CIP DOCUMENTS

CIP documentation

• CIP Documents
  • Management policy
  • License
  • Guide
• CIP (Civil Infrastructure Platform) Glossary
  • References

process

• CIP Development process (SM-1)
  • 1. Introduction
  • 2. Scope
  • 3. SM-1 : Development process
• CIP Requirements
  • Introduction
  • Process of defining CIP Requirements
  • CIP Functional Requirements
  • CIP Non-Functional Requirements
  • CIP Security Requirements
• Secure Design principles (SD-1)
  • Introduction
  • Scope
  • SD-1 : Secure Design principles
• Configuration Management
  • 1. Objective
  • 2. Acronyms
  • 3. Content
  • 4. CIP Kernel version
  • 5. CIP Core version
  • 6. CIP Core change control
  • 7. CIP kernel change control
  • 8. Audit Logging
• CIP CVE handling
  • 1. Objective
  • 2. Scope
  • 3. CIP Core CVE Handling
  • 4. CIP Kernel CVE Handling
  • 5. References
• Traceability from CIP requirements to design and testing
  • Introduction
  • Acronyms
  • Process behind creating requirement traceability matrices
  • Traceability matrix from CIP requirements to design
  • Traceability matrix from CIP requirements to testing process
• Management of security issues in CIP
  • Description
  • Objective
  • Scope
  • DM-1: Receiving notifications of security-related issues
  • DM-2: Reviewing security-related issues
  • DM-3: Assessing security-related issues
  • DM-4: Addressing security-related issues
  • DM-5: Disclosing security-related issues
  • DM-6: Periodic review of security defect management practice
• CIP File Integrity
  • 1. Objective
  • 2. Scope
  • 3. File Integrity of Source Code
  • 4. File Integrity of Images
  • 5. References
• Roles and Responsibilities
  • 1. Objective
  • 2. Scope
  • 4. Roles
  • 5. RACI
  • 6. Roles and Responsibilities
• CIP Release Security Checklist
  • 1. Objective
  • 2. Scope
  • 3. Checklist Usage
  • 4. Checklist
• Roles and Responsibilities
  • 1. Objective
  • 2. Scope
  • 3. Review and Approval Process
• Security Design review and best practices in CIP
  • Introduction
  • Scope
  • SD-3 : Security Design review
  • SD-4 : Secure Design best practices
• CIP Secure Development Process
  • 1. Overview
  • 2. [SM-1] Secure Development Process
  • 3. [SM-2] Identification of Responsibilities
  • 4. [SM-3] CIP Software version
  • 5 [SM-4] CIP Developer Security Expertise
  • 6 [SM-5] Process Scoping
  • 7. [SM-6] File Integrity
  • 8. [SM-7] Development Environment Security
  • 9. [SM-8] Private Key Protection
  • 10. [SM-9] Security Risk analysis for externally provided components
  • 11. [SM-10] Custom Developed Components from third party
  • 12. [SM-11] Security Issues Assessment
  • 13. [SM-12] Documented Checklist Review
  • 14. [SM-13] Define Review frequency
  • 15. [SR-1, SR-3, SR-4] Product Security Context
  • 16. [SR-2] Threat Model
  • 17. [SR-5] Security Requirements Review and Approval
  • 18. [SD-1] Secure Design Principles
  • 19. [SD-2] Defense in depth design
  • 20. [SD-3, SD-4] Security design review
  • 21. [SI-1] Security implementation review
  • 22. [SI-2] Secure Coding Standards
  • 23. [SVV-1] Security requirement testing
  • 24. [SVV-2] Threat Mitigation testing
  • 25. [SVV-3] Vulnerability testing
  • 26. [SVV-4] Penetration testing
  • 27. [SVV-5] Independence of testers
  • 28. [DM-1 to DM-5] Receiving notifications of security issues
  • 29. [DM-6] Periodic review of security defect management practice
  • 30. [SUM-1] Security Update Qualification
  • 31. [SUM-2, SUM-3] Security update documentation
  • 32. [SUM-4] Security update delivery
  • 33. [SUM-5] Timely delivery of security patches
  • 34. [SG-1, SG-2] Product defense in depth
  • 35. [SG-3] Security Hardening guidelines
  • 36. [SG-4] Secure Disposal Guidelines
  • 37. [SG-5] Secure operation guidelines
  • 38. [SG-6] Account management guidelines
  • 39. [SG-7] Documentation Review
• CIP Testing
  • 1. Introduction
  • 2. Objective
  • 3. Scope
  • 4. CIP Kernel testing
  • 5. CIP Core Testing
• Use of Cryptography
  • 1. Objective
  • 2. Use of Cryptography Requirement CR-4.3
  • 3. Recommended NIST Standards
  • 4. OpenSSL Support for FIPS-140-2
  • 5. Guidelines for CIP Users
  • 6. CIP Review frequency

