WIXLIB

Energy Company Boards, Cybersecurity,and Governance – Collected Materials 1http://www.EnergyCollection.us/457.pdf - this collectionhttp://www.EnergyCollection.us/456.pdf - associated paper on Energy Boards andGovernance for CybersecurityThe purpose of this collection is to serve as a reference document to various materials thatmay be of interest to those responsible for or researching the subject of Cybersecurity andGovernance within the context of a Board of Directors.The organization of the document is simply alphabetical. Articles and reports are generallyreferenced with the first 3 words in the title of the article or report for ease of finding thereference here. Terms and names of groups are simply inserted alphabetically in thecontinuous list. And so on.English “language articles” that were used in titles of various documents are ignored forpurposes of alphabetization in this document.Most of the material has been replicated with a link to the www.EnergyCollection.us site(maintained by the producer of this collection) to ensure availability. There is a renewedeffort to quote the original site as well.This Collection is meant to be a companion documents to a Paper: “Energy CompanyBoards, Cybersecurity, and Governance” which discusses these subjects from a Boardresponsibility perspective. The paper can be downloadedat http://www.EnergyCollection.us/456.pdfWith a bit less than 100 pages of references, Board members may face the question –Where do I start? These references are suggested starting points: NIST Framework and Roadmap for Smart Grid Interoperability Standards,Release 3.0 – NIST Special Publication 1108R3 - Framework 3.0 updates the plan fortransforming the nation's aging electric power system into an interoperable smart grid—a network that will integrate information and communication technologies with thepower-delivery infrastructure, enabling two-way flows of energy and communications.Beginner’s Guide – Framework-Roadmap-1108R3-B.pdfIf you have a good reference that should be included here –email PaulFeldman@Gmail.com 2and it will be included.1Last updated July 9, 20141 Page

Table of Contents with Links5 Tips to Cybersecure the Power Grid13 Ways Through a Firewall2012 Cost of Cyber Crime Study: United States2012 Utility Cyber Security Survey2013 Annual Cost of Failed Trust Report: Threats & Attacks2013 Data Breach Investigations Report [of 2012]2014 Data Breach Investigations Report440 Million New Hackable Smart Grid PointsAberdeen GroupAdvanced Cyber Security for UtilitiesAdvanced Persistent Threat- termAGA Report No. 12 - Cryptographic Protection of SCADA CommunicationsAlienVault Open Threat ExchangeAmerican Gas Association AGA Report No. 12 - Cryptographic Protection of SCADA CommunicationsAmerican National Standards Institute - ANSI ANSI Homeland Defense and Security Standardization Collaborative - HDSSC Identity Theft Prevention and Identity Management Standards - ANSIAmerican Public Power AssociationAMI Penetration Test Plan - DOEAnalysis of Selected Electric Sector High Risk Failure Scenarios - DOEAnonymous - TermANSI - American National Standards InstituteANSI Homeland Defense and Security Standardization Collaborative - HDSSCANSSI – Agency for National Security Systems and Information Classification Method and Key Measures - Cybersecurity for IndustrialControl Systems Detailed Measures - Cybersecurity for Industrial Control SystemsArgonne National Lab - DOEAssault On California Power Station Raises Alarm on Potential for TerrorismAttack Trees for Selected Electric Sector High Risk Failure Scenarios - EPRIAttacks Dragonfly: Western Energy Companies Under Sabotage Threat Utilities Report Cyber Incidents to Energy DepartmentAttacks on Trust: The Cybercriminal's New WeaponAutomation FederationAxelosBES-Control Centers - Secure ICCP and IEC 60870-104 CommunicationsBest Practices Against Insider Threats in All NationsBest Practices for Cyber Security in the Electric Power SectorThe Best Practices Guide for Application Security – HP part 3Bipartisan Policy Center Bipartisan Policy Center - Electric Grid Cybersecurity Initiative Cybersecurity and the North American Electric Grid - New Policy Approachesto Address an Evolving ThreatBlogs Digital Bond - www.digitalbond.com/blog2LinkedIn - www.linkedin.com/in/paulfeldman/2 Page

