व य पक पट ररच लन मस द

Transcription

1 व य पक पट ररच लन मस द प रल ख प र क षण स ज ञ पन स दर भ ददन क एलआईट ड 17/ट कन क सवमव : एलआईट ड 17 ऩ न व ऱ क न म: 1) स चन प रण ल स रक ष एव ब य म ट र क ववषय सवमव, एऱआईट ड 17 2) इऱ क ट र ननक एव स चन प र द य गगक ववभ ग ऩररषद एऱआईट ड स क प रध न सदस य 3) अन य र गच रखन व ऱ मह दय(य ) ननम नलऱखखत प रऱ ख क अवऱ कन कर : एलआईट ड 17(13569) आईएसओ/आईईस : 27019:2017 स चन प र द य ग क - स र तकन क - ऊर उपय ग त उद य ह त स चन स र ननय त रण क ऩय इस मस द क अवऱ कन कर और अऩन सम मनतय, यह बत त ह ए कक यदद यह भ रत य म नक प रक ल त ह त अमऱ करन म आऩ क व यवस य म क ट य कद न ईय आ सकत ह, भ ज सम मनतय भ जन क अ नतम नतग : यदद क ई सम मनत प र प त नह ह त य सम मनत सम ऩ दक य प रक नत क ह त ह त क ऩय य अन न न तम ह त उऩर क ट त मस द क लऱए आऩक अन म दन म न ऱ न क अन मत द त वऩ, यदद आऩक सम मनत क प रक नत तकन क ह त यदद च यर म न ववषय सलमनत द व र ऐस रहन व न त ह त इस आग क आवश यक क रव ई क लऱए च यर म न ववषय सलमनत क ऩ स ऩर म र ह त य ववषय सलमनत क ऩ स अवऱ क र करक अन न न तम ककय ज एग यह दस त व ज ब आईएस व बस इट ( Standardization<<<Standards Formulation<<<Drafts under wide circulation<<< Electronics & Information Technology) ऩर भ ह स ट ककय गय ह धन यव द, भवद य, स ऱग नक : उऩर क ट त (र न गगर) प रम ख (इऱ क ट र ननक व आईट ) ईम ऱ: hlitd@bis.gov.in, litd17@bis.gov.in ट लऱ:

2 DRAFT IN WIDE CIRCULATION Document Dispatch Advice Ref Date LITD17/T Technical Committee: LITD 17 ADDRESSED TO: 1. All Members of Information System Security and Biometrics Sectional Committee, LITD All Principal Members of Electronics and Information Technology Division Council (LITDC) 3. All others interested Dear Madam/Sir(s), Please find enclosed the following draft Indian Standard: LITD 17(13569) ISO/IEC 27019:2017 Information Technology Security Techniques Information Security Controls for the Energy Utility Industry Kindly examine this draft standard and forward your views stating any difficulties, which you are likely to experience in your business or profession, if this is finally adopted as National Standard. Last Date for comments: Comments if any, may please be made in the format indicated and mailed to the undersigned. In case no comments are received or comments received are of editorial nature, You will kindly permit us to presume your approval for the above document as finalized. However, in case of comments of technical in nature are received then it may be finalized either in consultation with the Chairman, Sectional Committee or referred to the Sectional committee for further necessary action if so desired by the Chairman, Sectional Committee. This document has been also hosted on BIS website ( Standardization<<<Standards Formulation<<<Drafts under wide circulation<<< Electronics & Information Technology) Thanking you, Yours faithfully, Encl: As above (Reena Garg) Head (Electronics & IT) Tele:

3 Doc. No. : LITD 17 (13569) IS/ISO/IEC 27019:2017 BUREAU OF INDIAN STANDARDS DRAFT FOR COMMENTS ONLY Draft Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES INFORMATION SECURITY CONTROLS FOR THE ENERGY UTILITY INDUSTRY ICS Last date for receipt of comments is: 27 March 2019 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD (Formal clauses to be added later) This Draft Indian Standard which is identical with ISO/IEC 27019:2017 Information Technology Security Techniques Information Security Controls For The Energy Utility Industry issued by International Organization for Standardization (ISO) and International Electro technical Commission (IEC) will be adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee, and approval of the Electronics and Information Technology Division Council.

