CIP Electronic Security Perimeter (ESP) - Dan Mishra FRCC Compliance Workshop May 09-13, 2011
|
|
|
- Adele Benson
- 8 years ago
- Views:
Transcription
1 CIP Electronic Security Perimeter (ESP) - Dan Mishra FRCC Compliance Workshop May 09-13,
2 Purpose Specific NERC CIP-005 Requirements Underlying fundamentals of the ESP architecture Building ESPs using Security Enclaves and DinD Electronic Access Control & Monitoring Systems Required Controls for Access Points (R2.1 & R2.2)
3 Disclaimer CAUTION: Every environment is different and requires a direct correlation. The material contained in this presentation may not represent your corporate or architectural requirements ADVISORY: Education, and compliance is about correctly interpreting and conveying information - a requirement for this content
4 Terminologies & Abbreviations Cyber Asset Programmable electronic devices and communication networks including hardware, software, and data. CCA Critical Cyber Assets ESP Electronic Security Perimeter EACM Electronic Access Control & Monitoring PACS Physical Access Control Systems DinD Defense in Depth DMZ Demilitirized Zone TFE Technical Feasibility Exceptions ACE Access Control Engine Security Enclave the collection of computing environments connected by one or more internal networks under the control of a single authority and security policy, including personnel and physical security 4
5 Specific NERC CIP-005 Requirements Cyber Security Electronic Security Perimeters: Requires the identification and protection of an electronic security perimeter and access points. The electronic security perimeter (ESP) is to encompass the critical cyber assets identified pursuant to the requirement of CIP R3.
6 Specific NERC CIP-005 Requirements The following are exempt from Standard CIP-005: Cyber Assets associated with communication networks and data communication links between discrete Electronic Security Perimeters.
7 Specific NERC CIP-005 Requirements Requirement 1 - Electronic Security Perimeter Define an ESP and its access points to protect Critical Cyber Assets Requirement 2 - Electronic Access Controls Deny by default, Specify explicit permissions Enable only required ports and services Securing dial-up access (Document needed) Documentation - implement and document the organizational processes and technical and procedural mechanisms for control of electronic access Appropriate Use Banner Requirement 3 - Monitoring Electronic Access Requirement 4 - Cyber Vulnerability Assessment Requirement 5 - Documentation Review and Maintenance Monitor FERC Order 706 Activity
8 NERC CIP Electronic Security Perimeter Specific NERC CIP Requirements focused in this presentation - R1, Defining ESP(s) - R1.5, ESP Access Control & Monitoring - R2, Electronic Access Control
9 Specific NERC CIP-005 Requirements What do we commonly miss? R1.5. Cyber Assets used in the access control and/or monitoring of the Electronic Security Perimeter(s) shall be afforded the protective measures as a specified in Standard CIP-003-3; Standard CIP Requirement R3; Standard CIP Requirements R2 and R3; Standard CIP Requirement R3; Standard CIP Requirements R1 and R3 through R9; Standard CIP-008-3; and Standard CIP R2. Electronic Access Controls The Responsible Entity shall implement and document the organizational processes and technical and procedural mechanisms for control of electronic access at all electronic access points to the Electronic Security Perimeter(s).
