a denial effect.

SOURCE: JP 3-12

Control System System containing analog and/or digital electronic devices (possibly computers) containing output signals that, either directly or indirectly, effect change external to the system and control a physical process. This includes system designated as machinery control systems, supervisory control and data acquisition systems; hull, mechanical, and electrical systems; and industrial control systems. Information technology systems are excluded.

Cybersecurity In the context of this SCG, the prevention of damage to, protection of, and restoration of control system, to ensure their availability, integrity, authentication, confidentiality, and non-repudiation.

Cyberspace A global domain within the information environment consisting of the interdependent networks of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.

SOURCE: JP 3-12

Industrial Control System

An information system used to control industrial processes such as manufacturing, product handling, production, and distribution. Industrial control systems include Supervisory Control and Data Acquisition (SCADA) systems used to control geographically dispersed assets, as well as distributed control system (DCS) and smaller control systems using programmable logic controllers to control localized processes.

SOURCE: SP 800-53; SP 800-53A; SP 800-39; SP 800-30

Information systems that differ significantly from traditional administrative, mission support and scientific data processing information systems. ICS typically have many unique characteristics—including a need for real-time response and extremely high availability, predictability, and reliability.

These types of specialized systems are pervasive throughout the critical infrastructure, often being required to meet several and often conflicting safety, operational, performance, reliability, and security requirements such as: (i) minimizing risk to the health and safety of the public; (ii) preventing serious damage to the environment; (iii) preventing serious production stoppages or slowdowns that result in negative impact to the Nation's economy and ability to carry out critical functions; (iv) protecting the critical infrastructure from cyber-attacks and common human error; and (v) safeguarding against the compromise of proprietary information.

SOURCE: SP 800-53 Rev. 3 Appendix I

Information System

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

SOURCE: CNSSI 4009

Information Technology System

System containing a computer or network of computers whose purpose is the storage, manipulation, and communication of electronic data.

Mission Critical

A control system whose disruption or destruction immediately degrades the ability of the ship to command, control or effectively conduct combat operations.

Platform IT

(PIT)

Information Technology (IT), both hardware and software that is physically part of, dedicated to, or essential in real time to the mission performance of special purpose systems.

SOURCE: DoDI 8500.1

Safety Critical A control system whose improper operation (including failure to operate) could result in permanent damage to non-weapons ship survival capability, injury, or loss of life.

Supervisory Control and Data Acquisition

(SCADA)

A generic name for a computerized system that is capable of gathering and processing data and applying operational controls over long distances.

Typical uses include power transmission and distribution and pipeline systems. SCADA was designed for the unique communication challenges (delays, data integrity, etc.) posed by the various media that must be used, such as phone lines, microwave, and satellite. Usually shared rather than dedicated.

SOURCE: SP 800-82

Networks or systems generally used for industrial controls or to manage infrastructure such as pipelines and power systems.

SOURCE: CNSSI-4009

Threat Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

SOURCE: SP 800-53; SP 800-53A; SP 800-27; SP 800-60; SP 800-37; SP

800-82; CNSSI-4009

The potential source of an adverse event.

SOURCE: SP 800-61

Vulnerability Weakness in a control system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source to result in a cyber-attack

SOURCE: SP 800-53; SP 800-53A; SP 800-37; SP 800-60; SP 800-82; SP

800-115; FIPS 200

A weakness in a system, application, or network that is subject to exploitation or misuse.

SOURCE: SP 800-61

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.

