Cyber Security for Industrial Automation and Control Systems (IACS) EDITION 2 Open Government status Open

Contents Open Government status ........................................................................................ 1 Contents ................................................................................................................. 1 Target audience ...................................................................................................... 2 Summary ................................................................................................................ 2 Introduction ............................................................................................................. 3 Action...................................................................................................................... 5 Background ............................................................................................................ 6 Organisation ........................................................................................................... 6 Targeting ............................................................................................................. 6 Timing ................................................................................................................. 6 Resources ........................................................................................................... 6 Recording & Reporting ........................................................................................ 6 Health & Safety ................................................................................................... 6 Diversity .............................................................................................................. 6 Further References ................................................................................................. 6 Relevant Regulations .......................................................................................... 6 Recognised Relevant Good Practice .................................................................. 7 Other Relevant Standards ................................................................................... 7 Contacts ................................................................................................................. 7 Appendix 1: Process for the Management of Cyber Security on IACS .................. 8 Note 1 – Recognise the Need to Manage Cyber Security Risk ........................... 9 Note 2 – Cyber Security Management System (CSMS) ...................................... 9 Note 3 – Defining the IACS Scope .................................................................... 10 Note 4 – Risk Assessment ................................................................................ 14 Note 5 – Define and Implement Countermeasures ........................................... 16 Appendix 2: Cyber Security Management Systems ............................................. 20 Appendix 3: Example Simple Network Drawings ................................................. 33 Appendix 4: Risk Assessment ............................................................................. 42 Appendix 5: Cyber Security Countermeasures .................................................... 47

Target audience Chemical Explosives and Microbiological Hazards Division (CEMHD) Electrical Control and Cyber Security (EC&CS) Specialist Inspectors and Energy Division (ED) Electrical Control and Instrumentation (EC&I) Specialist Inspectors.

Summary The term ‘duty holder’ is used in this guidance to describe those having duties under relevant health and safety legislation and / or under the Network Information Systems (NIS) Regulations.

The first edition of this guidance was published in March 2017 and used as a basis for carrying out a number of field trial inspections at major accident workplaces. This second edition has been issued following the feedback from those field trials and to address some wider developments in this topic. This second edition is compatible with the first, in that the approach and countermeasures are broadly the same as edition 1, although additional guidance on how to apply them has been included.

Whilst edition 2 does not include many additional requirements, it includes some important changes. These include:

• Incorporation of feedback from the field trials to improve the usability of the guidance. This has necessarily increased the size of the guide. o more detailed content has been added explaining how some of the requirements should be met, particularly in relation to management systems and some of the technical countermeasures, most notably Network Architecture, Segregation and Access. o In addition, the process of assessing if a duty holder had selected appropriate countermeasures based solely upon zone criticality was not adequate. The risk assessment approach has also been changed in the latest draft of IEC62443-2-1. Therefore, edition 2 requires inspectors to also consider if countermeasures are appropriate considering threat scenarios.

• Inclusion of Network Information Systems (NIS) regulation requirements. These apply to Operators of Essential Services only. This change mainly impacts upon definition of IACS scope and risk assessment. Operators subject to both Health and Safety and NIS legislation should carry out risk assessment(s) that cover both major accident and loss of essential services consequences and then use the highest risk to determine the countermeasures to be applied. The approach and countermeasures are common to both sets of legislation.

• Alignment of the guidance with the National Cybersecurity Centre (NCSC) cyber security principles, which was published subsequent to the publication of the first edition of this guidance. This change is largely presentational since although the NCSC principles are related to NIS, they were found to be consistent and compatible with the requirements within Edition 1. However, some additional requirements were added, most notably management of supply chains.

• A managed approach to implementing the countermeasures. This edition of the guidance identifies a basic level of countermeasures only to address the lower

levels of risk based on the NCSC basic cyber assessment framework (CAF) profile. As these are adopted, and duty holders gain experience and NCSC CAF framework develops further, the basic countermeasures may need to be improved to address higher levels of risk. This guide will be updated in future to include the enhanced control measures that will address higher levels of risk when the NCSC CAF is updated.

This Operational Guidance represents the Health and Safety Executive (HSE) interpretation of current and developing standards on industrial network, system and data security, and functional safety in so far as they relate to major accident workplaces and relevant sectors of operators of essential services.