security

• CIP-Security-CodingGuideLines
  • Introduction
  • CIP Project coding standards
  • CIP Upstream projects coding standards
  • Tools to assist security code review
• Static analysis tools for CIP packages
  • IEC-62443 Requirement for Static Code Analysis
  • Coverity Scan
  • Gitlab SAST
  • Key points:
  • Next Step
• CIP-Security-CodingGuideLines
  • Introduction
  • CIP Project coding standards
  • CIP Upstream projects coding standards
  • Tools to assist security code review
• CIP Security Hardening
  • Introduction
  • Assumptions
  • 1. Scope
  • 2. Terms
  • 3. Hardening Guidelines
  • 4. Technical Implementation details
  • 5. Normative references
  • 6. History
• Checklist for compliance to IEC-62443-4-1
  • Purpose
  • Scope
  • Checklists
  • Supply Chain
  • Development Process
  • Vulnerability Management
  • Documentation
• [CIP-Security] [CR2.10] Response to audit processing failure
  • 1. Objective
  • 2. Common Approach for Response to audit processing failure
  • 2.1. Alert the allocated audit log storage volume is nearly full
  • 2.2. Take the actions to response to audit log processing failure
  • 3. CIP Features for Response to Audit Processing Failure
  • 3.1. auditd
  • 3.2. The log daemon not support the space left, error detection or max log file features
  • Reference
• CIP Development Environment Security
  • 1. Objective
  • 2. Assumptions
  • 3. Scope
  • 4. Security Requirement
  • 5. CIP Development Environment
  • 6. Policy for CIP repository maintainer privilege
  • 7. Current CIP repositories and maintainers
  • 8. References
• CIP Security Partitions
  • 1. Objective
  • 2. Partitions
• iec62443-4-2-FR-1
  • Tests reference and CIP recommendation
  • Default action
• iec62443-4-2-FR-2
  • Tests reference and CIP recommendation
  • Default action
• iec62443-4-2-FR-3
  • Tests reference and CIP recommendation
  • Default action
• iec62443-4-2-FR-4
  • Tests reference and CIP recommendation
  • Additional notes
• iec62443-4-2-FR-5
  • Tests reference and CIP recommendation
• iec62443-4-2-FR-6
  • Tests reference and CIP recommendation
• iec62443-4-2-FR-7
  • Tests reference and CIP recommendation
• IEC 62443-4-2 App & HW Guidelines
  • 1. Objective
  • 2. Acronyms
  • 3. Assumptions
  • 4. Scope
  • 6. CIP Security packages
  • 7. IEC Security Layer
• OWASP Top 10 Vulnerabilities Monitoring
  • 1. Objective
  • 2. OWASP Top 10 Vulnerabilities
  • 3. CIP features for system monitoring
  • 4. References
• CIP Private Key Management
  • 1. Objective
  • 2. Assumptions
  • 3. Scope
  • 4. Security Requirement
  • 5. General Private Key Management Steps
  • 6. About CIP Private Keys
  • 7. Private Key Management Best Practices
  • 8. References
• CIP Security Requirements
  • Overview
  • IEC-62443-4-2 Requirements
  • Other Security Requirements
• CIP Threat Modeling
  • 1. Objective
  • 2. Assumptions
  • 3. Scope
  • 4. Security Requirements
  • 5. Threat Modeling Strategy
  • 6. Data Flow Diagrams(DFD)
  • 7. Potential Threats To the System and Mitigation
  • 8. Validation of Threats and Mitigation
  • 9. CIP Core Packages for mitigation
  • 10. CIP Kernel Threat Modeling
  • 11. Updating CIP Threat Model
  • 12. Further Guidelines for End Product owners
  • 13. Acronyms
  • 14. CIP Core CVE scanner
  • 15. CIP Kernel CVE scanner
  • 16. References
  • 17. Pending Work and known issues
• User Security Manual
  • 1. Objective
  • 2. Assumptions
  • 3. Scope
  • 4. Guidelines
  • 5. CIP System Monitoring
  • 6. Generating CVE report for the installed packages

testing

• Upstream testing results of CIP IEC Layer packages
  • 1. Introduction
  • 2. Scope
  • 3. Autopkgtest results in Debian CI
  • 4. Packages with no Debian CI results but has upstream tests
  • 5. Packages with no Debian CI results nor upstream tests
• CIP Penetration Testing
  • Objective
  • Penetration testing
  • CIP Penetration Testing
  • References

user

• CIP User Manual
  • 1. Overview
  • 2. Civil Infrastructure Platform
  • Reference Hardware
  • Open Source Base Layer (OSBL)
  • How to Create CIP Images
  • Default User Accounts
  • Porting CIP for New Hardware
  • CIP Testing
  • CIP Software Updates
  • CIP System Monitoring
  • References

TODO

• TODO List for further improvements of IEC documents