Mick Neshem CISA CISSP CSSA Senior Compliance Auditor

Mick Neshem CISA, CISSP, CSSA Senior Compliance Auditor – Cyber Security CIP-005 -5 Compliance Outreach CIP v 5 Roadshow May 14 -15, 2014 Salt Lake City, UT

V 5 Open Actions [SAR 1 -4] 1. Modify or remove the IAC in the 17 impacted requirements [February 3, 2015] 2. Develop modifications to the CIP standards to address security controls for Low impact assets 3. Develop requirements to protect transient electronic devices -thumb drives, laptops that do not meet BES cyber asset definition 4. Create a definition of “communication networks” and develop new or modified standards that address the protection of communication networks [February 3, 2015] 5. Study the application of the 15 -minute parameter for identification of BES Cyber Assets and the impact of this time constraint on the overall security and reliability of the BES. SDT Industry Webinar. pdf – April 22, 2014 2

3

FERC Staff Technical Conference (4/29/14) • whether additional definitions and/or security controls are needed to protect Bulk-Power System communications networks, including remote systems access • adequacy of the approved CIP version 5 Standards’ protections for Bulk-Power System data being transmitted over data networks • functional differences between the respective methods utilized for identification, categorization, and specification of appropriate levels of protection for cyber assets using CIP version 5 Standards as compared with those employed within the National Institute of Standards and Technology Security Risk Management Framework. 4 http: //ferc. gov/Calendar. Files/20140227165846 -RM 13 -5 -000 TC. pdf

FERC Technical Conference Update • Significant discussion regarding Communications Network • Cyber Systems use of non routable communication • Cyber Security Procurement Processes • NIST Risk Management Framework and Cyber Security Framework 5

Terminology • • 6 Cyber Asset BES Cyber Asset (BCA) BES Cyber Systems (BCS) Protected Cyber Asset (PCA) Electronic Security Perimeter (ESP) External Routable Connectivity (ERC) Electronic Access Point (EAP) Dial-up Connectivity

V 3 vs. V 5 Requirement Count • CIP v 3 o 5 Requirements (Version 3) o 26 Sub-requirements • CIP v 5 o 2 Requirements (Version 5) o 8 Parts 7

Applicable Systems 8

Moved 9

Deleted 10

IAC • 17 CIP Requirements that include IAC (2/3/2015) • CIP-005 -5 contains no Identify, Assess and Correct language in requirement. 11

CIP-002 -5 & CIP-005 -5 • CIP-002 -5 is the initial identification of the BES Cyber System • It is important for the CIP-002 -5 and CIP 005 -5 teams in your organization to work closely in the identification of BES Cyber Systems and Impact Rating Criteria (IRC) • ESP boundaries and High Water Mark impacts may affect CIP-005 -5 architecture 12

High Level Relationships [CIP-002 -5] Control Centers and Backup Control Centers (RC, BA, TOP or GOP) that meets CIP-002 -5 Attachment 1 Section 1 requirements BES Assets High Impact Facilities Medium Impact Facilities R 1. 1 BES Cyber Systems (BCS) BES Cyber Assets 13 CIP-002 -5 Attachment 1 Section 2 requirements R 1. 2 PCA BES Cyber Systems (BCS) BES Cyber Assets PCA

High Level Relationships [CIP-002 -5] BES Assets High Impact Facilities R 1. 1 BES Cyber Systems (BCS) One or more BES Cyber Assets logically grouped by a responsible entity to perform one or more reliability tasks for a functional entity Medium Impact Facilities R 1. 2 BES Cyber Systems (BCS) PCA BES Cyber Assets 14 Programmable electronic devices, including the hardware, software, and data in those devices PCA BES Cyber Assets

