Framework for Improving Critical Infrastructure Cybersecurity 8 March

Framework for Improving Critical Infrastructure Cybersecurity 8 March 2016 Ljubljana, Slovenia Tim Grance grance@nist. gov cyberframework@nist. gov

Improving Critical Infrastructure Cybersecurity “It is the policy of the United States to enhance the security and resilience of the Nation’s critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties” President Barack Obama Executive Order 13636, 12 February 2013

Development of the Framework Engage the Framework Stakeholders EO 13636 Issued – February 12, 2013 NIST Issues RFI – February 26, 2013 1 st Framework Workshop – April 03, 2013 Collect, Categorize, and Post RFI Responses Completed – April 08, 2013 Identify Common Practices/Themes – May 15, 2013 Analyze RFI Responses Ongoing Engagement: Open public comment and review encouraged and promoted throughout the process… and to this day 2 nd Framework Workshop at CMU – May 2013 Draft Outline of Preliminary Framework – June 2013 Identify Framework Elements 3 rd Workshop at UCSD – July 2013 4 th Workshop at UT Dallas – Sept 2013 Prepare and Publish Framework 5 th Workshop at NC State – Nov 2013 Published Framework – Feb 2014 3

Cybersecurity Framework Components Aligns industry standards and best practices to the Framework Core in a particular implementation scenario Supports prioritization and measurement while factoring in business needs Cybersecurity activities and informative references, organized around particular outcomes Framework Profile Framework Core Framework Implementation Tiers Describes how cybersecurity risk is managed by an organization and degree the risk management practices exhibit key characteristics Enables communication of cyber risk across an organization

Implementation Tiers Cybersecurity Framework Component Risk Informed Partial None Repeatable Adaptive • Allow for flexibility in implementation and bring in concepts of • • • maturity models Reflect how an organization implements the Framework Core functions and manages its risk Progressive, ranging from Partial (Tier 1) to Adaptive (Tier 4), with each Tier building on the previous Tier Characteristics are defined at the organizational level and are applied to the Framework Core to determine how a category is implemented. 5

Framework Core What processes and assets need protection? What safeguards are available? What techniques can identify incidents? What techniques can contain impacts of incidents? What techniques can restore capabilities?

Core Cybersecurity Framework Component Function Category Asset Management Business Environment Governance Identify Risk Assessment Risk Management Strategy Access Control Awareness and Training Data Security Protect Information Protection Processes & Procedures Maintenance Protective Technology Anomalies and Events Security Continuous Detect Monitoring Detection Processes Response Planning Communications Respond Analysis Mitigation Improvements Recovery Planning Recover Improvements Communications ID ID. AM ID. BE ID. GV ID. RA ID. RM PR. AC PR. AT PR. DS PR. IP PR. MA PR. PT DE. AE DE. CM DE. DP RS. RP RS. CO RS. AN RS. MI RS. IM RC. RP RC. IM RC. CO Subcategory Informative References ID. BE-1: The COBIT 5 APO 08. 04, APO 08. 05, organization’s role in APO 10. 03, APO 10. 04, APO 10. 05 the supply chain is ISO/IEC 27001: 2013 A. 15. 1. 3, identified and A. 15. 2. 1, A. 15. 2. 2 communicated NIST SP 800 -53 Rev. 4 CP-2, SA-12 ID. BE-2: The COBIT 5 APO 02. 06, APO 03. 01 organization’s place in NIST SP 800 -53 Rev. 4 PM-8 critical infrastructure and its industry sector is identified and communicated ID. BE-3: Priorities for COBIT 5 APO 02. 01, APO 02. 06, organizational APO 03. 01 mission, objectives, ISA 62443 -2 -1: 2009 4. 2. 2. 1, and activities are 4. 2. 3. 6 established and NIST SP 800 -53 Rev. 4 PM-11, SAcommunicated 14 ID. BE-4: Dependencies ISO/IEC 27001: 2013 A. 11. 2. 2, and critical functions A. 11. 2. 3, A. 12. 1. 3 for delivery of critical NIST SP 800 -53 Rev. 4 CP-8, PE-9, services are PE-11, PM-8, SA-14 established ID. BE-5: Resilience COBIT 5 DSS 04. 02 requirements to ISO/IEC 27001: 2013 A. 11. 1. 4, support delivery of A. 17. 1. 1, A. 17. 1. 2, A. 17. 2. 1 critical services are NIST SP 800 -53 Rev. 4 CP-2, CPestablished 11, SA-14 7 7

Profile Cybersecurity Framework Component Ways to think about a Profile: • A customization of the Core for a given sector, subsector, or organization Identify Protect Detect Respond Recover • A fusion of business/mission logic and cybersecurity outcomes • An alignment of cybersecurity requirements with operational methodologies • A basis for assessment and expressing target state • A decision support tool for cybersecurity risk management 8

Using Profiles to Communicate Priorities

Building a Profile A Profile Can be Created in Three Steps 1 2 Cybersecurity Requirements Legislation Regulation Internal & External Policy Best Practice Mission Priority Objective 1 A 2 B 3 C Subcategory 1 2 3 … 98 Operating Methodologies 3 Guidance and methodology on implementing, managing, and monitoring 10

