1 Ports and Services An Audit Approach ReliabilityFirst CIP Webinar Thursday, September 30, 2010 Lew Folkerth, Senior Engineer - Compliance

CIP-005: ESP Access Points CIP R2.2: “At all access points to the Electronic Security Perimeter(s), the Responsible Entity shall enable only ports and services required for operations and for monitoring Cyber Assets within the Electronic Security Perimeter, and shall document, individually or by specified grouping, the configuration of those ports and services.” CIP R4.2 requires that the Cyber Vulnerability Assessment (CVA) include: “A review to verify that only ports and services required for operations at these access points are enabled” CIP R5 requires annual review and update within 90 days of change 2

CIP-007: Systems Within ESP CIP R2.1: “The Responsible Entity shall enable only those ports and services required for normal and emergency operations.” CIP R8.2 requires that the CVA include: “A review to verify that only ports and services required for operation of the Cyber Assets within the Electronic Security Perimeter are enabled” CIP R9 requires annual review and update within 30 days of change 3

Audit Approach What follows is an example of how the compliance review might proceed. Since each entity is different, this example is offered only as general guidance on what to present to the audit team. 4

Baseline The baseline configuration is one or more lists of ports and services that have been determined to be needed for normal and/or emergency operations. The baseline includes: Port or range of ports The associated service The operational purpose of the port and/or service For firewalls, the source and destination address ranges Once baseline configurations have been established, changes and exceptions should be managed by a change management process The configuration of authorized ports and services should be able to be produced for any given time period 5

Operational Purpose Operational Purpose: The reason a port and/or service is needed for normal or emergency operations Demonstrates that a port and/or service is “required for operations” per the language of the standard Examples: Insufficient: Port 22/tcp is Secure Shell (SSH). Sufficient: Port 22/tcp is associated with the Secure Shell (SSH) service, which is required for remote administration of the SCADA system and other applications. Sufficient: Port 22/tcp, the SSH service, is needed for unknown reasons. The service was disabled in a test environment, after which the SCADA system operated in an anomalous manner. See testing document ABC

Audit of Baseline For the baseline configurations, the audit team will seek to determine: Do the baselines collectively cover all applicable cyber assets? For each port or port range listed, is there an associated service identified? What is the operational purpose of the port and/or service? For firewalls, are the source and destination address ranges sufficiently restricted? Are variations from the baseline properly documented? 7

Audit of Firewalls For a sample of firewalls, the audit team will ask the entity to demonstrate that the actual configuration of the firewall matches the expected configuration – that is, the baseline plus any documented variances The audit team will ask the entity to demonstrate that this determination has been made at least annually (per CIP-005 R4 and CIP-005 R5) 8

Audit of Systems Within ESP For a sample of systems within an ESP, the audit team will ask the entity to demonstrate that the actual ports open and services running match the expected configuration – that is, the baseline plus any documented variances The entity is free to use any desired tool, but the audit team will accept the output of “netstat –an” if no other tool is available. The audit team will ask the entity to demonstrate that this determination has been made at least annually (per CIP-007 R8 and CIP-007 R9) 9

CVA vs. Document Maintenance One question that usually arises from this discussion is: “What is the difference between the Cyber Vulnerability Assessment (CVA) (in CIP-005 R4 and CIP-007 R8) and Documentation Review and Maintenance (in CIP-005 R5 and CIP-007 R9)? The Documentation Review and Maintenance provisions require the documentation to be kept up with changes to the actual systems. The documentation should be compared against the actual systems to ensure the documentation accurately reflects the configuration of the systems. The CVA requires a review of the system configurations, not just the documentation. All ports and services should be reviewed to ensure that each is still necessary for normal or emergency operations. 10

Questions Questions should be ed to Karen Yoder Subject: “CIP Questions will be considered in the order they are received Clarifying questions are welcome and we will do our best to answer during the question period Challenges to a position should be addressed to the presenter and will be taken offline