Presentation is loading. Please wait.

Presentation is loading. Please wait.

Ben Christensen Senior CIP Enforcement Analyst CIP-010-1 May 15, 2014 SLC, UT.

Similar presentations


Presentation on theme: "Ben Christensen Senior CIP Enforcement Analyst CIP-010-1 May 15, 2014 SLC, UT."— Presentation transcript:

1 Ben Christensen Senior CIP Enforcement Analyst CIP May 15, 2014 SLC, UT

2 2 Who invented the electric motor? A.William Sturgeon B.Thomas Davenport C.Michael Faraday Pop Quiz!!

3 3 Who invented the electric motor? Pop Quiz!! Michael Faraday

4 4 Help entities understand and prepare for the upcoming CIP o Differences and relations to current requirements o Possible pitfalls to look for while implementing CIP o WECC’s audit approach o Best practices Agenda

5 5 CIP 010-1

6 6 Prevent and detect unauthorized changes to BES Cyber Systems. Specify vulnerability assessment requirements in support of protecting BES Cyber Systems from compromise. Document and maintain device baselines and periodically verify they are accurate. Purpose of CIP 010-1

7 7 Applicable Systems

8 8 CIP R6: Change Control and Configuration Management CIP R1: Test procedures CIP R4 and CIP R8: Cyber Vulnerability Assessment(s) CIP R9 and CIP R5: Documentation review and maintenance CIP Similarities with V.3

9 9 Who invented the modern automobile? A.Henry Ford B.Karl Benz C.Ransom Olds POP Quiz!!

10 10 Who invented the modern automobile? Pop Quiz!! Karl Benz

11 11 CIP R1

12 CIP R1.1 CIP R6 Applicable to Protected Cyber Assets (PCA) and specifies information required in device baselines CIP R1.1

13 13 CIP R6 was previously not applicable to Non-CCAs that resided within an ESP. Thus entity did not create baselines or update procedures to ensure baselines were maintained for these devices. CIP R1.1 - Possible Pitfall #1

14 14 Entity does not ensure documented baselines for all devices contain operating system, commercial/open source software, custom software, logical ports, and security patches applied. CIP R1.1 - Possible Pitfall #2

15 15 Ensure entity has documented baselines for all devices (or group of devices) in applicable BES Cyber Systems o Verify Baselines include operating system/firmware, commercial software, custom software, logical network accessible ports, and security patches applied CIP R1.1 Approach

16 16 Use combination of automated tools and manual walkthroughs/verifications to ensure lists and baselines are accurate Minimize applications on devices to only what is necessary Include step to periodically verify accuracy of applicable device lists and baselines CIP R1.1 Best Practice

17 17 Discussions and careful planning should be conducted on the method for maintaining device baselines o Review CIP 007 R3 presentation from Oct 2013 CIPUG for common methods to maintain informationCIP 007 R3 o What method is best for your organization:  Commercial Software  Custom Software  Spreadsheet CIP R1.1 Best Practice

18 18 Consider Moving away from spreadsheets and other manual methods, look into more advanced methods for retaining information. o See Joe B presentation from October 2011 CIPUG on advantages of moving from spreadsheet to relational databaseOctober 2011 CIPUG  Includes some labeling schema tips as well for when implementing a database for device management CIP R1.1 Best Practice

19

20 CIP R1.2 CIP R6 Applicable to PCA and requires changes to be authorized

21 21 Entity cannot demonstrate all changes made to baseline(s) were authorized CIP R1.2 - Possible Pitfall

22 22 Ensure all changes made to baselines have been authorized. CIP R1.2 - Approach

23 23 Update procedural documentation to include at minimum: o Who can authorize changes, and to what o When authorization needs to occur o How the authorization will be documented, stored, and tracked Segregation of duties o The implementer should be different from the authorizer CIP R1.2 – Best Practice

24 CIP R1.3 CIP R5 CIP R9 Baselines must be updated within 30 days of change

25 25 Entity cannot demonstrate baselines are updated within 30 days of changes made CIP R1.3 – Possible Pitfall

26 26 Ensure entity is updating baselines within 30 days of when change was made. o Start date will be determined by reviewing work orders, tracking sheet, or other documentation that details when the change actually occurred. CIP R1.3 - Approach

27 27 Procedures for updating baselines should address: o Who will communicate the changes made to the baselines o How changes will be communicated o Who the changes are communicated to o When the changes will be made CIP R1.3 – Best Practices

28 28 Maintain a version history when updating documentation. o Version number o Who performed the update to the documentation o Who made the change to the device o Who authorized the change o What was changed CIP R1.3 – Best Practices

29 29 Who invented the printing press? POP Quiz!!