High Level Relationships [CIP-002 -5] BES Cyber Asset High Impact Facilities R 1. 1 BES Cyber Systems (BCS) BES Cyber Assets 15 - A Cyber Asset that if rendered unavailable, degraded, BES Assets or misused would, within 15 minutes of its required Medium Impact operation, misoperation, or non-operation, adversely Facilities impact one or more Facilities, systems, or equipment, which, if destroyed, degraded, or otherwise rendered unavailable when needed, would affect the reliable R 1. 2 operation of the Bulk Electric System. Redundancy of BES Cyber affected Facilities, systems, and equipment shall not be Systems considered when determining adverse impact. Each BES (BCS) Cyber Asset is included in one or more BES Cyber Systems. (A Cyber Asset is not a BES Cyber Asset if, for 30 consecutive calendar days or less, it is directly BES Cyber connected to a network within an ESP, a Cyber Asset BES Cyber Assets within an ESP, or to a BES Cyber Asset, and it is used Assets BES Cyber for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes. ) Assets

CIP-005 -5 R 1 Part 1. 1 16

Changes 17 http: //www. nerc. com/docs/standards/sar/Mapping_Docu ment_012913. pdf

CIP-005 -5 R 1. 1 [ESP] High Impact BCS PCA R 1. 1 Internal Routable Connectivity ? Medium Impact BCS PCA YES The logical border surrounding a network to which BES Cyber Systems are connected using a routable protocol. 18 Requires ESP One or more Cyber Assets connected using a routable protocol within or on an Electronic Security Perimeter that is not part of the highest impact BES Cyber System within the same Electronic Security Perimeter. The impact rating of Protected Cyber Assets is equal to the highest rated BES Cyber System in the same ESP. A Cyber Asset is not a Protected Cyber Asset if, for 30 consecutive calendar days or less, it is connected either to a Cyber Asset within the ESP or to the network within the ESP, and it is used for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes.

Defined ESP 19

Electronic Security Perimeter • Version 3 (1/18/2008) o The logical border surrounding a network to which Critical Cyber Assets are connected and for which access is controlled. • Version 5 (4/1/2016) o The logical border surrounding a network to which BES Cyber Systems are connected using a routable protocol. 20

Electronic Security Perimeter(s) ‘defined’ • ESP defines a zone of protection around the BES Cyber System • Helps determine what systems or Cyber Assets are in scope and what Impact Rating the Cyber Systems meet, ultimately determines which requirements are applicable 21

ESPs • Isolated • Discrete • Extended 22

Isolated ESP • ESP network with no external connectivity o An ESP (a logical border) is required around every routable protocol network that contains a BES Cyber System, even if it is an isolated network and has no external connectivity 23

Isolated ESP – No External Communications EMS Electronic Security Perimeter File Server Non-BCS Workstations PCA Printer PCA PCA Switch CIP-007 CIP-005 BCA/PCARouter Printer CIP-002 PCA BCA Switch CCA BCA/PCA BCS Workstations BCA 24 BCA BCA EMS Servers

High Water Mark • CIP Cyber Security Standards do not require network segmentation of BES Cyber Systems by impact classification • A new concept from tiered impact model • Many different impact classifications can be identified within an ESP, however, the highest level of the BCS within the ESP sets the High Water Mark for all associated assets within that ESP 25

High Water Mark 26

High Water Mark 27

Discrete ESPs 28

Discrete ESPs 29

Extended ESP 30

Extended ESP CORP 31

Extended ESP • “If an entity wishes to state that a wide area network of sites are within one ESP, regardless of encryption, then all Cyber Assets (which includes, e. g. , all communication or networking equipment) within that very large ESP become associated PCAs and must meet the Requirements of the highest level BES Cyber System in the ESP. The standards do not preclude doing this, but there are implications that Responsible Entities should take into account” 32 Final_Petition_CIP_V 5. pdf (Jan. 31, 2013, page 45)

CIP-005 -5 Communication Equipment • Communications equipment between sites; o If using routable communication the communications equipment connecting discrete ESPs are not in scope (4. 2. 3. 2) o Extended ESPs will need to include the communications equipment – not “discrete” ESPs o Serial communications equipment will be included as no exclusion exists o This is TBD by Communication standard work in progress - wait and see GET INVOLVED § Contact Ryan Stewart at NERC to be added to the SDT plus list Ryan. Stewart@nerc. net 33

