----- # What's Inside Welcome Introduction 2 Accomplishments 3 Industrial Control Systems Cyber Emergency Response Team (JCS-CERT) 4 National Cybersecurity and Communications Integration Center (NCCIC) _S_ Industrial Control Systems Consequence Effects and Analysis (ICS-CEA) _S_ JCS-CERT key accomplishments for include: 6 Cybersecurity Assessments 7 Cybersecurity Training and Vendor Assessments 8 Roadmaps and Standards Development 9 Industrial Control Systems Joint Working Group 10 Path Forward 11 Assistance from CSSP 12 ----- ----- ----- ### Accomplishments In FY 2011, CSSP continued to move forward and grow - Cyber Security Evaluation Tool (CSET) Version 4.0 was as a program. By providing increased support to the released in August 2011 with vendors, owners, and operators of critical infrastructure, the over I , 1 S0 CSETs being distributed in FY 2 0 I I . program continued to work toward a safer and more secure - The CSET tool is now downloadable from the tomorrow by accomplishing several key tasks: CSSP website. - ICS-CERT fly-away teams were deployed to seven - In FY 2 0 1 I , over 7 S CSET onsite assessments organizations over the fiscal year (FY). were completed. - Approximately 600 participants attended the Fall 2010 - Over 40 training courses have been conducted domesti­ and Spring 2011 ICSJWG Conferences with over 200 cally and internationally for public and private partners scheduled to attend the Fall 2011 ICSJWG. with over 1 ,300 attendees. - The ICSJWG Cross-Sector Roadmap Document - CSSP provided more than a I 00 situational awareness was finalized. briefings and presentations at stakeholder meetings and conferences. ----- ## Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) The ICS-CERT provides cyber incident response, analysis, and information sharing to address the cybersecurity threats and vulnerabilities unique to industrial control systems (ICS). For example, this capability provides onsite and remote incident response services for a variety of cyber threats ranging from general malicious code infections to advanced persistent threat (APT) intrusions. The response team also produces alerts and advisories to warn of vulnerabilities and to recommend mitigations and best practices for securing ICS and the workplace. ICS-CERT does this in partnership with private sector organizations and Information Sharing and Analysis Centers in order to coor­ dinate and leverage cybersecurity efforts across all 18 critical infrastructure sectors. A technical analysis and malware lab enables the ICS-CERT to provide analysis of vulnerabilities and malware threats to control system environments.The team is able to verify vulnerabilities for researchers and vendors, perform impact analysis, and provide patch validation and testing prior to deployment to the asset-owner community. Another service the program offers asset owners is no-cost onsite assistance and offsite analysis to support discovery, forensics analysis, and recovery efforts associated with a cybersecurity event (incident) focused on control environ­ ments within critical infrastructure. Onsite assistance consists of a fly-away team being made available to deploy onsite to review affected entities’ network architectures, collect appli­ cable forensic data, assist with immediate mitigation efforts when appropriate, and work with the stakeholder to identify future defense strategies. Offsite services include providing analytical findings, including determination of origin and breadth and depth of compromise from data captured during the onsite deployment to the customer. ----- ----- ## y p FY 2011 include: ICS-CERT deployed onsite incident response fly-away teams to seven critical infrastructure organizations to assist with analysis and recovery efforts of a cyber incident. As part of the information sharing mission, ICS-CERT published over 100 security alerts and advisories to the ICS community warning of various threats and vulnerabilities impacting control systems. Vulnerability analysis and coordination rose a staggering 600% in FY 2011, with researchers utilizing ICS-CERT as a conduit to vendors in the ICS space. Reported cyber incidents were also up over 200% from FY 2010 with more asset owners and operators contacting ICS-CERT for support during a cyber event. ----- ## y y CSSP offers the CSET, a DHS product that assists organiza­ tions in protecting their key national cyber assets.This tool provides users with a systematic and repeatable approach for assessing the security posture of their cyber systems and networks against recognized industry and government standards, guidelines, and practices. It includes both highlevel and detailed questions related to all industrial control and IT systems, regardless of sector. CSET generates both interactive (on-screen) and printed reports that provide a summary of security level gaps or areas that do not meet the recommendations of the selected standards.These reports can be used to help an organization plan and prioritize mitigation strategies. Organizations who wish to conduct a self assessment can download CSET from the CSSP website. Over 1,150 copies of the tool were distributed in FY 2011. In addition to the CSET, CSSP also offers onsite training and guidance to asset owners in using CSET during onsite assessments.These assessments are conducted at no cost to the asset owners.This “over-the-shoulder” training and guidance is provided to assist asset owners in using the tool to better understand their control systems cybersecurity posture. In FY 2011, CSSP conducted over 75 assessments across the sectors. For information on the CSET or to download the tool, visit the website at: _[http://www.us-cert.gov/control_systems/satool.html](http://www.us-cert.gov/control_systems/satool.html)_ ----- ## Cybersecurity Training CSSP offers several training programs including Introductory, Intermediate, and Advanced Control Systems Security classes. These classes are offered at no cost to ICS professionals and managers across all sectors of CIKR. In FY 2011, over 40 training sessions were provided consisting of over 20 Introductory, 8 Intermediate, and 10 Advanced ICS classes. In April of 2011, CSSP released a new Management Level Training Course that provides managers with a high-level overview of control systems security. ## Vendor Assessments The Vendor Assessments effort focuses on vulnerabilities in specific vendor equipment/software where CSSP analyzes the potential impacts of emerging exploits in various ICS environ­ ments. CSSP completed assessments of several systems in FY 2011 and provided findings and recommendations to system vendors for consideration and action.The ICS-CERT leveraged these discoveries to issue alerts and guiding principles to the ICS stakeholder community to identify, mitigate, and reduce the security risks. ----- ----- ----- ## Path Forward The evolution of industrial control systems, as well as threats to those systems, requires CSSP and ICS-CERT to continue evolving to meet the needs of owners, vendors, and operators. It is our goal to assist in providing the stakeholder community with the tools and services required to securely operate those systems that the nation’s critical infrastructures rely apon daily. Goals in the upcoming year include strengthening the incident response capability and providing continued onsite incident response teams to assist CIKR owners and operators with investigation and remediation of damages following a cyber incident on industrial control systems. Supporting this, improvements will also be made to malware analysis capabilities. In addition to providing onsite assessments, CSSP will continue to focus on support for standards development organizations and release upgrades to the CSET tool.This tool is for use across the control systems community, including public and private sector partners, to increase situational awareness for cybersecurity status and improve the health of CIKR stakeholders’ control systems. CSSP plans to revise the Strategy to Secure Control Systems. The program will promote and maintain the CSSP website as a central repository for control systems cybersecurity information, vulnerability reporting, and cross-sector information sharing for public and private sector partners. CSSP also will continue industrial systems security support to the NCCIC and is dedicated to maintaining our position as a world class leader in control systems security. ----- ----- ## Assistance from CSSP is only a phone call away The CSSP and the ICS-CERT encourage you to report suspi­ cious cyber activity and vulnerabilities affecting critical infrastructure control systems. To report control systems cyber incidents and vulnerabilities contact the ICS-CERT: _[ics-cert@dhs.gov](mailto:ics-cert@dhs.gov)_ 877-776-7585 _www.us-cert.gov/control_systems/ics-cert_ For more information on the Control Systems Secuirty Program visit: _[http://www.us-cert.gov/control_systems/](http://www.us-cert.gov/control_systems)_ ----- -----