Cyber Security Awareness Month - Day 6 - NERC: The standard that enforces security on power SCADA
by Manuel Humberto Santander Pelaez (Version: 1)
The North American Electric Reliability Corporation (NERC) has published under the Critical Infrastructure Protection program a security standard that is mandatory for every SCADA to manage infrastructure within the electrical system. It has a close resemblance to ISO27002 control objectives. Look for the Critical Infrastructure protection item at NERC website. Let's have a look inside the detail of each document:
| ID | Description | Purpose |
|---|---|---|
| CIP-001-2a | Sabotage Reporting | Its purpose is to define how to handle disturbances or unusual occurrences, suspected or determined to be caused by sabotage. It indicates that companies need to define procedures and guides to handle sabotage and how to report them to the appropriate systems, governmental agencies, and regulatory bodies. |
| CIP-002-4a | Cyber Security - Critical Cyber Asset Identification |
Its purpose is to require the identification and documentation of the Critical Cyber Assets associated with the Critical Assets that support the reliable operation of the Bulk Electric System. It must include at least one of the following characteristics:
|
| CIP-003-4 | Cyber Security - Security Management Controls | Its purpose is to create and mantain Cyber Security Policy, define Leadership of a senior manager to lead an manage the implementation of CIP standards, control exceptions to policy, define and implement access control measures, change control, configuration management and information protection methodologies. |
| CIP-004-4a | Cyber Security - Personnel and Training | It requires that personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets obtained in CIP002-4a, including contractors and service vendors, have an appropriate level of personnel risk assessment, training, and security awareness as defined by the risk assessment model inside the company and in compliance with the Information Security Management System. |
| CIP-005-4a | Cyber Security - Electronic Security Perimeter | It requires the identification and protection of the Electronic Security Perimeter inside which all Critical Cyber Assets reside. This means placing controls like Firewalls that have specific support for the SCADA protocols being used, Application Whitelisting, IPS among many others. All those controls cannot induce or modify the protocol flow between all the SCADA entities in place. |
| CIP-006-4d | Cyber Security - Physical Security of Critical Cyber Assets | This standard is intended to ensure the implementation of a physical security program for the protection of Critical Cyber Assets. This include the implementation of physical controls like special locks, walls, biometric and the monitoring system checking all those controls for anomalies. |
| CIP-007-4 | Cyber Security - Systems Security Management | It requires Responsible Entities to define methods, processes, and procedures for securing those systems determined to be Critical Cyber Assets inside the Electronic Security Perimeter, like test procedures, security baseline for ports and services, security patch management, malicious software prevention, account management and security status monitoring. |
| CIP-008-4 | Cyber Security - Incident Reporting and Response Planning | It ensures the identification, classification, response, and reporting of Cyber Security Incidents related to Critical Cyber Assets. For more details on incident response, check NIST Computer Incident Response guide. |
| CIP-009-4 | Cyber Security - Recovery plans for Critical Cyber Assets |
It that recovery plans are put in place for Critical Cyber Assets and that these plans follow established business continuity and disaster recovery techniques and practices |
The implementation of the NERC CIP standards needs to be build from the Information Security Management System directives and both of them need to agree in the way controls are implemented.
Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter:@manuelsantander
Web:http://manuel.santander.name
e-mail: msantand at isc dot sans dot org
Comments