BCS Boundaries Can a BCS span multiple facilities crossing discrete ESPs? 34

BCS Boundaries [Single BCS] 35

BCS Boundaries [Multi BCS] 36

Example EMS ESP [Routable] EMS Electronic Security Perimeter Workstations Printer EMS WAN File Server CIP-005 Corp. Net Router Access Control Server Switch EAP Firewall CIP-007 CIP-005 Router EAP CCA Firewall Switch DMZ CCA Printer CCA EACM CCA Intermediate Server 37 CCA Access Control Server CCA Workstations CCA EMS Servers

Example EMS ESP [Routable] EMS Electronic Security Perimeter All PCA devices take on the impact level of the BCS File Server Non-BCS Workstations PCA Printer PCA Router PCA Switch CIP-005 DMZ Printer CIP-002 PCA BCA EACM Access Control Server Switch CCA BCA/PCA BCS Workstations BCA Intermediate Server Firewall CIP-005 BCA/PCARouter Firewall Switch 38 EAP CIP-007 EAP Corp. Net EMS WAN BCA BCA EMS Servers

Example EMS ESP [Multi-BCS ESP] EMS Electronic Security Perimeter BCS Server BCS Workstations BCA BCA BCS CIP-005 EAP Firewall CIP-005 BCA/PCARouter BCA Firewall DMZ CIP-005 EACM Printer CIP-002 PCA BCA Intermediate Server EACM Access Control Server Switch CCA BCA/PCA BCS Workstations BCA 39 Router CIP-007 EAP Switch EMS WAN PCA BCA Switch MEDIUM Corp. Net Printer BCA BCA EMS Servers HIGH

Example EMS ESP [High Water Mark Impact] EMS Electronic Security Perimeter All PCA devices take on the impact level of the BCS File Server Non-BCS Workstations PCA Printer EMS WAN PCA Router PCA Switch EAP Firewall EAP Corp. Net BCA/PCARouter Switch DMZ Switch Printer CCA BCA/PCA BCA EACM Intermediate Server EACM Access Control Server BCS Workstations BCA 40 BCA Firewall BCA BCA EMS Servers

Non-Routable BCS • Cyber Assets are subject to the CIP standards based on their functionality and resultant potential impact to BES reliability • BES Cyber Systems and associated BES Cyber Assets are not dependent upon a routable protocol (see definitions) o A BES Cyber System may include non-routable (serial) devices. End point devices (relays) may be included within the v 5 requirements and identified as BES Cyber Assets, even if no routable communications exist. Therefore, there are v 5 requirements to be addressed (i. e. CIP-007 -5) 41

BCS and ESPs • Does a BCS require an ESP? o BCS may not require an ESP o A BCA with no routable connectivity cannot be part of an ESP o The level of protection required depends on the classification (IRC) of the asset § Still required to apply the protections under CIP-007 that apply to a BCA/PCA 42

Mixed connectivity BCS Non-routable BCA 43

Non-Routable BCS 44

Measures (Part 1. 1) • List of BES Cyber Systems • List of BES Cyber Assets within each BCS o A BCA may be included in more than one BCS • List of Protected Cyber Assets (associated assets) • ESP network topology including subnets • Cyber Asset IP addresses 45

CIP-005 -5 R 1 Part 1. 2 46

Changes 47

CIP-005 -5 R 1. 2 [Electronic AP] High Impact BCS PCA R 1. 1 Internal Routable Connectivity ? Medium Impact BCS PCA YES Requires ESP The ability to access a BES Cyber System from a Cyber Asset that is outside of its associated Electronic Security Perimeter via a bidirectional routable protocol connection. External Routable Connectivity ? YES R 1. 2 Requires Electronic Access Point 48 A Cyber Asset interface on an Electronic Security Perimeter that allows routable communication between Cyber Assets outside an Electronic Security Perimeter and Cyber Assets inside an Electronic Security Perimeter.

