CIP-005-5 Lessons Learned CIPUG January 29, 2015 Anaheim, Ca

CIP-005-5 Lessons Learned CIPUG

January 29, 2015 Anaheim, Ca

Morgan King

CISSP-ISSAP, CISA

Senior Compliance Auditor, Cyber Security

W E S T E R N E L E C T R I C I T Y C O O R D I N A T I N G C O U N C I L

Lessons Learned

• External Routable Connectivity • Interactive Remote Access • Mixed Trust Authentication Environments • Intrusion Detection Systems at the EAP • Virtualization

– Network – Server – SAN

External Routable Connectivity Lesson Learned Purpose

• In the application of the CIP v5 standards to Medium Impact BES Cyber Systems, where there are serial-to-IP converters used in the communication, can the standards be approached that serial devices could either have, or not have, External Routable Connectivity?

If External Routable Connectivity

• CIP-004-7, All requirements • CIP-005-5, R1.2, R2.1, R2.2, R2.3 • CIP-006-6, All requirements except R1.1 • CIP-007-7, R1.1, R4.2, R5.1, R5.3, R5.6

Classification of BES Cyber Systems

• External Routable Connectivity • Electronic Security Perimeter • Electronic Access Control or Monitoring

Systems • High Impact BES Cyber Systems with External

Routable Connectivity • Medium Impact BES Cyber Systems with

External Routable Connectivity

ERC Defined

• “The ability to access a BES Cyber System from

a Cyber Asset that is outside of its associated Electronic Security Perimeter via a bi-directional routable protocol connection.”

‘Access’

• Medium Impact BES Cyber Systems with External Routable Connectivity – Only applies to medium impact BES Cyber Systems with External Routable Connectivity. This also excludes Cyber Assets in the BES Cyber Systems that cannot be directly accessed through External Routable Connectivity.

‘Its Associated’

• Can a serially connected BES Cyber Asset with

no Electronic Security Perimeter, based on connectivity, still be considered logically associated with an Electronic Security Perimeter?

‘Via’/Uses a routable protocol 9

Serial Connections

• Pure serial connections, i.e. ones that do not transit via IP at any point, are out of scope for this discussion.

No External Routable Connectivity? 11

No External Routable Connectivity? 12

External Routable Connectivity

• Scenario #1 – Cyber Assets that are connected by a simple serial-to-

IP conversion that in essence extends non-routable communication through the use of serial-to-IP conversion.

• Scenario #2 – a “break” in the ERC communication that would

exclude serially connected devices from having ERC, but require the serial-to-IP converter to be designated as an Electronic Access Control or Monitoring System (EACMS).

MI BES Cyber System with ERC 14

MI BES Cyber System with ERC 15

MI BES Cyber System without ERC 16

Cyber Asset at a Control Center

• CIP-007, Requirement R1, Part 1.2 – Protect the physical ports on the BES Cyber Systems

• CIP-007, Requirement R4, Part 4.3 – Retain access logs for 90 days

• CIP-007, Requirement R5, Part 5.3 – Authenticate interactive user access

• CIP-007, Requirement R5, Part 5.7 – Limit unsuccessful authentication attempts or

generate alerts after a threshold of unsuccessful authentication attempts

ERC Considerations

• Is the BES Cyber System accessible to or from Cyber Assets outside of the BES Cyber System Network?

• Do data protocols, whether or not they are themselves routable, transit via routable protocols at any point between the end device (Protection Relay, RTU, etc…) and the remote Cyber Asset?

• Would the misuse or disruption of those routable protocols or BES Cyber Assets have an adverse impact on the BES within 15 minutes?

Lesson Learned Interactive Remote Access

• User-initiated Interactive Remote Access by a person using routable protocol, such as through a VPN connection.

• Access originating from outside any of the Responsible Entity’s Electronic Security Perimeters (ESPs).

• Access not originating from an Intermediate System or Electronic Access Points (EAP).

• Access through a remote access client or other remote access technology using a routable protocol.

IRA Requires

• Use an Intermediate System such that the Cyber Asset initiating Interactive Remote Access does not directly access an applicable Cyber Asset (Part 2.1);

• Use encryption that terminates at an Intermediate System for all Interactive Remote Access (Part 2.2); and

• Use multi-factor (i.e., at least two) authentication to manage all IRA sessions (Part 2.3).

Intermediate System

• Ensure IRA originates only from the Intermediate System and not from the Cyber Asset accessing the Intermediate System.

• Intermediate System can be used to access Cyber Assets of different impact ratings

• Place the Intermediate System in a defined, protected network with both ingress and egress filtering rules in place.

• Encryption between the Cyber Asset initiating communication and the Intermediate System.

Interactive Remote Access

Is System-to-System process communication IRA?

Management Interfaces 23

Management Interfaces 24

Out of Band Management 25

Out of Band Management 26

Documenting IRA

• Create a diagram which identifies each of the network zones entering the ESP

• Identify where user access takes place • Determine which applications need to be on the

Intermediate System to allow the user to interactively access the BES Cyber Assets and Protected Cyber Assets within the ESP.

• Document the data flows throughout the network environment to illustrate all access through the ESP.

IRA 28

Mixed Trust Authentication Environments

• Implementation where a BES Cyber System shares an authentication mechanism with a corporate system.

• Not prohibited by the CIP version 5 Reliability Standards, such environments could increase an entity’s compliance obligation.