30 30 Who invented the printing press? POP Quiz!! Johannes Gutenberg

31 CIP R1.4 CIP R1 Impact due to a change must consider security controls in CIP 005 and CIP 007

32 32 Entity verifies same controls for all changes made to any baseline. o Thus entity does not account for different environments, devices, or changes when determining what controls could be impacted  May be ok if all controls are verified every time CIP R1.4 – Possible Pitfall

33 33 Verify all changes made to device baselines are documented Ensure controls that may be impacted were identified and documented prior to the change o Why were some controls not included? Review evidence supporting identified controls were not adversely impacted CIP R1.4 - Approach

34 34 Procedures should include: o Documenting date all steps taken to support cyber security controls were identified prior to change taking place o How are potential impacted cyber security controls identified?  Who does this? o How will adverse impacts will be detected  Who does this and when? CIP R1.4 – Best Practices

35 35 Include a peer review step for reviewing what controls may be impacted and when verifying controls weren’t adversely impacted Coordinate testing processes between departments, business units, etc. to ensure consistency CIP R1.4 – Best Practices

36 CIP R1.5 CIP R1

37 37 Only applicable to High Impact systems Specific to security controls that must be tested o Security Controls in CIP 005 and CIP 007 New test environment requirements o Document if test environment was used o Document differences between test and production environment  Measures taken to account for these differences CIP R1.5 cont..

38 38 Entity does not document differences between production and testing environment Entity does not take measures to account for differences in the production and testing environment. CIP R1.5 Possible Pitfall

39 39 For each change that deviates from existing baseline: o List of cyber security controls tested  Test results  List of differences between the production and test environments  Descriptions of how any differences were accounted for  When testing occurred. CIP R1.5 - Approach

40 40 Use checklist or other task managing tool to reduce likelihood of not testing all controls Document specific test procedures for all cyber assets or group of assets? o Describe the test procedures Describe the test environment and how It reflects the production environment CIP R1.5 – Best Practices

41 CIP R2

42 42 When was the atomic bomb first invented? POP Quiz!!

43 43 When was the atomic bomb first invented? POP Quiz!! July 1945

44 CIP R2.1 Must actively search for unauthorized changes to baseline –Automated preferred but can be manual Must document and investigate unauthorized changes CIP R2.1 CIP R6

45 45 Not consistently monitoring for changes every 35 days o Entity begins process at end of month  Thus entity continuously misses 35 day deadline as it does not have enough time to complete review o Documentation is inconsistent and SMEs can’t keep track if specific devices have automated or manual process for tracking configuration changes CIP R2.1 – Possible Pitfall

46 46 logs from a system that is monitoring configurations Work orders, tracking sheets, raw data evidence of manual investigations Records investigating detected unauthorized changes CIP R2.1 - Approach

47 CIP R2 – Best Practice Consider using a commercial or open source File Integrity Monitoring software for continuous monitoring Start monitoring process with enough advance to complete review o Consider using an automated task managing tool

48 48 What if you find an unauthorized change? o What change(s) have been made without authorization o Who made the change(s)? o When were the change(s) made? o How can a similar issue be prevented? CIP R2 – Best Practice

49 49 QUIZ Time CIP R1 and R2

50 50 Entities are required to test all changes in a test environment that reflects the production environment. CIP R1 and R2 False

51 51 Entity baselines are required to include: 1.Operating system/Firmware 2.Commercial/open source software 3.Custom software 4.Logical ports 5.All security patches applied CIP R1 and R2 TRUE But what about devices where some of these don’t apply?

52 CIP R3

53 CIP R3.1 CIP R8 CIP R4 No more annual requirement, and CVA can be active or paper

54 54 Entity conducts initial Vulnerability Assessment in January then not again until April the next year (16 months) Remember the CIP 003 pitfalls CIP R3.1 – Possible Pitfall

55 55 Verify when last CVA was conducted Verify current CVA was conducted within 15 calendar months of previous CVA Evidence could include: o A document listing the date of the assessment and the output of any tools used to perform the assessment. CIP R3.1 – Approach

56 56 Vulnerability assessment should include at minimum: o Network and access point discovery o Port and service Identification o Review of default accounts, passwords, and network management community strings o Wireless access point review CIP R3.2 – Best Practices

57 57 Consider keeping Vulnerability Assessments for devices or groups of devices on the same cycle Implement a task managing tool to help track needed tasks and deadlines Review NIST SP800 ‐ 115 for guidance on conducting a vulnerability assessmentNIST SP800 ‐ 115 CIP R3.1 – Best Practice

58 58 What was the first home video game console? A.Atari 2600 B.Magnavox Odyssey C.VES D.RCA Studio II POP Quiz!!