Change Rationale (Part 1. 2) • Changed to refer to the defined term Electronic Access Point (EAP versus ESP access point) and BES Cyber System • Where external routable connectivity and the ESP logical border are defined by the implementation of Electronic Access Points (EAPs) 49

Electronic Access Point ‘identified’ • • • Firewalls Modems VPN concentrators Dual-homed systems Protocol converters (communications controllers, FEP, etc. ) • Etc. 50

Unidirectional Gateways 51

External Routable Connectivity • External Routable Connectivity’ includes the term ‘bi-directional’ o ‘bi-directional routable protocol connection’ • Systems behind a data diode do not have External Routable Connectivity 52

Serially Connected Cyber Assets • Are serially connected Cyber Assets within scope for Requirements applicable to BES Cyber Systems with External Routable Connectivity? o All BES Cyber Assets are in scope of all the CIP Version 5 standards o Type of connectivity limits applicability 53

Protocol Conversion • Non-intelligent Device – thing of the past o Serial IP conversion o One to one relationship – one serial port & 1 IP port o Non-intelligent – no advanced conversion capabilities • Intelligent Device o Serial IP conversion o Multiple serial ports supported with individual port management o Advanced conversion and connectivity capabilities per serial port § Reverse telnet per serial port § Passthru capabilities – direct IP to specific serial device connected to a serial port on the device 54

Cisco TS [2511] – Reverse Telnet TCP Port associated with the specific serial device http: //www. cisco. com/c/en/us/support/docs/dialaccess/asynchronous-connections/5466 -commserver. html#design http: //www. cisco. com/c/en/us/support/docs/dial 55 access/asynchronous-connections/177199. html#reversetelnet

DIGI TS http: //ftp 1. digi. com/support/documentation/90287 00 c. pdf -- (page 113) 56

Protocol Conversion Issues • • • 57 External Routable Connectivity (ERC) High Water Mark Impacts Electronic Security Perimeter (ESP) Electronic Access Point (EAP) V 5 Standard & Guidance Connectivity versus accessibility

Serial to Field Device 58

Serial to Field Device 59

Serial Communications [standalone ESPs] SCADA WAN Telecom IP BCA serial BCA IP serial BCA Serial/Routable RTU Terminal Server Protocol convertor FEP Router/Switch 60 serial BCA BCA BCA

Routable Communications [Discrete ESPs] SCADA WAN IP IP Telecom EAP EAP serial BCA 61 Serial/Routable RTU Terminal Server Protocol convertor FEP Router/Switch BCA serial IP BCA serial BCA BCA BCA

Single BCS across PSP/ESP [Discrete ESPs] SCADA WAN IP IP Telecom EAP serial BCA IP EAP serial BCA BCA serial BES Cyber System BCA 62 BCA BCA

Multiple BCS example [Routable – Discrete ESPs] SCADA WAN IP IP Telecom EAP Serial – IP convertor serial BCA IP BCA BCA PCA serial 63 serial BCA Serial – IP convertor Medium BCS IP EAP BCA BCA Medium BCS

PCC Serial WAN Serial Subs PSP EMS Electronic Security Perimeter File Server Non-BCS Workstations PCA ESP Printer PCA PCA PSP Medium BCS BCA RTU BCA serial BCA BCA PCA Corp. Net Switch Medium BCS EAP PCA RTU Router BCA serial BCA BCA Printer Switch High BCS FEP CCA BCA/PCA BCS PCA BCA BCA Workstations BCA 64 BCA BCA EMS Servers

PCC Routable with Serial & IP substations EMS Electronic Security Perimeter File Server Medium BCS Non-BCS Workstations PCA Printer PCA EAP PCA BCABCA IP IP RTU IP BCA BCA PCA Corp. Net IP Switch Medium BCS EAP IP BCA/PCA Router BCA EAP Printer serial BCA Switch High BCS RTU BCA BCA CCA BCA/PCA BCS PCA serial BCA Low BCS BCA Workstations BCA Serial RTU BCA ESP 65 BCABCA EMS Servers PSP Serial BCA BCA

Field Devices - Complexity • Connection method (serial, Ethernet, etc. ) • Connection protocol (non-routable, routable) • Serial convertors/ controllers – IP accessible requires EAP capabilities if IRA • End to end serial, no ESP or EAP required • Be aware of multiple connection types 66

SEL-421 Connectivity capabilities Ethernet (IP) 67 https: //www. selinc. com/SEL-421/

