You are on page 1of 30

NERC CIP Considerations when Procuring and Implementing SCADA Systems

EMS Users Conference

September 18, 2012

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

Introductions

MarioMarchelli Director,EnergyManagement&ControlSystemsPracticeLead (832)5630897 mario.marchelli@thestructuregroup.com GilbertPerez Manager,EMCSPractice (786)8799544 Gilbert.perez@thestructuregroup.com

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

Agenda

BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

BestPracticesforSCADASystemProcurement
WorkwithyourvendorinordertodriveyourdesiredESPDesign
CIP005

Correctlycommunicatecorporatestandardsfor ElectronicSecurityPerimeters(ESPs)toyourvendor. SpecifythelocationoftheProductionAssets. SpecifythelocationoftheDevelopmentAssets. SpecifythelocationoftheTraining(DTS)Assets. Specifythelocationofthereadonlyserversand theremoteaccesstothem.


Reference:R1.ElectronicSecurityPerimeter

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

BestPracticesforSCADASystemProcurement
TighterSecuritywillcontinuetobeimposedontheindustry,planforthefuture today
CIP005

Requestthefollowingsecurityenhancements: SecuredDNP3. SecuredICCP. ServiceDMZwhichwillhousetheprintersand othernonessentialdevices.


Reference:R2.ElectronicAccessControls

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

BestPracticesforSCADASystemProcurement
CIP007R1isthemosthighlyviolatedofalltheCIPStandards.Requesttoolswhich willhelpyouachievecompliance
CIP007

Testing/QAenvironment SpecifythelocationoftheQAAssets. Vendorprovidedtoolsfortesting Vendorservicesfortesting


Reference:R1.TestProcedures
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

BestPracticesforSCADASystemProcurement
Hardeningofsystemsisamust,auditorslovetodwellonportsandservices.
CIP007

Documentationofyourbaselinesoftware,portsand services. Removinganynonessentialsoftware,portsandservices priortodeliveryoftheSCADAsystem.


Reference:R2.PortsandServices

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

BestPracticesforSCADASystemProcurement
Sharetheresponsibilityofkeepingyoursystemuptodatewithyourvendor.
CIP007

Testingandvalidationofthepatchesforsecurity controlsnotjustfunctionality.
Reference:R3.SecurityPatchManagement

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

BestPracticesforSCADASystemProcurement
SharedAccountsareheadache,placetheburdenonyourvendor
CIP007

Disableguestaccounts. Implementpasswordcomplexityandagerequirements. Limittheuseofadministratoraccounts. Implementtheprincipleofleastprivilege.


Reference:R5.AccountManagement

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

BestPracticesforSCADASystemProcurement

CIP007

Implementtheusageofcentralizedlogging. ImplementtheusageofHostBasedIntrusionDetection System(HIDS)/IntrusionDetectionSystem(IDS).


Reference:R6.SecurityStatusMonitoring

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

10

BestPracticesforSCADASystemProcurement
SharedAccountsareheadache,requesttoolsformanagingtheseaccountsonyour vendor.
CIP007

Implementloggingtoolswhichallowstrackingof genericusernames. Tracktheuserutilizingthegenericusername. Trackthedateandtimewhichthegeneric usernamewasutilized. Tracktheactionswhichweretaken.


Reference:R5.AccountManagement

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

11

BestPracticesforSCADASystemProcurement
DecidewhoperformsyourvulnerabilityassessmentpriorissuingtheRFP
CIP007

Whowillconducttheassessment? Vendor Inhouse Thirdparty Decide: Timingofassessment. Responsibleparty


Reference:R8.CyberVulnerabilityAssessment

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

12

BestPracticesforSCADASystemProcurement
OtherissuestoconsiderpriorissuingtheRFP
CIP007

Virtualization: CIPandNonCIP StorageAreaNetworks: CIPandNonCIP. IPconnections.


Reference:SystemDesign(CIP005andCIP007)

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

13

BestPracticesforSCADASystemProcurement
RequesttoolsandprocedurestoaddressDisasterRecoveryonaperCCAbasis
CIP009

Consideravendorprovidedbackupsolution.
Reference:R4.BackupandRestore

IncludeinyourRFPthatthevendormustrestorethe SCADAsystemfrombackupmediapriortogoingonline.
*PleasenotethatyoumustdocumentedthefullrestorationoftheSCADAin ordertoprovidebookendingevidence.
Reference:R5.TestingBackupMedia

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

14

Agenda

BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

15

BestPracticesforSCADASystemImplementation
CIP002

HowtotestthenewSCADASystem: If controlling Testonesubstationatatime. AvoidSubstationsdeemedCriticalAssets Avoidtestingon500and300KVsites (CIPVersion4) Establishwelldocumentedtestprocedures.

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

16

BestPracticesforSCADASystemImplementation
DonotforgettoaddyournewcriticalCyberAssetstoyourCCAlist
CIP002

OnceanewSCADAsystemhastheabilitytocontrolthe BulkElectricalSystem,alloftheCriticalCyberAssets (CCAs)associatedwiththenewsystemneedtobe declaredandaddedtoyourexistingCCAlist.


