IEC TC57 WG15 - Security Status & Roadmap , TC57 Plenary, May 2007

1. IEC TC57 WG15 - SecurityStatus & Roadmap,TC57 Plenary, May 2007 Frances Cleveland Convenor WG15 Presented at Plenary by Herb Falk US Representative to WG15

2. Scope of WG15 on Security • Undertake the development of standards for security of the communication protocols defined by the IEC TC 57, specifically the IEC 60870-5 series, the IEC 60870-6 series, the IEC 61850 series, the IEC 61970 series, and the IEC 61968 series. • Undertake the development of standards and/or technical reports on end-to-end security issues. • Other notes of Interest: • WG15 started as Adhoc Working 06 in 1997 (this is the WG’s 10 year anniversary). • 13 Participating Countries, 32 individuals WG15 Status October 2005

3. Status of Security Documents, May 2007 • IEC 62351: Data and Communications Security • Part 1: Introduction • Part 2: Glossary • Part 3: Security for profiles including TCP/IP • Part 4: Security for profiles including MMS • Part 5: Security for IEC 60870-5 and derivatives • Part 6: Security for IEC 61850 profiles • Part 7: Objects for Network Management • Part 8: Security process for power industry operations Withdrawn Working draft, under review and discussion Submitted as DTS ver 2 January 2007. Comments being awaited Submitted as Technical Specifications in Dec 2006, being finalized by IEC WG15 Status October 2005

4. Non-Repudiation Confidentiality Integrity Availability Unauthorized Access to Information Denial of Action that took place, or Claim of Action that did not take place Unauthorized Modification or Theft of Information Denial of Service or Prevention of Authorized Access Modification Intercept/Alter Repudiation - Desired - Actively Being Addressed Security Functionsvs.Threats Listening Interactions Planted in System Eavesdropping Traffic Analysis EM/RF Interception Indiscretions by Personnel Media Scavenging Masquerade Bypassing Controls Authorization Violation Physical Intrusion Man-in-the-Middle Integrity Violation Theft Replay Virus/Worms Trojan Horse Trapdoor Service Spoofing After-the-Fact Stolen/Altered Repudiation Denial of Service Resource Exhaustion Integrity Violation WG15 Status October 2005

5. Tele-comm Identity Establishment, Quality, and Mapping Role-Based Access Control Certificate and Key Management Security Functions, Threats, and WG15 Work Pattern Integrity Availability Confidentiality Non-Repudiation Unauthorized Access to Information Denial of Action that took place, or Claim of Action that did not take place Unauthorized Modification or Theft of Information Denial of Service or Prevention of Authorized Access Data Backup Audit Logging Intrusion Detection Systems (IDS) Authentication Firewalls with Access Control Lists (ACL) Anti-Virus/ Spy-ware Credential Establishment, Conversion, and Renewal IEC62351 Security for TASE.2, DNP, 61850 Public Key Infrastructure (PKI) Network and System Management (NSM) Passwords Certificates Transport Level Security (TLS) Virtual Private Network (VPN) WPA2/80211.i for wireless AGA 12-1 “bump-in-the-wire” Digital Signatures CRC Symmetric and Asymmetric Encryption (AES, DES) Security Management Security Testing, Monitoring, Change Control, and Updating Security Compliance Reporting Security Risk Assessment of Assets Being Addressed by many other bodies During-Attack Coping and Post-Attack Recovery Security Policy Exchange Security Incident and Vulnerability Reporting Security Attack Litigation Cigre, Utilities Corporate Security Policy and Management

6. TC57 Security (62351) Roadmap WG19 As of May 2007 Release • Remote Changing of Update Keys for IEC 60870-5 • Implementation Specification for IEC 60870-5 • Conformance testing and interoperability testing • Security for Access to CIM (Interfaces and RBAC) • Role-Based Access Control • Security Guidelines for Telecommunications Security • IEC TC65C WG10 • ISA, CIGRE D2.22 • EPRI,NERC, PCSF • National Labs • IEEE PSRC • IEEE Security P1711, P1686, P1689 • TC57 WG03 • TC57 WG07? Features Time Frame WG15 Status October 2005