SOURCE: CNSSI-4009

8. Classification Authority Block: Classified documents derivatively generated based upon this SCG shall be marked as follows:

Classified by: Derivative Classifier’s Name, Title, Code Derived from: SCG ID# 10-040, U.S. Navy Afloat Control Systems Cyber Declassify on: 20400419

SECTION 3 – OVERALL EFFORT:

1. Identification. National Security Information (NSI) as defined in E.O. 13526 is: "information that has been determined to require protection against unauthorized disclosure and is marked to indicate its classified status," Top Secret (TS), Secret (S), and Confidential (C). All NSI documents will be marked conspicuously with the highest classification level and restrictive caveat(s) contained in the document on the top and bottom of the cover, the title page, and the outside of the back page. All classified documents will be marked appropriately IAW DoDM 5200.01-Vol 2 and all controlled unclassified documents IAW DoDM 5200.01-Vol 4 for government personnel, and DoD 5220.22-M for contractors, the Security Markings Program (SMP) guidelines and OPNAVINST N9210.3 as applicable. These documents will contain information about the source or authority for classification and duration of classification on the cover or the front page of the document.

The SCG will be updated when new naval engineering cybersecurity developments or other changes dictate a change. It will be reviewed by NAVSEA at least annually to keep current with continuing and emergent cybersecurity activities and events. This guide shall be revised whenever necessary to promote effective protection of critical program information. Changes identified as necessary in the review process shall be promptly made. If no changes are required, the record copy of the guide shall be so annotated, with the date of the review.

2. Threat. Afloat control systems are responsible for the mission essential functions of the ship and its warfighting capabilities.

They require stringent protection to prevent unauthorized disclosures of classified information concerning mission, capabilities, design, operations, vulnerability, and survivability. Safeguarding the cybersecurity information for control systems is a key step towards protecting afloat assets. If not protected from disclosure, the cybersecurity information for these systems could be exploited by hostile forces. The protection of control systems from the threats posed by the trusted insider, as well as those posed by nation-state or unaffiliated cyber actors, requires additional protections. Specific threats potentially affecting control systems are contained in the following threat documents:

• (U) NIFC Topic 370 – Cyberspace Operations

• (U) Cyberspace Operations Capstone Threat Assessment, 3rd Edition, 30 April 2015

3. Goal and Mission. First and foremost, the purpose of this guide is to safeguard the cybersecurity information for control systems.

If not protected from disclosure, the cybersecurity information for these systems could be exploited by hostile forces to:

• Leverage unmitigated control system vulnerabilities to cyber threats and cyber-attack with the intent to cause a shutdown or improper operation of software or hardware so as to impact the ability of afloat platforms to perform its mission,

• Assess the effectiveness and weaknesses of cybersecurity protections, development processes, and configuration and data integrity checks of control systems to subvert the cybersecurity measures and take control, damage or destroy equipment, or display misleading information within control systems,

• Establish means to prevent cyber-attacks that would inhibit the effective use of United States power projection by developing and implementing security measures that are derived from control systems cybersecurity information, within their own control system.

4. End Item. Assumes the highest classification of information revealed, processed or stored.

SECTION 4 – FINANCIAL: Not Applicable

SECTION 5 – MILESTONES: Not Applicable

SECTION 6 – PERFORMANCE DATA AND TECHNICAL CHARACTERISTICS:

6.1 Research and Development.

# TOPIC CLASSIFICATION REASON DECLASS ON REMARKS

Event (EV) is Declassify when the technology/capability is no longer in service; or When all instances of the control system has been removed from service.

6.1.1 The fact that NAVSEA is investigating

potential cybersecurity technologies for use, even if the name of the company and the general details of the cybersecurity technology are revealed.

UNCLASSIFIED

N/A N/A This information will be available via various activities and sources.

6.1.2 The fact that NAVSEA is placing a

contract with a specific company for

N/A N/A This information is publicly available.

cybersecurity technology.

6.1.3 Information about the development and

contracting schedules for cybersecurity technology being pursued.

FOR OFFICIAL

USE ONLY

N/A N/A This information could inform an adversary of the priority of a technology and when it may be operational in the Fleet.

Apply Distribution Statement as per Ref. (o), Ref. (r) and Ref. (w).

6.1.4 General details of how the

cybersecurity technology works if the cybersecurity technology is commercially available.

N/A N/A This information is publicly available.

6.1.5 Sufficient or specific details of

customized portions of the cybersecurity technology to fit NAVSEA needs.

