DOCSLIB.ORG

SGTF EG2 Report On

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
SGTF EG2 Report On SMART GRIDS TASK FORCE - EXPERT GROUP 2 - CYBERSECURITY Smart Grid Task Force Expert Group 2 Recommendations to the European Commission for the Implementation of Sector-Specific Rules for Cybersecurity Aspects of Cross-Border Electricity Flows, on Common Minimum Requirements, Planning, Monitoring, Reporting and Crisis Management. Final Report June 2019 The mission of the Smart Grid Task Force Expert Group 2 on cybersecurity is to prepare the ground for sector-specific rules for cyber security aspects of cross-border electricity flows, on common minimum requirements, planning, monitoring, reporting and crisis management for the electricity subsector. SGTF EG2 / Cybersecurity June 2019 1. Contents 1. Contents ........................................................................................................................................ 2 1. Introduction .................................................................................................................................. 5 1.1 Context .................................................................................................................................. 5 1.2 1st Interim Report .................................................................................................................. 5 1.3 2nd Interim Report ................................................................................................................. 5 1.4 Acknowledgements ............................................................................................................... 6 1.5 Disclaimer .............................................................................................................................. 6 2. Symbols and Abbreviations ........................................................................................................... 7 3. Executive Summary ....................................................................................................................... 9 4. Scope and Analysis Approach of SGTF EG2 ................................................................................. 12 5. Objectives for the Network Code on Cybersecurity ................................................................... 14 6. Recommended Structure for the Network Code on Cybersecurity ............................................ 15 6.1 Harmonized Cybersecurity Baseline across the European Union ....................................... 16 6.2 Advanced Cybersecurity Implementation for Operator of Essential Services .................... 16 6.3 Supportive Elements for the Network Code on Cybersecurity ........................................... 17 7. Baseline Cybersecurity Requirements for All Operators ............................................................ 19 7.1 Conformity to ISO/IEC 27001 .............................................................................................. 20 7.1.1 Scope of the Information Security Management System ........................................... 20 7.1.2 Risk Management ....................................................................................................... 22 7.1.3 Asset Management ..................................................................................................... 23 7.1.4 Application of Minimum Security Requirements ........................................................ 24 7.2 Minimum Security Requirements ....................................................................................... 25 7.2.1 International Standards used in the Electricity Subsector .......................................... 26 7.2.2 IEC 62351 Series – Communication Security in the Electricity Subsector .................. 27 7.2.3 EU Cybersecurity Act and Minimum Cybersecurity Requirements ............................ 30 7.2.4 Categorization of Products, Systems and Services ..................................................... 33 7.2.5 Holistic Approach to define Minimum Cybersecurity Requirements ......................... 35 7.2.6 Recommended Methodology for the Definition of Minimum Cybersecurity Requirements .............................................................................................................................. 36 7.2.7 Recommended for a Certification Scheme ................................................................. 40 7.2.8 Individual Certification Approaches ............................................................................ 46 7.2.9 Common Criteria ......................................................................................................... 48 7.2.10 New Legislative Framework ........................................................................................ 49 2 SGTF EG2 / Cybersecurity June 2019 7.3 Summary of Recommendations .......................................................................................... 50 8. Advanced Cybersecurity Requirements for Operators of Essential Services ............................. 53 8.1 Protection of Current Infrastructure ................................................................................... 53 8.2 Supply Chain Cybersecurity Risk Management................................................................... 54 8.3 Protection against Cross-Border and Cross-Organisational Risks ....................................... 56 8.3.1 Cyber Risk Methodology ............................................................................................. 57 8.3.2 Extreme Cyber Risk Scenarios ..................................................................................... 