Logical Ports and Services David Sopata 4/14/2016 Agenda High - PowerPoint PPT Presentation

Logical Ports and Services David Sopata 4/14/2016

Agenda  High level methodology and tips from a recovering CIP Auditor on how to: • Identify Ports and Services for BES Cyber Systems and/or Assets CIP-007-6 • Justifying the use of Ports and Services CIP-007-6 • Incorporating the information into a baseline CIP-010-2 • Monitoring the Baseline CIP-010-2, CIP-008-5 2 Forward Together • ReliabilityFirst

A little bit about me…  I am a recovering CIP Auditor  I love technology  I enjoy helping others  I’m not afraid of a terminal  I enjoy learning from others  I consider myself a process improvement hacker  I also enjoy memes! 3 Forward Together • ReliabilityFirst

WARNING!!!!  I might just get silly and talk about things outside of the standards. However, these would be the next maturity step towards good practice.  Also… 4 Forward Together • ReliabilityFirst

CIP-007-6 Part 1.1 Asset Level Requirement, High and Medium Impact 5 Forward Together • ReliabilityFirst

CIP-007-6 R1.1  CIP-007-6 R1.1: Protecting Logical Port s • This is similar to CIP-007-3 R2 • This includes: ‒ All enabled logical ports that are generally associated with “layer 4” of the OSI Network model on BES Cyber Assets/other cyber assets. ‒ “windows services” for Windows environments or PID for the “*nix” type environments. • Other appliances/devices may call this something different. 6 Forward Together • ReliabilityFirst

CIP-007-6 R1.2  CIP-007-7-6 R1.2: Protecting Physical Ports • Additional documentation in the key Lessons Learned and FAQs • This includes ‒ Disabling all unnecessary input/output ports on BES Cyber Assets i.e. (Ethernet, Serial, USB, and/or other common/proprietary ports) ‒ This is to try to prevent plugging in unauthorized removable storage, and/or transient devices  This can be accomplished through logical and physical means of disabling the ports and through signage . 7 Forward Together • ReliabilityFirst

8 Forward Together • ReliabilityFirst

CIP-007-6 R1.1 Evidence/Audit Approach  Need to provide one or more documented processes for disabling or restricting ports  Need a complete list of EACMS, PACS, and PCA that are included in your High and Medium BES Cyber Systems.  Need to provide a list/document of what is needed and/or a baseline of ports that are used and what services they are tied to for ALL Cyber Assets included in your High and Medium BES Cyber Systems. • This can be shown through: ‒ Command Line output such as “netstat –boan” for Windows or “netstat – pault” for *nix ‒ Configuration files ‒ Vendor/third-party device configuration/policy management tools and reports  Bottom Line, need to see ports and protocols tied to a program/PID that are listening/active, and justified! 9 Forward Together • ReliabilityFirst

CIP-007-6 R1.1 Evidence/Audit Approach  Need to provide how these baselines are being enforced for ALL BES Cyber Assets. • This can be shown through: ‒ Vendor/third-party device configuration/policy management tools ‒ Device-level/host-based firewalls systems/tools  “Where technically feasible,” indicates that if a BES Cyber Asset can not enforce/restricts these ports and services, TFEs may be required.  As always… go to the vendor documentation and/or vendor for guidance. 10 Forward Together • ReliabilityFirst

11 Forward Together • ReliabilityFirst

Need to start at our foundation!!!  This all starts at CIP-002-5 • Need to start with how BES Cyber assets make up the BES Cyber Systems ‒ It may be found that there could be some better logical grouping of assets. • Remember, Entities have the ability to slice and dice BES Cyber System assets however they see fit. It can even be different between standards and requirements. * * In order to survive CIP-010-2 baselines, it has to get down to the Cyber Asset Level.  Now that we have our foundation, we can now start digging around and start poking cyber assets right?... 12 Forward Together • ReliabilityFirst