CLASSIFY AT

THE LEVEL OF

THE CAPABILITY

1.4 (a) (g) EV This information could inform an adversary of the specific details of the customized portion of the technology that can be exploited.

6.1.6 Sufficient or specific details on how the

cybersecurity technology will be integrated in ships and used within

NAVSEA.

CLASSIFY AT

THE LEVEL OF

THE CAPABILITY

1.4 (a) (g) EV This information could inform an adversary of the specific details of the customized portion of the technology that can be exploited.

SECTION 7 – OPERATIONAL AND TACTICAL:

7.1 Vulnerabilities, Attacks and Intrusions.

# TOPIC CLASSIFICATION REASON DECLASS ON REMARKS

Event (EV) is when permanent elimination of the vulnerability in all instances of the control system; or when all instances of the control system has been removed from service.

7.1.1 Aggregation of information which

describes the tools, techniques, and procedures necessary and sufficient to exploit a vulnerability that has not been eliminated from all instances of a control system:

When the control system is

UNCLASSIFIED.

CONFIDENTIAL 1.4 (a) (g) EV

When the control system is UNCLASSIFIED and either the system is mission or safety critical or the vulnerability could be used to facilitate a multi-platform attack originating off hull.

CONFIDENTIAL 1.4 (a) (g)

EV

UNCLASSIFED and both the system is mission or safety critical and the vulnerability could be used to facilitate a multi-platform attack originating off hull.

SECRET 1.4 (a) (g)

CONFIDENTIAL.

CONFIDENTIAL 1.4 (a) (g) EV

When the control system is CONFIDENTIAL and either the system is safety critical or the vulnerability could be used to facilitate a multi-platform attack originating off

SECRET 1.4 (a) (g) hull.

When the control system is

CONFIDENTIAL and both the system is safety critical and the vulnerability could be used to facilitate a multi-platform attack originating off hull.

TOP SECRET 1.4 (a) (g)

When the control system is SECRET. SECRET 1.4 (a) (g) EV When the control system is SECRET and either the system is safety critical or the vulnerability could be used to facilitate a multi-platform attack originating off hull.

When the control system is SECRET and both the system is safety critical and the vulnerability could be used to facilitate a multi-platform attack originating off hull.

When the control system is TOP

SECRET.

TOP SECRET 1.4 (a) (g) EV

7.1.2 The mere fact a cyber-attack has

occurred or was attempted on the control system, without any details as to the technical means or operational impact.

FOR OFFICIAL

USE ONLY

N/A N/A Apply Distribution Statement as per Ref. (o), Ref. (r) and Ref. (w).

7.1.3 The technical means of a cyber-attack

or attempted cyber-attack on the control system.

SEE REMARKS See Remarks

See Remarks

Treat as a Vulnerability and Classify Accordingly.

The determination may be driven by the Intel Community and the classification of garnering of information.

7.1.4 The impact of a cyber-attack on a

mission critical control system when the specific cyber threat and the impact to ship operational capabilities are revealed.

SEE REMARKS 1.4 (a) (g) EV Classify in accordance with Table 7.1.1 or in accordance with operational commander’s guidance. Make this determination in consultation with SEA 05T4 and SEA 08B.

7.1.5 The impact of a cyber-attack on a

mission critical control system when the impact to ship operational capabilities is revealed without the identification of the cyber threat that caused the impact.

SEE REMARKS See Remarks

See Remarks

Classify in accordance with operational commander’s guidance.

SECTION 8 – HARDWARE: Not Applicable

SECTION 9 – COMPUTER RESOURCES: Not Applicable

SECTION 10 – OTHER:

10.1 Office of Primary Responsibility (PR). This guide is issued by NAVSEA, and all inquiries concerning content and interpretation, as well as any recommendations for changes, should be addressed to:

Commander, Naval Sea Systems Command 1333 Isaac Hull Avenue, S.E.