IP Accessible CIP-006 -5 ERC Impacts • • • 68 CIP-006 -5 Part 1. 2 – physical access controls Part 1. 4 – Monitor for unauthorized PSP access Part 1. 5 – Alarms and alerts on detection of unauthorized access to PSP Part 1. 6 – PACS systems monitoring Part 1. 7 – PACS alarms Part 1. 8 – Logging of access for authorized unescorted access Part 1. 9 – Retention of access logs for 90 days Part 2. 1 – Visitor escort requirements Part 2. 2 – Visitor logging required Part 2. 3 – Visitor log retention

Span Ports 69 https: //supportforums. cisco. com/docs/DOC-32763

Span Ports • SPAN – typical for IDS sensor o local • RSPAN o Cannot cross any Layer 3 device • ERSPAN (Cisco proprietary) o Can monitor traffic across a WAN or different networks –L 3 connectivity o Look for an identified EAP 70

R 1. 2 Audit Approach • V 3 Electronic Access Points and routable connectivity concepts are valid – ESPs expanded to “isolated” ESPs • Electronic Access Point required for all ESPs with any external routable connectivity to or from BES cyber assets • External Routable Connectivity – o What about “IP Accessible” via routable protocol? o Routable protocol accessible? – serial IP conversion o The serial field devices are no longer under a serial exemption, therefore are included within BCS as a BCA. They are now included in CIP compliance Standards based on BES criteria (reliability operating services), regardless of their connectivity method o However, be aware of reverse telnet risks (IP Accessible) associated with protocol conversion devices – may require IRA and ERC requirements o Extended ESPs are still a valid ESP configuration 71

Measures (Part 1. 2) • Network Diagrams • External routable communication paths • List of all Identified EAPs 72

CIP-005 -5 R 1 Part 1. 3 73

CIP-005 -5 R 1. 3 [Bi-Directional Controls] High Impact BCS PCA The logical border surrounding a network to which BES Cyber Systems are connected using a routable protocol. The ability to access a BES Cyber System from a Cyber Asset that is outside of its associated Electronic Security Perimeter via a bidirectional routable protocol connection. A Cyber Asset interface on an Electronic Security Perimeter that allows routable communication between Cyber Assets outside an Electronic Security Perimeter and Cyber Assets inside an Electronic Security Perimeter. 74 R 1. 1 Internal Routable Connectivity ? Medium Impact BCS PCA YES Requires ESP R 1. 2 External Routable Connectivity ? YES Requires Electronic Access Point R 1. 3 Requires Bi-directional controls One or more Cyber Assets connected using a routable protocol within or on an Electronic Security Perimeter that is not part of the highest impact BES Cyber System within the same Electronic Security Perimeter. The impact rating of Protected Cyber Assets is equal to the highest rated BES Cyber System in the same ESP. A Cyber Asset is not a Protected Cyber Asset if, for 30 consecutive calendar days or less, it is connected either to a Cyber Asset within the ESP or to the network within the ESP, and it is used for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes.

Change Rationale (Part 1. 3) • Changed to refer to the defined term Electronic Access Point and to focus on the entity knowing and having a reason for what it allows through the EAP in both inbound and outbound directions 75

Audit Approach (Part 1. 3) • Responsible Entity knows what other Cyber Assets or ranges of addresses a BES Cyber System needs to communicate with and limits the communications to that known range • Not required to document the inner workings of stateful firewalls, where connections initiated in one direction are allowed a return path 76

Access Permissions • “SDT notes the requirement does not require that all 65535 ports be documented as this is a ‘deny by default’ requirement and only the remaining open ports (those that ‘grant access’) should be documented. ” Final_Petition_CIP_V 5. pdf (Jan. 31, 2013, page 46) 77

Measures (Part 1. 3) • Established baseline • Electronic Access Point(s) configuration(s) • Utilize ‘remark’ type command 78