10 NERC CIP Compliance Underlying fundamentals of the ESP architecture
11 Architecting your ESP Design and define the ESP to provide the appropriate operating functionality, access control and monitoring capabilities Approach, controls, monitoring, assessment and documentation requirements defined in CIP-005 (R2, R3) Challenging to define an electronic perimeter around geographically disperse systems collecting information and performing automated and manual control operations Define an ESP and access point, access control request, review and response process and authorization controls (CIP-005, R2.5, CIP-004, R4 ) Define an appropriate trust model for your systems (Security Enclaves) Ensure the adequacy of protection and continued high availability of authorized access and control Do not forget documenting (identifying) the Non-critical Cyber Assets and Access Control and Monitoring assets used in the access control and/or monitoring of the Electronic Security Perimeter(s)
12 Integrating ESP Assess all CIP-005 Requirements then collectively design the solution - Understand your organization s trust model based upon the enclave approach outlined in the methodology Select your identity type, system and appropriate audit trail (logs) collections approach for each ESP enclave Define the appropriate administrative and operational trusts for system access Separate technical administrative, developers, system operators and general users Correlate your physical and cyber identities as appropriate Ensure identity integrity throughout the ESP
13 Traditional Isolation of Corporate and Control Domains Source: Idaho National Laboratory, Control Systems Cyber Security: Defense in Depth Strategies (May, 2006)
14 Overview of Contemporary Control System Architectures Source: Idaho National Laboratory, Control Systems Cyber Security: Defense in Depth Strategies (May, 2006)
15 Database Attack Vector Source: Idaho National Laboratory, Control Systems Cyber Security: Defense in Depth Strategies (May, 2006)
16 Common Security Zones Source: Idaho National Laboratory, Control Systems Cyber Security: Defense in Depth Strategies (May, 2006)
17 Firewall Deployment for Common Security Zones Source: Idaho National Laboratory, Control Systems Cyber Security: Defense in Depth Strategies (May, 2006)
18 Defense in Depth with IDS (R??) Source: Idaho National Laboratory, Control Systems Cyber Security: Defense in Depth Strategies (May, 2006)
19 Definition: Security Enclaves An enclave is, as defined in the Department of Defense Directive (DoDD ) E , the collection of computing environments connected by one or more internal networks under the control of a single authority and security policy, including personnel and physical security. Terminology Potpourri Security Zones DeMilitarized Zones (DMZ) Transactional Zones Determine security controls and define system interactions Review NIST SP r2;
20 Security Enclave Creation Security enclaves provide the layers of trusted systems which limit untrusted interactions Enclaves creation can be based upon: Mission criticality Dependent Risks Operational requirements Type of application System users Trusted versus untrusted interactions
21 Enclave Split - Services Services are separated among enclaves Separation of duties External DNS / Internal DNS External Mail / Internal Mail External Web / Internal Web External Authentication / Internal Authentication Split Active Directory Domains Out Of Band Management Network Application Proxy
22 Building Security Enclaves Legend Site-to-Site VPN Firewall Defined logical ESP access points with enterprise identity management and network integrated firewalls and IDS ESP High Availability Virtualized Architecture Restricted WAN Control Enclave IDS/EDS Remote VPN, Contractor, Identity Mgmt, Uncontrolled ISO Enclaves Office Desktop Systems ISO, Identity & Event Mgmt Enclaves Testing Enclaves
23 Building Security Enclaves Control Enclaves IDS/EDS Legend VPN Firewall Testing Enclave ESP Generating / Sub Station ISO Enclave High Availability Virtualized Architecture Primary Testing Enclaves ISO Enclave Secondary High Availability Virtualized Architecture WAN Control Enclave IDS/EDS Remote VPN, Contractor, Uncontrolled ISO Enclaves Office Systems ISO Enclave Testing Enclaves Control Enclave IDS/EDS Office Systems Remote VPN, Contractor, Uncontrolled ISO Enclaves
24 CIP-005 R 1.5, Access Control & Monitoring Cyber Assets used in the access control and/or monitoring of the Electronic Security Perimeter(s) (EACMs) shall be afforded the protective measures as a specified in Standard CIP-003-3; Standard CIP Requirement R3; Standard CIP Requirements R2 and R3; Standard CIP Requirement R3; Standard CIP Requirements R1 & R3 R9; Standard CIP-008-3; Standard CIP
25 CIP-005 R 1.5, Access Control & Monitoring What is considered as Cyber Assets used in the access control and/or monitoring of the Electronic Security Perimeter(s)? EACMs are Cyber Assets that can 1.Controls Access (authenticates / sets privileges) of the ESP 2.Used in monitoring the ESP (logging/recording/alerting)
26 CIP-005 R 1.5, Access Control & Monitoring Protection of Electronic Access Control Systems (EACMs) Cyber Assets used in the access control and/or monitoring of the Electronic Security Perimeter(s) shall reside within an identified Physical Security Perimeter. CIP R3 Sister Requirement Physical Access Control Systems (PACS) CIP R2
27 CIP-005 R2, Access Control & Monitoring R2. Electronic Access Controls The Responsible Entity shall implement and document the organizational processes and technical and procedural mechanisms for control of electronic access at all electronic access points to the Electronic Security Perimeter(s). R2.1. These processes and mechanisms shall use an access control model that denies access by default, such that explicit access permissions must be specified. R2.2. At all access points to the Electronic Security Perimeter(s), the Responsible Entity shall enable only ports and services required for operations and for monitoring Cyber Assets within the Electronic Security Perimeter, and shall document, individually or by specified grouping, the configuration of those ports and services. R2.3. The Responsible Entity shall implement and maintain a procedure for securing dial-up access to the Electronic Security Perimeter(s).
