CIPC Executive Committee Update

1. Public Release CIPC Executive Committee Update CIPC Meeting Washington DC June 9, 2005 Stuart Brindley CIPC Chair

2. CIPC Executive Committee Chair Stuart Brindley (IESO, CEA) Vice-Chair Larry Bugh (ECAR) Vice-Chair Pat Laird (Exelon) Cyber Jamey Sample (Cal-ISO) Physical Bob Canada (Southern Co.) Operations Roger Lampila (NY-ISO) Policy Barry Lawson (NRECA) Secretary Lou Leffler (NERC) • Executive Committee 2-year terms end December 2005 • Need to “refresh” commitments of all CIPC members - letter to NERC Regional Managers later this year • opportunity for greater Owner/Operator involvement

3. CIPC Nominating TF Bob Canada SERC Larry Dolci SPP Tom Glock WECC Mike Hyland APPA Roger Lampila NPCC

4. CIPC Executive Committee Activities • NERC Board • Highlights - May 2 Stakeholder meeting and May 3 Board of Trustees meeting • US/Canada Outage TF Recommendations • Established the Electricity Sector Coordinating Council (ESCC) and the Government Coordinating Council (GCC) • ESCC = NERC President & CEO plus CIPC Executive Committee • GCC = DoE lead, plus DHS, FERC • Public messaging

5. Critical Infrastructure Protection Committee Update Stakeholders Committee May 2, 2005

6. Key CIPC Initiatives Complete actions to address the US-Canada Outage TF Recommendations by end-2005 Continue to support the development of the Permanent cyber security standard Plan to support implementation New and revised Security Guidelines and White Papers Contribute to DHS’ National Infrastructure Protection Plan Reach-out within our industry, and to other sectors

7. DHS Plan for Sector Engagement NERC is the Electricity Sector Coordinating Council CIPC’s Executive Committee President/CEO NERC Government Energy Coordinating Council DOE, DHS, FERC, possibly others April 20, 2005 inaugural meeting “One-stop shop” to address strategic issues Key CIPC Initiatives (cont’d)

8. DHS Plan for Sector Engagement Electricity

9. Electricity and TelecommunicationsInterdependencies • Engaged with Telecom and Electric Power Interdependency Task Force • Task force reports to the President’s National Security Telecom Advisory Committee • Topics include • Situational awareness • Incident management • Restoration priorities - electricity and telecom • Well-established local relationships • Inter-sector exercises • Paper by late Summer 2005

10. New Security GuidelinesCritical Infrastructure Protection Committee Board of Trustees May 3, 2005

11. Control Systems Security • New guidelines for BoT approval • Patch Management for Control Systems • Control Systems to Business Network Electronic Connectivity • Why are they necessary? • US-Canada Outage TF Recommendations related to cyber security • White paper prepared by CIPC’s Control Systems Security Working Group - “Common Vulnerabilities of Control Systems” • Increased industry and government awareness to control systems security; DOE Lab demos • Support the Urgent Action and Permanent cyber security standards

12. Development Process • Development began Q2 2004 by CIPC’s Control Systems Security Working Group • March 2005, agreed to fast-track • During April • final draft to CIPC members • conducted Webex conference call to review • conducted vote

13. Patch Management for Control Systems How to keep control systems software current and secure • Complexities associated with maintaining high availability required of control systems • Key steps • Maintain asset inventory • Notification of new vulnerabilities • Assess risks of new vulnerabilities • Test and implement

14. Control Systems to Business Network Electronic Connectivity How to secure control systems from the vulnerabilities introduced when connected to business systems Key steps • Identify inventory and information flows • User authentication • Defence in depth • Control and monitor access

15. Results of Vote • Quorum established, both passed • Patch Management for Control Systems (85.1%) • Control Systems to Business Network Electronic Connectivity (74.0%) • Reasons for “no” votes: • Generally, “more time to get it right” • Some concerns with “the speeded-up process”, rather than “content” • Language needs even further emphasis of non-mandatory nature • Definitions presume those in latest draft of Permanent Cyber Security Standard

16. US/Canada Outage TF Recommendations • Final Task Force report expected June-05 (Canadian government assigned task of coordinating response to Security-related recommendations) • Since Jan-05, several conference calls: • CIPC EC and government (DOE, DHS, NRCan, PSEPC) • CEA and Canadian government • mid-Jan-05, provided CIPC members with a table of security recommendations and actions • Table has since been updated to reflect recent CIPC Work Plan accomplishments • CIPC commitments compete, or on-target

17. ESCC and GCC

18. ESCC and GCC • “Inaugural” meeting April 20 • ESCC: Gent, Brindley, Leffler, Canada, Lampila, Lawson (Johnson, Hyland, Brown invited as observers) • GCC: De Alvarez, Friedman, Kenchington, Caverley, Carrier plus ~10 others Topics: • Interim NIPP: Energy Sector-Specific plan provided to ESCC • Targeting to provide comments by Jul-05 • Don’t forget value of response/recovery • Protecting information (CEII, PCII) • National Asset Database • ESCC position: Continue to question the need for government to have a list of infrastructure assets.

19. ESCC and GCC (cont’d) • FACA requirements (Federal Advisory Committee Act) • Formal recognition that ESCC provides advice to government • But FACA requires open and public disclosure • Brindley, Laird participating in Sector Partnership Model Working Group, reporting to NIAC…lawyers deliberating… • HSIN Status • Need to map information flows - who gets what • Technology Roadmap

20. Public Messaging Our industry is doing a lot to manage threats to our critical infrastructure. Are we getting that message out to help manage public perceptions?

21. Key Messages - Readiness • We take an all-hazards, all-threats approach to security and emergency preparedness • Natural threats • Man-made threats (cyber & physical attacks) • Not just recovery, but mitigation and prevention • Tested through drills and exercises • Keep government informed - recovery • Key Messages - Experience • During the [Blackout]…draw on local experiences

22. Key Messages - US/Canada Blackout TF Recommendations • Identify those systems critical to supporting the reliability of the grid • Secure the perimeter to those systems • Manage and monitor access to those systems • Screen and train staff • Conducting vulnerability assessments to ensure appropriate measures are in-place • … and we were already meeting many of these • ... and we’re working to improve and exceed

23. Key Messages - Our Biggest Challenge? • Maintaining and raising awareness • Address today’s threats • Keeping aware of emerging threats • Fill in the blanks: • What are your vulnerabilities? • What are you doing about them?

24. Key Messages - the Stump Question The Question: • “So what about all those people saying how vulnerable the grid is?” The Answer: • From my own experience… • We have taken action • The industry is taking action • … but “never say never”

25. Public Messaging: Go-Forward • Public statements need to be situation-dependent • CIPC Exec Ctee and NERC staff as resources • Brindley/Laird/Bugh/Leffler • Ellen Vancko, NERC Director - Communications & Government Affairs