ACL Remarks Object-group network BCS 1 Network-object host 10. 1. 1. 3 Network-object host 10. 1. 1. 4 Object-group network BCS 2 Network-object host 172. 16. 1. 5 Network-object host 172. 16. 1. 8 access-list 101 remark BCS 1 hosts allowed to communicate with BCS 2 hosts access−list 101 remark permit_SSH for EIA access−list 101 permit tcp host 10. 1. 1. 2 host 172. 16. 1. 10 eq 22 access-list 201 remark ‘deny by default CIP-005 -5 R 1. 3 access-list 101 deny ip any log access=-list 201 remark BCS 2 hosts allowed to communicate with BCS 1 access-list 201 remark permit_iccp access-list 201 permit tcp host 10. 1. 1. 3 host 172. 16. 1. 5 eq 102 access-list 201 remark ‘deny by default CIP-005 -5 R 1. 3 access-list 201 deny ip any log Access-group 101 in interface ethernet 0/0 79

Audit Approach (Part 1. 3) • Requirement does not require that all 65535 ports be documented as this is a ‘deny by default’ requirement • Only the remaining open ports (those that ‘grant access’) should be documented per R 1. 3 • Does not limit the Responsible Entity from controlling outbound traffic at the level of granularity that it deems appropriate and large ranges of internal addresses may be allowed 80

Identifying Ports and Services for EAP/EACM • Is an EAP an EACM in version 5? o To remove any cross referencing, these Cyber Assets are now included in the Applicability column for each cyber security requirement 81

Categorization Criteria • Electronic Access Control or Monitoring Systems (“EACMS”) o Examples include: Electronic Access Points, Intermediate Devices, authentication servers (e. g. , RADIUS servers, Active Directory servers, Certificate Authorities), security event monitoring systems, and intrusion detection systems 82

CIP-005 -5 R 1 Part 1. 4 83

Changes 84

Change Rationale (Part 1. 4) • Added clarification that dial-up connectivity should perform authentication so that the BES Cyber System is not directly accessible with a phone number only 85

‘Dial-up Connectivity’ • A data communication link that is established when the communication equipment dials a phone number and negotiates a connection with the equipment on the other end of the link • CIP-005 -5 is silent on differentiating Dial-in vs. Dial-out direction • Dial-up is generally and historically recognized as a two way communication service once established • Requirement R 2 (Interactive Remote Access) builds upon Requirement R 1. 4 when the session meets the definition of Interactive Remote Access 86

R 1. 4 Audit Approach • Requires authentication for all dial-up accessible cyber assets • Authentication – does not require multifactor authentication as in IRA • Capability does not mean – “because we do not want to” or “it makes access difficult”, “our techs wont use it”, etc…. 87

CIP-005 -5 R 1. 4 Applicability • Applies to any access including machine to machine • CIP-005 R 1. 4 concerns the security of the ‘network’ level and requires that there be some form of authentication before a ‘network’ connection is established to the BES Cyber System o R 2 only applies to ‘Interactive Remote Access’ which is user-based • EAP-like functionality on dialups o Once a connection is made, then CIP-007 applies as we’ve moved from the ‘network’ level security to device level security and any user access has to be authenticated at the device 88

Measures (Part 1. 4) • “…a documented process…” • Auditors conducting performance audits • “…how the Responsible Entity is providing authenticated access through each dial‐up connection. ” 89

CIP-005 -5 R 1 Part 1. 5 90

Changes 91

CIP-005 -5 R 1. 5 [Malicious Communication Detection] High Impact BCS Medium Impact BCS PCA Control Centers Electronic Access Point Exists? Yes R 1. 5 Requires Bi-directional monitoring for malicious activity 92

Change Rationale • Per FERC Order No. 706, Paragraphs 496503, ESPs need two distinct security measures such that the Cyber Assets do not lose all perimeter protection if one measure fails or is misconfigured. The Order makes clear this is not simple redundancy of firewalls, thus the SDT has decided to add the security measure of malicious traffic inspection as a requirement for these ESPs. 93

Audit Approach (Part 1. 5) • Is audit approach to detect 100% of all malicious communications? o “Known or suspected” o Communications that have attributes of known or suspected malicious communications 94

IDS placement 95

Audit Approach (Part 1. 5) • Direction of the traffic monitored o both inbound and outbound traffic subject to the detection • Placement of malicious communications inspection o specific architecture and placement is not prescribed • Number of IDS’s o Applicability is set at the EAP level o EAPs at Medium Impact BCS Control Centers needs to be covered by the entity’s method for detecting malicious communications • CIP-007 -5 Part 4 addresses logging (4. 1) and alerting (4. 2) for this malicious communications detection device (EACMS) 96

