K E M A, I N C. Current Status of Cyber Security Issues 2004 Keynote Address Joe Weiss January 20, 2004

K E M A, I N C. 2 Agenda n Control systems defined n Control systems cyber security threats are real n Address the issue: It makes good business sense  Productivity improvements  Response to security threats  Reliability  Regulatory compliance  Liability

K E M A, I N C. 3 What’s a Control System? n SCADA/EMS n DCS n PLCs n RTUs/IEDs n Meters n Enterprise applications for utility operations

K E M A, I N C. 4 Successful Attacks With Damage n Electric Utility  100 – 150 hits/day on control network  17 Intrusions  2 Denial of Service (DOS) Events  3 Loss of Control Events  Switchgear controller  Boiler Deaerator controls n Wastewater Utility  Wireless hack by disgruntled ex- SCADA supplier employee  Release of millions of liters of sewage

K E M A, I N C. 5 Hackers Starting to Look at SCADA n - Brumcon Report “It was a detailed breakdown of the RF systems used by water management authorities in the UK and how these systems can be abused, interfered with and generally messed. The live demonstration included how to monitor the un-encrypted water management systems and create a DOS attack. It was clear that additional communication channels using dial up connections would kick in automatically in the event of an attack.”

K E M A, I N C. 6 Business Drivers n Need for productivity improvements  Customer service  Financial impact n Response to security threats n Reliability: High visibility n Regulatory compliance n Liability

K E M A, I N C. 7 Need for productivity improvements n Technology Advances Enabling  On-line maintenance (RCM)  System optimization  Wide access to system data  Centralized data analysis n Security solution  Standards organizations: Lack of coordination  Policies  Procedures  Control systems architecture  Develop security policies  ISO not adequate

K E M A, I N C. 8 Productivity Improvement: Examples n Major Oil/Gas Company  ~90% of control systems world-wide are networked n IED Supplier  Systems require dial-up access n PLC Supplier  Systems have default passwords hardcoded into firmware

K E M A, I N C. 9 Response to security threats n Current responses  NERC  Presidential decision directive  DHS/DOE  National Plan to secure cyber space  Industry/standards organizations n Solution  Conduct vulnerability and risk assessment  Develop recovery plans  Address IT/Operations gap  Provide training programs

K E M A, I N C. 10 SCADA Cyber Assessment n Test conducted following factory acceptance test n Most secure possible case  Vendor knew we were coming  All patches installed  No outside connections n Penetration complete within 2 working days

K E M A, I N C. 11 Misidentification n Penetration test performed by organization without significant control system expertise  Identified unauthorized access of plant DCS Engineer’s Workstation n Control system assessment  Confirmed identified workstation was not DCS Engineer’s Workstation  Additional walkdown identified vulnerabilities not found by traditional penetration testing  Non-IP vulnerabilities

K E M A, I N C. 12 Reliability: High Visibility n Cyber security/reliability connection  Cyber events have impacted reliability of utility control systems  Fixes to improve reliability can impact cyber security  Control systems role in preventing and/or mitigating future blackouts n Solution  Include cyber security in reliability upgrades

K E M A, I N C. 13 Example: Substation Automation/EMS Upgrade n Includes cyber security considerations  Industry proven specifications  Remote access  Data communications/protocols  Vendor access  Training

K E M A, I N C. 14 Regulatory compliance n Current compliance issues  NERC  Presidential decision directive  AGA  EPA n Solution  Vulnerability and risk assessment  Policies and procedures  IT strategy and plan

K E M A, I N C. 15 NERC n Urgent Action Standard 1200  Control Center Only  Substantial compliance by March 2004  16 tasks  Some require additional work n SAR  In ballot process  Includes power plant controls and substation equipment

K E M A, I N C. 16 Homeland Security Presidential Directive 7  DHS Lead Agency  DOE responsible for Energy  Require a strategy to identify, prioritize, and coordinate protection of critical infrastructure  By July 2004, develop plans for protecting critical infrastructure § National goal: Protect critical infrastructure from physical and cyber attacks HSPD-7 December 17, 2003

K E M A, I N C. 17 Liability n Why liability is an issue  This is not an unforeseen event  Insurance will have exclusions for cyber  Insurance may not cover company executives  SEC may require status of cyber in filings n Solution  Perform due diligence  Move toward industry accepted program

K E M A, I N C. 18 National SCADA Test Bed n Developing new tools n Determine vulnerabilities n Large scale assessments n Testing and validating n Industry products n Safe and secure test bed n Full scale testing n Computer controls n Communications n Field Systems n Substations and RTU’s

K E M A, I N C. 19 Conclusion n Cyber security threats are real n Cyber security is not just a regulatory or national infrastructure issue; it makes good business sense n Technology will continue to evolve to meet demands for productivity and reliability improvements n Security requirements need to keep pace with technology advancements n There are workable near-term solutions n We need to work toward  Addressing the gap between IT and operations  Long-term technology changes