59 59 What was the first home video game console? Developed in 1972 POP Quiz!! Magnavox Odyssey

60 CIP R3.2 CIP R4 CIP R8 CIP R3.2

61 61 Only applicable to High Impact BES systems Required to be performed at least every 36 months CVA must be active and can be performed in production or test environment o Test environment must reflect production o Document differences between test and production environment o Take and document measures to address the differences between test and production environment CIP R3.2 cont..

62 62 Entity does not conduct active Vulnerability Assessments at least every 36 months Entity does manual review on devices that are technically feasible to have active review CIP R3.2 – Possible Pitfall

63 63 Verify active Vulnerability Assessments conducted at least every 36 months Description of test environment and how differences were account for (if test environment used for assessment) Raw data outputs of assessment for applicable devices CIP R3.2 – Approach

64 64 Vulnerability assessment should include at minimum: o Network and access point discovery o Port and service Identification o Review of default accounts, passwords, and network management community strings o Wireless access point review CIP R3.2 – Best Practices

65 65 Where possible conduct the Vulnerability Assessment on the production environment Implement a task managing tool to help track needed tasks and deadlines Document SMEs responsible for conducting the Vulnerability Assessment and for what cyber assets CIP R3.2 – Best Practice

66 CIP R3.3 CIP R1 New devices need an active Vulnerability Assessment prior to deployment

67 67 Entity adds new asset to production without first conducting active Vulnerability Assessment CIP R3.3 – Possible Pitfall

68 68 Ensure all newly added assets have had active vulnerability scan conducted prior to device being added to production Verify all necessary controls were verified as part of assessment Verify raw data output of vulnerability assessment can be provided CIP R3.3 – Approach

69 69 Document specific procedures that include: o Responsible personnel for conducting the test o When testing needs to occur o Where testing should occur o How the testing should be conducted for each cyber asset or group of cyber assets Use a checklist and/or peer reviews to reduce chance of human error CIP R3.3 – Best Practice

70

71 CIP R3.4 CIP R4 CIP R8 CIP R3.4 Document planned completion date for each remediation action

72 72 Entity is not actively maintaining an action plan to remediate vulnerabilities found in the CVA. o Entity is not documenting or updating planned date of completion for remediation actions CIP R3.4 – Possible Pitfall

73 73 Document results or the review or assessment List of action items to remediate issues Status of the action items o Documented proposed dates of completion for the action plan CIP R3.4 – Approach

74 74 Tie actions outlined in the plan to specific SMEs Use an automated task managing tool to track all required tasks and ensure they are being completed Have steps to ensure action plan is updated and reflects actual proposed completion date of actions CIP R3.4 – Best Practice

75 75 QUIZ Time CIP R3

76 76 Entities are required to test all changes in a test environment that reflects the production environment. CIP R3 False Active CVA not required for Medium impact facilities or for like devices with similar baseline configurations

77 77 Entity’s will be required to meet expected completion date of action plans to remediate issues found during Vulnerability Assessment CIP R3 However, entity can update the expected date if more time is needed. If the update is reasonable, justified, and done prior to the due date TRUE

78 78 CIP NERC version 4 to version 5 mapping Glossary of Terms Used in NERC Reliability StandardsGlossary of Terms Used in NERC Reliability Standards NIST SP800 ‐ 115 – Security testingNIST SP800 ‐ 115 Additional Resources

79 79 Know what is required for each BES cyber system(s) Create and Maintain device baselines Track and manage deadlines Review referenced NIST documents for added guidance Summary

80 Ben Christensen Senior CIP Enforcement Analyst CIP May 15, 2014 SLC, UT

81 81 Help entities understand and prepare for the upcoming CIP standard o Differences and relations to current requirements o Possible pitfalls to look for while implementing CIP o Implementation tips Agenda

82 82 Identify, Assess, and Correct (IAC) o FERC has conditionally approved CIP on the basis that NERC’s Standard Drafting Team make clarifications or remove the IAC language BES Cyber System o Pay special attention to the applicable BES cyber systems in each requirement CIP General Pitfalls

83 83 Prevent unauthorized access to BES Cyber System Information Purpose

84 84 Information about the BES Cyber System that could be used to gain unauthorized access or pose a security threat to the BES Cyber System – NERC glossary BES Cyber System Information