The Guidance will be applied by Inspectors to major hazards workplaces (as defined within the Relevant Regulations section of this guidance) only in so far as it relates to the control of major accident hazards by the duty holder.

Where such duty holders also have legal duties under The Network and Information Systems Regulations 2018 (NIS) as an Operator of Essential Services (OES), this guidance will be applied by Inspectors in so far as it relates to both control of major accident hazards and also loss of essential services.

Where an OES is not a duty holder for a major hazards workplace, this guidance will be applied by Inspectors only in so far as it relates to the loss of essential services by the duty holder as defined under NIS.

This guidance does not cover other data protection requirements, for example as required by data protection legislation, or other business data protection requirements, e.g. protection of intellectual property.

For the purpose of the enforcement management model, this guidance is an interpretive standard.

This Operational Guidance could contribute towards a suitable demonstration of compliance with relevant legislation, in order to demonstrate that appropriate and proportionate measures have been taken to control cyber security risks, but alternative equivalent means may also be used to demonstrate compliance.

Note that the requirement to address cyber security threats for SIS in clause 8.2.4 of BS EN 61511 (edition 2) may be met by following the process detailed in this Operational Guidance.

Introduction Reducing the risk of a major accident, or operating an essential service, often requires the application of process control and safety systems and / or electrical supervisory / control systems. Therefore, major hazard risk reduction or continuity of essential service(s) may depend upon the correct functioning of these systems.

In the context of cyber security these systems are often termed Industrial Automation and Control Systems (IACS), or Industrial Control Systems (ICS) or Operational Technology (OT). This guidance uses the term IACS.

Cyber security is a term used to define measures taken to protect IACS against threats and through accidental circumstances, actions or events, or through deliberate attack. The threats can originate from the Internet, external networks (corporate or third party), maintenance activities, software upgrades, and unauthorised access etc. with the potential to result in incidents with major health, safety or environmental consequences and / or loss of essential services.

Duty holders may operate a range of IACS; these typically include basic process control and safety systems, electrical control / data acquisition systems and the associated information and business systems connected via an IACS network infrastructure.

IACS are now more accessible and ‘open’ than ever before with increasing use of commercial-off-the-shelf information technology (IT) solutions, allowing connectivity and exchange of data with other systems and with external (corporate or third party) networks. IACS are thus increasingly merging with networks and systems. This, together with an increased use of non-proprietary systems (e.g. Microsoft Windows, typically for operator interface and engineering workstations), and the associated increased functionality has led to modern IACS having an increased attack-surface and therefore becoming potentially more vulnerable to a cyber-attack, even if they are ‘air-gapped’ from other systems.

In major accident workplaces, prevention and mitigation of major accident risks is the responsibility of the major accident duty holder, defined in relevant health and safety legislation. This is normally achieved through the application of good practice, an assessment of the hazards and risks posed and application of appropriate risk reduction measures. However, normal risk assessment processes such as hazard and operability studies (HAZOP), process hazard risk analysis (PHR) etc. are not sufficient to address cyber security threats to IACS since they do not, in general, consider multiple contingencies (i.e. several dangerous events occurring at once) or know and understand the capabilities of those that have malicious intent that are typical of a cyber-attack.

Operators of essential services (OES) may also have previously considered disruption to these services as part of business risk assessments, e.g. from equipment failures. But, these risk assessments are unlikely to have considered the risk to loss of essential services with respect to the impact on UK infrastructure, or from cyber-attack.

Therefore, it is not possible to discount cyber security threats on the basis of traditional risk assessment processes or to assume that the risk of such threats will be addressed by existing risk reduction measures alone.

Duty holders may use IT and business cyber security solutions (e.g. firewalls, anti- virus software etc.) to improve cyber security of the IACS, but these need to be applied in the correct way as part of a holistic approach incorporating people, process, procedures and technology.

It may not be possible for existing IACS systems (which were designed prior to widespread cyber security threats) to comply with all the requirements of the quoted standards. It is expected however that duty holders should take appropriate and proportionate steps to reduce cyber security risks and where the required countermeasures cannot be applied to existing systems, other compensating countermeasures are considered instead.