Tom Alrich’s Blog - http://tomalrichblog.blogspot.com/Boardroom Cyber Watch Survey - 2014 ReportBound to Fail: Why Cyber Security Risk Cannot Simply Be "Managed" AwayBrookings Center Bound to Fail: Why Cyber Security Risk Cannot Simply Be "Managed" Away Brookings Center for 21st Century Security and IntelligenceBulk Power System Cyber SecurityThe Business Case for Application Security – HP part 2C-Cubed Program – from DHSCalifornia Cybersecurity and the Evolving Role of State Regulation: How it Impacts theCalifornia Public Utilities CommissionCan the Power Grid Be Hacked? Why Experts DisagreeCarnegie Mellon University Cylab at Carnegie Mellon Governance of Enterprise Security: Cylab 2012 ReportCatalog of Control Systems Security: Recommendations for Standards DevelopersCategorizing Cyber Systems - An Approach Based on BES Reliability FunctionsCERTCenter for the Study of the Presidency & Congress – CSPC Securing The U.S. Electrical GridCertificate Management for Embedded Industrial SystemsChertoff Group Addressing the Dynamic Threats to the Electric Power Grid ThroughResilienceCIP5CIP Version 5 Supports Unidirectional Security GatewaysCIP Version 5: What Does it Mean for Utilities?CIP5 FERC OrderCIPAC - Critical Infrastructure Partnership Advisory CouncilCisco 2014 Annual Security ReportClassification Method and Key Measures – Cybersecurity for Industrial ControlSystemsCloud Security Alliance – CSACOBIT - Control Objectives for Information and Related TechnologyCongress Congressional Testimony – 2014-04-10 Congressional Testimony – 2012-07-17Congressional Research Service Cybersecurity: Authoritative Reports and Resources, by Topic The Smart Grid and Cybersecurity Regulatory Policy and Issues The Stuxnet Computer Worm: Harbinger of an Emerging Warfare Capability Terrorist Use of the Internet: Information Operations in CyberspaceConnecticut Cybersecurity and Connecticut's Public UtilitiesControl Center Security at the Bulk Electric System LevelCouncil on CybersecurityCouncil on Foreign Relations on CybersecurityCost of Failed Trust - 2013 Annual ReportCRISP - Cybersecurity Risk Information Sharing ProgramCritical Infrastructure in WikipediaCritical Infrastructure Partnership Advisory Council - CIPAC3 Page