EAP Malicious Code Prevention • No TFE language in CIP-007 -5 R 3 for EACMS • Requirement has been written at a much higher level than previous versions • Guidance has numerous suggested methods up to and including policy level measures • Requirement no longer prescriptively requires a single technology tool for addressing the issue 97

Unified Threat Management (UTM) • Does the IDS measure have its own configuration, firmware, module? • Can the IDS measure operate independent of a failure or misconfiguration of the Electronic Access Point? 98

Audit Approach (Part 1. 5) • Isolated networks applicability? o Isolated networks do not have EAPs o R 1. 5 would not be applicable? o IDS is an EACM … therefore § Detection is only one half of the issue § Addressing or mitigating the detected threat per CIP-007 -5 R 4 99

EACMs and PACS • EACMs and PACS can still be located outside an ESP • PACS o No distinction between “field devices” and “central servers” o Protections primarily through the CIP-007 requirements for authorization, access control, and logging and monitoring for these systems 100

Measures (Part 1. 5) • • 101 Dual protection architecture IDS configuration Layer 7 firewall configuration Monitoring evidence

R 1 Issues & Pitfalls • EAP and Intrusion Detection System (IDS) o Need both technologies not just access control • Inbound and outbound access controls o Requires detailed understanding of all traffic • Bi-directional monitoring • Multiple ESPs with different impact levels at one facility o Intercommunications and High Water Mark • Extended ESPs may still be a valid ESP architecture – Technical conference to provide communications devices security controls may affect the Extended ESP architecture – stay tuned 102

R 2 Interactive Remote Access 103

v 5 Interactive Remote Access • v 5 – CIP-005 -5 R 2 Summary § Requires Intermediate system [proxy/jump host] § Requires encryption to intermediate system § Requires multi-factor authentication at intermediate system § Strong Procedures are not included as option for interactive remote access 104

CIP-005 -5 R 2. 1 105

Changes 106

CIP-005 -5 R 2. 1 [Intermediate System] High Impact BCS PCA User-initiated access by a person employing a remote access client or other remote access technology using a routable protocol. Remote access originates from a Cyber Asset that is not an Intermediate System and not located within any of the Responsible Entity’s Electronic Security Perimeter(s) or at a defined Electronic Access Point (EAP). Remote access may be initiated from: 1) Cyber Assets used or owned by the Responsible Entity, 2) Cyber Assets used or owned by employees, and 3) Cyber Assets used or owned by vendors, contractors, or consultants. Interactive remote access does not include system-to-system process communications. Interactive Remote Access ? A Cyber Asset or collection of Cyber Assets performing access control to restrict Interactive Remote Access to only authorized users. The Intermediate System must not be located inside the Electronic Security Perimeter. 107 Yes R 2. 1 Requires Intermediate System for Interactive Remote Access Yes Medium Impact BCS External Routable Connectivity ? PCA

R 2. 1 Audit Approach • All Interactive Remote Access requires an intermediate system that “proxies” all traffic into the ESP o No direct external access from client to internal BES cyber asset o Source IP address is the IP address of the intermediate system – no pass through • System-to system process communications not IRA o Can this communications be accessed for interactive remote access? • System Interactive communication– capabilities are key, not limited to functional use alone • Interactive Remote Access includes any cyber asset that is not within the ESP o (i. e Corp net, DMZs, Substation, Internet, etc. ) and includes bidirectional traffic to/from a lower security zone (non-ESP) • ESP interactive access does not require R 2 108

CIP-005 -5 R 2. 2 109

CIP-005 -5 R 2. 2 [Encrypted communications] High Impact BCS PCA Medium Impact BCS Interactive Remote Access ? Yes R 2. 1 Requires Intermediate System for Interactive Remote Access R 2. 2 Requires encryption that terminates at Intermediate System 110 Yes External Routable Connectivity ? PCA

