Industrial IT Security · TOP 5 Bedrohungen* Ausfall Know-how-Abfluss Spionage Manipulation an...

www.steria-mummert.de

Bewertung der Informationssicherheit nach CMMI und

O-ISM3

Industrial IT Security

www.steria-mummert.de Inhalt

Industrial Control Systems

Status Quo der Informationssicherheit

Industrie 4.0 und CPS

SmartFactory

Integrationstopologie

zusätzliche Bedrohungen

Sicherheitsstrategien heute und für Industrie 4.0

security by design mit CMMI

ISMS und O-ISM3

11.09.2014 3

© Steria Mummert Consulting GmbH

www.steria-mummert.de Industrial Control Systems

11.09.2014 4

herkömmliche Struktur


Quelle: BSI

www.steria-mummert.de Status Quo der Informationssicherheit

11.09.2014 5


ICS

menschliches

Fehlverhalten und

Sabotage

Einschleusen von

Schadcode auf Maschinen

und Anlagen

technisches Fehlverhalten

und höhere Gewalt

online-Angriffe über Office-

/Enterprise-Netze

unberechtigter Zugriff auf

Ressourcen

*VDMA-Studie

TOP 5 Bedrohungen*

Ausfall

Know-how-Abfluss

Spionage

Manipulation an

Maschinen und Anlagen

Schutzziele

hohe Verfügbarkeits- und

Performanceanforderun-

gen

lange Lebensdauer

fehlende Berücksichtigung

der IT Security

Genehmigung und Betrieb

Hintergrund

www.steria-mummert.de Industrie 4.0

11.09.2014

© Steria Mummert Consulting GmbH 6

Internet

Cloud,

Smart Data

Cyber Physical

Systems

Smart Factory

Smart Grid


Quelle: Abschlussbericht AK 4.0

Smart Factory

11.09.2014



Cyber Physical System

11.09.2014


ständige, zumeist drahtlose Vernetzung über das

Internet of Things,

Verschmelzung der physikalischen mit der virtuellen

Welt,

erfassen von Informationen zu realen Objekten über

Sensoren,

Verarbeitung der Informationen

Kommunikation mit anderen CPS (Machine to

Machine – M2M)

Reaktion über Aktoren

übergreifend auch Cyber Physical Production System

(CPPS)

www.steria-mummert.de Integrationstopologie

11.09.2014



11.09.2014

zusätzliche Bedrohungen

10

im Industrie 4.0 - Zeitalter


CPS

Software

Mechanik

Elektrik, Elektronik

Automatisierung, HMI

Safety, Security

Maintenance

Ortsangabe, Identität

Zustand

SW-Version

Schnittstellen

Informationen

Kommunikation

Störung

Manipulation

Information

Manipulation

Wirtschaftsspionage

Monitoring der Produktion

Störung

Manipulation

Bedrohungen für

www.steria-mummert.de Sicherheitsstrategien heute

Quelle: Homeland Security

Defense in Depth mit SIEM und IDS

11.09.2014 © Steria Mummert Consulting GmbH 11

www.steria-mummert.de Sicherheitsstrategien


ICS

Systemintegrität

Netzwerkintegrität

Anlagensicherheit (Security/Safety)

weitere

Security

by

Design

Defense in Depth

www.steria-mummert.de Sicherheitsstrategien heute

11/09/2014 13

VDI/VDE 2182

Security by Design


www.steria-mummert.de security by design mit CMMI

Application Guide for CMMI-DEV Version 1.3

11.09.2014 Musterfolien.pptm



Ergänzungen für CMMI-DEV



SG1: Establish an Organizational

Capability to Develop Secure

Products

SG1: Prepare and Manage Project

Activities for Security

SG2: Manage Product Security Risks

SG1: Develop Customer Security

Requirements and Secure

Architecture Design

SG2: Implement Secure Design

SG1: Perform Security Verification

SG2: Perform Security Validation

Specific Goals


Ergänzungen für CMMI-DEV



SG1: Establish an Organizational

Capability to Develop Secure

Products

SG1: Prepare and Manage Project

Activities for Security

SG2: Manage Product Security Risks

SG1: Develop Customer Security

Requirements and Secure

Architecture Design

SG2: Implement Secure Design

SG1: Perform Security Verification

SG2: Perform Security Validation

Specific Goals

www.steria-mummert.de Open Information Security Management

Maturity Model (O-ISM3)



“A distinctive feature of ISM3 is that it is based on a fully process-based approach to

information security management and maturity, on the basis that every control needs a process

for managing it. It breaks information security management down into a comprehensive but manageable

number of processes, with specifically relevant security control(s) being identified within each process

as an essential subset of that process.

