Cybersecurity standards


Cybersecurity standards are techniques generally set forth in published materials that attempt to protect the cyber environment of a user or organization. This environment includes users themselves, networks, devices, all software, processes, information in storage or transit, applications, services, and systems that can be connected directly or indirectly to networks.
The principal objective is to reduce the risks, including prevention or mitigation of cyber-attacks. These published materials consist of collections of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies.

History

standards have existed over several decades as users and providers have collaborated in many domestic and international forums to effect the necessary capabilities, policies, and practices - generally emerging from work at the Stanford Consortium for Research on Information Security and Policy in the 1990s.
A 2016 US security framework adoption study reported that 70% of the surveyed organizations the NIST Cybersecurity Framework as the most popular best practice for Information Technology computer security, but many note that it requires significant investment.

Standards

The subsections below detail the most commonly used standards.

ISO/IEC 27001 and 27002

ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an information security management system standard, of which the last revision was published in October 2013 by the International Organization for Standardization and the International Electrotechnical Commission. Its full name is ISO/IEC 27001:2013 – Information technology – Security techniques – Information security management systems – Requirements.
ISO/IEC 27001 formally specifies a management system that is intended to bring information security under explicit management control.
ISO/IEC 27002 incorporates mainly part 1 of the BS 7799 good security management practice standard. The latest versions of BS 7799 is BS 7799-3. Sometimes ISO/IEC 27002 is therefore referred to as ISO 17799 or BS 7799 part 1 and sometimes it refers to part 1 and part 7. BS 7799 part 1 provides an outline or good practice guide for cybersecurity management; whereas BS 7799 part 2 and ISO/IEC 27001 are normative and therefore provide a framework for certification. ISO/IEC 27002 is a high level guide to cybersecurity. It is most beneficial as explanatory guidance for the management of an organisation to obtain certification to the ISO/IEC 27001 standard. The certification once obtained lasts three years. Depending on the auditing organisation, no or some intermediate audits may be carried out during the three years.
ISO/IEC 27001 replaces BS 7799 part 2, but since it is backward compatible any organization working toward BS 7799 part 2 can easily transition to the ISO/IEC 27001 certification process. There is also a transitional audit available to make it easier once an organization is BS 7799 part 2-certified for the organization to become ISO/IEC 27001-certified. ISO/IEC 27002 provides best practice recommendations on information security management for use by those responsible for initiating, implementing or maintaining information security management systems. It states the information security systems required to implement ISO/IEC 27002 control objectives. Without ISO/IEC 27001, ISO/IEC 27002 control objectives are ineffective. ISO/IEC 27002 controls objectives are incorporated into ISO 27001 in Annex A.
ISO/IEC 21827 is an International Standard based on the Systems Security Engineering Capability Maturity Model that can measure the maturity of ISO controls objectives.

NERC

An initial attempt to create information security standards for the electrical power industry was created by NERC in 2003 and was known as NERC CSS. Subsequent to the CSS guidelines, NERC evolved and enhanced those requirements. The most widely recognized modern NERC security standard is NERC 1300, which is a modification/update of NERC 1200. The newest version of NERC 1300 is called CIP-002-3 through CIP-009-3. These standards are used to secure bulk electric systems although NERC has created standards within other areas. The bulk electric system standards also provide network security administration while still supporting best-practice industry processes.

NIST

  1. The NIST Cybersecurity Framework "provides a high level taxonomy of cybersecurity outcomes and a methodology to assess and manage those outcomes." It is intended to help private sector organizations that provide critical infrastructure with guidance on how to protect it, along with relevant protections for privacy and civil liberties.
  2. Special publication 800-12 provides a broad overview of computer security and control areas. It also emphasizes the importance of the security controls and ways to implement them. Initially this document was aimed at the federal government although most practices in this document can be applied to the private sector as well. Specifically it was written for those people in the federal government responsible for handling sensitive systems.
  3. Special publication 800-14 describes common security principles that are used. It provides a high level description of what should be incorporated within a computer security policy. It describes what can be done to improve existing security as well as how to develop a new security practice. Eight principles and fourteen practices are described within this document.
  4. Special publication 800-26 provides advice on how to manage IT security. Superseded by NIST SP 800-53 rev3. This document emphasizes the importance of self assessments as well as risk assessments.
  5. Special publication 800-37, updated in 2010 provides a new risk approach: "Guide for Applying the Risk Management Framework to Federal Information Systems"
  6. Special publication 800-53 rev4, "Security and Privacy Controls for Federal Information Systems and Organizations", Published April 2013 updated to include updates as of January 15, 2014, specifically addresses the 194 security controls that are applied to a system to make it "more secure".
  7. Special publication 800-63-3, "Digital Identity Guidelines", Published June 2017 updated to include updates as of December 1, 2017, provides guidelines for implementing digital identity services, including identity proofing, registration, and authentication of users.
  8. Special Publication 800-82, Revision 2, "Guide to Industrial Control System Security", revised May 2015, describes how to secure multiple types of Industrial Control Systems against cyber attacks while considering the performance, reliability and safety requirements specific to ICS.

    ISO 15408

This standard develops what is called the “Common Criteria”. It allows many different software and hardware products to be integrated and tested in a secure way.

