1 / 11

Ports and Services An Audit Approach

Ports and Services An Audit Approach. Reliability First CIP Webinar Thursday, September 30, 2010 Lew Folkerth, Senior Engineer - Compliance. CIP-005: ESP Access Points.

barth
Download Presentation

Ports and Services An Audit Approach

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Ports and ServicesAn Audit Approach ReliabilityFirst CIP Webinar Thursday, September 30, 2010 Lew Folkerth, Senior Engineer - Compliance 1

  2. CIP-005: ESP Access Points • CIP-005-3 R2.2: “At all access points to the Electronic Security Perimeter(s), the Responsible Entity shall enable only ports and services required for operations and for monitoring Cyber Assets within the Electronic Security Perimeter, and shall document, individually or by specified grouping, the configuration of those ports and services.” • CIP-005-3 R4.2 requires that the Cyber Vulnerability Assessment (CVA) include: “A review to verify that only ports and services required for operations at these access points are enabled” • CIP-005-3 R5 requires annual review and update within 90 days of change 2

  3. CIP-007: Systems Within ESP • CIP-007-3 R2.1: “The Responsible Entity shall enable only those ports and services required for normal and emergency operations.” • CIP-007-3 R8.2 requires that the CVA include: “A review to verify that only ports and services required for operation of the Cyber Assets within the Electronic Security Perimeter are enabled” • CIP-007-3 R9 requires annual review and update within 30 days of change 3

  4. Audit Approach • What follows is an example of how the compliance review might proceed. Since each entity is different, this example is offered only as general guidance on what to present to the audit team. 4

  5. Baseline • The baseline configuration is one or more lists of ports and services that have been determined to be needed for normal and/or emergency operations. The baseline includes: • Port or range of ports • The associated service • The operational purpose of the port and/or service • For firewalls, the source and destination address ranges • Once baseline configurations have been established, changes and exceptions should be managed by a change management process • The configuration of authorized ports and services should be able to be produced for any given time period 5

  6. Operational Purpose • Operational Purpose: The reason a port and/or service is needed for normal or emergency operations • Demonstrates that a port and/or service is “required for operations” per the language of the standard • Examples: • Insufficient: Port 22/tcp is Secure Shell (SSH). • Sufficient: Port 22/tcp is associated with the Secure Shell (SSH) service, which is required for remote administration of the SCADA system and other applications. • Sufficient: Port 22/tcp, the SSH service, is needed for unknown reasons. The service was disabled in a test environment, after which the SCADA system operated in an anomalous manner. See testing document ABC-234. 6

  7. Audit of Baseline • For the baseline configurations, the audit team will seek to determine: • Do the baselines collectively cover all applicable cyber assets? • For each port or port range listed, is there an associated service identified? • What is the operational purpose of the port and/or service? • For firewalls, are the source and destination address ranges sufficiently restricted? • Are variations from the baseline properly documented? 7

  8. Audit of Firewalls • For a sample of firewalls, the audit team will ask the entity to demonstrate that the actual configuration of the firewall matches the expected configuration – that is, the baseline plus any documented variances • The audit team will ask the entity to demonstrate that this determination has been made at least annually (per CIP-005 R4 and CIP-005 R5) 8

  9. Audit of Systems Within ESP • For a sample of systems within an ESP, the audit team will ask the entity to demonstrate that the actual ports open and services running match the expected configuration – that is, the baseline plus any documented variances • The entity is free to use any desired tool, but the audit team will accept the output of “netstat –an” if no other tool is available. • The audit team will ask the entity to demonstrate that this determination has been made at least annually (per CIP-007 R8 and CIP-007 R9) 9

  10. CVA vs. Document Maintenance • One question that usually arises from this discussion is: “What is the difference between the Cyber Vulnerability Assessment (CVA) (in CIP-005 R4 and CIP-007 R8) and Documentation Review and Maintenance (in CIP-005 R5 and CIP-007 R9)? • The Documentation Review and Maintenance provisions require the documentation to be kept up with changes to the actual systems. The documentation should be compared against the actual systems to ensure the documentation accurately reflects the configuration of the systems. • The CVA requires a review of the system configurations, not just the documentation. All ports and services should be reviewed to ensure that each is still necessary for normal or emergency operations. 10

  11. Questions • Questions should be emailed to Karen Yoder (karen.yoder@rfirst.org) Subject: “CIP WEBINAR” • Questions will be considered in the order they are received • Clarifying questions are welcome and we will do our best to answer during the question period • Challenges to a position should be addressed to the presenter and will be taken offline

More Related