Cyber Security Compliance (NERC CIP V5)
Ray Wright
NovaTech, LLC Abstract:
Topics
•
Review of Version 5 Changes
•
Review Major Challenges in Transitioning to Version 5
•
Review the Need for Automation in Meeting Version 5
• The “Intermediate System”
• Configuration Management
Current NERC CIP Documents
CIP–002–3 — Cyber Security— Critical Cyber Asset Identification CIP–003–3 — Cyber Security — Security Management Controls CIP–004–3 — Cyber Security — Personnel and Training
CIP–005–3 — Cyber Security — Electronic Security Perimeter(s) CIP–006–3 — Cyber Security — Physical Security
CIP–007–3 — Cyber Security — Systems Security Management
CIP–008–3 — Cyber Security — Incident Reporting and Response Planning CIP–009–3 — Cyber Security — Recovery Plans for Critical Cyber Assets
NERC CIP Documents “Version 5”
CIP–002–5 — Cyber Security — BES Cyber System Categorization
CIP–003–5 — Cyber Security — Security Management Controls CIP–004–5 — Cyber Security — Personnel and Training
CIP–005–5 — Cyber Security — Electronic Security Perimeter(s)
CIP–006–5 — Cyber Security — Physical Security of BES Cyber Systems
CIP–007–5 — Cyber Security — Systems Security Management
CIP–008–5 — Cyber Security — Incident Reporting and Response Planning
CIP–009–5 — Cyber Security — Recovery Plans for BES Cyber Systems
(new) CIP–010–1 — Cyber Security — Configuration Change Mgmt. and Vulnerability Assessments (new) CIP–011–1 — Cyber Security — Information Protection
Version 5 Introduces New Definitions
Cyber Asset
Programmable electronic devices, including the hardware, software, and data in those devices.
BES Cyber Asset
A Cyber Asset that if rendered unavailable, degraded, or misused would affect the
reliable operation of the Bulk Electric System.
BES Cyber System
One or more BES Cyber Assets logically grouped to perform
one or more reliability tasks.
“Bulk Electric System”
…generally 100kV or higher.
Improved Definition of Criticality
V3/V4
V5
Critical High Medium Non-Critical Non-Critical Low OtherAny BES Cyber Asset not “High” or “Medium”
Version 5 Expands Definition of “Applicable Systems”
• Electronic Access Control or Monitoring Systems (EACMS) – Applies to each Electronic
Access Control or Monitoring System associated with a referenced high impact BES Cyber System or medium impact BES Cyber System. Examples may include, but are not limited to, firewalls, authentication servers, and log monitoring and alerting systems.
• Physical Access Control Systems (PACS) – Applies to each Physical Access Control System
associated with a referenced high impact BES Cyber System or medium impact BES Cyber System with External Routable Connectivity.
• Protected Cyber Assets (PCA)– Applies to each Protected Cyber Asset associated with a
referenced high impact BES Cyber System or medium impact BES Cyber System
Other Significant Changes V3/4 to V5
• Must now use an “intermediate device” between User and Critical Asset
• The exemption of Cyber Assets from applicability to the NERC CIP standards based on
communication characteristics no longer applies.
• Must remove/disable both unused “software ports” and unused “hardware points”
• Improved definition for patching
• Defines the source of the “patches” (also “hot fixes” and “updates”)
• Provides better definition of “release date” and “availability date”
• If installing the patch introduces more risk than the vulnerability represents, an alternate process is defined
• Does not mandate anti-virus software
• Requires security monitoring points
Top 10 Transition Challenges
The Need for Automation in Meeting NERC CIP 5
System without Intermediate System
Intermediate System
Electronic Security Perimeter System
User
Networked Servers
Remote
Connection and Password Managers Broadband Connection Critical Cyber Assets Intermediate System
Remote Connection and Password Management System
August 30, 2014 Presentation title
Electronic Security Perimeter System User Networked Servers Critical Cyber Assets
All users who interact with substation assets login to the system System manages all user passwords and permission
System manages the details of all connections to substation assets System manages passwords in the substation assets
Encrypted
Broadband Connection
Remote Connection and Password Management System
The Need for Automation in Meeting NERC CIP 5
•
Configuration
Management
August 30, 2014 Presentation title
The Need for Automation in Meeting NERC CIP 5
•
Configuration Management (cont.)
Etc.
Return to Table of Contents
17
Return to Table of Contents
Substation Security Appliance
System Operation Example – Configuration Retrieval
Configuration data from substation assets collected by substation security applianceand forwarded to servers for comparison
Substation Security Appliance
Return to Table of Contents
19
Return to Table of Contents
Configuration Retrieval Steps
Return to Table of Contents
21
Return to Table of Contents
Configuration Retrieval Steps