We Research! 13 Forward Together • ReliabilityFirst

Sources to start the search  Vendor Documentation • The best place to start is with the vendor documentation for your BES Cyber System and specific BES Cyber Assets i.e. EMS, DCS, ICS, SCADA systems • Some vendors realize this need, and are providing a list of needed ports and services required to run the system. Some don’t…  Other outside sources might be needed or we may need to do some technical device interrogation. (I hope in a lab!) 14 Forward Together • ReliabilityFirst

Sources to start the search cont.  Other Vendor documentation • Hardware/Software vendors generally have marketing and/or technical manuals that show capabilities, what ports and protocols are available, and even example configurations and/or configuration options.  Third-party baselines • In addition to vendor documentation, there are also some suggested best practice baselines such as ‒ NIST Special Publications (NIST-SP-800-XXX) (some are device specific, but most are more general best practice) ‒ SANS Institute (some are device specific, but most are more general best practice) ‒ Center for Internet Security (CIS)* baselines and benchmarks (device specific, line-by- line configuration)  * Caution!…. There will be a need to modify these baselines to meet your environment!!!! 15 Forward Together • ReliabilityFirst

Sources to start the search cont.  What if I have Cyber Assets or programs that can’t be found in these sources or the vendor site is not easy to navigate? 16 Forward Together • ReliabilityFirst

Search Engine Hacking  Known as “Google Hacking” or “Google Dorking” • These are general terms. You can use your favorite search engine.  • These techniques are used to search hard to find documents and information, and even vulnerabilities! Aka... Open- source Intelligence (OSTIN) • This is using the built-in operators of the search engine • Example : Google operator search: site:www.url.com – ext:pdf • Google will only search the specific site containing all files ending in .pdf . https://www.ethicalhacker.net/features/book-reviews/google- hacking-ten-simple-security-searches-that-work Google Hacking for Pentesters 3 rd Addition, by Johnny Long 17 Forward Together • ReliabilityFirst

Search Engine Hacking cont.  WayBack machine • http://archive.org/web/ • It’s an internet archive site that allows you to search previously cached webpages from back in the past  User forums… • User forums can be a wealth of information where someone can find problem and/or answers to issues found with different devices.  A word of caution !!!… • Be Careful what you post to these sites!!! People with malicious intent search these sites too! 18 Forward Together • ReliabilityFirst

How do I find Ports and Protocols?  IANA Service Name and Transport Protocol Port Number Registry • http://www.iana.org/assignments/service-names-port- numbers/service-names-port-numbers.xhtml • It’s a great reference of ‒ System Ports ( 0-1023 ) assigned by IETF ‒ User Ports ( 1024-49151 ) assigned by IETF ‒ Dynamic and/or Private Ports ( 49152 – 65535 ) assigned by IANA using the IETF review process ‒ Transport Protocol used (udp/tcp) ‒ RFCXXXX reference of known protocols • This information can be downloaded in many formats. (CVS, XML, HTML, Plain Text) • Millage will very … Some software/OS vendors take liberties with protocols and do not follow protocols as they were defined in the RFCs. • On that note.. If you want some “light” reading it’s a good to read through some of the RFCs (Don’t operate heavy machinery while reading.) 19 Forward Together • ReliabilityFirst

Quiz Time…  What are the common port numbers of these protocols commonly found in ESPs? • DNP/DNP3 • MODBUS • HTTP • HTTPS • DNS • NTP • SSH 20 Forward Together • ReliabilityFirst

I found it, now what do I do with it?  STORE THE INFORMATION!!!!  This can help in building a good knowledge base system of your BES Cyber System Assets and other cyber assets  If it took this much time and effort to find it, why would you want to go hunting for it again? Why make someone else hunt for it?  This information can be used in helping to develop your baselines for CIP-010-2, monitoring rules for the SIEM, help new hires understand your systems. etc. 21 Forward Together • ReliabilityFirst

Who’s talking to whom? Why?  What should we know by now? • A list BES Cyber Assets and other associated cyber assets/devices/appliances • The additional programs and services that are running on the assets/devices • Hopefully at this point we only have a subset of assets/devices that are unknown where we would need to do additional technical interrogation.  We should have some rules from CIP-005-5 as a starting point telling us some port ranges. 22 Forward Together • ReliabilityFirst