59 8.3.3 Recommendation for a Cyber Risk Management of Cross-Border and Cross- Organisational Risks .................................................................................................................... 68 8.4 Active Participation in the Early Warning System .............................................................. 70 8.4.1 Existing Information Sharing Requirements in the EU ................................................ 70 8.4.2 Threat Intelligence Layers and the Value of Information ........................................... 72 8.4.3 Complementing the NIS Directive with the Concept of Voluntary Information Sharing 74 8.4.4 Code of Conduct for an Early Warning System ........................................................... 75 8.4.5 Possible Participation of Operators that are not Operators of Essential Services ..... 75 8.4.6 Information Sharing Platform ..................................................................................... 75 8.4.7 Open Items for Setting-Up of an Early Warning System ............................................. 76 8.5 Summary of Recommendations .......................................................................................... 78 9. Supportive Elements for All Operators ....................................................................................... 80 9.1 Guidance on Crisis Management ........................................................................................ 80 9.2 Guidance on Supply Chain Security .................................................................................... 82 9.3 Energy Cybersecurity Maturity Framework ........................................................................ 84 9.3.1 Introduction of the Concept of Maturity Frameworks ............................................... 85 9.3.2 ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27019 in regard to Maturity Frameworks .... 86 9.3.3 Capability Models in Standards Relevant for the Electricity Subsector ...................... 87 9.3.4 National and International Cybersecurity Maturity Frameworks ............................... 90 9.3.5 Recommendation on a Cybersecurity Maturity Framework and Approach ............... 95 9.4 Summary of Recommendation ........................................................................................... 98 10. Conclusion ................................................................................................................................. 100 11. Annex ........................................................................................................................................ 101 11.1 Annex A-1: Smart Grids Task Force – Expert Group – Working Group on Cybersecurity . 101 11.2 Annex A-2: Editorial Team ................................................................................................ 102 11.3 Annex A-3: Working Groups on Key Areas Identified ....................................................... 103 3 SGTF EG2 / Cybersecurity June 2019 11.4 Annex A4: Risk-Impact Matrix - Template ........................................................................ 106 4 SGTF EG2 / Cybersecurity June 2019 1. Introduction 1.1 Context The ‘Clean Energy for all Europeans’-package acknowledges the importance of cybersecurity for the energy sector, and the need to duly assess cyber-risks and their possible impact on the security of supply. In particular, the Electricity Regulation1 proposes the adoption of sector-specific rules for cyber security aspects of cross-border electricity flows, on common minimum requirements, planning, monitoring, reporting and crisis management in the following referred to as “Network Code on cybersecurity”. The working group on cybersecurity originated from the Commission Communication ‘Clean Energy for All Europeans’ (COM/2016/0860 final) announcing the set-up of a group in spring 2017 and the delivery of final results by the end of 2018. This Communication emphasizes that ensuring
Load more

Recommended publications
  • Using Web Honeypots to Study the Attackers Behavior
    i 2017 ENST 0065 EDITE - ED 130 Doctorat ParisTech THÈSE pour obtenir le grade de docteur délivré par TELECOM ParisTech Spécialité « Informatique » présentée et soutenue publiquement par Onur CATAKOGLU le 30 Novembre 2017 Using Web Honeypots to Study the Attackers Behavior Directeur de thèse : Davide BALZAROTTI T H Jury È William ROBERTSON, Northeastern University Rapporteur Magnus ALMGREN, Chalmers University of Technology Rapporteur S Yves ROUDIER, University of Nice Sophia Antipolis Examinateur Albert LEVI, Sabanci University Examinateur E Leyla BILGE, Symantec Research Labs Examinateur TELECOM ParisTech École de l’Institut Télécom - membre de ParisTech Using Web Honeypots to Study the Attackers Behavior Thesis Onur Catakoglu [email protected] École Doctorale Informatique, Télécommunication et Électronique, Paris ED 130 November 30, 2017 Advisor: Prof. Dr. Davide Balzarotti Examiners: EURECOM, Sophia-Antipolis Prof. Dr. Yves ROUDIER, University of Nice Sophia Antipolis Reviewers: Prof. Dr. William ROBERTSON, Prof. Dr. Albert LEVI, Northeastern University Sabanci University Prof. Dr. Magnus ALMGREN, Dr. Leyla BILGE, Chalmers University of Technology Symantec Research Labs Acknowledgements First and foremost I would like to express my gratitude to my supervisor, Davide Balzarotti. He was always welcoming whenever I need to ask questions, discuss any ideas and even when he was losing in our long table tennis matches. I am very thankful for his guidance throughout my PhD and I will always keep the mental image of him staring at me for various reasons as a motivation to move on when things will get tough in the future. I would also like to thank my reviewers for their constructive comments regarding this thesis.
