SARA is a project of the Industrial Control System Information Sharing and Analysis Center (ICS-ISAC) to capture and codify the industry standards and best practices associated with critical infrastructure cybersecurity situational awareness. See http://ics-isac.org for more information on SARA.

1. Situational Awareness Reference
Architecture (SARA)
Overview

2. • Reference Architecture for Shared Visibility
– Facility, industry, region, nation, world
• Technical and Process
– Open Standards of Practice
• Compatible and Extensible
– Combine Industry Efforts
– Solution Provider Framework
SARA Overview

3. • Identity
– “Who are we?”
• Inventory
– “What do we have?”
• Activity
– “What is it doing?”
• Sharing
– “How do we communicate with others?”
SARA Components

4. • Standard of Practice for Determining Identity
– What capabilities do we have?
– How do we make decisions?
– What is our structure?
• Existing Open Architecture
– http://all.net/Arch/index.html
Identity

5. • Create and Maintain Inventory
– Control System Components
– Process Equipment
– System Topology
– Device Configurations
Inventory

6. • Behavior Baseline
– Device Relationships
– Approved Patterns
– Change Control
• Anomaly Detection
– Device Configurations
Activity

7. • Inbound
– Receiving and Utilizing External Knowledge
• Outbound
– Deriving
– Anonymizing
• Communication
– Schemas and Transports (STIX, TAXII, IODef, CIF…)
Sharing

8. Emergent Properties of Knowledge Sharing
ICS-ISAC
Integrators
CERTs
ICS-ISAC
Knowledge
Source
MSSPs
Trade
Organizations
Knowledge
Centers
Asset Owner

9. ICS-ISAC
Schemas and
Transports
STIX/TAXII
IODEF
CIF
ROW
Privacy
Legalities
Motivations
PLC
Switch
HMI
SCADA Server
Network
Monitoring
Server
Internet
Process Equipment
Technical Architecture
Inventory
Activity
Change
ICS LAB
Firewall/VPN

10. • CY 2013
– Functional Draft SARA Document
– Limited Pilot
• CY 2014
– 1.0 SARA Document Published
– Scaled Pilot
SARA Timeline

11. For more information:
ics-isac.org
sara@ics-isac.org
+1 408-656-8732