1. CIP Version 5 Immersion EnergySec Summit August 19, 2014 Steven Parker Stacy Bresler

2. Welcome Logistics Workshop format Introductions Agenda Overview of major changes in V5 Discussion of key definitions Discussion of key transition issues Q&A 2 3. Major Changes 19 new or revised definitions Bright Line Criteria BES Cyber Assets/Systems High/Medium/Low Requirement Applicability Tables Guidelines and Technical Basis New and relocated requirements 4. Bright Line Criteria Assigns impact levels to BES Cyber Systems associated with Facilities based on specific criteria Provides three levels of impact May depend on 3rd party designations In practice, not so bright. 4 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 5. Impact Levels High Primarily large control centers Medium Primarily large generation, critical generation, major substations, and remaining control centers Low Everything else that meets the definition of BES 5 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 6. Applicability Tables New approach to requirements Each requirement lists in-scope asset types Requirements vary by impact level and type of asset EACMS and PACS are directly listed instead of included by reference. 6 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 7. Guidelines and Technical Basis Provides substantial narrative discussion on the requirements Provides the SDTs intent for certain requirements Discussed the technical basis for certain requirements Contains some conflicting or unsupported statements Legal status is uncertain 7 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 8. Definitions CIP version 5 has 19 new or revised definitions to the NERC Glossary. We will review the most pertinent here today 8 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 9. Cyber Assets Programmable electronic devices, including the hardware, software, and data in those devices. Communication networks have been removed from the definition of Cyber Asset 10. BES Cyber Assets A Cyber Asset that if rendered unavailable, degraded, or misused would, within 15 minutes of its required operation, misoperation, or non-operation, adversely impact one or more Facilities, systems, or equipment, which, if destroyed, degraded, or otherwise rendered unavailable when needed, would affect the reliable operation of the Bulk Electric System. Redundancy of affected Facilities, systems, and equipment shall not be considered when determining adverse impact. Each BES Cyber Asset is included in one or more BES Cyber Systems. (A Cyber Asset is not a BES Cyber Asset if, for 30 consecutive calendar days or less, it is directly connected to a network within an ESP, a Cyber Asset within an ESP, or to a BES Cyber Asset, and it is used for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes.) 11. BES Cyber Assets Steves Translation: A Cyber Asset that, if pwned, would allow a bad guy to disrupt the operation of a facility that meets the Bright Line criteria. 12. BES Cyber Systems One or more BES Cyber Assets logically grouped by a responsible entity to perform one or more reliability tasks for a functional entity 13. BES Cyber System Information Information about the BES Cyber System that could be used to gain unauthorized access or pose a security threat to the BES Cyber System. BES Cyber System Information does not include individual pieces of information that by themselves do not pose a threat or could not be used to allow unauthorized access to BES Cyber Systems, such as, but not limited to, device names, individual IP addresses without context, ESP names, or policy statements. Examples of BES Cyber System Information may include, but are not limited to, security procedures or security information about BES Cyber Systems, Physical Access Control Systems, and Electronic Access Control or Monitoring Systems that is not publicly available and could be used to allow unauthorized access or unauthorized distribution; collections of network addresses; and network topology of the BES Cyber System. 13 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 14. Electronic Access Control or Monitoring Systems Cyber Assets that perform electronic access control or electronic access monitoring of the Electronic Security Perimeter(s) or BES Cyber Systems. This includes Intermediate Devices. 14 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 15. Electronic Access Point A Cyber Asset interface on an Electronic Security Perimeter that allows routable communication between Cyber Assets outside an Electronic Security Perimeter and Cyber Assets inside an Electronic Security Perimeter. Routable communications only Refers to interface, not a device Direction not specified (See External Routable Connectivity) 16. Electronic Security Perimeter [OLD] The logical border surrounding a network to which Critical Cyber Assets are connected and for which access is controlled. [NEW] The logical border surrounding a network to which BES Cyber Systems are connected using a routable protocol. Now limited to routable protocols 17. External Routable Connectivity The ability to access a BES Cyber System from a Cyber Asset that is outside of its associated Electronic Security Perimeter via a bi-directional routable protocol connection. 