NERC CIPC March 16, 2006 Roadmap to Secure Control Systems in the Energy Sector

1. CIPC Confidentiality: Public Release NERC CIPC March 16, 2006 Roadmap to Secure Control Systems in the Energy Sector U.S. Department of Energy Office of Electricity Delivery and Energy Reliability Hank Kenchington 202-586-1878 henry.kenchington@hq.doe.gov

2. PNL INL NIST SNL National SCADA Test Bed OBJECTIVE Support industry and government efforts to enhance control systems cyber security across the energy infrastructure SCOPE DOE multi-laboratory program jointly managed and executed by INL and SNL (other partners include PNL, ANL, NIST, other contractors) Key program areas: • Assess and mitigate SCADA system vulnerability • Support development of security standards • Develop and test advanced secure control systems technology • Conduct outreach and awareness

3. National SCADA Test Bed Key Activities: • SCADA System Assessments - ABB, AREVA, GE, Siemens • Provided cyber security training to over 400 end-users • Evaluated use of COTS IT antivirus and firewall tools in control systems • Working closely with electricity sector, developed mitigation strategies for “top 10” vulnerabilities • Conducting performance testing and cryptographic analysis of AGA 12 • Evaluated and cataloged existing SCADA Standards Results: • New “hardened” SCADA systems now being deployed • Software patches developed by vendors and supplied to end-users to better secure existing systems

4. Enhanced SCADA systems are being deployed…TODAY “Proprietary” Test Reports Vendor National SCADA Test Bed SCADA/ Control Systems “Public” Test Reports Test Direction Enhanced SCADA/Control Systems Asset Owners System Patches Enhanced SCADA systems in market

5. Lots of activities…but no coordination NERC Standards & Guidelines EPRI EIS projects NSF R&D projects DOE National SCADA Test Bed DHS I3P SCADA FERC projects DHS Process Control Systems Forum DHS NCSD Cyber Security Test Bed DOD TSWG AGA 12 Standard NIST Process Control Security Requirements Forum DOE Critical Infrastructure Test Range DHS S&T SBIR projects

6. Roadmap Process Create Steering Group Guide Roadmap Development • Trends & Driver • Challenges &Barriers • Priorities • Action Plans Conduct Roadmap Workshop Identify Needs and Priorities Prepare Technology Roadmap Integrate into Plans Implement Roadmap Initiate Projects and Partnerships We Are Here!

7. Asset Owners and Operators Tom Flowers - CenterPoint Energy (electricity) Linda Nappier – Ameren (electricity) Al Rivero – formerly w/Chevron (oil and gas) David Poczynek – Williams Co. (oil and gas) Tom Frobase – TEPPCO (oil and gas) Michael Assante – formerly w/AEP and IEIA Forum Industry Organizations Bill Rush – GTI Lisa Soda – API Kimberly Denbow – AGA Gary Gardner – AGA Tom Kropp - EPRI Government Doug Maughan – U.S. DHS Hank Kenchington – U.S. DOE David Darling – Natural Resources Canada Researchers (National Laboratories) Tommy Cabe – Sandia National Laboratories Jeff Dagle – Pacific Northwest National Laboratory Bob Hill – Idaho National Laboratory Roadmap Steering Committee

8. People Technology Processes Roadmap Scope Sectors - Electricity - Oil - Gas - Telecom (supporting) • Time Frames • Near: 0-2 yrs. • Mid: 2-5 yrs. • Long: 5-10 yrs. Potential Solutions See: www.controlsystemsroadmap.net

9. Target Participants Operations, 5 Commercial Suppliers Business and Industry Organizations 8 Asset Owners and Operators Security, 10 7 30 Government & Labs 15 ControlSystems, 15 Workshop Participants • Led by energy sector owners and operators • Includes representatives from electricity, oil, gas, telecom industries • Engages a cross-section of stakeholders and experts

10. Roadmap Framework Vision In 10 years, control systems for critical applications will be designed, installed, operated, and maintained to survive an intentional cyber assault with no loss of critical function. • Key Strategies • Measure and assess security posture • Develop and integrate protective measures • Detect intrusion and implement response strategies • Sustain security improvements

11. Develop and Detect Intrusion Detect Intrusion Develop and Measure and Measure and Sustain Security Sustain Security and Implement and Implement Integrate Protective Integrate Protective Assess Security Assess Security Improvements Improvements Measures Response Strategies Response Strategies Measures Posture Posture Milestones Milestones Milestones Milestones Milestones Milestones Milestones Milestones • 50% of asset owners and operators performing self-assessments of their control systems using consistent criteria (2008) • Secure connectivity between business systems and control systems within corporate network (2009) • Cyber incident response is part of emergency operating plans at 30% of control systems (2008) • Resolve major info protection and sharing issues between U.S. govt. and industry (2006) • Fully automated security state and common response of control system networks (2015) • Secure control system architectures produced with built-in, end-to-end security (2015) • Self-configuring control system network architectures are in production (2015) • Cyber security awareness, education, and outreach programs integrated into energy sector operations (2015) EXAMPLE time

12. Next Steps • Work with Sector Coordinating Councils to develop Roadmap Implementation Forum • Use results to coordinate activities of government, academia, and private sector to align with roadmap • Use roadmap to guide DOE control systems security program activities IndustryOrganizations Government Asset Owners& Operators Commercial Entities Researchers See: www.controlsystemsroadmap.net

13. END US Department of Energy Office of Electricity Delivery and Energy Reliability Hank Kenchington henry.kenchington@hq.doe.gov 202-586-1878