IEEE and Other Selected Standards Activities Related to Control System Cyber security

1
IEEE and Other Selected Standards Activities
Related to Control System Cyber security
ISA 2002 October 21, 2002 Chicago, Illinois Joe
Weiss KEMA Consulting jweiss_at_kemaconsulting.com (
408) 253-7934
2
IEEE

• 2 panel sessions on Control System Cyber security
  at IEEE Winter Power Meetings
• Power Engineering Society (PES) created a task
  force to review cyber security impacts
• Joe Weiss Task Force Chair
• POSIX (portable operating systems) excluded
  security as a consideration
• Now addressing as part of the Open Groups Real
  Time Security Forum
• Focus is to create security APIs for Real Time
  Operating System kernels

3
IEEE PES

• The IEEE PES Standards Coordinating Committee
  created a Task Force on Electronic Security in
  IEEE PES Standards.
• The Task Force has the following initial scope
• Survey all IEEE PES Standards (both existing
  underdevelopment) for electronic security issues.
• Survey legislative regulatory electronic
  security rules that may effect IEEE PES
  Standards.
• Survey other IEEE industry standards for
  electronic security sections that may effect IEEE
  PES Standards.
• Participate, as appropriate, in the development,
  assessment dissemination of technical
  information on electronic security that may
  effect the development and maintenance of IEEE
  PES Standards.
• This scope may be revised and resubmitted to the
  IEEE PES Standards Coordinating Committee by the
  Task Force after it is formed and the scope can
  be discussed by the Task Force membership.
•  The Task Force Membership shall be composed of
  one member appointed by each Committee
  represented on the IEEE PES Standards
  Coordinating Committee and other members at-large
  who wish to participate.

4
IEC

• TC 57 Working Groups 7 and 15 Telecontrol for
  Electric Power
• Revising TASE.2 (ICCP) to include security
• However, NOT addressing control systems
• TC 65C Fieldbus

5
DNP

• SCADA protocol
• Current status
• Does not include security
• Assessing the need

6
UCA2

• Substation and Field Equipment Protocol
• General Model for Substation and Field Equipment-
  GOMSFE
• High Speed device to device communication
  protocol
• Generic Object Oriented Substation Event (GOOSE)
  protocol
• Does not include security
• UCA2 addresses security but technology does not
  exist to implement

7
Other Buses and Protocols That Do Not Include
Security

• HART
• Profibus
• Profisafe
• Fieldbus (SP50)
• Devicenet
• Modbus

8
Other Industry Standards Efforts

• CIGRE WG35.13 Control/Communication Security
  (Management of Information Security in Power
  Utilities)
• North American Electricity Reliability Council
  (NERC) Critical Infrastructure Protection
  Advisory Group (CIPAG)
• Open Group Real Time Security Forum