Washington, D.C. 20376

10.2 Document Control and Markings. Control systems require stringent protection to prevent unauthorized disclosures of classified and CUI defined in DoDM 5200.01-Vol 2 and Vol 4 concerning mission, capabilities, design, operations, vulnerability, and survivability. Access to this type of cybersecurity information shall be based on a strict “need-to-know” basis, which is defined as access necessary for an individual’s contribution to these systems. Any such information that is not required for the performance of an individual’s work on these systems shall not be disclosed to that individual.

10.3 Classified Information. Existing data and documents need not be reviewed for protection under this classification guidance until it is revised, updated, reissued, used as a source material, extracted in the creation of a new document, or reviewed for content or accuracy; however, it must be reviewed for declassification IAW DoDM 5200.01-Vol 1.

10.4 Distribution, Destruction, and Other Controls. All technical and administrative documents, containing classified or CUI shall be distributed based upon the “need-to-know” concept and applicable protection classification markings. This shall be accomplished by affixing the distribution and destruction statements on the front cover or title page of each document. All information created from this document shall be at minimum marked “Distribution C.” For technical and administrative documents (classified or unclassified) that contain NNPI, refer to OPNAVINST N9201.3.

10.5 Destruction Notice. For classified documents which derive classification from an aggregation of unclassified sources, affix the destruction notice for classified documents. Use the appropriate statement below:

“DESTRUCTION NOTICE – This document shall be destroyed in the manner described for classified material IAW DoDM 5200.01, Volume 3”

10.5.1 For classified documents, follow the procedures in DoDM 5200.01-Vol 3 or DoDM 5220.22-M

10.6 CUI. All CUI will be handled in accordance with DoDM 5200.01-Vol 4.

10.7 NNPI. NNPI will be handled in accordance with OPNAVINST N9210.3.

10.8 References.

a. DoD Manual 5200.01-Vol 3, DoD Information Security Program: Protection of Classified Information, 24 February 2012, Incorporating Change 2, 19 March 2013

b. Executive Order 13526, Classified National Security Information Memorandum, 29 December 2009

c. OSD Memorandum OSD 00521-11, Delegation of Top Secret (TS) Original Classification Authority (OCA), 3 February

d. DoD Manual 5200.01-Vol 1, DoD Information Security Program: Overview, Classification and Declassification, 24 February 2012

e. SECNAV M-5510.36, DON Information Security Program, June 2006

f. DoD Manual 5200.01-Vol 4, DoD Information Security Program: Controlled Unclassified Information, 24 February 2012

g. DoD Manual 5200.45, Instruction of Developing Security Classification Guides, 2 April 2013

h. DoD Directive 5230.09, Clearance of DoD Information for Public Release, 22 August 2008, certified current through 22 August 2015

i. DoD Directive 5230.29, Security and Policy Review of DoD Information for Public Release, 13 August 2014

j. DoD Directive 5400.7, DoD Freedom of Information Act (FOIA) Program, 2 January 2008, certified current through 2 January 2015

k. DoD Instruction 5405.3, Development of Proposed Public Affairs Guidance (PPAG), 5 April 1991

l. DoD Directive 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations, 16 June 1992

m. OPNAVINST N9210.3, Safeguarding of Naval Nuclear Propulsion Information (NNPI), 7 June 2010

n. DoD Manual 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), 28 February 2006, Incorporating Change 1, 28 March 2013

o. DoD Instruction 3600.02, Information Operations Security Classification Guidance, 28 November 2005

p. DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 March 2014

q. NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments, September 2012

r. NIST Special Publication 800-82 Revision 1, Guide to Industrial Control Systems (ICS) Security, May 2013

s. DoD Manual 5200.01-Vol 2, DoD Information Security Program: Marking of Classified Information, 24 February 2012, Incorporating Change 2, 19 March 2013

t. DoD Instruction 5230.24, Distribution Statements on Technical Documents, 23 August 2012

This Page Intentionally Left Blank