    [Show full text]
  • Security Operations and Incident Management Knowledge Area (Draft for Comment)
    SECURITY OPERATIONS AND INCIDENT MANAGEMENT KNOWLEDGE AREA (DRAFT FOR COMMENT) AUTHOR: Hervé Debar – Telecom SudParis EDITOR: Howard Chivers – University of York REVIEWERS: Douglas Weimer – RHEA Group Magnus Almgren – Chalmers University of Technology Marc Dacier – EURECOM Sushil Jajodia – George Mason University © Crown Copyright, The National Cyber Security Centre 2018. Security Operations and Incident Management Hervé Debar September 2018 INTRODUCTION The roots of Security Operations and Incident Management (SOIM) can be traced to the original report by James Anderson [5] in 1981. This report theorises that full protection of the information and communication infrastructure is impossible. From a technical perspective, it would require complete and ubiquitous control and certification, which would block or limit usefulness and usability. From an economic perspective, the cost of protection measures and the loss related to limited use effectively require an equilibrium between openness and protection, generally in favour of openness. From there on, the report promotes the use of detection techniques to complement protection. The first ten years afterwards saw the development of the original theory of intrusion detection by Denning [18], which still forms the theoretical basis of most of the work detailed in this ka. Security Operations and Incident Management can be seen as an application and automation of the Monitor Analyze Plan Execute - Knowledge (MAPE-K) autonomic computing loop to cybersecu- rity [30], even if this loop was defined later than the initial developments of SOIM. Autonomic com- puting aims to adapt ICT systems to changing operating conditions. The loop, described in figure 1, is driven by events that provide information about the current behaviour of the system.
    [Show full text]
  • Standards and Tools for Exchange and Processing of Actionable Information
    Standards and tools for exchange and processing of actionable information November 2014 Standards and tools for exchange and processing of actionable information November 2014 European Union Agency for Network and Information Security www.enisa.europa.eu Standards and tools for exchange and processing of actionable information November 2014 About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Authors : This document was created by the CERT capability team at ENISA in consultation with CERT Polska /NASK (Poland)1 Acknowledgements (in alphabetical order): Luc Dandurand (NATO) Aaron Kaplan (CERT.at) Pavel Kácha (CESNET) Youki Kadobayashi (NAIST) Andrew Kompanek (CERT/CC) Tomás Lima (CERT.PT) Thomas Millar (US-CERT) Jose Nazario (Invincea) Richard Perlotto (Shadowserver) Wes Young (CSIRT Gadgets Foundation) Contact For contacting the authors please use [email protected] For media enquires about this paper, please use [email protected]. 1 Paweł Pawliński, Przemysław Jaroszewski, Janusz Urbanowicz, Paweł Jacewicz, Przemysław Zielony, Piotr Kijewski (CERT Polska), Katarzyna Gorzelak (CERT Polska) Page ii Standards and tools for exchange and processing of actionable information November 2014 Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise.
    [Show full text]
  • Actionable Information for Security Incident Response Study
    Actionable Information for Security Incident Response November 2014 European Union Agency for Network and Information Security www.enisa.europa.eu Actionable Information for Security Incident Response November 2014 About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Authors: This document was created by the CERT capability team at ENISA in consultation with CERT Polska / NASK (Poland)1 Project Manager: Cosmin Ciobanu (ENISA) Acknowledgements: Luc Dandurand (NATO) Mark Davidson (MITRE) and STIX / TAXII team Bernd Grobauer (Siemens) Pavel Kácha (CESNET) Aaron Kaplan (CERT.at) Andrew Kompanek (CERT/CC) Maarten Van Horenbeeck (FIRST) Additionally, our “thank you” goes to all participants of the Birds of a Feather session Finding & Sharing Actionable Information, co-organized by CERT Polska, US-CERT, and Microsoft during the 26th annual FIRST conference in Boston.2 Contact For contacting the authors please use [email protected] For media enquires about this paper, please use [email protected].
    [Show full text]
  • D2.1 Cyber Incident Handling Trend Analysis
    D2.1 Cyber Incident handling Trend Analysis Project number: 833683 Project acronym: CyberSANE Cyber Security Incident Handling, Warning and Project title: Response System for the European Critical Infrastructures Start date of the project: 1st September, 2019 Duration: 36 months Programme: H2020-SU-ICT-2018 Deliverable type: Report DS-01-833683 / D2.1/ Final | 0.8 Deliverable reference number: 2020_CSN_RP_05_Deliverable 2.1_Cyber Incident Handling Trend Analysis_v1 Work package contributing to the WP 2 deliverable: Due date: 01/03/2020 Actual submission date: 02/03/2020 Responsible organisation: Inria Editor: Inria Dissemination level: PU Revision: V2.0 This deliverable describes the different incident handling trend analysis performed in Task T2.1. It provides a categorisation of attacks, a description of the different tools Abstract: identified to be used in the design and development of the CyberSANE infrastructure. In addition, it reviews the related standards and provides the best practices to follow in the rest of the project. Keywords: Attacks categorisation and trends, standards, tools The project CyberSANE has received funding from the European Union’s Horizon 2020 research and innovation program under grant agreement No 833683. D2.1 – Cyber Incident Handling Trend Analysis Editor Nathalie Mitton (Inria) Contributors (ordered according to beneficiary numbers) Luís Landeiro Ribeiro (PDMFC) Luis Miguel Campos (PDMFC) Oleksii Osliak (CNR) Stefen Beyer (S2) Sergio Zamarripa (S2) Valeria Loscri (Inria) Nathalie Mitton (Inria) Edward Staddon (Inria) Mania Hatzikou (MAG) Athanasios Karantjias (MAG) Spyridon Papastergiou (MAG) Sophia Karagiorgou (UBI) Manos Athanatos (FORTH) Georgios Spanoudakis (STS) Paris-Alexandros Karypidis (SID) Anastasios Lytos (SID) Umar Ismail (UoB) Haris Mouratidis (UoB) Disclaimer The information in this document is provided “as is”, and no guarantee or warranty is given that the information is fit for any particular purpose.
