CAPITAL WORKPAPERS TO PREPARED DIRECT …

1 (U 904-G)COMPANY for authority to update its gas revenue requirement and base rates OCTOBER 2017 Application of SOUTHERN california GASeffective January 1, 2019))))Exhibit No.: (SCG-27-CWP) CAPITAL WORKPAPERS TO PREPARED DIRECT TESTIMONYOF GAVIN H. WORDENON BEHALF OF SOUTHERN california GAS COMPANYBEFORE THE PUBLIC UTILITIES COMMISSIONOF THE STATE OF CALIFORNIAA pplication No. 17-10-___2019 General Rate Case - APPINDEX OF WORKPAPERSE xhibit SCG-27-CWP - CYBER SECURITYPAGEDOCUMENTO verall Summary For Exhibit No. SCG-27-CWP 1 Category: A. PROTECT - RAMP - INCREMENTAL PKI REBULD - RAMP - INCREMENTAL FIREWALL SECURITY - RAMP - INCREMENTAL FOF - CONVERGED PERIMETER SECURITY - RAMP - INCREMENTAL FOF - HOST BASED PROTECTION - RAMP - INCREMENTAL EMAIL SPAM PROTECTION - RAMP - INCREMENTAL IS ZONE REBUILD - RAMP - INCREMENTAL SECURITY ORCHESTRATION - RAMP - INCREMENTAL CRITICAL GAS INFRASTRUCTURE PROTECTION - RAMP - INCREMENTAL CRITICAL GAS INFRASTRUCTURE PROTECTION - 2018 - RAMP - INCREMENTAL CRITICAL GAS INFRASTRUCTURE PROTECTION - 2019 - RAMP - INCREMENTAL CASB (CLOUD DATA USE) - RAMP - INCREMENTAL WEB APPLICATIONS AND DATABASE FIREWALLS - RAMP - INCREMENTAL ENTERPRISE SOURCE CODE SECURITY - RAMP - INCREMENTAL WIRED NETWORK PREVENTATIVE CONTROLS - RAMP - INCREMENTAL MULTI FACTOR AUTHENTICATION REFRESH - RAMP - INCREMENTAL MY ACCOUNT MULTI FACTOR AUTHENTICATION 113 Category: B.

2 DETECT - RAMP - INCREMENTAL THREAT RESPONSE SYSTEMS - RAMP - INCREMENTAL THREAT RECOVERY SYSTEMS - RAMP - INCREMENTAL SCG NETWORK ANOMALY DETECTION PHASE 1 - RAMP - INCREMENTAL INSIDER THREAT DETECTION / PREVENTION - RAMP - INCREMENTAL SSL DECRYPTION - RAMP - INCREMENTAL NETWORK SECURITY MONITORING - RAMP - INCREMENTAL PERIMETER TAP INFRASTRUCTURE REDESIGN - RAMP - INCREMENTAL THREAT DETECTION SYSTEMS 173 Category: C. RESPOND - RAMP - INCREMENTAL FORENSICS SYSTEM REBUILD - RAMP - INCREMENTAL INCIDENT RESPONSE SECURE COLLABORATION 192 Category: D. IDENTIFY - RAMP - INCREMENTAL ENTERPRISE THREAT INTELLIGENCE - RAMP - INCREMENTAL THREAT IDENTIFICATION SYSTEMS 209 Overall Summary For Exhibit No. SCG-27-CWP In 2016 $ (000)Adjusted-ForecastArea:Witness:CYBER SECURITYG avin H. Worden201720182019A. PROTECT10,51516,0854,807B. DETECT5,6531,47713,193C. RESPOND2021,9140D. IDENTIFY1,47404,731 Total17,84419,47622,731 Note: Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G.