… Security controls don't necessarily have a defined output, but processes do ”

Kompatibilität mit ISO/IEC 27000

“ISM3 is compatible in many ways with the ISO/IEC 27000:2009 standard, but it uses a different approach.

ISO/IEC 27001:2005 focuses on security management as a single process for what controls are required and

in place to build an ISMS, and ISO/IEC 27002:2005 outlines a large number of potential controls and control

mechanisms from which to choose to achieve selected control objectives using the guidance provided

by ISO/IEC 27001.

In contrast, the ISM3 approach is to define and measure what people do in the activities that support security;

in this respect we may consider ISO/IEC 27001 to serve an auditor's requirements, while ISM3 meets

a manager's needs.”

“What you can’t measure, you can’t manage, and what you can’t manage, you can’t improve.” William Thomson (1824-1907)

www.steria-mummert.de O-ISM3

Prozesse



Process Areas Initial Set

Generic Processes (GP) GP-1: Knowledge Management

GP-3: ISM Design and Evolution

Strategic Specific Processes (SSP) SSP-1: Report to Stakeholders

SSP-2: Coordination

SSP-6: Allocate Ressources for Information Security

Tactical-Specific Processes (TSP) TSP-1: Report to Strategic Management

TSP-2: Manage Allocated Ressources

TSP-3: Define Security Targets

TSP-4: Service-Level Mangement

Operational-Specific Processes (OSP)

OSP-1: Report to Tactical Management

OSP-5: IT Managed Domain Patching

OSP-11: Access Control

OSP-16: Segmentation and Filtering Management

OSP-17: Malware Protection Management

OSP-10: Backup Management

OSP-21: Information Quality and Compliance

Probing


Beispiel




Capability




Maturity - Beispiel



www.steria-mummert.de O-ISM3 und ISO/IEC 27001

Process versus Control - Auszug



www.steria-mummert.de O-ISM3 und ISO/IEC 27001

Mapping - Auszug



www.steria-mummert.de Fazit



signifikante Unterschiede Industrial IT zu Office IT,

IT-Sicherheitsstrategien im ICS-Umfeld,

Nutzen von CMMI-basierten Guidlines bzw. Standards zur Bewertung der

Informationssicherheit

allgemeine Verwendbarkeit O-ISM3

Messbarkeit der Informationssicherheit



11.09.2014 25


“The nice thing about standards is that there are so many

to choose from.”

Andrew S. Tannenbaum

www.steria-mummert.de Quellen



Security by Design with CMMI for Development, Version 1.3

http://cmmiinstitute.com/resource/security-by-design-with-cmmi-for-

development-version-1-3/

Open Informations Security Management Maturity Model (O-ISM3)

https://www2.opengroup.org/ogsys/catalog/C102

Optimizing ISO/IEC 27001:2013 using O-ISM3

https://www2.opengroup.org/ogsys/jsp/publications/PublicationDetails.jsp?p

ublicationid=12634

http://cmmiinstitute.com/resource/security-by-design-with-cmmi-for-development-version-1-3/






















https://www2.opengroup.org/ogsys/jsp/publications/PublicationDetails.jsp?publicationid=12634



www.steria-mummert.de Kontakt


Marco Kupilas

Senior Consultant

Information Security Solutions

Steria Mummert Consulting GmbH

Friedrichstraße 148

10117 Berlin

Tel: +49 (0) 30 206188-7742

Fax: +49 (0) 30 206188-3742

Mobil: +49 (0) 151 4062 7742

[email protected]


mailto:[email protected]



http://www.steria-mummert.de/



Date post:	04-Aug-2020
Category:	Documents
Upload:	others
View:	3 times
Download:	0 times

Industrial IT Security · TOP 5 Bedrohungen* Ausfall Know-how-Abfluss Spionage Manipulation an...

Documents