Industrial Internet Security Framework v 1.0 | Page 3

Security Framework

Contents

CONTENTS
Part I: Introduction
1 Overview ........................................................................................................................ 11
1.1
1.2
1.3
1.4
1.5
1.6

Purpose............................................................................................................................. 11
Scope ................................................................................................................................ 11
Audience ........................................................................................................................... 11
Terms and Definitions........................................................................................................ 12
Conventions ...................................................................................................................... 12
Relationship with Other IIC documents .............................................................................. 12

2 Motivation ...................................................................................................................... 13
3 Key System Characteristics Enabling Trustworthiness ...................................................... 15
3.1
3.2
3.3
3.4
3.5
3.6
3.7

Assurance of Key System Characteristics ............................................................................ 15
Security ............................................................................................................................. 16
Safety................................................................................................................................ 17
Reliability .......................................................................................................................... 18
Resilience .......................................................................................................................... 18
Privacy .............................................................................................................................. 19
Trustworthy Systems ......................................................................................................... 20

4 Distinguishing Aspects of Securing the IIoT ...................................................................... 21
4.1
4.2
4.3
4.4
4.5
4.6

Convergence of Information Technology and Operational Technology ................................ 21
Security Evolution in IT and OT........................................................................................... 22
Regula tory Requirements and Standards in IT and OT......................................................... 23
Brownfield Deployments in OT .......................................................................................... 23
Cloud Systems in the IIoT ................................................................................................... 24
Implications for Securing the IIoT ....................................................................................... 24

Part II: The Business Viewpoint
5 Managing Risk ................................................................................................................ 27
5.1
5.2

Security Programs ............................................................................................................. 28
Risk Assessments............................................................................................................... 29
5.2.1
OWASP IoT Attack Vectors................................................................................................ 31
5.2.2
STRIDE Threat Model ........................................................................................................ 31
5.3 Communicating Risk .......................................................................................................... 32
5.4 Ongoing Business Attention ............................................................................................... 33
5.5 Metrics and Key Performance Indicators ............................................................................ 34
5.6 Management Considerations ............................................................................................. 34

6 Permeation of Trust in the IIoT System Lifecycle .............................................................. 36
6.1
6.2
6.3
6.4
6.5

System Lifecycle ................................................................................................................ 36
Roles in the Permeation of Trust ........................................................................................ 38
Trust at Component Builder Roles ...................................................................................... 40
Trust at System Builder Roles ............................................................................................. 42
Trust at the Operational User Roles.................................................................................... 43

IIC:PUB:G4:V1.0:PB:20160926

- iii -