Comprehensive Mitigation
|
|
|
- Jade Flynn
- 6 years ago
- Views:
Transcription
1 Comprehensive Mitigation Jenny Anderson Compliance Engineer - CIP janderson.re@spp.org July 25, 2013
2 Goals and Benefits of Mitigation Mitigation should lessen the risk of unintended consequences and reduce vulnerabilities that may pose risk to the BES, with ultimate goal of improving system reliability Reduce Risk Improve Security Increase Reliability 2
3 Submitting Comprehensive Mitigation Plans Saves time and resources Speeds up mitigation and violation processing Could reduce the penalty amount Allows you to tell your story 3
4 The Life of a Mitigation Plan VIOLATION MITIGATION COMPLETION Identified Status Reported Evidence Provided Validated Changes Implemented Completed Scoped Changes Planned Verified 4
5 Section 1 MITIGATION PLANNING 5
6 Mitigation Planning Review documentation Violation Description Audit Report, Self-Report, etc. Evidence Identified Standard and Requirement Compliance Application Reports Request For Information/responses Determine scope VIOLATION Identified Validated Scoped 6
7 Violation Summary Cause Identification Method Duration Scope Standard Requirement Included requirement(s) 7
8 Summary Examples LACKING Patch management program was not followed. GOOD Several patches were not assessed for applicability within 30 days. BETTER It was identified that 12 of 27 patches released between April 1 and April 30, 2011 were not assessed for applicability within the 30 days prescribed in CIP R3. 8
9 Summary Examples BEST The SPP RE audit team found at the February 2012 CIP audit that 12 of 27 patches released between April 1 and April 30, 2011 were not assessed for applicability within the 30 days prescribed in CIP R3, R3.1. 9
10 Violation Summary A gold star violation summary contains Standard and Requirement(s) violated Specific violation Method of identification Scope and duration 10
11 Relevant Information Root Cause Additional Information 11
12 Relevant Information Examples LACKING Patches were assessed. GOOD The missed patches were assessed 38 days after availability. BETTER These patches were not assessed in the required 30 days because the patch management program that alerts IT staff when a patch is available had become unresponsive. This was found and fixed, and the missed patches were assessed 38 days after availability. 12
13 Relevant Information BEST The patch management application alerts IT staff when a patch is available. However, the patch management application had become unresponsive and no alerts of available patches were received by IT staff. This was discovered by IT staff when they became suspicious of the lack of alerts, and the patch management program was immediately restarted. The missed patches were assessed 38 days after release. 13
14 Plan Details and Additional Information Tasks or actions taken or to be completed 14
15 Plan Detail Examples LACKING Patches were assessed. GOOD The patch management program was restarted, and the missing patches were assessed. BETTER The patch management program was restarted, and the missed patches were assessed 38 days after availability and have been applied. 15
16 Plan Details BEST Immediately upon realizing the patch management application had failed, IT staff restarted the application on April 9, 2012 and inventoried those patches that were not assessed/applied. The 12 missed patches were assessed the same day; 38 days after their availability. These patches were subsequently installed. We now verify daily that the patch management server is operating properly. 16
17 Additional Information Examples LACKING GOOD Staff are taking measures to improve the patch management program. BETTER IT Staff will ensure patch management program is running. 17
18 Additional Information BEST The patch management server will be added to the automated health check system. Until then, IT staff will manually verify the patch management program is functioning. 18
19 Summary: Plan Details and Additional Information PLAN DETAILS Corrective action(s) Mitigating action(s) taken Actions to be taken ADDITIONAL INFO Any compensating measure(s) Other actions taken or planned Able to be supported by evidence 19
20 Activities and Timeline Future milestones Supported by evidence 20
21 Milestones Should be: Measurable Not to exceed 90 day interval(s) Future dated any completed activity should be documented in the plan details section Stepped activity, i.e. 1 st, 2 nd, 3 rd Able to be supported by evidence Remember! Don t list previouslycompleted activities 21
22 Milestones LACKING Single comprehensive milestone Already complete Are not relevant Cannot be supported by evidence BETTER Future activity Multiple Specific Stepped Able to be supported by evidence 22
