ISA SP99 Standards Committee Manufacturing and Control System Security

1
ISA SP99 Standards Committee Manufacturing and
Control System Security

• Focusing on
• Security Technology for Manufacturing and Control
  Systems (MCS)
• Integrating Electronic Security into the MCS
  Environment ( by Following an Overall Process
  the Security Lifecycle)
• SP99
• Is Cross-industry in scope
• Will evolve from Tech Reports to Standard (in
  steps)
• Lifecycle Starts at a High Level, Will Add Lower
  Level Details as they Become Available

DJT/SP99 6/4/03
2
OPEN QUESTION TO INTEGRATE PCSRF OUTPUTS WITH
SP99 - ARE WE PRIMARILY CONCERNED WITH THESE
SP99 LIFECYCLE STEPS ??
System goes operational here
DRAFT
Finalize Operational Security Measures
1.

Define Risk Goals
Routine Security Reporting and Analysis
11.
2.
10.

Assess Define
Define System
Perform Validation
Existing System
Validation Test Plan
test on installed
system
3.
8.
9.
Conduct Risk
Perform Pre-
Periodic Audit And Compliance Measures
Define Integration
Assessment
Installation
Test Plan
Gap Analysis
Integration test
4.
6.
7.
Define
Design or Select
Test
Component
Reevaluate Security Counter-measures ( Break-in
or Major Plant Change)
Countermeasures
Countermeasures
Test Plans
5.
Procure or Build
Security
Countermeasures
DJT/WG3 4/23/03