18. Interactive Remote Access User-initiated access by a person employing a remote access client or other remote access technology using a routable protocol. Remote access originates from a Cyber Asset that is not an Intermediate Device and not located within any of the Responsible Entitys Electronic Security Perimeter(s) or at a defined Electronic Access Point (EAP). Remote access may be initiated from: 1) Cyber Assets used or owned by the Responsible Entity, 2) Cyber Assets used or owned by employees, and 3) Cyber Assets used or owned by vendors, contractors, or consultants. Interactive remote access does not include system-to- system process communications. 19. Interactive Remote Access User-initiated access by a person employing a remote access client or other remote access technology using a routable protocol. Remote access originates from a Cyber Asset that is not an Intermediate Device and not located within any of the Responsible Entitys Electronic Security Perimeter(s) or at a defined Electronic Access Point (EAP). IRA must be controlled pursuant to CIP-005 R2 ESP to ESP access is not covered by this definition By definition, does not include non-routable protocols access Encryption and intermediate devices are required 20. Intermediate System A Cyber Asset or collection of Cyber Assets performing access control to restrict Interactive Remote Access to only authorized users. The Intermediate System must not be located inside the Electronic Security Perimeter. 20 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 21. Questions 22. Top 10 Issues 1. Asset Identification 2. BES Cyber System grouping 3. Impact level assessment 4. New ESP Definitions 5. Detection of Malicious Communications 6. Interactive Remote Access 7. Patch Management 8. Handling of BES Cyber System Information 22 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 23. Top 10 Issues 9. Protection of Physical I/O Ports A. Low Impact Assets B. New Definitions C. Data Preservation During Recovery D. Baseline Configurations E. Vulnerability Assessments F. Security Event Monitoring 10.Documentation Updates 23 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 24. Asset Identification 15 minute criteria BROS Inventory Not your fathers RBAM 24 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 25. BES Cyber System Grouping Definition Logical or not? Considerations Location Connectivity Impact Ratings 25 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 26. Impact Level Assessment Bright Lines Impact ratings are applied to BES Cyber Systems, NOT assets or Facilities Not based on connectivity High includes location consideration Medium does NOT include location Associated with Low Impact 26 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 27. New ESP Definitions Routable protocols only External Routable Connectivity ESP? Cyber System? Cyber Asset? Non-programmable network elements Non-routable connections 27 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 28. Detection of Malicious Communications New requirement Many ways to skin the cat Functional requirement Plausibly effective 28 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 29. Interactive Remote Access New Requirements Intermediate Systems Technical Architecture Placement of IS Multi-factor auth Encryption 29 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 30. Patch Management Source identification Must implement or mitigate New timelines Windows XP TFEs 30 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 31. Handling of BES Cyber System Information New Definition Storage Use Transit BCSI Repositories Disposal and redeployment 31 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 32. Low Impact Assets Implementation of policies Uncertainty on V6 External routable protocol paths Lists vs. inventory 32 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 33. Baseline Configurations New requirements Specific attributes to be collected Broad applicability Change management of configurations 33 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 34. Vulnerability Assessments Not well defined Paper vs. active Not a pen test Documentation and follow up requirements 34 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 35. Security Event Monitoring Functional requirements Plausibly effective Guidance and technical basis comments 35 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 36. Data Preservation During Recovery Recovery plans need to address preservation of forensics evidence Timelines 36 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 37. Protection of Physical I/O Ports Control centers only Does not need to be preventative Device configuration can suffice 37 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 38. Documentation Updates New terminology Renumbered and relocated requirements Cybersecurity policy requirements expanded Nearly all requirements require documented processes 38 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 39. New Definitions and Terminology Time to relearn the language READ THE GLOSSARY! 39 The National Electric Sector Cybersecurity Organization (NESCO) is operated by EnergySec with funding assistance from the U.S. Department of Energy 40. Questions 41. Thank You Steven H Parker President, EnergySec steve@energysec.org 503.905.2923 (desk) @es_shp (twitter) www.energysec.org