    [Show full text]
  • To Augment Cyber Threat Intelligence (CTI): a Comprehensive Study Mohammad Ashraful Huq Shahi St
    St. Cloud State University theRepository at St. Cloud State Culminating Projects in Information Assurance Department of Information Systems 5-2018 Tactics, Techniques and Procedures (TTPs) to Augment Cyber Threat Intelligence (CTI): A Comprehensive Study Mohammad Ashraful Huq Shahi St. Cloud State University, [email protected] Follow this and additional works at: https://repository.stcloudstate.edu/msia_etds Recommended Citation Shahi, Mohammad Ashraful Huq, "Tactics, Techniques and Procedures (TTPs) to Augment Cyber Threat Intelligence (CTI): A Comprehensive Study" (2018). Culminating Projects in Information Assurance. 54. https://repository.stcloudstate.edu/msia_etds/54 This Starred Paper is brought to you for free and open access by the Department of Information Systems at theRepository at St. Cloud State. It has been accepted for inclusion in Culminating Projects in Information Assurance by an authorized administrator of theRepository at St. Cloud State. For more information, please contact [email protected]. Tactics, Techniques and Procedures (TTPs) to Augment Cyber Threat Intelligence (CTI): A Comprehensive Study by Mohammad Ashraful Huq Shahi A Starred Paper Submitted to the Graduate Faculty of St. Cloud State University in Partial Fulfillment of the Requirements for the Degree of Master of Science in Information Assurance May, 2018 Starred Paper Committee: Tirthankar Ghosh, Chairperson Dennis C. Guster Jim Q. Chen 2 Abstract Sharing Threat Intelligence is now one of the biggest trends in cyber security industry. Today, no one can deny the necessity for information sharing to fight the cyber battle. The massive production of raw and redundant data coupled with the increasingly innovative attack vectors of the perpetrators demands an ecosystem to scrutinize the information, detect and react to take a defensive stance.
    [Show full text]
  • Catalogue of EATM-CERT Services
    Catalogue of EATM-CERT Services Edition: 2.0 Edition date: 13-03-2020 Classification: WHITE Reference nr: SRV00-Catalogue of EATM-CERT Services EUROCONTROL Network Management Directorate DOCUMENT CONTROL Document Title Catalogue of EATM-CERT Services Document Subtitle This field is automatically updated Document Reference SRV00-Catalogue of EATM-CERT Services Edition Number 2.0 Edition Validity Date 13-03-2020 Classification WHITE Status Released Issue Author(s) Patrick MANA NMD/INF/IAC Contact Person(s) Patrick MANA NMD/INF/IAC APPROVAL TABLE Authority Date Signature Prepared by: 13/03/2020 EATM-CERT Team Reviewed and endorsed by: 13/03/2020 Patrick MANA Approved by: 17/03/2020 Iacopo PRISSINOTTI Edition Number: 2.0 Edition Validity Date: 13-03-2020 Classification: WHITE Page: i EUROCONTROL Network Management Directorate EDITION HISTORY Edition No. Validity Date Author(s) Reason 1.0 11/09/2017 Patrick MANA First Version 2.0 13/03/2020 Patrick MANA Update of EATM-CERT services Edition Number: 2.0 Edition Validity Date: 13-03-2020 Classification: WHITE Page: ii EUROCONTROL Network Management Directorate TABLE OF CONTENT DOCUMENT CONTROL ................................................................................................... I APPROVAL TABLE ......................................................................................................... I EDITION HISTORY ......................................................................................................... II INTRODUCTION ............................................................................................................
    [Show full text]