NERC CIP Considerations when Procuring and Implementing SCADA Systems
EMS Users Conference
September 18, 2012
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
Introductions
MarioMarchelli Director,EnergyManagement&ControlSystemsPracticeLead (832)5630897 [email protected] GilbertPerez Manager,EMCSPractice (786)8799544 [email protected]
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
Agenda
BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
BestPracticesforSCADASystemProcurement
WorkwithyourvendorinordertodriveyourdesiredESPDesign
CIP005
Correctlycommunicatecorporatestandardsfor ElectronicSecurityPerimeters(ESPs)toyourvendor. SpecifythelocationoftheProductionAssets. SpecifythelocationoftheDevelopmentAssets. SpecifythelocationoftheTraining(DTS)Assets. Specifythelocationofthereadonlyserversand theremoteaccesstothem.
Reference:R1.ElectronicSecurityPerimeter
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
BestPracticesforSCADASystemProcurement
TighterSecuritywillcontinuetobeimposedontheindustry,planforthefuture today
CIP005
Requestthefollowingsecurityenhancements: SecuredDNP3. SecuredICCP. ServiceDMZwhichwillhousetheprintersand othernonessentialdevices.
Reference:R2.ElectronicAccessControls
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
BestPracticesforSCADASystemProcurement
CIP007R1isthemosthighlyviolatedofalltheCIPStandards.Requesttoolswhich willhelpyouachievecompliance
CIP007
Testing/QAenvironment SpecifythelocationoftheQAAssets. Vendorprovidedtoolsfortesting Vendorservicesfortesting
Reference:R1.TestProcedures
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
BestPracticesforSCADASystemProcurement
Hardeningofsystemsisamust,auditorslovetodwellonportsandservices.
CIP007
Documentationofyourbaselinesoftware,portsand services. Removinganynonessentialsoftware,portsandservices priortodeliveryoftheSCADAsystem.
Reference:R2.PortsandServices
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
BestPracticesforSCADASystemProcurement
Sharetheresponsibilityofkeepingyoursystemuptodatewithyourvendor.
CIP007
Testingandvalidationofthepatchesforsecurity controlsnotjustfunctionality.
Reference:R3.SecurityPatchManagement
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
BestPracticesforSCADASystemProcurement
SharedAccountsareheadache,placetheburdenonyourvendor
CIP007
Disableguestaccounts. Implementpasswordcomplexityandagerequirements. Limittheuseofadministratoraccounts. Implementtheprincipleofleastprivilege.
Reference:R5.AccountManagement
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
BestPracticesforSCADASystemProcurement
CIP007
Implementtheusageofcentralizedlogging. ImplementtheusageofHostBasedIntrusionDetection System(HIDS)/IntrusionDetectionSystem(IDS).
Reference:R6.SecurityStatusMonitoring
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
10
BestPracticesforSCADASystemProcurement
SharedAccountsareheadache,requesttoolsformanagingtheseaccountsonyour vendor.
CIP007
Implementloggingtoolswhichallowstrackingof genericusernames. Tracktheuserutilizingthegenericusername. Trackthedateandtimewhichthegeneric usernamewasutilized. Tracktheactionswhichweretaken.
Reference:R5.AccountManagement
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
11
BestPracticesforSCADASystemProcurement
DecidewhoperformsyourvulnerabilityassessmentpriorissuingtheRFP
CIP007
Whowillconducttheassessment? Vendor Inhouse Thirdparty Decide: Timingofassessment. Responsibleparty
Reference:R8.CyberVulnerabilityAssessment
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
12
BestPracticesforSCADASystemProcurement
OtherissuestoconsiderpriorissuingtheRFP
CIP007
Virtualization: CIPandNonCIP StorageAreaNetworks: CIPandNonCIP. IPconnections.
Reference:SystemDesign(CIP005andCIP007)
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
13
BestPracticesforSCADASystemProcurement
RequesttoolsandprocedurestoaddressDisasterRecoveryonaperCCAbasis
CIP009
Consideravendorprovidedbackupsolution.
Reference:R4.BackupandRestore
IncludeinyourRFPthatthevendormustrestorethe SCADAsystemfrombackupmediapriortogoingonline.
*PleasenotethatyoumustdocumentedthefullrestorationoftheSCADAin ordertoprovidebookendingevidence.
Reference:R5.TestingBackupMedia
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
14
Agenda
BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
15
BestPracticesforSCADASystemImplementation
CIP002
HowtotestthenewSCADASystem: If controlling Testonesubstationatatime. AvoidSubstationsdeemedCriticalAssets Avoidtestingon500and300KVsites (CIPVersion4) Establishwelldocumentedtestprocedures.
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
16
BestPracticesforSCADASystemImplementation
DonotforgettoaddyournewcriticalCyberAssetstoyourCCAlist
CIP002
OnceanewSCADAsystemhastheabilitytocontrolthe BulkElectricalSystem,alloftheCriticalCyberAssets (CCAs)associatedwiththenewsystemneedtobe declaredandaddedtoyourexistingCCAlist.