R 2. 2 Audit Approach • Interactive Remote Access requires encryption from remote client all the way to the intermediate system • Intermediate system provides decryption of the encrypted traffic • ESP remote access only allowed into the ESP from the intermediate system o source IP address of the intermediate system • Restrictive access controls defined for all traffic from the intermediate system into the ESP • All Intermediate system communications into the ESP must traverse an EAP prior to entry into ESP 111

CIP-005 -5 R 2. 3 112

CIP-005 -5 R 2. 3 [Multi-factor Authentication] High Impact BCS PCA Medium Impact BCS Interactive Remote Access ? Yes External Routable Connectivity ? PCA Yes R 2. 1 Requires Intermediate System for Interactive Remote Access R 2. 2 Requires encryption that terminates at Intermediate System R 2. 3 Requires multi-factor authentication 113 Multi-Factor Authentication -- examples • Something the individual knows such as passwords or PINs. • Something the individual has such as tokens, digital certificates, or smart cards; • Something the individual is such as fingerprints, iris scans, or other biometric characteristics.

R 2. 3 Audit Approach • Multi-factor authentication is required for all Interactive Remote Access • Multi-factor authentication requires at least two of the following: o Something you have (tokens) o Something you know (passwords) o Something you are (biometrics) • Multi-factor authentication is required at the intermediate system –this is in addition to external corporate VPN access authentication 114

v 3 Remote Access [Discreet ESP] Support Corp DMZ Internet Encrypted Corp VPN concentrator 2 Factor Technical solution Requires 2 -factor authentication for ESP access from both networks ESP EAP Vendor All internal corp access into the ESP is the same as the “Logical VPN User” EMS WAN Logical VPN User Corp. Net EAP Corporate User ESP EMS Console 1 -4 Prod Net EAP Mgmt DMZ Prod. AD 2 Factor 115 Mgmt. AD Jump Host EMS Not required, but best practice HMI 1 ICCP 1 - 2

v 5 Remote Access [Discreet ESP] Support Requires 2 -factor authentication for ESP access Corp DMZ Internet Encrypted Corp VPN concentrator 2 Factor Vendor All internal corp access into the ESP is the same as the “Logical VPN User” Medium EAP ESP Logical VPN User Corp. Net EAP Corporate User ESP Prod Net EMS Console 1 -4 BES Cyber System High Mgmt DMZ PCA Prod. AD 2 Factor 116 Mgmt. AD Jump Host EMS WAN REQUIRED EMS HMI 1 ICCP 1 - 2 EAP

R 2 Issues & Pitfalls • v 5 potential issues: o Adding an “intermediate system” into current remote access architectures o Proxy architecture – how will this affect access data flows and performance o Encryption to the intermediate system o Multi-factor authentication at the intermediate system o High water mark security 117

What Do We Do Now? • Additional ESP identification – routable connectivity of High and Medium impact Cyber Systems – with no external routable communications • Inbound and outbound access controls o Requires detailed understanding of all traffic • EAP and IDS – requires both technologies • Bi-directional monitoring • Adding an “intermediate system” into current remote access architectures • Planning for proxy architecture – how will this affect access • Encryption to the intermediate system • Multi-factor authentication at the intermediate system 118

CIP-005 -5 Roadshow Presentation Revision History CIP-005 -5 Change History Date By V 1 Initial Presentation developed for SLC V 5 Roadshow 2/4/14 M Neshem, M King V 2 Presentation modified for Marina Del Ray Roadshow. Added drawings, VM slides added, UTM slides added and modified slide content 3/18/14 M Neshem, M King V 3 SMUD Outreach presentation modified to clarify questions received from previous presentation. Serial relay communications clarification and additional detailed slides. SAR additional slide 5/5/14 M Neshem, M King V 4 Updated content and presentation flow for SLC Roadshow based upon previous lessons learned. Removed redundant slides, modified content as needed. Change order of serial relay topic. Added Revision table. Updated slides 43 and 44 for clarification 5/14/14 M Neshem, M King 119

Questions? Michael (Mick) Neshem CISA, CISSP, CSSA Senior Compliance Auditor - Cyber Security Western Electricity Coordinating Council (WECC) 7400 NE 41 st Street, Suite 320 Vancouver, WA 98662 Mneshem@wecc. biz (C) 425. 891. 4671 (O) 801. 734. 8187