GE Measurement & Control Cyber Security for NERC CIP Compliance
GE Proprietary Information: This document contains proprietary information of the General Electric Company and may not be used for purposes other than that for which it was originally furnished except with written permission of GE Oil & Gas. Copyright 2012 General Electric Company. All rights reserved.
Contents Cyber Security for NERC CIP Compliance...4 Sabotage Reporting...4 Access Control...4 Change Control and Configuration Management...4 Electronic Security Perimeter...4 Monitoring Electronic Access...5 Cyber Vulnerability Assessment...5 Documentation Review and Maintenance...5 Test Procedures...5 Ports and Services...5 Security Patch Management...6 Malicious Software Prevention...6 Account Management...6 Security Status Monitoring...6 Recovery Plans for Critical Cyber Assets...6 Cyber Security for NERC CIP Compliance 3
Cyber Security for NERC CIP Compliance During the Cyber Security and the Grid Senate Hearing on July 17, 2012, Mr. Gerry W. Cauley, North American Electric Reliability Corporation (NERC) President and Chief Executive Officer testified that compliance with NERC CIP standards is not enough; is an important threshold for properly securing the bulk electric system. However, no single security asset, technique, procedure, or standard even if strictly followed will protect an entity from all potential cyber threats. The cyber security threat environment is constantly changing and our defenses must keep pace. Security best-practices call for additional processes, procedures, and technologies beyond those required by the CIP standards. As a vendor of industrial controls, GE embraces its responsibilities to assist critical infrastructure owners to improve their security postures and support compliance efforts as they relate to GE provided equipment. Many of the product security features available for current controls, such Mark* VIe and EX2100e, are also available as enhancements for older controls, such as the EX2000, Mark V, EX2100, Mark VI. GE supports customer compliance efforts by providing baseline configuration documentation for current and certain legacy controls, supporting asset operator cyber vulnerability assessments and associated mitigations. GE s cyber security solution is comprised of the Cyber Asset Protection (CAP) Software Update Subscription, and the SecurityST Appliance that support cyber security best practices such as centralized patch management, anti-virus/host intrusion detection updates, account management, logging and event management, intrusion detection and automated backup. The solution supports confidentiality, integrity and availability of critical controls and related networks, which in turn can be applied to support owner compliance towards NERC CIP. The following matrix provides more details on how CAP SW Update Subscription and SecurityST support NERC CIP compliance. NERC CIP Standards How CAP SW Update Subscription + SecurityST Support Responsible Entity s Compliance NERC CIP Standards Sabotage Reporting CIP-001 Access Control CIP-003: R5 How CAP SW Subscriptions + SecurityST Support Responsible Entity s Compliance The Security Information Event Management (SIEM) system centralizes and correlates event logs. The SIEM provides operators with a single, centralized, correlated and real-time display of activities throughout the plant data highway (PDH) and unit data highway (UDH) network. The SIEM supports correlation analysis through logged data. Centralized account management supports unified administration of role based access control and least privilege that easily integrates into plant wide, account management. The SIEM analyzes access log data and provides alerting and reporting of role-based access logs. Access to the ESP and changes made to the network and systems will be logged. The SIEM centralizes and aggregates log and event management to support correlation analysis. Change Control and Configuration Management CIP-003: R6 GE s CAP SW Update subscription supports CIP-003 R6 Change Control and Configuration Management by providing subscribers with the delivery of monthly DVDs that contain validated and tested critical operating system (OS) updates, security patches, and anti-virus and host intrusion detection system (HIDS) definitions. SIEM capture changes to configuration of controls and related network devices. Electronic Security Perimeter CIP-005: R1 GE assists the Responsible Entity in meeting the logical access control of CIP-003-4 R5 by capturing ingress and egress firewall activity. Firewall rule set and Network Intrusion Detection monitoring/logging capabilities further support Electronic Security Perimeter (ESP) access control. 4 Cyber Security for NERC CIP Compliance