28 CIP-005 R 2, Electronic Access Controls R2.4. Where external interactive access into the Electronic Security Perimeter has been enabled, the Responsible Entity shall implement strong procedural or technical controls at the access points to ensure authenticity of the accessing party, where technically feasible. R2.5. The required documentation shall, at least, identify and describe: The processes for access request and authorization. The authentication methods. The review process for authorization rights, in accordance with Standard CIP Requirement R4. The controls used to secure dial-up accessible connections. R2.6. Appropriate Use Banner Where technically feasible, electronic access control devices shall display an appropriate use banner on the user screen upon all interactive access attempts. The Responsible Entity shall maintain a document identifying the content of the banner.
29 CIP-005 R 2, Electronic Access Controls Entity perspective 1. High Risk Control - It is in Entity s best interest to secure this control 2. Implementation can be complex Auditor perspective 1. Requirement is the level 1/ front-line defense for the ESP 2. Highest Risk impact if controls are ineffective 3. Takes very long to review these controls as it is time and resources intensive and can vary based on configuration and device technology.
30 R2.1 Deny by default Model for Access Control CISCO ACE Configuration Required steps may include Known Communication Between Systems Review levels of system trust for need of isolation station / proxy Define appropriate access rules Identify Source & Destination Identify IP Subnets (IP, Mask) Identify Ports (ranges, gt, lt) Unknown Communication Between Systems Review levels of system trust for need of isolation station / proxy Work with application vendor to identify requirements If necessary, enable connectivity in learning mode Do you know who, how, why, where, and when the system communicates across the ESP?
31 R2.1 Deny by default Model for Access Control CISCO ACE Example Good access-list 101 permit tcp host host eq 102 access-list 101 permit tcp EMS_Net host object-group EMS_Ports Bad (not always wrong) access-list 101 permit tcp host host access-list 101 permit tcp host host /24 eq 102 deny tcp any any Ugly Permit tcp any any
32 R2.2 - Defining Ports and Services Access Rules R2.2 Requires to enable only ports and services required for operations and for monitoring Cyber Assets within the Electronic Security Perimeter, and shall document, individually or by specified grouping, the configuration of those ports and services. Beyond the configuration, Entity documentation to include Ports or range of ports required for normal or emergency operation (Service/Application, Normal or emergency) Device / Cyber Asset where these application or services are enabled. Since requirement state only ports, all other ports communication must be explicitly/implicitly denied. Caution Routers (Implicit Deny R3.2) How is CIP-007 R2 different?
