CIP-005-5 R1.5 Spring CIP Audit Workshop April 14, 2016 Scott - PowerPoint PPT Presentation

CIP-005-5 R1.5 Spring CIP Audit Workshop April 14, 2016 Scott Pelfrey, CISA, CISSP, GISP, MBA Senior Technical Auditor

CIP-005-5 Part 1.5 – Learning Objectives  Terminology  Discussion of IPS/IDS & firewall  Questions Answered  Overview of Requirement  Audit Approach by RF 2 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Terminology  BES Cyber Asset (BCA)  High Impact BES Cyber Systems (BCS)  Protected Cyber Asset (PCA)  Electronic Security Perimeter (ESP)  Electronic Access Point (EAP)  Intrusion Prevention System (IPS)  Intrusion Detection System (IDS)  Firewall 3 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Discussion  Firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS) 4 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 - Firewall  Firewall – Analyzes packet headers, enforces policy ‒ Policy based on: • Protocol Type • Source Address • Destination Address • Source Port • Destination Port ‒ Transparent and Fast 5 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Firewall Details (1)  Capabilities • Single point for monitoring, exclusion of attacks, unauthorized users, malware, viruses, etc. • Convenient platform for Internet functions not security related • Can log or audit ingress / egress activities • Stateful Inspection ‒ Keeps “directory” of TCP connections ‒ Only allows incoming traffic for “known” connections ‒ May also keep track of TCP sequence numbers as well 6 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Firewall Details (2)  Limitations • Cannot protect against attacks bypassing device (Transient devices) • May not fully protect against threats ‒ May be vulnerable to IP address spoofing, source route attacks & tiny fragment attacks ‒ Vulnerable to TCP/IP protocol bugs • Improper configuration may lead to breaches • Wireless connections may circumvent firewall 7 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Firewall Example 8 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IDS  Intrusion Detection System (IDS)  Analyzes packets – both header and payload – looks for known events ‒ known event detected; a log message generated detailing event 9 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IDS Details (1)  Two Physical Types • Host-Based ‒ Resident on one system ‒ M onitors only that system’s activity ‒ Can detect both Internal / External intrusions • Network-Based ‒ Monitors particular network segments or devices ‒ May be inline (as part of another net device) or passive (copy of traffic through tap or mirrored port) 10 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IDS Details (2)  Two Detection Types • Signature or Rules Detection ‒ Analyze records for match with current rules or signatures ‒ Requires constant updates for protection ‒ Issue: only knows known intrusions, new intrusions may not be found • Anomaly Detection ‒ Builds profile or keeps thresholds ‒ Matches incoming packets to profiles or thresholds ‒ Issue: May have false positives during “extreme” events • Events generated from deviations of either 11 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IDS Example Corporate Network 12 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IPS  Intrusion Prevention System (IPS) analyzes packets – both header and payload – looks for known events ‒ known event detected the packet is rejected 13 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IPS Details (1)  Host Based • Resident on one system • M onitors only that system’s activity • Can detect both Internal / External intrusions • Uses both Signature/Rules & Anomaly Detection • Can be tailored for specific purpose ‒ Web, Database, General • May use sandbox to monitor behavior • May give file, registry, or I/O protection 14 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IPS Details (2)  Network Based • Inline IPS can discard packets or terminate TCP connections • Uses both Signature/Rules & Anomaly Detection • May provide content flow protection • Identifies malicious packets using multiple methods 15 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IPS Example Host-Based IPS 16 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Differences (1)  Firewall – use of rules to “pass” traffic through (looking for a rule to allow packets through)  IPS – use of rules to “block” traffic through (looking for a rule to drop packets)  Firewall/IPS – “control” devices, sitting inline and controlling packets  IDS – “visibility” tool 17 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Differences (2)  IPS/IDS – Functional difference very subtle between two  IPS/IDS – Sometimes only configuration setting  IPS/IDS – May or may not be physical modules  IPS/IDS – Often functionally indistinguishable (even if they are two separate devices or modules) 18 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – IDS/IPS Management 19 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – NGFW (1)  Next Generation Firewall (NGFW)  Newer concept  Single device converges FW and IDS/IPS  Deep packet inspection of both Header and Payload in one action  Decision-making capabilities for policy enforcement 20 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – NGFW (2)  Supports typical FW capabilities (NAT, VPN, QoS, packet filtering)  Adds • Intrusion Prevention • SSL / SSH inspection • Reputation-based Malware detection • Application Awareness • Signature-based antivirus 21 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – NGFW (3) 22 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – NGFW Single Pass Architecture 23 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Overview (1) 24 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Overview (2)  Applies to only Electronic Access Points (EAPs)  Applies only to High/Medium Control Centers • specifically RC, BA, TO, GO  Best Practice – apply to all EAPs… 25 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Questions  A couple of questions answered first… 26 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Question 1  Why include outbound communications? 27 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Answer  Compromised BCA – outside communication (Command and Control)  First level of defense to stop Command & Control (C&C) exploit  Know what you connect to and limit traffic to those communications needs to include: • Normal Operations • Emergency Operations • Support • Maintenance • Troubleshooting 28 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Question 2  Do we need two separate devices? • Part 1.5 direct result of FERC Order 706, Paragraphs 496-503 • ESPs required to have two DISTINCT security measures • Further explanation in FERC Order 706-A, paragraph 66 - requirement for two separate and distinct electronic devices (but that doesn’t necessarily mean two physical devices) for defense-in-depth 29 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 - Answer  Short Answer: No.  CIP Version 5 FAQs – Need one or more METHODS… not physical devices… modules CAN reside on same appliance 30 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Guidelines  Guidelines and Technical Basis Overview 31 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Guidelines (1)  Large ranges of internal addresses allowed (ephemeral ports…)  You know what ranges are required – (Document)  Suggest communication through EAP to Entities address space ONLY – no internet  Know what you talk to – both inside and outside of ESP – (Document)  Need to detect rogue connections and block 32 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Guidelines (2)  “Deny by default” – need to see explicit (or implicit) “deny all” in ruleset  Direct serial or non-routable connections not included  Use common sense and due diligence  Fail “open” but maintain perimeter protection  Show malicious traffic inspection – (Document)  Require “deep packet inspection”  Redundancy of firewalls does NOT count 33 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Audit Approach  ReliabilityFirst’s Audit Approach 34 Forward Together • ReliabilityFirst

CIP-005-5 Part 1.5 – Audit Approach (1)  Most entities – EAP is firewall (Juniper, Cisco, Microsoft, Check Point, Palo Alto, Sophos, WatchGuard, Barracuda, many others…) - first line of defense  May add modules, separate systems, taps to monitor ingress – egress traffic on EAP  May be host-based or network-based for malicious communications – Entity decision – (Document)  Updates – Software / Firmware  Change control for updates 35 Forward Together • ReliabilityFirst