TC 57

IEC TC57 WG15 - SecurityStatus & Roadmap,TC57 Plenary, May 2007

Frances Cleveland

Convenor WG15

Presented at Plenary by Herb Falk

US Representative to WG15

WG15 Status October 2005 2

TC 57 Scope of WG15 on Security

Undertake the development of standards for security of the communication protocols defined by the IEC TC 57, specifically the IEC 60870-5 series, the IEC 60870-6 series, the IEC 61850 series, the IEC 61970 series, and the IEC 61968 series.

Undertake the development of standards and/or technical reports on end-to-end security issues.

Other notes of Interest:

WG15 started as Adhoc Working 06 in 1997 (this is the WG’s 10 year anniversary).

13 Participating Countries, 32 individuals

WG15 Status October 2005 3

TC 57

IEC 62351: Data and Communications Security Part 1: Introduction Part 2: Glossary Part 3: Security for profiles including TCP/IP Part 4: Security for profiles including MMS Part 5: Security for IEC 60870-5 and derivatives Part 6: Security for IEC 61850 profiles Part 7: Objects for Network Management Part 8: Security process for power industry operations

Status of Security Documents, May 2007

Submitted as Technical Specifications in Dec 2006, being finalized by IEC

Submitted as DTS ver 2 January 2007. Comments being awaitedWorking draft, under review and discussion

Withdrawn

WG15 Status October 2005 4

TC 57 Security Functions vs. Threats

Unauthorized Access to

Information

Unauthorized Modification or Theft

of Information

Denial of Service or Prevention of

Authorized Access

Denial of Action that took place, or Claim of Action

that did not take place

Confidentiality

Integrity AvailabilityNon-

Repudiation

Resource Exhaustion

Integrity Violation

Planted in System

Virus/Worms

Trojan Horse

Trapdoor

Service SpoofingStolen/Altered

Eavesdropping

Traffic Analysis

EM/RFInterception

Indiscretionsby Personnel

Media Scavenging

Listening

After-the-Fact

Denial of Service

Interactions

Masquerade

BypassingControls

AuthorizationViolation

PhysicalIntrusion

Man-in-the-Middle

Integrity Violation

Theft

Replay

Intercept/Alter

Repudiation

Modification

Repudiation

- Actively Being Addressed

- Desired

Security Functions, Threats, and WG15 Work Pattern

Unauthorized Modification or Theft of Information

Integrity

Unauthorized Access to

Information

Confidentiality

Denial of Service or Prevention of

Authorized Access

Availability

Denial of Action that took place, or Claim of Action that did not

take place

Non-Repudiation

Corporate Security Policy and Management

Cigre, UtilitiesS

ecu

rity

Man

agem

ent

Security Testing, Monitoring, Change Control, and Updating

Security Compliance Reporting

Security Risk Assessment of Assets

Security Policy Exchange

Security Attack Litigation

During-Attack Coping and Post-Attack Recovery

Security Incident and Vulnerability Reporting

Firewalls with Access Control Lists (ACL)

Intrusion Detection Systems (IDS)

Audit Logging

Anti-Virus/ Spy-wareIEC62351 Security

for TASE.2, DNP, 61850

Public Key Infrastructure (PKI)

Transport Level Security (TLS)

Virtual Private Network (VPN)

AGA 12-1 “bump-in-the-wire”

WPA2/80211.i for wireless

Digital Signatures

CRC

Symmetric and Asymmetric Encryption (AES, DES)

Network and System Management (NSM)

Credential Establishment, Conversion, and Renewal

CertificatesPasswords

Authentication

Data Backup

Being Addressed by many other bodies

Identity Establishment, Quality, and Mapping Role-Based Access Control

Certificate and Key Management

Tele-comm

WG15 Status October 2005 6

TC 57 TC57 Security (62351) Roadmap As of May 2007

WG19

Current Work NWIPs to be Issued On-Going Coordination

• Parts 1, 3, 4, 6 – Finalized as TS Standards

• Party 2: Glossary – CDV

• Part 5: Security for IEC 60870-5 Protocols – CDV

• Part 7: Network and System Management /MIBs as CD

Activities in 2007 To be issued 2007 Current and Future

• Remote Changing of Update Keys for IEC 60870-5

• Implementation Specification for IEC 60870-5

• Conformance testing and interoperability testing

• Security for Access to CIM (Interfaces and RBAC)

• Role-Based Access Control

• Security Guidelines for Telecommunications Security

• IEC TC65C WG10

• ISA, CIGRE D2.22

• EPRI,NERC, PCSF

• National Labs

• IEEE PSRC

• IEEE Security P1711, P1686, P1689

• TC57 WG03

• TC57 WG07?