33 R2.2 Resultant product in Cisco Environment What s the difference? Network Object Model hostname (config)# object-group network eng hostname (config-network)# network-object host hostname (config-network)# network-object host hostname (config)# object-group network Trans hostname (config-network)# network-object host hostname (config-network)# network-object host hostname (config)# object-group network SysControl hostname (config-network)# network-object host hostname (config-network)# network-object host hostname (config)# object-group network EMS_Net hostname (config-network)# group-object eng hostname (config-network)# group-object Trans hostname (config-network)# group-object SysControl object-group service EMS_Ports tcp port-object eq 102 port-object eq 389 port-object eq 88 port-object eq 543 port-object eq domain port-object eq 123 port-object eq time port-object eq 443 port-object eq 22 Direct ACL Entry access-list 101 permit tcp host host eq 102 access-list 101 permit tcp host host eq 389 access-list 101 permit tcp host host eq 88 access-list 101 permit tcp host host eq 543 access-list 101 permit tcp host host eq domain access-list 101 permit tcp host host eq 123 access-list 101 permit tcp host host eq time access-list 101 permit tcp host host eq 443 access-list 101 permit tcp host host eq 22 access-list 101 permit tcp host host eq 102 access-list 101 permit tcp host host eq 389 access-list 101 permit tcp host host eq 88 access-list 101 permit tcp host host eq 543 access-list 101 permit tcp host host eq domain access-list 101 permit tcp host host eq 123 access-list 101 permit tcp host host eq time access-list 101 permit tcp host host eq 443 access-list 101 permit tcp host host eq 22 access-list 101 permit tcp EMS_Net host object-group EMS_Ports (similar for udp)
34 Questions / Discussions
E-Commerce Security Perimeter (ESP) Identification and Access Control Process
Electronic Security Perimeter (ESP) Identification and Access Control Process 1. Introduction. A. This document outlines a multi-step process for identifying and protecting ESPs pursuant to the North American
Cyber Security Compliance (NERC CIP V5)
Cyber Security Compliance (NERC CIP V5) Ray Wright NovaTech, LLC Abstract: In December 2013, the Federal Energy Regulatory Commission (FERC) issued Order No. 791 which approved the Version 5 CIP Reliability
Redesigning automation network security
White Paper WP152006EN Redesigning automation network security Presented at Power and Energy Automation Conference (PEAC), Spokane, WA, March 2014 Jacques Benoit Eaton s Cooper Power Systems Abstract The
Joe Andrews, MsIA, CISSP-ISSEP, ISSAP, ISSMP, CISA, PSP Sr. Compliance Auditor Cyber Security
Joe Andrews, MsIA, CISSP-ISSEP, ISSAP, ISSMP, CISA, PSP Sr. Compliance Auditor Cyber Security CIP-005-3 Audit Approach, ESP Diagrams, Industry Best Practices September 24 25, 2013 SALT LAKE CITY, UTAH
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Overview. Firewall Security. Perimeter Security Devices. Routers
Overview Firewall Security Chapter 8 Perimeter Security Devices H/W vs. S/W Packet Filtering vs. Stateful Inspection Firewall Topologies Firewall Rulebases Lecturer: Pei-yih Ting 1 2 Perimeter Security
NERC CIP Whitepaper How Endian Solutions Can Help With Compliance
NERC CIP Whitepaper How Endian Solutions Can Help With Compliance Introduction Critical infrastructure is the backbone of any nations fundamental economic and societal well being. Like any business, in
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
NERC CIP VERSION 5 COMPLIANCE
BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements that are the basis for maintaining
FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.
1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams
We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall
Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
FIREWALLS & CBAC. philip.heimer@hh.se
FIREWALLS & CBAC philip.heimer@hh.se Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that
- Introduction to Firewalls -
1 Firewall Basics - Introduction to Firewalls - Traditionally, a firewall is defined as any device (or software) used to filter or control the flow of traffic. Firewalls are typically implemented on the
Notable Changes to NERC Reliability Standard CIP-005-5
MIDWEST RELIABILITY ORGANIZATION Notable Changes to NERC Reliability Standard CIP-005-5 Electronic Security Perimeter(s) Bill Steiner MRO Principal Risk Assessment and Mitigation Engineer MRO CIP Version
Firewalls. CEN 448 Security and Internet Protocols Chapter 20 Firewalls
CEN 448 Security and Internet Protocols Chapter 20 Firewalls Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa
Standard CIP 007 3a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3a 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates
Firewall Environments. Name
Complliiance Componentt DEEFFI INITION Description Rationale Firewall Environments Firewall Environment is a term used to describe the set of systems and components that are involved in providing or supporting
INTRODUCTION TO FIREWALL SECURITY
INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ
Deploying ACLs to Manage Network Security
PowerConnect Application Note #3 November 2003 Deploying ACLs to Manage Network Security This Application Note relates to the following Dell PowerConnect products: PowerConnect 33xx Abstract With new system
NERC CIP Substation Cyber Security Update. John M Shaw Presentation to UTC Region 7 February 19, 2009 jshaw@garrettcom.com
NERC CIP Substation Cyber Security Update John M Shaw Presentation to UTC Region 7 February 19, 2009 jshaw@garrettcom.com It s February 19, 2009 132 project days left to compliance Do you know where (what)
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute
Lessons Learned CIP Reliability Standards
Evidence for a requirement was not usable due to a lack of identifying information on the document. An entity should set and enforce a "quality of evidence" standard for its compliance documentation. A
Adding an Extended Access List
CHAPTER 11 This chapter describes how to configure extended access lists (also known as access control lists), and it includes the following topics: Information About Extended Access Lists, page 11-1 Licensing
Securing Modern Substations With an Open Standard Network Security Solution. Kevin Leech Schweitzer Engineering Laboratories, Inc.