NERC CIP Standards Electronic Access Controls CIP-005: R2 How CAP SW Subscriptions + SecurityST Support Responsible Entity s Compliance By default does not contain dial-up connectivity. Wireless access in not provided as part of GE s standard network configuration. When operating in secure mode, the controller solely permits executables, on a hash protected, encrypted list defined in firmware Components can be configured to display licensee or unit-specific use banners messages before granting access, ensuring the message remains on the screen until the user takes explicit actions to log on. System-use banners are supported by local security policy and can be centrally configured using the Active Directory. System-use banners can also be configured with routers, switches, and NIDS. Monitoring Electronic Access CIP-005: R3 Monitors, logs and alerts for attempts to access ESP NIDS (network intrusion detection system) logs and monitors traffic at the outer perimeter of the Controls network. SIEM correlates logs to allow centralized view of access activities. Controls and associated network devices are not configured to support public remote dial-up devices. Cyber Vulnerability Assessment CIP-005: R4 GE helps customers meet CIP-005-4a R4 by documenting baseline configurations and ports and services for normal and emergency operations. This data can be used to support assessment activities. GE SIEM and NIDS log retention capability are configured to meet or exceed 90 day NERC storage requirement, until user can move to longer term storage. Documentation Review and Maintenance CIP-005: R5 Test Procedures CIP-007: R1 Ports and Services CIP-007: R2 The CAP Software Update Subscription supports critical infrastructure owners efforts to manage current patch levels and Anti-Virus/Host Intrusion Detection signatures, as well as enhanced backup to support continuity of operations. The patches and Anti-Virus/Host Intrusion Detection signatures provided through the CAP Software Update subscription have been evaluated for applicability, tested in a representative operational lab environment, documented securely delivered. Controls Solutions maintains a validation lab in which OS and application patches and Anti-Virus/Host Intrusion Detection signature updates are tested in a controlled, operationally representative environment, OS and major ControlST platform software revision at the customer site. Testing demonstrates that functional operation of the control and related interfaces, as well as the communication to the system is not adversely impacted by the updates. Further, updates are also tested for optional customer scope such as hardened switches, firewalls and SecurityST appliance. Any updates that are identified to potentially impact operations are excluded; these updates are documented and a mitigation strategy is developed to compensate for this security update. Any false positive identified by new signatures, which would quarantine files needed for Normal and Emergency operations are noted and instruction on how to allow whitelist these files are included. Ports and services, as well as software/processes, for HMIs, switches and controllers have been minimized to those required for normal and emergency operations Cyber Security for NERC CIP Compliance 5
NERC CIP Standards Security Patch Management CIP-007: R3 How CAP SW Subscriptions + SecurityST Support Responsible Entity s Compliance GE s patch management application, supports patch change management compliance documentation by generating a report that shows the following: Listing of applicable updates to your system Status of the update (applied or missing). Update reference information, including patch number, bulletin ID and bulletin title US Computer Emergency Readiness Team (US CERT) level of severity associated with update Time required to apply update in the representative operational test environment and whether or not a reboot is required. Malicious Software Prevention CIP-007: R4 Account Management CIP-007: R5 Monthly provision of applicable, documented and tested anti-virus and HIDS signatures. Centralized account management supports unified administration of role based access control and least privilege that easily integrates into plant wide, account management. Access logging can be centrally logged on the domain control server and maintained for 90 days or longer. Security Status Monitoring CIP-007: R6 The SIEM provides real-time capability that centrally alerts, logs and detects cyber security events, allowing operators to monitor unauthorized activity The SIEM provides a single, centralized real-time display aggregating data/logs for correlation analysis Recovery Plans for Critical Cyber Assets CIP-009: R1-R2 The SecurityST Appliance includes a centralized backup and recovery tool that allows for scheduled backup. Related documentation to support recovery procedures. 6 Cyber Security for NERC CIP Compliance
GE Measurement & Control 1800 Nelson Road Longmont, CO 80501 (540) 387-8726 (888) 943-2272 GE4Service@ge.com http://www.ge-mcs.com/controlsolutions Controls Connect customer portal: ge-controlsconnect.com * Denotes a trademark of the General Electric Company. Copyright 2012 General Electric Company. All rights reserved. GEA20307 (10/2012)