Reference:R2.(V4) R3.(V3)CriticalCyberAssetIdentification CIP003
MakeyourcompanysCyberSecurityPolicyreadily availabletoallvendoremployeeswhowillworkonyour system.
Reference:R1.CyberSecurityPolicy
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
17
BestPracticesforSCADASystemImplementation
ImplementinganewESPisthebestpathtotake
CIP005
Ifpossible,establishanewESPforthenewSCADA system.Doingsowillallowyouto: Conducttestingpriortogoingonline. Establishwelldocumentedfirewallrules. Insurethatnonewvulnerabilitiesareintroduced tothecurrentproductionenvironment. Allowsfortheimplementationofnewernetwork equipmentwithminimalinterruptiontothe existingnetwork.
Reference:R2.ElectronicAccessControls
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
18
BestPracticesforSCADASystemImplementation
VulnerabilityTestinganddocumentationareamustpriortogoingonline..
CIP005
PriortothenewESPgoinglive,youmustperforma CyberVulnerabilityAssessment.
Verifythatthevendorhasprovideyoualistingoftheports andservices.Reference:R4.CyberVulnerabilityAssessment(CVA)
OncethenewESPisestablishedortheequipmenthas beenaddedtotheexistingESP,youmustupdatethe documentationtoreflectthemodificationofthe networkorcontrolswithinninetycalendardaysofthe changes. Reference:R5.2Documentation
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
19
BestPracticesforSCADASystemImplementation LetsnotforgetthoseTFEs
TechnicalFeasibilityExceptions
RequestthefollowingTechnicalFeasibility Documentation: ListofdevicesforwhichaTFEmustbetaken. Equipmentvendorlettersstatingthespecific requirementwhichcannotbemet. RoadmapforeliminatingalloftheseTFEs
Reference:CIP005andCIP007
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
20
Agenda
BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
21
BestPracticesforSystemGoLive
ProperCIPPersonnelcredentialsforContractorsandVendorsisamust.
CIP004
RequirethevendortotraintheiremployeesperyourCIPprogram. Requirethevendortoproviderecordsofthetrainingresults. Contractuallanguagetoaddressliabilitiesfornoncompliance.
Reference:R2.Training
RequirethevendortoprovidePersonnelRiskAssessmentforthe following: ProjectPersonnel
Maintenanceandsupportpersonnel. HardwareOEMsupportpersonnel.
RequirethevendortoprovideyourecordsofthePRAresults.
Reference:R3.PersonnelRiskAssessment(PRA)
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
22
BestPracticesforSystemGoLive
TestingofthemonitoringcapabilitiespriortogoingLIVEisessential.
CIP007
Verifythatloggingisbeingperformedforallofthefollowing securityevents: Failedaccessattempts. Successfulaccessattempts. Antivirusandantimalwarealerts.
*Developaplaninordertotestthatthesecurityeventslistedabovearebeing
properlyloggedoncethesystemgoeslive.
Reference:R6.SecurityStatusMonitoring
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
23
BestPracticesforSystemGoLive
Utilizestrictsecuritycontrolswhenallowingremoteaccessoncethesystem isliveisamust
CIP005
RemoteAccess(VendorandEmployees) Twofactorauthenticationforvendoraccessthruthe firewall. SecuredVPNaccess. Loggingofallvendoraccess. Layeredsecurity,possiblyajumpserverwithtwofactor authentication.
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
24
Agenda
BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
25
ProperStepsforretirementoflegacySCADAsystems
Followingthepropersequenceofeventsisessential.
CIP007
Whenredeployingmagneticmedia,overwritethe mediausingDoDStandard. Whendisposingofmedia,youmustphysicallydestroy suchmedia
*Pleasenotethatyoumustoverwriteordestroythediscardedmediawhile itstillresideswithinthePSP.
Youmustcreatedandmaintainedrecordsofdisposed and/orredeployedmedia.
Reference:R7.DisposalorRedeployment
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
26
ProperStepsforretirementoflegacySCADAsystems
CIP005
ElectronicSecurityPerimeter IfanewESPwascreated,retiretheoldESP.
RemovetheESPwheretheretiredequipmentresidedfromanydrawings.
CIP006
PhysicalSecurityPerimeter IfanewPSPwascreated,retiretheoldPSP.
RemovetheoldPSPfromthePhysicalSecurityPlan.
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
27
Agenda
BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
28
Conclusions Becomepartnerswithyourselectedvendorinsharingthe CIPSecurityresponsibilities. SelectavendorwhichhasembracedCIPSecurityandhas acultureofexceedingtheCIPRequirements. DeveloptestplansforSecurityTestingcontrolsduringthe implementationofyournewSCADAsystem. Oncethesystemgoeslive,insurethatallofthevendor personnelworkingonyoursystemhavetheproperCIP credentials. Properdisposalofyourdiscardedsystemisessential.
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
29
KeyCyberSecurityConsiderations Questions?
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.
30