23 Milestone Examples GOOD Add patch management server to automated health check system BETTER Acquire additional license Configure Test Place into production Run in parallel to ensure works correctly Drop manual process 23
24 Milestones Gold star milestones Are appropriate to the violation Corrective or mitigating action Consider evidence 24
25 Proposed Completion Date When all activities in the mitigation plan were or will be completed The final milestone proposed completion date The proposed and actual completion dates should be consistent 25
26 Reliability Risk and Prevention Risk Potential Impact to: - Self - BES Prevention - Immediate - Future 26
27 Risk Statement Examples LACKING There is no risk. GOOD There is minimal risk because we are small and patches are rarely released that have a serious impact. BETTER There is minimal risk to the BES because the patches released were not all urgent, and because the systems for which patches were released were protected by other means. 27
28 Risk Statement BEST There was minimal risk to the BES because none of the vulnerabilities for which the patches were released were being actively exploited. The vulnerabilities addressed by the security patches were mitigated by existing defense in-depth compensating measures including highly restrictive firewall rules, limited physical access, and security hardening of the vulnerable Cyber Assets including active, up-to-date anti-malware, system enforced prohibition of removable media, and limited user rights. 28
29 Risk Statement A gold star risk statement Actual AND potential risk to the BES Considers what ifs Compensating measures 29
30 Prevention Statement Examples LACKING Completion of the plan will minimize or prevent further occurrences. GOOD The 30 day patch assessment requirement will not be missed. BETTER By eliminating the risk of missing the 30 day patch assessment, patches will be assessed per the requirement and applied with the intended urgency. 30
31 Prevention Statement BEST By performing a daily status check of the patch management server and ultimately adding the server to the automated health check process, failures of this server will be promptly identified and remediated. The risk of missing the 30 day patch assessment will be eliminated and patches will be assessed per the requirement and applied with the intended urgency. 31
32 Prevention Statement A gold star prevention statement tells how the entity will prevent further or similar violations and addresses Root cause Future considerations Compensating measures 32
33 Section 1 COMPLETING MITIGATION 33
34 Demonstrating Completion Evidence should Be submitted for all plan details/milestones Be specific to the activity Provide context and a supportable end date Sufficient, appropriate, and adequate SHOW YOUR WORK 34
35 Evidence Submission webcdms For evidence that does not contain sensitive CIP-related information EFT Server CIP-protected or sensitive information Requires access Is secured with PGP encryption 35
36 Determining What to Submit 1. Violation Summary and Relevant Information 2. Plan Details and Additional Information 3. Activities and Timeline (Milestones) 4. Risk and Prevention Statements 36
37 Examples of Evidence SUMMARY The SPP RE audit team found at the February 2012 CIP audit that 12 of 27 patches released between April 1 and April 30, 2011 were not assessed for applicability within the 30 days prescribed in CIP R3, R3.1. EVIDENCE Patch inventory 37
38 Examples of Evidence RELEVANT INFO patch management application alerts IT staff when a patch is available patch management application had become unresponsive and no alerts of available patches were received... discovered by IT patch management program was immediately restarted missed patches were assessed 38 days after release. EVIDENCE Change record of the application restart Patch assessments 38
39 Examples of Evidence PLAN DETAILS IT staff restarted the application on April 9, 2012, inventoried those patches that were not assessed days after their availability subsequently installed. We now verify daily that the patch management server is operating properly. EVIDENCE Change record of the application restart Patch inventory and assessments Patch install records Verification check 39
40 Examples of Evidence MILESTONES Acquire additional license Configure Test Place into production Run in parallel to ensure works correctly Drop manual process EVIDENCE Purchase order/receipt Configuration screen captures Testing records Change records 40
41 Examples of Evidence RISK STATEMENT minimal risk none of the vulnerabilities were actively exploited were mitigated by restrictive firewall rules, limited physical access, anti-malware, system enforced prohibition of removable media, and limited user rights. EVIDENCE Patch alerts Applicable firewall rule sets Physical access controls, access list Screen captures of AV, disabled ports User list, PRAs 41