ANSI/ISA 62443 (Formerly ISA-99)

ANSI/ISA 62443 is a series of standards, technical reports, and related information that define procedures for implementing secure Industrial Automation and Control Systems.
These documents were originally referred to as ANSI/ISA-99 or ISA99 standards, as they were created by the International Society for Automation and publicly released as American National Standards Institute documents. In 2010, they were renumbered to be the ANSI/ISA-62443 series.
ISA99 remains the name of the Industrial Automation and Control System Security Committee of the ISA. Since 2002, the committee has been developing a multi-part series of standards and technical reports on the subject of IACS security. These work products are then submitted to the ISA approval and then publishing under ANSI. They are also submitted to IEC as input to the IEC 62443 series of international standards following the IEC standards development process.
All ISA-62443 standards and technical reports are organized into four general categories called General, Policies and Procedures, System and Component.
  1. The first category includes foundational information such as concepts, models and terminology.
  2. The second category of work products targets the Asset Owner. These address various aspects of creating and maintaining an effective IACS security program.
  3. The third category includes work products that describe system design guidance and requirements for the secure integration of control systems. Core in this is the zone and conduit design model.
  4. The fourth category includes work products that describe the specific product development and technical requirements of control system products.

    The ISA Security Compliance Institute (ISCI) Conformity Assessment Program

Established in 2007, The International Security Compliance Institute created the first conformity assessment scheme for the ANSI/ISA 62443 standards. This program certifies Commercial Off-the-shelf automation, control systems, and IOT devices, addressing securing the control systems supply chain.
ISCI development processes include maintenance policies to ensure that the ISASecure certifications remain in alignment with the IEC 62443 standards as they evolve. While the ANSI/ISA 62443 standards are designed to horizontally address technical cybersecurity requirements of a cross-section of industries, the ISASecure working groups have included subject matter experts from traditional process industries and building management system suppliers and asset owners.
The ISASecure scheme requires that all products are properly tested during the supplier development process in conformance to ANSI/ISA 62443-4-1.
exida from the United States was the first certification body accredited for the ISASecure scheme by the American National Standards Institute followed by the Control Systems Security Center – Certification Laboratory accredited by the Japan Accreditation Board and TÜV Rheinland accredited by Deutsche Akkreditierungsstelle. Five additional certification bodies are being accredited in 2019 including TÜV SÜD.
Two COm,TS product certifications are available under the ISASecure® brand: ISASecure-CSA certifying automation products to the IEC 62443-4-1 / IEC 62443-4-2 cybersecurity standards and ISASecure-SSA, certifying systems to the IEC 62443-3-3 standard.
A third certification, SDLA is available from ISCI which certifies automation systems development organizations to the IEC 62443-4-1 cybersecurity standard.
ISO 17065 and Global Accreditation
The ISASecure 62443 conformity assessment scheme is an ISO 17065 program whose labs are independently accredited by ANSI/ANAB, JAB, DAkkS, Singapore Accreditation Council, and other global ISO 17011 accreditation bodies. The certification labs must also meet ISO 17025 lab accreditation requirements to ensure consistent application of certification requirements and recognized tools.
Through Mutual Recognition Arrangements with IAF, ILAC and others, the accreditation of the ISASecure labs by the ISA 17011 accreditation bodies ensures that certificates issued by any of the ISASecure labs are globally recognized.

IEC 62443

The IEC-62443 cybersecurity standards are multi-industry standards listing cybersecurity protection methods and techniques. These documents are the result of the IEC standards creation process where ANSI/ISA-62443 proposals and other inputs are submitted to country committees where review is done and comments regarding changes are submitted. The comments are reviewed by various IEC 62443 committees where comments are discussed and changes are made as agreed upon. Many members of the IEC committees are the same persons from the ISA S99 committees. To date, the fundamental concepts from the original ANSI/ISA 62443 documents have been utilized.

IEC 62443 Certification Programs

IEC 62443 certification schemes have also been established by several global Certification Bodies. Each has defined their own scheme based upon the referenced standards and procedures which describes their test methods, surveillance audit policy, public documentation policies, and other specific aspects of their program. Cybersecurity certification programs for IEC 62443 standards are being offered globally by several recognized CBs including exida, SGS-TÜV Saar, TÜV Nord, TÜV Rheinland, TÜV Sud, UL and CertX. In the automation system market space most cybersecurity certifications have been done by exida.
Global Accreditation and Recognition
A global infrastructure has been established to ensure consistent evaluation per these standards. Impartial third party organizations called Certification Bodies are accredited to operate ISO/IEC 17065 and ISO/IEC 17025. Certification Bodies are accredited to perform the auditing, assessment, and testing work by an Accreditation Body. There is often one national AB in each country. These ABs operate per the requirements of ISO/IEC 17011, a standard that contains requirements for the competence, consistency, and impartiality of accreditation bodies when accrediting conformity assessment bodies. ABs are members of the International Accreditation Forum for work in management systems, products, services, and personnel accreditation or the International Laboratory Accreditation Cooperation for laboratory accreditation. A Multilateral Recognition Arrangement between ABs will ensure global recognition of accredited CBs...