4 The text of ISO/IEC Standard may be approved as suitable for publication as an Indian Standard without deviations. Certain co nventions are, however, not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the d ecimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standard also exist. For undated references, the latest edition of the referenced document applies, including any corrigenda and amendment.the corresponding Indian Standard which is to be substituted in its respective place is listed below along with its degree of equivalence for the edition indicated: International Standard Corresponding Indian Standard Degree of Equivalence ISO/IEC Information technology Security techniques Information security management systems Overview and vocabulary ISO/IEC 27001:2013 Information technology Security techniques Information security management systems Requirements ISO/IEC 27002:2013 Information technology Security techniques Code of practice for information security controls IS/ISO/IEC 27000:2018 Information technology Security techniques Information security management systems Overview and vocabulary (First Revision) (Under Print) Identical with ISO/IEC 27000:2018 IS/ISO/IEC 27001:2013 Information technologyidentical Security techniques Information security management systems Requirements (First Revision) IS/ISO/IEC 27002:2013 Information technologyidentical Security techniques Code of practice for information security controls

5 Scope of ISO/IEC 27019:2017 is as follows: This document provides guidance based on ISO/IEC 27002:2013 applied to process control systems used by the energy utility ind ustry for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil a nd heat, and for the control of associated supporting processes. This includes in particular the following: central and distributed process control, monitoring and automation technology as well as information systems used for their operation, such as programming and parameterization devices; digital controllers and automation components such as control and field devices or Programmable Logic Controllers (PLCs), including digital sensor and actuator elements; all further supporting information systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving, historian logging, reporting and documentation purposes; communication technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote co ntrol technology; Advanced Metering Infrastructure (AMI) components, e.g. smart meters; measurement devices, e.g. for emission values; digital protection and safety systems, e.g. protection relays, safety PLCs, emergency governor mechanisms; energy management systems, e.g. of Distributed Energy Resources (DER), electric charging infrastructures, in private households, residential buildings or industrial customer installations; distributed components of smart grid environments, e.g. in energy grids, in private households, residential buildings or industrial customer installations; all software, firmware and applications installed on above-mentioned systems, e.g. DMS (Distribution Management System) applications or OMS (Outage Management System);

6 any premises housing the above-mentioned equipment and systems; remote maintenance systems for above-mentioned systems. This document does not apply to the process control domain of nuclear facilities. This domain is covered by IEC This document also includes a requirement to adapt the risk assessment and treatment processes described in ISO/IEC 27001:2013 to the energy utility industry-sector specific guidance provided in this document. Note: The Technical content of this document has not been enclosed as these are identical with the corresponding ISO/IEC Standard. For details please refer ISO/IEC 27019:2017 or kindly contact. Initial Comments sent by some stake holders are placed at Annexure -1.Reoslution of these will take place along with comments received during the wide circulation stage. Head Electronics & IT Department Bureau of Indian Standards 9, B.S. Zafar Marg, New Delhi hlitd@bis.gov.in litd17@bis.gov.in Tele:

7 Annex-1 TEMPLATE FOR SENDING COMMENTS ON BIS DOCUMENTS Date: Document No.: ISO/IEC 27019:2017 Name of the Commentator/ Organization: Title of the Document: National Critical Information Infrastructure protection center) & Indian Computer emergency response team Information technology -- Security techniques -- Information security controls for the energy utility industry Abbreviation of the Commentator/Organization: CERT-IN & NCIIPC (Comments on each clause/subclause/table/fig, etc be started on a fresh box. Information in column 5 should include reasons for the comments/suggestions for modified wordings of the clauses when the existing text/provision is found not acceptable. Adherence to this format facilitates Secretariat s work) Abbreviation of the Commentator/O Clause/ Subclause No. Paragraph No. / Figure No. / Type of Comment 1) Comments/Suggestions along with Justification for the Proposed Change Proposed Change/Modified Wordings rganization (e.g. 3.1) Table No. (e.g. Table 1) (1) (2) (3) (4) (5) (6) CERT-In 0.2 a ge Safe may be included as customer expectation Customers expect a safe, secure and reliable energy supply. CERT-In 1 Te Human Machine Interface (HMI) may be specifically included as it is common way for attacker to enter the network Human Machine Interface (HMI) CERT-In 3 ge Definition of Industrial Control System (ICS) may be included NCIIPC IT & OT security personnel duties may be defined NCIIPC Energy organization may constitute ISAC (Information sharing and Analysis Centre) for sharing cyber threats in standard formats with other organisations in order to

