ICS-CERT Publishes FY 2015 Assessment Report

Today the DHS ICS-CERT published a report that looks at the results of 112 formal assessments that ICS-CERT conducted of industrial control systems during FY 2015. These assessments were conducted using the ICS-CERT’s Cybersecurity Evaluation Tool (CSET, 38 facilitated assessments), the Design Architecture Review (DAR, 46 assessments), and the Network Architecture Validation and Verification (NAVV, 28 assessments).

The report provides the following snap shot of the assessments conducted in FY 2015 (pg 1):

• ICS-CERT conducted 112 assessments in FY 2015, including 38 facilitated CSET®, 46 DAR, and 28 NAVV assessments.

• There were 638 weaknesses identified through DAR and NAVV assessments.

• The top six categories represented 36 percent of all weaknesses.

• Boundary protection was the most commonly identified area of weakness in both FY 2014 and FY 2015.

• Weaknesses related to boundary protection and least functionality represented 21 percent of all discovered weaknesses.

• Key trends included pervasive issues related to virtual machines, remote access, virtual local area network (VLAN) use, bring your own device (BYOD) risks, use of cloud services, and ICS network monitoring.

While the report draws some interesting conclusions about the most common cybersecurity weaknesses found in these assessments, it is very difficult to determine how these weaknesses apply to the total control system environment in the United States. The small number of facilities assessed, the fact that they were self-selected (the facilities requested ICS-CERT assessments), and the lack of information about facility size, type of control system (DCS, SCADA, etc), or the extent of support the facilities had from internal or contract cybersecurity personnel in setting up the security of their control systems all make it very difficult to draw wider conclusions about the results of these assessments.

The other problem with this report is that we are not even sure that there were 112 separate facilities included in the assessments. The very real possibility that facilities may have had ICS-CERT conduct combinations of assessments could seriously reduce the actual number of facilities involved in the study.

Having said all of that, I think that control system security personnel (professional or the untrained grunts on the frontline) should probably read this 25-page document. Addressing the most common problems identified in these assessments will not necessarily make the associated industrial control systems secure, but they will provide a good starting point for making facilities more secure.

OMB Approves Counterfeit Parts ICR

Last Friday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that they had approved the information collection request (ICR) for the DAR final rule implementing further congressional requirements to prevent the use of counterfeit electronic parts in DOD equipment. I briefly described OIRA’s approval of that final rule on Saturday.

Again, I am not trying to turn this blog into a discussion of DOD acquisition rules, but counterfeit electronic parts do provide an alternative route of attack on control systems so some attention to this rule is warranted in this blog.

According to the data submitted [.DOC download] to OIRA by DOD the new final rule will require (pg 1) “contractors and subcontractors that are not the original manufacturer of or an authorized supplier for an electronic part to make available to the Government, upon request, the following:

“Documentation of traceability from the original manufacturer of electronic parts; or

“When traceability of electronic parts cannot be established, documentation of the inspection, testing, and authentication performed in accordance with industry standards.”

The ICR documentation breaks the burden estimates into two parts, reporting and recordkeeping. The table below shows the burden estimates for each of these activities. It should be noted that the number of responses for the recordkeeping portion of the ICR is based is based upon the number of sub-contractors (average 11.89 per contractor) that will be required to maintain records to support the DOD reporting requirements.

	Respondents	Responses	Hours	Cost
Reporting	6,624	8.01	53,040	$2.0 M
Recordkeeping	6,624	11.89	2,363,190	$75.6 M
ICR Total	6,624	20	2,407,050	$77.6 M

The ICR addresses the requirements to maintain records and make reports to DOD. It does not include the time and expense of doing any required ‘inspection, testing and authentication’. The total cost of using electronic parts that are not properly vetted is quite high as a consequence of this new rule. Which is of course the intent; if the cost of using low cost parts is raised to higher than using OEM parts, then there is no incentive to use the ‘low cost’ parts.

DOD, of course, can get away with adding this language to their acquisition contracts because they were required to do so by Congress. This requirement, of course (GRIN), means that Congress has accepted the higher cost of using OEM parts on all of the DOD acquisition contracts.

It might be a tad bit harder to convince a corporate board to pay the higher capital acquisition costs associated with adopting a similar standard in corporate contracts. The question that must be taken into account is what are the potential costs of remediating a corporate breach based upon network penetration via counterfeit electronic parts? A risk-based response to that question could lead to carefully selecting which systems would require a similar process for preventing the acquisition of counterfeit parts.