85 85 Includes: o Security procedures/information  BES Cyber Systems  PACS  EACMS o List of devices with IP addresses o Network diagrams BES Cyber System Information

86 86 Does NOT include: o Individual pieces of information that by themselves do not pose a threat or could not be used to allow unauthorized access  Devices names  Individual IP addresses  ESP names  Policy statements BES Cyber System Information

87 87 CIP R4: Information Protection CIP R7: Disposal or Redeployment CIP Similarities with V.3

88 CIP similarities to V.3 CIP R4 CIP R7 CIP R1.1 CIP R1.2 CIP R2.2 CIP R2.1

89 CIP R1 - Intro

90 CIP R1 CIP R4 CIP R1.1 CIP R1.2

91 CIP R1.1 Language No longer a requirement to classify BES cyber system information CIP R1.1 CIP R4

92 CIP R1.2 CIP R4 CIP R1.1 Procedures for protecting information must now address storage, transit, and use

93 93 Documented BES Cyber System Information method How you identify BES Cyber System Information (labels, classification)? Repository or electronic and physical locations to house BES Cyber System Information CIP R1.1 - Evidence

94 94 Procedure for protecting BES Cyber System o Storage o Transit o Use Records information was handled per your procedures o Change control ticket CIP R1.2 - Evidence

95 95 Information Protection plan does not address storage, transit, and use of BES Cyber System Information CIP R1 Possible Pitfall

96 96 Consider different variables when determining how to properly protect information during transit, storage, and use o Digital information stored locally o Physical information stored in a PSP or not o Information being held by vendors or accessed by vendors CIP R1 - Implementation tips

97 97 QUIZ CIP R1

98 98 Which of the following would be considered BES Cyber System Information? A.Device host name B.ESP diagram C.PSP name D.Inventory list with network addresses CIP R1

99 99 Which of the following would be considered BES Cyber System Information? A.Device host name B.ESP diagram C.PSP name D.Inventory list with network addresses CIP R1

100 10 0 CIP R2

101 CIP R2.1 CIP R7 Focus is now on preventing unauthorized retrieval instead of data destruction

102 CIP R2.2 Focus is now on preventing unauthorized retrieval instead of data destruction CIP R2.2 CIP R7

103 10 3 Records of sanitization actions o Clearing o Purging o Destroying Records tracking o Encryption o Held in PSP CIP R2.1 – Evidence

104 10 4 Records showing media was destroyed prior to disposal Other records of actions taken to prevent unauthorized retrieval of BES Cyber System Information CIP R2.2 – Evidence

105 10 5 Entity secures cyber assets no longer used that contain BES cyber system information in a location that is not restricted to only those individuals with access to the BES cyber system information CIP R2 – Possible Pitfall

106 10 6 Review NIST SP for guidance on developing media sanitation processesNIST SP Where possible erase, destroy, degauss, or encrypt data as soon as possible after a device is no longer needed to reduce mishandling of devices or BES cyber system information CIP R2 – Implementation tips

107 10 7 What if I have a 3 rd party host my ? Do I need to protect this information under CIP-011-1? CIP – Scenario 1

108 10 8 I have hard copies of my network diagrams located in a secure facility. Do I need to include these in my CIP program? CIP – Scenario 2

109 10 9 Prevent unauthorized access to BES Cyber System information Purpose

110 11 0 What if I have a 3 rd party host my ? Do I need to protect this information under CIP-011-1? It Depends CIP – Scenario 1

111 111 What type of information is stored on the exchange server? o BES Cyber System Information How do your procedures account for s containing this information? CIP – Scenario 1

112 11 2 I have hard copies of my network diagrams located in a secure facility. Do I need to include these in my CIP program? YES CIP – Scenario 2

113 11 3 What type of information is on the diagrams? o BES Cyber System Information o List of all IP addresses o List of all network access points What do your procedures state about securing hard copies? What facilities might contain this information? CIP – Scenario 2

114 11 4 CIP NERC version 4 to version 5 mapping Glossary of Terms Used in NERC Reliability StandardsGlossary of Terms Used in NERC Reliability Standards NIST SP – Disposal guidanceNIST SP Additional Resources

115 11 5 Purpose Differences Pitfalls Implementation tips Summary

116 Ben Christensen Questions?


Download ppt "Ben Christensen Senior CIP Enforcement Analyst CIP-010-1 May 15, 2014 SLC, UT."

Similar presentations


Ads by Google