Critical Infrastructure Protection – Cybersecurity Guidance Is Available, but More CanBe Done to Promote Its Use – GAO-12-92Critical Infrastructure Protection – Multiple Efforts to Secure Control Systems AreUnderway, but Challenges Remain GAO-07-1036Critical Infrastructure Protection in WikipediaCritical Infrastructure Protection - Cybersecurity Guidance Is Available, but MoreCan Be Done to Promote Its Use - GAO ReportCritical Infrastructure Cybersecurity (by Lockheed Martin)Critical Infrastructure Sectors DHSCritical Infrastructure Protection Standards (CIP)Critical Infrastructure: Security Preparedness and MaturityCritical Security Controls for Effective Cyber DefenseCSA - Cloud Security AllianceCSPC - Center for the Study of the Presidency & Congress – see aboveCyber Attack Task Force (NERC)Cyber and Grid Security at FERCCyber insurance becomes the new cost of doing businessCyber-Physical Systems Security for Smart GridCyber-Risk OversightCyber Risk and the Board of Directors - Closing the GapCyber Security for DER SystemsCyber Security and Privacy Program - 2013 Annual ReviewCyber security procurement language for control systemsCyber Solutions Handbook - Making Sense of Standards and FrameworksCyber Security for Smart Grid, Cryptography, and PrivacyCyber Security Standards in WikipediaCyber Security Standards (NERC) in WikipediaCyber threat Intelligence Integration Center - CTIICCyber threats Proving Their Power over Power Plant Operational TechnologyCyber War - Hardening SCADACyberattack Insurance a Challenge for BusinessCybersecurity and the Audit Committee - DeloitteCybersecurity and the Board: Avoiding Personal Liability - Part I of III: Policiesand ProceduresCybersecurity and the Board: Avoiding Personal Liability - Part II of III: Policiesand ProceduresCybersecurity and the Board: Avoiding Personal Liability - Part III of III: Policiesand ProceduresCybersecurity: Authoritative Reports and Resources, by Topic – by CRSCybersecurity Best Practices for Small and Medium Pennsylvania UtilitiesCybersecurity: Boardroom Implications - NACDCybersecurity and Connecticut's Public UtilitiesCybersecurity Capability Maturity Model - Electricity SubsectorCybersecurity Challenges in Securing the Electricity Grid – GAO-12-507T Testimony Before the Committee on Energy and Natural Resources, U.S. SenateCybersecurity.Continued in the BoardroomCybersecurity and the Evolving Role of State Regulation: How it Impacts theCalifornia Public Utilities CommissionCybersecurity and the North American Electric Grid - New Policy Approaches toAddress an Evolving ThreatCybersecurity and the PUCCybersecurity Procurement Language for Energy Delivery SystemsCybersecurity and Remote Access – SPARK Article4 Page

Cybersecurity Risk Information Sharing Program - CRISPCybersecurity Risks and the Board of Directors – Harvard ArticleCybersecurity for State Regulators - With Sample Questions for Regulators to AskCybersecurity for Utilities: The Rest of the StoryCybersecurity Webpage on DHSCybersecurity Website Page on DOECyberspace Policy ReviewCylab at Carnegie MellonDark Reading – Cyber NewsData Breach Notification Laws by StateThe Debate Over Cyber ThreatsDefense Critical Infrastructure – Actions needed to improve the identification andmanagement of electrical power risks and vulnerabilities to DOD Critical AssetDellHow Traditional Firewalls Fail Today's Networks - and Why Next-GenerationFirewalls Will Prevail - DellDeloitte Cybersecurity and the Audit Committee - Deloitte Cybersecurity.Continued in the Boardroom Deloitte - Audit Committee Brief - 2014-05-01 SEC’s Focus on Cybersecurity – Key insights for investment advisorsDepartment of Defense – DoDoCERT Insider Threat Center of CERToSoftware Engineering Institute Insider Fraud in Financial Services Illicit Cyber Activity Involving Fraud inthe U.S. Financial Services Sector – Software Engineering Institute Insider Threat Study: Illicit Cyber Activity Involving Fraud in the U.S.Financial Services Sector – Software Engineering InstituteDepartment of Energy - DOEo2012 DOE Smart Grid Cybersecurity Information ExchangeoAMI Penetration Test PlanoAnalysis of Selected Electric Sector High Risk Failure ScenariosoArgonne National Lab - DOEoCyber security procurement language for control systemsoEnergy Sector Cybersecurity Framework Implementation GuidanceoICS-CERT Year in Review - Industrial Control Systems Cyber EmergencyResponse Team 2013 - DOEoElectricity Subsector - Risk Management ProcessoGridwise Architecture CounciloHigh Impact, Low-Frequency Event Risk to the North American Bulk PowerSystem – NERC and DOEoIdaho National LaboImplementing Effective Enterprise Security Governance - DOEoIndustrial Control Systems Joint Working Group (ICSJWG)oInfrastructure Security and Energy RestorationoNational Electric Sector Cybersecurity Organization - NESCO Electric Sector Failure Scenarios and Impact Analyses - NESCOR ERPI NESCOR Webpage NESCOR Guide to Penetration Testing for Electric Utilities - Version 3oOffice of Electric Delivery & Energy Reliability – NESCOoPacific Northwest National Laboratory – PNNLoSandia National Lab5 Page