The following guiding principles were used in producing this guidance: • Protect, detect and respond. It is important to be able to detect possible attacks and respond in an appropriate and timely manner in order to minimise the impacts. • Defence in depth. No single cyber security countermeasure provides absolute protection as new threats and vulnerabilities can be identified at any time. To reduce these risks, implementing multiple organisational, protective and detect and respond countermeasures in series avoids single point failures: i.e. Organisational Countermeasures – Governance, Risk Management, Asset Management, Supply Chain Management, Policy and Procedures, Competence and Awareness Protective Countermeasures – Identity and Access Control, Data Security, System Security and Resilience Detect and Respond Countermeasures – Security monitoring, Incident response

This guidance describes the required cyber security countermeasures to address low levels of cyber security risk based upon the NCSC basic CAF profile (see reference to good practice below). The topic of cyber security is rapidly developing and relevant international, national or industry standards have yet to be fully established. Therefore, this guidance will be updated in future as relevant standards are established and to address higher levels of risk as the NCSC CAF profiles develop further.

Action Inspectors should: • Use the high-level process described in Appendix 1, Figure 1 and the accompanying notes along with the associated Appendices 2-5 to verify, or otherwise: o the adequacy of a cyber security management system including competence management; o the adequacy of cyber security countermeasures; for (as appropriate): o Major accident workplaces; o Operators of essential services covered under the NIS Regulations. • Refer duty holders to the high-level process described in Appendix 1, Figure 1 and the accompanying notes along with the associated Appendices 2-5.

Background International Standards are being developed, such as ISA/IEC62443 to provide standards for analysing cyber risk and to specify the design, installation, inspection, maintenance and testing of cyber security countermeasures. However, these standards are yet to become established good practice.

Whilst it is expected that relevant standards for IACS cyber security will continue to be developed, this document provides guidance to Inspectors with a practical interpretation of the standards.

This guidance may also optionally be used as good practice by duty holders. However, duty holders are free to follow other good practice so long as it provides equivalent protection. Duty holders may need to work with IACS manufacturers / vendors and system integrators etc. to achieve the requirements.

Organisation Targeting Major accident workplaces where cyber security could pose a major risk to the health and / or safety of employees and / or members of the public and / or environment.

Operators of essential services, as defined in the NIS Regulations, in the energy sector where cyber security could pose a risk to loss of essential services.

This guidance will be applicable to duty holders who own / operate IACS and to IACS manufacturers and system integrators.

Timing Ongoing.

Resources To be used by CEMHD EC&CS and ED EC&I Specialist Inspectors during interventions at major accident workplaces or operators of essential services.

Recording & Reporting No special requirements.

Health & Safety No special requirements.

Diversity No special requirements.

Further References Relevant Regulations Major Accident Workplaces ➢ Control of Major Accident Hazards Regulations (COMAH) 2015

➢ Offshore Installations (Offshore Safety Directive) (Safety Case etc.) Regulations 2015 ➢ Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 ➢ Specified Animals Pathogens Order (SAPO) ➢ Pipelines Safety Regulations 1996 ➢ Gas Safety (Management) Regulations 1996

Operators of Essential Services ➢ Network and Information Systems (NIS) Regulations 2018

Recognised Relevant Good Practice ➢ BS EN 61511 (Edition 2) – Functional safety – Safety instrumented systems for the process industry sector ➢ NCSC NIS Guidance Collection (including Cyber Assessment Framework - CAF) https://www.ncsc.gov.uk/guidance/nis-guidance-collection

Other Relevant Standards ➢ ISA-TR84.00.09-2013- Security Countermeasures Related to Safety Instrumented Systems (SIS). ➢ BS EN / IEC 62443; Security for Industrial Automation and Control Systems; 4 Parts. ➢ BS EN ISO/IEC 27001; Information technology – Security techniques – Information security management systems - Requirements