8 protect CIIs in the power/energy sector CERT-In ge Sector CERTs, ISACs of Power/energy (national/international), service providers may be included CERT-In ge Energy Utilities may prepare Cyber Crisis Management Plan (CCMP) in line with their requirements. CCMP may be referred for keeping up to date contact details and responding to cyber security incidents. CERT-In te Threat Information exchange groups may be added. NCIIPC Security features has to be incorporated at conceptualization stage for critical element procurement and establishment of system by third parties/vendors. Security for legacy systems needs to be ensured through suitable controls, if technological solutions are not available. NCIIPC ACL may be configured and session legos may be maintained for each user who is accessing critical devices. Maximum data size may also be defined for data transfer. Log analysis Process for mobile devices has to be established and suitable incident handling mechanism for cyber threat emerging through such platform. NCIIPC Remote log in activities may be logged and monitored CERT-In te Teleworking should be avoided. NCIIPC 7 Post-employment requirement may also be defined for personals working on Critical Infrastructure. Suitable, access control changes to be made in the system postemployment of personal. CERT-In ge Awareness program should be conducted for all employees of organisation. Awareness/training program should be customized role-based. Exercises such as desktop check & quiz may be included/reffered. CERT-In te Data Diode may be considered for inclusion to control flow of information from/to IT to OT environment.

9 NCIIPC 9.3 Statement may be defined in exception clause of Information Security Policy for default passwords usage during operational activity after approval of competent authority. NCIIPC For securing control centre, extended security level SLA may be signed with the vendor in order get sufficient support to update of software patches/firmware/technologies from the vendor for defined years for securing the control centre /peripheral operations. NCIIPC 11.3 The systems at the premise of external parties should be hardened in order to arrest the spread of malware. NCIIPC Regular reviews of services running on the system should be done identification of unknown malicious services in absence of Anti-virus. NCIIPC Tthe energy utility organisation should ensure that it receives a comprehensive and up-to-date software inventory should be read as the energy utility organisation should ensure that it receives a comprehensive and up-to-data software/firmware/operating in least possible time frame NCIIPC Minimum and maximum parameter values (digital values) may be defined for the critical safety systems in order to ensure safety function. NCIIPC Access control sessions may be managed and connections /authorized access may be closed after use. When access is given to external parties, their activities may be monitored during the session. NCIIPC Security technology may be considered as first priority. CERT-In te Preparation of Cyber Crisis Management plan in line with requirements of energy utility sector. NCIIPC Apart from ICT, there should be provision for data redundancy as well for critical process control systems in order to ensure data availability.

10 CERT-In te Frequency of technical compliance review should be defined as per critically of the system/application which can be continuous review, weekly, quarterly, biannual or annual. At least annual review should be there. NCIIPC In case of process control systems, simulated test-bed vulnerability assessment can be carried-out to avoid any damage to the operational system.

11 TEMPLATE FOR SENDING COMMENTS ON BIS DOCUMENTS Date: Document No.: Title of the Document: Name of the Commentator/ Organization: Abbreviation of the Commentator/Organization: (Comments on each clause/subclause/table/fig, etc be started on a fresh box. Information in column 5 should include reasons for the comments/suggestions for modified wordings of the clauses when the existing text/provision is found not acceptable. Adherence to this format facilitates Secretariat s work) Abbreviation of the Commentator/ Organization Clause/ Subclause No. (e.g. 3.1) Paragraph No. / Figure No. / Table No. (e.g. Table 1) Type of Comment 1) Comments/Suggestions along with Justification for the Proposed Change Proposed Change/Modified Wordings (1) (2) (3) (4) (5) (6) 1) Type of comment: ge = general te = technical ed = editorial BIS electronic commenting template/version 2017/01 page 1 of 1