Howdy folks.  I am sitting here in Colombia after an entire day of presentations, round tables and general discussion about cyber security and standards, and I have to say I see a common theme, regardless of the industry.  Point in fact—I was asked more than once what amounts to “why should we bother?” with respect to implementing and following standards.  Now I have a multitude of ideas as to how this should be answered but to properly deal with them would take more space here than I think you want to read, so how about this:  I am going to list all my objections to that statement, and then each of those subjects will be my next few blog entries so that we can do the subjects proper justice.

The issues that are spawned for me by that statement (and the subsequent discussion points it created) are as follows:

• “Why bother?” totally misses the point of a security program—a program that I think is a victim of its own name.  Really, security is about the safe, reliable and expected operation of your facility.
• Documentation (or paper pushing for compliance) is a waste of time.  Sure—if you see it as simply a paper exercise.  But I ask, why is there paper?  Is this a cover-your-behind practice, or is the intent of expecting documentation in fact a mechanism to force participation and verification?
• Who is responsible for specific security controls/standards on new technology: the vendor supplying technology or the user purchasing it?  This one is a hot topic.  There is the obvious divide of chronology—the vendor has to walk away from the project at some point and leave it with the purchaser—but what about prior to implementation? 
• Evolution of purchasing.  I suggested to an operator today that if I were to very securely configure a system and build that security as well as hand over the security controls to an operator, that my price would invariably be higher than my competition who does not include robust security controls and training.  So who budges first?  Very few organizations (the leaders do) have a basic security standard that is required of all proposed applications.  So when you are comparing the technology of an application against its peers, is there a line item in the procurement decision tree for robustness and completeness of security controls?  Or is the secure one simply more expensive?

Anyways, I will try to get these all fired out in the near term so that we can all chew on them and have some fun debating too.  In the meantime, our friends over at Control Global put out a great discussion with similar themes as it applies to NERC CIP.  You should check it out.  Until then, happy trails my friends.

Howdy folks.  Sitting here thinking about the amount of effort that has gone into NERC CIP 002-009 thus far and an interesting thought struck me.  Bear with me for a moment as I set the scene.  As it stands today, we have quite the storied path from inception to where we currently sit.  In essence, the first version of 002-009 was not well received, and since its inception subsequent iterations have been drafted, offered, edited and ultimately put into place.  As of this writing we are on the precipice of the 4th version (6th if you include Urgent Action 1200 and 1300) of the standard, with a significant number of hours and effort poured into the body of work to date.

Here is the interesting part.  The SDT, which has labored over many details, comments, complaints, politics, etc etc, have put significant personal and professional investment into this.  And as of their last meeting they, in essence, realized they have not quite got it right yet and actually encouraged the voting public to REJECT their work!  Not so interesting you say?  Fair enough.  How about adding the notion that many people believe that regardless of what the vote is, FERC is either going to adopt it anyway or impose their own version of 002 to hike up participation.  The result is the fact that, to the pessimist, all the effort, blood, sweat and tears shed thus far by the SDT is for naught.  The SDT sets out a standard, tells everyone not to vote for it and in the end it will not matter anyway?

The situation seems absurd and if this is how the CIP 002-009 plays out then it is also tragic.  Just my two cents.

Until next time, happy trails my friends.