Securing Modern Substations With an Open Standard Network Security Solution Kevin Leech Schweitzer Engineering Laboratories, Inc. Copyright SEL 2009 What Makes a Cyberattack Unique? While the resources
John M Shaw Presentation to UTC Region 7 February 19, 2009 jshaw@garrettcom.com
NERC CIP Substation Cyber Security Update John M Shaw Presentation to UTC Region 7 February 19, 2009 jshaw@garrettcom.com It s February 19, 2009 132 project days left to compliance Do you know where (what)
How to Painlessly Audit Your Firewalls
W h i t e P a p e r How to Painlessly Audit Your Firewalls An introduction to automated firewall compliance audits, change assurance and ruleset optimization May 2010 Executive Summary Firewalls have become
Security Technology: Firewalls and VPNs
Security Technology: Firewalls and VPNs 1 Learning Objectives Understand firewall technology and the various approaches to firewall implementation Identify the various approaches to remote and dial-up
A Quick Guide to Publish Thecus NAS on Internet. Contents
Contents 1. Overview...2 2. Setup Thecus NAS on Internet...2 2-1 Demo with DD-WRT...2 2-1-1 Setup DMZ for Thecus NAS...2 2-1-2 Setup Port Forwarding for Thecus NAS...3 2-2 Demo with Tomato...3 2-2-1 Setup
Firewalls and VPNs. Principles of Information Security, 5th Edition 1
Firewalls and VPNs Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to: Understand firewall technology and the various approaches
ReliabilityFirst CIP Evidence List CIP-002 through CIP-009 are applicable to RC, BA, IA, TSP, TO, TOP, GO, GOP, LSE, NERC, & RE
R1 Provide Risk Based Assessment Methodology (RBAM) R1.1 Provide evidence that the RBAM includes both procedures and evaluation criteria, and that the evaluation criteria are riskbased R1.2 Provide evidence
A Model Design of Network Security for Private and Public Data Transmission
2011, TextRoad Publication ISSN 2090-424X Journal of Basic and Applied Scientific Research www.textroad.com A Model Design of Network Security for Private and Public Data Transmission Farhan Pervez, Ali
F-SECURE MESSAGING SECURITY GATEWAY
F-SECURE MESSAGING SECURITY GATEWAY DEFAULT SETUP GUIDE This guide describes how to set up and configure the F-Secure Messaging Security Gateway appliance in a basic e-mail server environment. AN EXAMPLE
8. Firewall Design & Implementation
DMZ Networks The most common firewall environment implementation is known as a DMZ, or DeMilitarized Zone network. A DMZ network is created out of a network connecting two firewalls; i.e., when two or
Innovative Defense Strategies for Securing SCADA & Control Systems
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet
Security Design. thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/
Security Design thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/ Content Security Design Analysing Design Requirements Resource Separation a Security Zones VLANs Tuning Load Balancing
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Chapter 15. Firewalls, IDS and IPS
Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet
TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices
Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security
March 2012 www.tufin.com
SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...