Resource and Budget Decisioning What Can You Do with a CSF Profile As-Is Subcategory 1 2 3 … 98 Priority moderate high moderate … moderate Year 1 To-Be Year 2 To-Be Year 1 Year 2 Gaps Activities small X large X medium X … none reassess …and supports on-going operational decisions too 11

Key Attributes • It’s a framework, not a prescription • It provides a common language and systematic methodology for managing cyber risk • It is meant to be adapted • It does not tell a company how much cyber risk is tolerable, nor does it claim to provide “the one and only” formula for cybersecurity • Having a common lexicon to enable action across a very diverse set of stakeholders will enable the best practices of elite companies to become standard practices for everyone • The framework is a living document • It is intended to be updated over time as stakeholders learn from implementation, and as technology and risks change • That’s one reason why the framework focuses on questions an organization needs to ask itself to manage its risk. While practices, technology, and standards will change over time—principals will not

Industry Use The Framework is designed to complement existing business and cybersecurity operations, and has been used to: • Self-Assessment, Gap Analysis, Budget & Resourcing Decisions • Standardizing Communication Between Business Units • Harmonize Security Operations with Audit • Communicate Requirements with Partners and Suppliers • Describe Applicability of Products and Services • Identify Opportunities for New or Revised Standards • Categorize College Course Catalogs • As a Part of Cybersecurity Certifications • Categorize and Organize Requests for Proposal Responses • Consistent dialog, both within and amongst countries • Common platform on which to innovate, by identifying market opportunities where tools and capabilities may not exist today

Case Studies Compare-Contrast Intel Boeing Source: case study + RSA sessions Pilot Description Source: RSA sessions Survey of key personnel about the state of security • relative to Category level outcomes • Using augmented Implementation Tiers to measure current and target state Survey of key personnel about the state of security • relative to Category level outcomes • Using Implementation Tiers to measure current and target state Intel IT - a service organization, offers solutions to other business units that drive other products Internal security operations across multiple divisions • augmented the Tier definitions to provide environmentspecific guidance to assessors • Added a fourth Category, Threat Intelligence, to Detect • Created additional Subcategories to better reflect how Intel manages each Category • none Value Received • harmonization of risk management technologies and language across the enterprise • improved visibility into Intel’s risk landscape • better-informed risk tolerance discussions • the ability to better set security priorities, develop capital and operational expenditure budgets, and deploy security solutions • Categories and Tiers provided easy to understand structure to communicate gaps and map projects against gaps • Mapping activity has resulted in changing project priority and implementation of some recommendations • Framework mapping now included in project proposals and RFI/RFP responses by cyber security business unit Feedback • Include the cyberthreat intelligence lifecycle • Relevant threat agents and actors • Threat agents’ and actors’ tactics, techniques, and procedures • Incidents and campaigns • Incident handling and vulnerability management • • Tailor the CSF for your business CSF is flexible and adaptive enough for different domains Implement for Intel manufacturing (approx. 73% of Intel) Implement on a broader basis internally and use with external customers Scope Adaptation Lessons Learned Next Steps Add cyberthreat intelligence lifecycle Consider an active pursuit (aka “hunt”) Subcategory Profile examples would be helpful Risk Informed is a property that spans all Tiers, so it may not be a good choice as a Tier Title

Examples of Industry Resources Cybersecurity Guidance for Small Firms The Cybersecurity Framework in Action: An Intel Use Case Cybersecurity Risk Management and Best Practices Working Group 4: Final Report Energy Sector Cybersecurity Framework Implementation Guidance 15

Examples of U. S. State & Local Use Texas, Department of Information Resources • • Aligned Agency Security Plans with Framework Aligned Product and Service Vendor Requirements with Framework North Dakota, Information Technology Department • • Allocated Roles & Responsibilities using Framework Adopted the Framework into their Security Operation Strategy Houston, Greater Houston Partnership • • Integrated Framework into their Cybersecurity Guide Offer On-Line Framework Self-Assessment National Association of State CIOs • 2 out of 3 CIOs from the 2015 NASCIO Awards cited Framework as a part of their award-winning strategy New Jersey • Developed a cybersecurity framework that aligns controls and procedures with Framework 16

Recent Framework Related Policy and Legislation Maritime Transportation Security Act of 2002 Cybersecurity Enhancement Act of 2014 • • Codified NIST’s on-going role facilitating Framework evolution Asked NIST to facilitate less redundancies in regulation OMB Memorandum M-16 -03 & 04 • M-16 -03: FY 2015 -16 Guidance on Federal Information Security and Privacy Management Requirements • M-16 -04: Cybersecurity Strategy and Implementation Plan Circular A-130 Update • • Provides generalized guidance for use of pre-existing FISMA-based guidance like Risk Management Framework with Cybersecurity Framework NIST publishing guidance on using Risk Management Framework and Cybersecurity Framework together 17

NIST Challenges • High variance in sector communications = high variance in socialization = high variance in engagement • Balancing adoption of version 1. 0 with the growing desire for an update • Servicing high demand with limited resources • Determining the best long-term governance model to preserve or enhance value to industry