Other Relevant Guidance These provide useful background and further information on cyber security: ➢ National Cyber Security Centre – 10 Steps to Cyber Security https://www.ncsc.gov.uk/guidance/10-steps-cyber-security ➢ National Cyber Security Centre – Security for Industrial Control Systems https://www.ncsc.gov.uk/guidance/security-industrial-control-systems ➢ NIST Publication 800-82 – Guide to Industrial Control Systems (ICS) Security http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf ➢ ICS-CERT Recommended Practices https://ics-cert.us-cert.gov/Recommended-Practices ➢ EEMUA Industry Information Sheet 2 – Cyber security assessment process for industrial control systems https://www.eemua.org/EEMUAPortalSite/media/EEMUA-Flyers/EEMUA- Industry-Information-Sheet-2.pdf ➢ Purdue Model - Theodore J. Williams (1994) "The Purdue enterprise reference architecture." Computers in industry Vol 24 (2). p. 141-158 ➢ SANS Twenty Critical Security Controls for Effective Cyber Defence https://www.sans.org/security-resources/posters/20-critical-security- controls/55/download

Contacts Chemicals, Explosives and Microbiological Hazards Division; Electrical, Control and Cyber Security team. Energy Division; Electrical, Control and Instrumentation team.

Appendix 1: Process for the Management of Cyber Security on IACS

Recognise the Need to Manage Cyber Security Risk (Note 1)

Another approach, e.g. IEC62443 and ISA- Either TR84.00.09-2013 and BS EN 61511 Ed 2

Risk Management As defined in Appendix 2 A2 IACS Simple Define IACS Network Drawing Scope + associated data (Note 3)

IACS Risk Risk Assessment Assessment (Note 4) Records

Threat Intel, Vulnerability Info Define & etc.

Management of Cyber Security (Note 2) Implement Countermeasures (Note 5)

Operate and IACS Operation & maintain security Maintenance measures Records (Note 2)

Audit, monitor and IACS Reports review (Note 2) KEY:

Action to be Change taken Change management N required? Y (Note 2) Documented output / record

IACS Change Decision Control Records

Figure 1: Process for Management of Cyber Security on IACS

Notes to Figure 1, Appendix 1

Note 1 – Recognise the Need to Manage Cyber Security Risk Most IACS will be vulnerable to at least some cyber security risk. Even where the IACS is largely non-programmable or is physically separated from other networks, there will be cyber security risks from, for example, activities completed during maintenance, software upgrades, vendor support or by unauthorised physical access etc.

Resources will need to be applied by the duty holder to manage cyber security risks to build up competence in the subject, develop appropriate management systems and select and manage appropriate cyber security organisational and technical countermeasures.

The number and type of the systems vulnerable to attack and potential consequences that could be realised should be considered when deciding how much resource needs to be applied to ensure a proportionate approach is implemented.

Note 2 – Cyber Security Management System (CSMS) Purpose The purpose of this step is to implement a suitable CSMS.

Background Appropriate cyber security risk management can only be achieved if the definition of the countermeasure requirements and the on-going management of the countermeasures is completed in a systematic way.

Approach A CSMS should be implemented for the defined IACS. This should be incorporated into the site’s wider management system(s).

The structure of the CSMS doesn’t need to be different to any other management system and could take a number of forms, for example: • As described in relevant standards such as IEC 62443 and ISO 27001; • the structure of management activities presented in IEC 61511; • the plan / do / check / act structure of general management systems that is used in “Managing for health and safety (HSG65)”, http://www.hse.gov.uk/pubns/books/hsg65.htm.

Similarly, technical aspects of cyber security management do not need to be different to any technical discipline, for example, in the way that Engineering projects are executed, or assets are maintained, modified and decommissioned.

Whatever form of CSMS is adopted, the following cyber security principles should be addressed (additional guidance is provided by the NCSC NIS guidance, IEC 62443- 2-1 and 2-2 and appendix 2 of this guidance):

A. Managing security risk A.1 Governance A.2 Risk management A.3 Asset management A.4 Supply chain

B. Protecting against cyber attack B.1 Protection policies and processes B.2 Identity and access control B.3 Data security B.4 System security B.5 Resilient networks and systems B.6 Staff awareness and training

C. Detecting cyber security events C.1 Security monitoring C.2 Proactive security event discovery

D. Minimising the impact of cyber security incidents D.1 Response and recovery planning D.2 Lessons learned

The documents of the CSMS should be maintained to be accurate (i.e. up to date and sensitive to changing threats / attack methods as they emerge over time), suitable for their purpose and site specific in setting out what is to be done, by whom and when; it is not necessary to include repetition of guidance when this could be referenced.

Output of this Step The output of this step will be the implementation of formal policy, procedures and management systems which will