Network Security. Outlines: Introduction to Network Security Dfii Defining Security Zones DMZ. July 2010. Network Security 08
Network Security (Principles i & Practices) Outlines: Introduction to Network Security Dfii Defining Security Zones DMZ By: Arash Habibi Lashkari July 2010 1 Introduction to Network Security Model of Network
SonicWALL PCI 1.1 Implementation Guide
Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS Standard
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
Firewall Audit Techniques. K.S.Narayanan HCL Technologies Limited
Firewall Audit Techniques K.S.Narayanan HCL Technologies Limited Firewall Management Technology Network Security Architecture Firewall Placement Firewall Appliance Rule base compliance with security policy
Firewall Introduction Several Types of Firewall. Cisco PIX Firewall
Firewall Introduction Several Types of Firewall. Cisco PIX Firewall What is a Firewall? Non-computer industries: a wall that controls the spreading of a fire. Networks: a designed device that controls
Supporting our customers with NERC CIP compliance. James McQuiggan, CISSP
Supporting our customers with NERC CIP compliance James, CISSP Siemens Energy Sector Energy products and solutions - in 6 Divisions Oil & Gas Fossil Power Generation Renewable Energy Service Rotating Equipment
Building Your Firewall Rulebase Lance Spitzner Last Modified: January 26, 2000
Building Your Firewall Rulebase Lance Spitzner Last Modified: January 26, 2000 Building a solid rulebase is a critical, if not the most critical, step in implementing a successful and secure firewall.
NC School Connectivity Initiative Firewall Best Practices. NCET 2014 Conference
NC School Connectivity Initiative Firewall Best Practices NCET 2014 Conference Session Presenters n Chris Rose, MCNC Client Network Engineer n Dianne Dunlap, MCNC Client Network Engineer 2 3/21/14 Agenda
NEW YORK INSTITUTE OF TECHNOLOGY School of Engineering and Technology Department of Computer Science Old Westbury Campus
NEW YORK INSTITUTE OF TECHNOLOGY School of Engineering and Technology Department of Computer Science Old Westbury Campus CSCI - 440 Network Security and Perimeter Protection 3-0-3 CATALOG DESCRIPTION This
Information Technology Security Guideline. Network Security Zoning
Information Technology Security Guideline Network Security Zoning Design Considerations for Placement of s within Zones ITSG-38 This page intentionally left blank. Foreword The Network Security Zoning
CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System
CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System Purpose CIP-005-5 R2 is focused on ensuring that the security of the Bulk Energy System is not compromised
GE Measurement & Control. Cyber Security for NERC CIP Compliance
GE Measurement & Control Cyber Security for NERC CIP Compliance GE Proprietary Information: This document contains proprietary information of the General Electric Company and may not be used for purposes
Firewall Design Principles
Firewall Design Principles Software Engineering 4C03 Dr. Krishnan Stephen Woodall, April 6 th, 2004 Firewall Design Principles Stephen Woodall Introduction A network security domain is a contiguous region
- Introduction to PIX/ASA Firewalls -
1 Cisco Security Appliances - Introduction to PIX/ASA Firewalls - Both Cisco routers and multilayer switches support the IOS firewall set, which provides security functionality. Additionally, Cisco offers
Recommended IP Telephony Architecture
Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 SNAC.Guides@nsa.gov This Page Intentionally Left Blank ii Warnings
Cyber Security. Smart Grid
Cyber Security for the Smart Grid Peter David Vickery Executive Vice President N-Dimension Solutions Inc. APPA National Conference June 21, 2010 Cyber Security Solutions For Cyber Security
How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN
How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN Applicable Version: 10.6.2 onwards Overview Virtual host implementation is based on the Destination NAT concept. Virtual