Framework Roadmap Items Authentication Automated Indicator Sharing Conformity Assessment Cybersecurity Workforce Data Analytics Federal Agency Cybersecurity Alignment International Aspects, Impacts, and Alignment Supply Chain Risk Management Technical Privacy Standards

International Dialogs Twenty six (26) countries have participated in discussion with NIST, including dialog with: • The European Union, and 12 out of 28 Member States • 4 out of 5 of the Five Eyes • 6 countries in Asia • 5 countries in the Middle East

Emerging International Use - Italy’s National Framework for Cybersecurity: • http: //www. cybersecurityframework. it/ • Adopted 100% of the NIST Cybersecurity Framework • Extended NIST Cybersecurity Framework • Created with industry and academia • Published in both Italian and English

Recent and Near-Term Framework Events 015 11, 2 Questions focused on: experiences, update, governance, and best practice sharing Dec RFI: Views on the Framework for Improving Critical Infrastructure Cybersecurity h 201 6 Summary posted that includes analysis of topic trends in RFI responses and continued discussion topics for Workshop break-out sessions Marc RFI Analysis Goal: Highlight examples of Framework use, gather feedback on timing and content of an update, governance, and best practice sharing 016 6 -7, 2 g April ithersbur Ga NIST Cybersecurity Framework Workshop 2016 Publication on the topics that evoked the most consensus and dissonance at Cybersecurity Framework Workshop 2016 May Workshop Summary

RFI Questions and Workshop Discussion Threads Request for Information https: //www. federalregister. gov/articles/2015/12/11/2015 -31217/views-on-the-framework-forimproving-critical-infrastructure-cybersecurity RFI Responses: http: //csrc. nist. gov/cyberframework/rfi_comments_02_09_16. html • ways in which the Framework is being used to improve • • cybersecurity risk management, how best practices for using the Framework are being shared, the relative value of different parts of the Framework, the possible need for an update of the Framework, and options for long-term governance of the Framework. Cybersecurity Framework Workshop 2016 Registration: https: //appam. certain. com/profile/form/index. cfm? PKform. ID=0 x 29774 a 453 More Info: http: //www. nist. gov/cyberframework 23

Resources Where to Learn More and Stay Current The National Institute of Standards and Technology Web site is available at http: //www. nist. gov NIST Computer Security Division Computer Security Resource Center is available at http: //csrc. nist. gov/ The Framework for Improving Critical Infrastructure Cybersecurity and related news and information are available at www. nist. gov/cyberframework For additional Framework info and help cyberframework@nist. gov

Background

CEOs Cyber Risk Dilemma Our Board has a duty to protect its assets (including digital assets) and shareholder value. Share Value = EPS X P: E Multiple We consider factors affecting earnings, cash and PE Multiples (incl. brand erosion indices) Yet we still have a difficult time linking cyber risk and share value.

Continued Board Challenges & Questions 1. Briefings in Tech language, not in EPS or P: E multiple factor terms 2. Where is Cyber in Board Risk Committee? 3. Who highlights cyber impact in 10 Q financials, footnotes or MDA narratives? 4. Is there a cyber allocation in the ERM budget? 5. Do they quantify the cyber impact on financial and reputation exposure and its share value impact?

Project Description Objective: Create a Bulk Liquids Transportation Cybersecurity Framework Profile Value: By creating a Subsector level Cybersecurity Framework Profile, we are: • Minimizing future work by each organization • Decreasing the chance that organizations accidentally omit a requirement • Reducing errors due to varying interpretations

Building a Profile A Profile Can be Created in Three Steps 1 2 Cybersecurity Requirements Legislation Regulation Internal & External Policy Best Practice Mission Priority Objective 1 A 2 B 3 C Subcategory 1 2 3 … 98 Operating Methodologies 3 Guidance and methodology on implementing, managing, and monitoring 29

Conceptual Profile Value Proposition 2 Cybersecurity Requirements Subcategory A 1 Priority 1 moderate 2 high 3 moderate F … … G 98 moderate B C D E 3 Operating Methodologies I II IV V VI VIII When you organize yourself in this way: • Compliance reporting becomes a byproduct of running your security operation • Adding new security requirements is straightforward • Adding or changing operational methodology is nonintrusive to on-going operation 30

Resource and Budget Decisioning What Can You Do with a CSF Profile As-Is Subcategory 1 2 3 … 98 Priority moderate high moderate … moderate Year 1 To-Be Year 2 To-Be Year 1 Year 2 Gaps Activities small X large X medium X … none reassess …and supports on-going operational decisions too 31

Customizing a Subsector CSF Profile customization Organization -Specific CSF Profile Cybersecurity Requirements Subcategory Priority A 1 moderate 2 high 3 moderate F … … G 98 moderate VIII Cybersecurity Requirements Subcategory Priority A 1 moderate 2 high 3 high … … Operating Methodologies I II III Additional practice IV V VI VII G 98 moderate VIII H 99 Moderate IX B C D E F Organization Policy Operating Methodologies I II IV V VI VII