Reference:R2.(V4) R3.(V3)CriticalCyberAssetIdentification CIP003

MakeyourcompanysCyberSecurityPolicyreadily availabletoallvendoremployeeswhowillworkonyour system.


Reference:R1.CyberSecurityPolicy
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

17

BestPracticesforSCADASystemImplementation
ImplementinganewESPisthebestpathtotake
CIP005

Ifpossible,establishanewESPforthenewSCADA system.Doingsowillallowyouto: Conducttestingpriortogoingonline. Establishwelldocumentedfirewallrules. Insurethatnonewvulnerabilitiesareintroduced tothecurrentproductionenvironment. Allowsfortheimplementationofnewernetwork equipmentwithminimalinterruptiontothe existingnetwork.


Reference:R2.ElectronicAccessControls
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

18

BestPracticesforSCADASystemImplementation
VulnerabilityTestinganddocumentationareamustpriortogoingonline..
CIP005

PriortothenewESPgoinglive,youmustperforma CyberVulnerabilityAssessment.
Verifythatthevendorhasprovideyoualistingoftheports andservices.Reference:R4.CyberVulnerabilityAssessment(CVA)

OncethenewESPisestablishedortheequipmenthas beenaddedtotheexistingESP,youmustupdatethe documentationtoreflectthemodificationofthe networkorcontrolswithinninetycalendardaysofthe changes. Reference:R5.2Documentation


2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

19

BestPracticesforSCADASystemImplementation LetsnotforgetthoseTFEs

TechnicalFeasibilityExceptions
RequestthefollowingTechnicalFeasibility Documentation: ListofdevicesforwhichaTFEmustbetaken. Equipmentvendorlettersstatingthespecific requirementwhichcannotbemet. RoadmapforeliminatingalloftheseTFEs
Reference:CIP005andCIP007

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

20

Agenda

BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

21

BestPracticesforSystemGoLive
ProperCIPPersonnelcredentialsforContractorsandVendorsisamust.
CIP004

RequirethevendortotraintheiremployeesperyourCIPprogram. Requirethevendortoproviderecordsofthetrainingresults. Contractuallanguagetoaddressliabilitiesfornoncompliance.


Reference:R2.Training

RequirethevendortoprovidePersonnelRiskAssessmentforthe following: ProjectPersonnel


Maintenanceandsupportpersonnel. HardwareOEMsupportpersonnel.

RequirethevendortoprovideyourecordsofthePRAresults.
Reference:R3.PersonnelRiskAssessment(PRA)
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

22

BestPracticesforSystemGoLive
TestingofthemonitoringcapabilitiespriortogoingLIVEisessential.
CIP007

Verifythatloggingisbeingperformedforallofthefollowing securityevents: Failedaccessattempts. Successfulaccessattempts. Antivirusandantimalwarealerts.


*Developaplaninordertotestthatthesecurityeventslistedabovearebeing
properlyloggedoncethesystemgoeslive.
Reference:R6.SecurityStatusMonitoring
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

23

BestPracticesforSystemGoLive
Utilizestrictsecuritycontrolswhenallowingremoteaccessoncethesystem isliveisamust
CIP005

RemoteAccess(VendorandEmployees) Twofactorauthenticationforvendoraccessthruthe firewall. SecuredVPNaccess. Loggingofallvendoraccess. Layeredsecurity,possiblyajumpserverwithtwofactor authentication.


2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

24

Agenda

BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

25

ProperStepsforretirementoflegacySCADAsystems
Followingthepropersequenceofeventsisessential.
CIP007

Whenredeployingmagneticmedia,overwritethe mediausingDoDStandard. Whendisposingofmedia,youmustphysicallydestroy suchmedia


*Pleasenotethatyoumustoverwriteordestroythediscardedmediawhile itstillresideswithinthePSP.

Youmustcreatedandmaintainedrecordsofdisposed and/orredeployedmedia.
Reference:R7.DisposalorRedeployment
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

26

ProperStepsforretirementoflegacySCADAsystems

CIP005

ElectronicSecurityPerimeter IfanewESPwascreated,retiretheoldESP.
RemovetheESPwheretheretiredequipmentresidedfromanydrawings.

CIP006

PhysicalSecurityPerimeter IfanewPSPwascreated,retiretheoldPSP.
RemovetheoldPSPfromthePhysicalSecurityPlan.

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

27

Agenda

BestpracticesforSCADAprocurement BestpracticesforSCADAimplementation BestpracticesforSCADAGoLive ProperstepsforretirementoflegacySCADA Conclusions

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

28

Conclusions Becomepartnerswithyourselectedvendorinsharingthe CIPSecurityresponsibilities. SelectavendorwhichhasembracedCIPSecurityandhas acultureofexceedingtheCIPRequirements. DeveloptestplansforSecurityTestingcontrolsduringthe implementationofyournewSCADAsystem. Oncethesystemgoeslive,insurethatallofthevendor personnelworkingonyoursystemhavetheproperCIP credentials. Properdisposalofyourdiscardedsystemisessential.
2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

29

KeyCyberSecurityConsiderations Questions?

2012Copyright.ConfidentialandproprietarytoTheStructureGroup,LLC.

30

You might also like