CMS Operational Policy for Infrastructure Router Security
Chief Information Officer Office of Information Services Centers for Medicare & Medicaid Services CMS Operational Policy for Infrastructure Router Security September 2005 Document Number: CMS-CIO-POL-INF05-01
Standard CIP 007 3 Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for securing
Introduction to Endpoint Security
Chapter Introduction to Endpoint Security 1 This chapter provides an overview of Endpoint Security features and concepts. Planning security policies is covered based on enterprise requirements and user
State of New Mexico Statewide Architectural Configuration Requirements. Title: Network Security Standard S-STD005.001. Effective Date: April 7, 2005
State of New Mexico Statewide Architectural Configuration Requirements Title: Network Security Standard S-STD005.001 Effective Date: April 7, 2005 1. Authority The Department of Information Technology
How To Configure Apple ipad for Cyberoam L2TP
How To Configure Apple ipad for Cyberoam L2TP VPN Connection Applicable to Version: 10.00 (All builds) Layer 2 Tunneling Protocol (L2TP) can be used to create VPN tunnel over public networks such as the
Security Policies Tekenen? Florian Buijs
Security Policies Tekenen? Florian Buijs Good Old Days: IP Address = User Application = Port/Protocol Today: IP Address! User Application! Port/Protocol What are ACL s? Firewall Rules? Real World example:
LogRhythm and NERC CIP Compliance
LogRhythm and NERC CIP Compliance The North American Electric Reliability Corporation (NERC) is a nonprofit corporation designed to ensure that the bulk electric system in North America is reliable, adequate
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
F i r e s ec tm F i r e w a l l R u l e b a s e A n a l y s i s T o o l
F i r e s ec tm F i r e w a l l R u l e b a s e A n a l y s i s T o o l P C I D S S C o m p l i a n c e Usage guide Comprehensive rule base analysis for medium to large enterprise environments The large
Firewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
Securing Manufacturing Control Networks. Alan J. Raveling, CISSP November 2 nd 5 th Pack Expo 2014
Securing Manufacturing Control Networks Alan J. Raveling, CISSP November 2 nd 5 th Pack Expo 2014 As Internet-enabled technologies such as cloud and mobility grow, the need to understand the potential
Defense-in-Depth Strategies for Secure, Open Remote Access to Control System Networks
Defense-in-Depth Strategies for Secure, Open Remote Access to Control System Networks A look at multi-vendor access strategies Joel Langill TÜV FSEng ID-1772/09, CEH, CPT, CCNA Security Consultant / Staff
Firewall Rulebase Analysis Tool
Advances in Communications, Computing, Networks and Security 10 Abstract 96 Firewall Rulebase Analysis Tool P. Jain and P.S. Dowland Centre for Security, Communications and Network Research Plymouth University,
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
Cornerstones of Security
Internet Security Cornerstones of Security Authenticity the sender (either client or server) of a message is who he, she or it claims to be Privacy the contents of a message are secret and only known to
Architecture Overview
Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and
The Bomgar Appliance in the Network
The Bomgar Appliance in the Network The architecture of the Bomgar application environment relies on the Bomgar Appliance as a centralized routing point for all communications between application components.
Configuration Guide. How to set up the IPSec site-to-site Tunnel between the D-Link DSR Router and the Sonicwall Firewall.
Configuration Guide How to set up the IPSec site-to-site Tunnel between the D-Link DSR Router and the Sonicwall Firewall Overview This document describes how to implement IPSec with pre-shared secrets
Company Co. Inc. LLC. LAN Domain Network Security Best Practices. An integrated approach to securing Company Co. Inc.
