Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide: Volume 1 – General Implementation Guidance
Total Page:16
File Type:pdf, Size:1020Kb
NISTIR 8183A Volume 1 Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide: Volume 1 – General Implementation Guidance Keith Stouffer Timothy Zimmerman CheeYee Tang Jeffrey Cichonski Michael Pease Neeraj Shah Wesley Downard This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-1 NISTIR 8183A Volume 1 Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide: Volume 1 – General Implementation Guidance Keith Stouffer Neeraj Shah Timothy Zimmerman Strativia, LLC CheeYee Tang Largo, Maryland Michael Pease Intelligent Systems Division Engineering Laboratory Jeffrey Cichonski Wesley Downard Applied Cybersecurity Division G2, Inc. Information Technology Laboratory Annapolis Junction, Maryland This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-1 September 2019 U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology National Institute of Standards and Technology Internal Report 8183A, Volume 1 81 pages (September 2019) This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-1 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Comments on this publication may be submitted to: National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000 Email: [email protected] All comments are subject to release under the Freedom of Information Act (FOIA). NISTIR 8183A VOL. 1 CSF MFG PROFILE LOW IMPACT LEVEL EXAMPLE IG GENERAL IMPLEMENTATION GUIDANCE Abstract This guide provides general implementation guidance (Volume 1) and example proof-of-concept solutions demonstrating how available open-source and commercial off-the-shelf (COTS) products could be implemented in manufacturing environments to satisfy the requirements in the Cybersecurity Framework (CSF) Manufacturing Profile Low Impact Level. Example proof-of- concept solutions with measured network, device, and operational performance impacts for a process-based manufacturing environment (Volume 2) and a discrete-based manufacturing environment (Volume 3) are included in the guide. Manufacturers should make their own determinations about the breadth of the proof-of-concept solutions they voluntarily implement. Some important factors to consider include: company size, cybersecurity expertise, risk This publication is available free of charge of from: http This free available publication is tolerance, and the threat landscape. The CSF Manufacturing Profile can be used as a roadmap for managing cybersecurity risk for manufacturers and is aligned with manufacturing sector goals and industry best practices. The Manufacturing Profile provides a voluntary, risk-based approach for managing cybersecurity activities and cyber risk to manufacturing systems. The Manufacturing Profile is meant to complement but not replace current cybersecurity standards and industry guidelines that the manufacturer is embracing. Keywords Computer security; Cybersecurity Framework (CSF); distributed control systems (DCS); industrial control systems (ICS); information security; manufacturing; network security; programmable logic controllers (PLC); risk management; security controls; supervisory control and data acquisition (SCADA) systems. s ://doi.org/10.6028/ Supplemental Content Additional volumes of this publication include: NISTIR 8183A Volume 2, Cybersecurity Framework Manufacturing Profile Low Impact NIST.IR.8183A Level Example Implementations Guide: Volume 2 – Process-based Manufacturing System Use Case. https://doi.org/10.6028/NIST.IR.8183A-2 NISTIR 8183A Volume 3, Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide: Volume 3 – Discrete-based Manufacturing - 1 System Use Case. https://doi.org/10.6028/NIST.IR.8183A-3 ii NISTIR 8183A VOL. 1 CSF MFG PROFILE LOW IMPACT LEVEL EXAMPLE IG GENERAL IMPLEMENTATION GUIDANCE Acknowledgments The authors gratefully acknowledge and appreciate the significant contributions from individuals and organizations in the public and private sectors, whose thoughtful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. A special acknowledgement to the members of the International Society of Automation (ISA) 99, Industrial Automation and Control Systems Security Committee and the Department of Homeland Security Industrial Control System Joint Working Group (ICSJWG) for their exceptional contributions to this publication. Note to Readers This publication is available free of charge of from: http This free available publication is This guide describes a proof-of-concept solution for securing manufacturing environments that has only been tested in a lab environment. Manufacturers should make their own determinations about the breadth of the proof-of-concept solutions they voluntarily implement. Some important factors to consider include: company size, cybersecurity expertise, risk tolerance, and the threat landscape. We welcome feedback on its contents and your input. Comments, suggestions, and success stories will improve subsequent versions of this guide. Please contribute your thoughts to [email protected]. Revision to Include Updates in Cybersecurity Framework Version 1.1 The Cybersecurity Framework Manufacturing Profile, NISTIR 8183, was drafted and released when the Cybersecurity Framework was at Version 1.0. This guide provides implementation guidance and example proof-of-concept solutions with respect to the language in the original s Cybersecurity Framework Manufacturing Profile. ://doi.org/10.6028/ The Cybersecurity Framework Manufacturing Profile, NISTIR 8183, is scheduled to be revised to include the updates in the Cybersecurity Framework Version 1.1, and will be published as NISTIR 8183, Revision 1. NIST.IR.8183A Once NISTIR, 8183, Revision 1 has been released, this implementation guide will be revised to include the updates in the Cybersecurity Framework Version 1.1 as well, and will be published as NISTIR 8183A, Revision 1. - 1 iii NISTIR 8183A VOL. 1 CSF MFG PROFILE LOW IMPACT LEVEL EXAMPLE IG GENERAL IMPLEMENTATION GUIDANCE Table of Contents Executive Summary ..................................................................................................... vi 1. Introduction ............................................................................................................ 1 Purpose and Scope ........................................................................................ 1 Audience ......................................................................................................... 2 Document Structure ........................................................................................ 3 This publication is available free of charge of from: http This free available publication is 2. Overview of Manufacturing Systems ................................................................... 4 3. CSF Manufacturing Profile Overview ................................................................... 5 4. CSF Manufacturing Profile Implementation Approach ....................................... 6 5. Policy/Procedural Capabilities Overview ............................................................. 7 Cybersecurity Program Document .................................................................. 8 Cybersecurity Policy Document ...................................................................... 8 Cybersecurity Operations Document .............................................................. 8 Risk Management Document .......................................................................... 8 Incident Response Plan Document ................................................................. 8 System Recovery Plan Document .................................................................. 9 6. Technical Capabilities Overview ......................................................................... 10 Hardware Inventory Management ................................................................. 10 Software and Firmware Inventory Management ..........................................