Mixed Trust Authentication Environments

Non-Mixed Trust Authentication Environments

EACM and Mixed Trust Authentication Environments

Lesson Learned Intrusion Detection Systems at the EAP

Figure 1 Figure 2

Lesson Learned Intrusion Detection Systems at the EAP • To meet this requirement, Order No. 706 stated that it is in

the public interest to require a responsible entity to implement “two or more distinct security measures when constructing an electronic security perimeter.”51 The Commission believes that a responsible entity cannot meet the goal of defense in depth as required by the Commission with a single electronic device, because a single electronic device is easier to bypass than multiple devices. Therefore, we clarify that two or more separate and distinct electronic devices are necessary to implement the Commission’s defense in depth requirements.

ORDER DENYING REHEARING AND GRANTING CLARIFICATION ORDER NO. 706-A(Issued May 16, 2008)

Lesson Learned Network Virtualization

Layer-2 switch

Figure 1

Figure 2

Vlan 5

Vlan 3

Vlan 5

Lesson Learned Server Virtualization

Virtualized Cyber Assets • The guest machine in itself is a PED and meets all criteria from the

definition from the PED LL. • The guest machine is also then considered a Cyber Asset and meets

all criteria for Cyber Asset glossary term. • If the Cyber Asset meets the definition of a BCA, then the guest

machine becomes a BCA. • Once a guest machine becomes a BCA, the Hypervisor then

becomes a BCA due to the command, control, and ultimate functionality over the guest machine, in this case a (BCA).

• All other guest machines on the Hypervisor then also become PCAs due to the Hypervisor having complete command, control, and ultimate functionality over the guest machine.

• The Hypervisor, and all of its guest machines are then considered a BCS.

Lesson Learned Server Virtualization

Lesson Learned Storage Virtualization

BCA BCA

• Controls deployed in the SAN infrastructure governing access to data storage services utilized by BES Cyber Assets

• Controls applied to the SAN Storage Array and Storage Controller governing access to data storage services utilized by BES Cyber Assets

• Controls applied to the Fibre Channel transport path governing access to fabric services

• Identification of SAN resources and mapping of SAN Cyber Asset components to an ESP boundary

Contact Info Morgan King, CISSP-ISSAP, CISA

Senior Compliance Auditor - Cyber Security Western Electricity Coordinating Council (WECC) mking@wecc.biz Office 801.819.7675 Mobile: 801.608.6652

CIP-005-5 Lessons Learned CIPUG January 29, 2015 Anaheim, Ca

Documents

Transcript of CIP-005-5 Lessons Learned CIPUG January 29, 2015 Anaheim, Ca

CIP-005-5 — Cyber Security – Electronic Security … Standards/CIP-005-5.pdf · CIP-005-5 — Cyber Security – Electronic Security Perimeter(s) 4.1.8 Transmission Owner 4.2.

Unapproved - Anaheim

CIP-005-5 Electronic Security Perimeter(s

January 15–18 Anaheim, California Anaheim … 15–18 • Anaheim, California Anaheim Convention Center ... Featuring Andy Timmons and his band, Paul Gilbert and his band, ...

CIP$101:(CIP$005$5(AuditApproach,(ESP(Diagrams,( …...2014/09/24 · CIP$005$5(R1(Requirements(Overview(• R1.(Each(Responsible(En@ty(shall(implementone(or(more(documented(processes(thatcollec@vely(include(each(of(the(applicable(requirement

Cruising Anaheim:

ANAHEIM CITY SCHOOL DISTRICT 1001 South East …images.pcmac.org/Uploads/Anaheim/Anaheim/Departments... · ANAHEIM CITY SCHOOL DISTRICT 1001 South East Street Anaheim, California

Anaheim Ruling

NESCOR/NESCO Comment Submission for the Second Version of the ... - EPRI cip 005 comments 05-2012.pdf · NESCOR/NESCO Comment Submission for the Second Version of the NERC CIP Version

005 R2:UnderstandingtheSecurity Requirements+for+Secure+Remote+Access… · 2017-04-11 · CIP"005!R2:UnderstandingtheSecurity Requirements+for+Secure+Remote+Access+to+ theBulkEnergySystem!!

CIP-005 R2: Electronic Access Controls R2: Electronic Access Controls Knowing who is in your network July 25, 2013 Steven Keller Senior Compliance Specialist –CIP . skeller.re@spp.org

CIP-005-5 — Cyber Security – Electronic Security Perimeter(s) Standards/CIP-005-5.pdfCIP-005-5 — Cyber Security – Electronic Security Perimeter(s) 4.1.8 Transmission Owner

CITY/UNINCORPORATED AREA CODES FOR PRECINCTS · 0002276 - anaheim 8002276 0002276 anaheim 11 0002307 - anaheim 80023958002307 0002307 anaheim 6 0002315 - anaheim 8002315 0002315 anaheim

Anaheim 2020

SCCE Presentation - NERC CIP Compliance Program Metrics II ......Protocol CIP-005 Electronic Access Point policy requires business units to minimize the number of communication channels

CIP-003-7 & CIP-003-8 Effective Dates and... · CIP-003-8 R4 Delegate CIP Senior Manager authority 7/1/2016 9. CIP Reliability Standard Effective Date CIP-005-6 July 1, 2020 CIP-008-6

Lessons Learned from Commission-Led CIP Reliability Audits · 2020. 5. 12. · CIP-004-3, CIP-005-3, CIP-006-3, CIP-007-3, CIP-008-3, and CIP-009-3. 13. The NERC Glossary defines

Comment Report - NERC 201602 Modifications to CIP... · Comment Report Project Name: 2016-02 Modifications to CIP Standards | Virtualization Updates for CIP-004, CIP-005, CIP-006,

10 cip rome cip

CIP -005 -5 Cyber Security Electronic Security Perimeter(s) · 2017. 4. 12. · CIP -005 -5 Cyber Security Electronic Security Perimeter(s) 4.2.3.5 Responsible Entities that identify