Company Co. Inc. LLC Multiple Minds, Singular Results LAN Domain Network Security Best Practices An integrated approach to securing Company Co. Inc. LLC s network Written and Approved By: Geoff Lacy, Tim
Industrial Security for Process Automation
Industrial Security for Process Automation SPACe 2012 Siemens Process Automation Conference Why is Industrial Security so important? Industrial security is all about protecting automation systems and critical
Network Architecture & Active Directory Considerations for the PI System. Bryan Owen - OSIsoft Joel Langill - SCADAhacker
Network Architecture & Active Directory Considerations for the PI System By: Bryan Owen - OSIsoft Joel Langill - SCADAhacker Agenda Moore s Law Network Architecture Domain Services in a DMZ 2 HD Moore
FIREWALL POLICY DOCUMENT
FIREWALL POLICY DOCUMENT Document Id Firewall Policy Sponsor Laura Gibbs Author Nigel Rata Date May 2014 Version Control Log Version Date Change 1.0 15/05/12 Initial draft for review 1.1 15/05/14 Update
Fundamentals of Windows Server 2008 Network and Applications Infrastructure
Fundamentals of Windows Server 2008 Network and Applications Infrastructure MOC6420 About this Course This five-day instructor-led course introduces students to network and applications infrastructure
Reclamation Manual Directives and Standards
Vulnerability Assessment Requirements 1. Introduction. Vulnerability assessment testing is required for all access points into an electronic security perimeter (ESP), all cyber assets within the ESP, and
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Secure Network Design: Designing a DMZ & VPN
Secure Network Design: Designing a DMZ & VPN DMZ : VPN : pet.ece.iisc.ernet.in/chetan/.../vpn- PPTfinal.PPT 1 IT352 Network Security Najwa AlGhamdi Introduction DMZ stands for DeMilitarized Zone. A network
Firewall Security. Presented by: Daminda Perera
Firewall Security Presented by: Daminda Perera 1 Firewalls Improve network security Cannot completely eliminate threats and a=acks Responsible for screening traffic entering and/or leaving a computer network
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall
Cisco Configuring Commonly Used IP ACLs
Table of Contents Configuring Commonly Used IP ACLs...1 Introduction...1 Prerequisites...2 Hardware and Software Versions...3 Configuration Examples...3 Allow a Select Host to Access the Network...3 Allow
Note: This case study utilizes Packet Tracer. Please see the Chapter 5 Packet Tracer file located in Supplemental Materials.
Note: This case study utilizes Packet Tracer. Please see the Chapter 5 Packet Tracer file located in Supplemental Materials. CHAPTER 5 OBJECTIVES Configure a router with an initial configuration. Use the
Class Test 2 - e-security (CSN11102/11117) Semester 2, Session 2012-13
Class Test 2 - e-security (CSN11102/11117) Semester 2, Session 2012-13 Outline Requirements The test will account for 20% of the module final grade, and is based on the academic content of the course covering
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
UNCLASSIFIED (U) U.S. Department of State Foreign Affairs Manual Volume 5 Information Management 5 FAM 870 NETWORKS
5 FAM 870 NETWORKS (Office of Origin: IRM/BMP/GRP/GP) 5 FAM 871 ENTERPRISE NETWORKS (CT:IM-138; 01-18-2013) The Department currently has two enterprise networks: ClassNet and OpenNet. Only Department-issued
H3C Firewall and UTM Devices DNS and NAT Configuration Examples (Comware V5)
H3C Firewall and UTM Devices DNS and NAT Configuration Examples (Comware V5) Copyright 2015 Hangzhou H3C Technologies Co., Ltd. All rights reserved. No part of this manual may be reproduced or transmitted
Securing EtherNet/IP Using DPI Firewall Technology
Securing EtherNet/IP Using DPI Firewall Technology www.odva.org Technical Track About Us Erik Schweigert Leads device firmware development at Tofino Security BSc in Computer Science from VIU Michael Thomas
7.1. Remote Access Connection
7.1. Remote Access Connection When a client uses a dial up connection, it connects to the remote access server across the telephone system. Windows client and server operating systems use the Point to
Configuration Guide. How to set up the IPSec site-to-site Tunnel between the D-Link DSR Router and the Cisco Firewall. Overview
Configuration Guide How to set up the IPSec site-to-site Tunnel between the D-Link DSR Router and the Cisco Firewall Overview This document describes how to implement IPSec with pre-shared secrets establishing
The Cisco IOS Firewall feature set is supported on the following platforms: Cisco 2600 series Cisco 3600 series
Cisco IOS Firewall Feature Set Feature Summary The Cisco IOS Firewall feature set is available in Cisco IOS Release 12.0. This document includes information that is new in Cisco IOS Release 12.0(1)T, including
c) Password Management The assignment/use of passwords is controlled in accordance with the defined Password Policy.
Responsible Office: Chief Information Officer Pages of these Procedures 1 of 5 Procedures of Policy No. (2) - 1. User Access Management a) User Registration The User ID Registration Procedure governs the
Architecture. The DMZ is a portion of a network that separates a purely internal network from an external network.
Architecture The policy discussed suggests that the network be partitioned into several parts with guards between the various parts to prevent information from leaking from one part to another. One part