3 WordenPage 1 of 216 Workpaper:Area:Witness:CYBER SECURITYG avin H. WordenA. PROTECTC ategory:VARIOUSIn 2016$ (000)2016201720182019 Summary for Category: A. PROTECTA djusted-ForecastAdjusted-RecordedLabor08 131,035398 Non-Labor08,86815,0504,409 NSE083400 Total010,51516,0854, RAMP - Incremental PKI RAMP - Incremental Firewall RAMP - Incremental FOF - Converged Perimeter Security0011670 Labor002,4001,200 Non-Labor0000 NSE002,5161, RAMP - Incremental FOF - Host Based Protection0011623 Labor002,1510 Non-Labor0000 NSE002, RAMP - Incremental Email Spam Protection001050 Labor001470 Non-Labor008340 NSE001, : Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 2 of 216 Workpaper:Area:Witness:CYBER SECURITYG avin H. WordenA. PROTECTC ategory:VARIOUSIn 2016$ (000)2016201720182019 Adjusted-RecordedAdjusted-Forecast00758K RAMP - Incremental IS Zone RAMP - Incremental Security Orchestration0010535 Labor001,600150 Non-Labor0000 NSE001, RAMP - Incremental Critical Gas Infrastructure Protection001740 Labor001,5000 Non-Labor0000 NSE001, RAMP - Incremental Critical Gas Infrastructure Protection - 2018000291 Labor0002,000 Non-Labor0000 NSE0002, RAMP - Incremental Critical Gas Infrastructure Protection - 2019232000 Labor4,000000 Non-Labor0000 NSE4, RAMP - Incremental CASB (cloud data use)00093 Labor0002,800 Non-Labor0000 NSE0002, RAMP - Incremental Web Applications and Database Firewalls000128 Labor0002,100 Non-Labor0000 NSE0002, : Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G.

4 WordenPage 3 of 216 Workpaper:Area:Witness:CYBER SECURITYG avin H. WordenA. PROTECTC ategory:VARIOUSIn 2016$ (000)2016201720182019 Adjusted-RecordedAdjusted-Forecast00758U RAMP - Incremental Enterprise Source Code Security360080 Labor0001,100 Non-Labor0000 NSE36001, RAMP - Incremental Wired Network Preventative Controls6000175 Labor0003,200 Non-Labor0000 NSE60003, RAMP - Incremental Multi Factor Authentication Refresh000140 Labor0002,500 Non-Labor0000 NSE0002, RAMP - Incremental My Account Multi Factor : Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 4 of 216 Beginning of Workpaper Group00758A - RAMP - Incremental PKI RebuldSouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 5 of 216 CYBER SECURITYG avin H. - RAMP - Incremental PKI RebuldArea:Witness:Category:Category-Sub :Workpaper Group:Budget Code:A.

5 PROTECT1. PROTECTS ummary of Results (Constant 2016 $ in 000s):Forecast MethodAdjusted RecordedAdjusted enterprise PKI currently uses the SHA-1 signature algorithm. SHA-1 algorithm has been widely used since1985 but is vulnerable to hacking and is no longer recommended for PKI. Microsoft, Google and other major providers will not recognize certificates signed using SHA-1 after January 1, 2017. The impact to our users (and potentially customers) will be a series of escalating trust notifications beginning December 2015 and eventual loss of access to Purpose:To secure our websites, intranet communications and applications we must build a new PKI infrastructure using SHA-2 in parallel to the current SHA-1 PKI and issue new certificates to all dependent Description:Enhance security of company websites, intranet communications and applications. Certificate Authorities servers will enable consolidation of systems, simplify support and reduce support complexity.

6 Upgrade to MS Server 2012 will improve high-volume certificate issuance and certificate enrollment across Active Directory Domain Services forest Justification:Note: Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 6 of 216 CYBER SECURITYG avin H. - RAMP - Incremental PKI RebuldArea:Witness:Category:Category-Sub :Workpaper Group:Budget Code:A. PROTECT1. PROTECTF orecast Methodology:Labor - Zero-BasedProject is currently in-flight. Based on actual timeline of the project to - Zero-BasedProject is currently in-flight. Based on actual timeline of the project to - Zero-BasedN/ASouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 7 of 216 Beginning of Workpaper Sub Details forWorkpaper Group 00758 ASouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G.

7 WordenPage 8 of 216 Workpaper Group:Witness:Budget Code:Area:Workpaper Detail:In-Service Date:Description:CYBER SECURITYG avin H. - RAMP - Incremental PKI Rebuld01/31 - RAMP - Incremental PKI Rebuld1. PROTECTA. PROTECTC ategory:Category-Sub:Self developed softwareForecast In 2016 $(000) : Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 9 of 216 CYBER SECURITYG avin H. - RAMP - Incremental PKI RebuldArea:Witness:Category:Category-Sub :Workpaper Group:Budget Code:A. PROTECT1. PROTECTW orkpaper - RAMP - Incremental PKI RebuldProgram Name: Public Key InfrastructureRAMP Chapter: SCG-3 RAMP Item # 1 Program Description: PKI digital key encryption system to protect in transit and to authenticate devices, services, and applicationsDeploy SHA2 compliance public key infrastructure for digital certificatesRisk: All Cyber Security RisksRisk/Mitigation:Mitigation: ProtectForecast CPUC Cost Estimates ($000)Low 0 2017 0 2018 2019 0 0 0 0 HighForecast Method: Zero-BasedFunding Source: CPUC-GRCWork Type: Non-MandatedWork Type Citation: See WorkpaperHistorical Embedded Cost Estimates ($000)Embedded Costs: 0 Explanation: Southern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G.

8 WordenPage 10 of 216 Beginning of Workpaper Group00758B - RAMP - Incremental Firewall SecuritySouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 11 of 216 CYBER SECURITYG avin H. - RAMP - Incremental Firewall SecurityArea:Witness:Category:Category-S ub:Workpaper Group:Budget Code:A. PROTECT1. PROTECTS ummary of Results (Constant 2016 $ in 000s):Forecast MethodAdjusted RecordedAdjusted Cybersecurity Protect function refers to developing and implementing the appropriate safeguards so that the company can provide safe and reliable delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of control Categories within this Function include: Access Control; Awareness and Training; Data Security; Information Protection Processes and Procedures; Maintenance; and Protective activities are focused on avoiding or limiting potential cybersecurity events.

9 Activities in this functional area include: managing asset access, cybersecurity awareness and training, protective technologies, and system maintenance. Ongoing cybersecurity awareness and training is important for engaging all employees so that they understand their roles and responsibilities regarding cybersecurity. Other activities in this area include vulnerability management, system implementation, security consulting and support, and operating support for protection systems. This support can include: two-factor authentication, the public key infrastructure, malware prevention, web content management, and supporting network protections, such as firewalls and intrusion detection and Purpose:Evaluate and deploy a firewall management system (hardware and software) to control outbound firewall egress policies, Prevent unauthorized access to firewall, centrally managed configurations , mitigate vulnerabilities using industry standard best practices, Secure the Enterprise network perimeter and internal Description:Reduced risk of business system outages, data loss, and malware proliferation.

10 Increased efficiency in firewall request approval and risk assessment and enhancing current Justification:Note: Totals may include rounding california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 12 of 216 CYBER SECURITYG avin H. - RAMP - Incremental Firewall SecurityArea:Witness:Category:Category-S ub:Workpaper Group:Budget Code:A. PROTECT1. PROTECTF orecast Methodology:Labor - Zero-BasedProject is currently in-flight. Based on actual timeline of the project to - Zero-BasedProject is currently in-flight. Based on actual timeline of the project to - Zero-BasedN/ASouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G. WordenPage 13 of 216 Beginning of Workpaper Sub Details forWorkpaper Group 00758 BSouthern california Gas Company2019 GRC - APPC apital WorkpapersSCG/CYBER SECURITY/Exh No:SCG-27-CWP/Witness: G.