42 Examples of Evidence PREVENTION daily check of patch management server adding automated health check, failures remediated risk of missing patch assessment eliminated patches assessed per requirement applied with the intended urgency. EVIDENCE Daily check-out Automated configuration Postimplementation patch notification/ assessment 42
43 Evidence Gold star evidence Is specific to activities in the mitigation plan Is sufficient, appropriate, and adequate Supports completion date(s) 43
44 Certification of Completion Submit only when mitigation plan is complete AND has been reviewed to determine that it Meets the Standard and Requirement Provides sufficient evidence supporting date of completion of milestones and plan Was completed in advance of or on the proposed completion date 44
45 Submitting Comprehensive MPs Saves time and resources Speeds up mitigation and violation processing Could reduce the penalty amount Allows you to tell your story 45
46 46
47 SPP RE Training Videos: vimeopro.com/sppre/basics Audits: Top 10 Ways to Prepare CIP Audit: What to Expect CIP-005: Electronic Security Perimeter CIP R3 CIP-006: Physical Security CIP-007 Compliance CIP-007: R1 System Configuration CIP-007 R3 and R4 Compliance Education at My Company Internal Compliance Programs Q&A Event Analysis-Entity Perspective Evidence Submission Firewalls: 13 Ways to Break Through Hashing: How To Human Performance - Entity Perspective Human Performance -NERC Mitigation Plans: Milestones, Completion, and Evidence Mock 693 Audit Self-Reporting: When and How TFE Expectations and Issues Training Employees on Compliance 47
48 Jenny Anderson Compliance Enforcement Analyst
Interactive Remote Access FERC Remote Access Study Compliance Workshop October 27, Eric Weston Compliance Auditor Cyber Security.
Interactive Remote Access Compliance Workshop October 27, 2016 Eric Weston Compliance Auditor Cyber Security 2 Agenda Interactive Remote Access Overview Review of Use Cases and Strategy 1 Interactive Remote
CIP 007 Compliance. Kevin B. Perry Dir, Critical Infrastructure Protection
CIP 007 Compliance Kevin B. Perry Dir, Critical Infrastructure Protection kperry@spp.org 501.614.3251 Agenda CIP 007 Purpose CIP 007 Requirement Overview Past Non Compliance Potential Non Compliance Concerns
Standard CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-1 3. Purpose: Standard CIP-007 requires Responsible Entities to define methods, processes, and procedures for securing
Standard CIP 007 3a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3a 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for
Standard CIP 005 2a Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-2a 3. Purpose: Standard CIP-005-2 requires the identification and protection of the Electronic Security Perimeter(s)
Standard CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-4 3. Purpose: Standard CIP-007-4 requires Responsible Entities to define methods, processes, and procedures for securing
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
Standard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard is adopted by the NERC Board of Trustees (Board).
Standard CIP 007 4a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-4a 3. Purpose: Standard CIP-007-4 requires Responsible Entities to define methods, processes, and procedures for
Compliance Exception and Self-Logging Report Q4 2014
Agenda Item 5 Board of Trustees Compliance Committee Open Session February 11, 2015 Compliance Exception and Self-Logging Report Q4 2014 Action Information Introduction Beginning in November 2013, NERC
NERC CIP VERSION 6 BACKGROUND COMPLIANCE HIGHLIGHTS
NERC CIP VERSION 6 COMPLIANCE BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements
NERC CIP: Fundamental Security Requirements of an Electronic Access Control and Monitoring System (EACMS) Requirements Mapping to ConsoleWorks
NERC CIP: Fundamental Security Requirements of an Electronic Access Control and Monitoring System (EACMS) Requirements Mapping to ConsoleWorks NERC Standard Requirement Requirement Text Measures ConsoleWorks
EEI Fall 2008 Legal Conference Boston, Massachusetts Stephen M. Spina November 1,
EEI Fall 2008 Legal Conference Boston, Massachusetts Stephen M. Spina November 1, 2008 www.morganlewis.com Overview Reliability Standards Enforcement Framework Critical Infrastructure Protection (CIP)
Standard CIP Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-2 3. Purpose: Standard CIP-005-2 requires the identification and protection of the Electronic Security Perimeter(s)
Security Assessment. Prepared For: Prospect Or Customer Prepared By: Your Company Name
Security Assessment Prepared For: Prospect Or Customer Prepared By: Your Company Name Agenda Security - External & Outbound - Policy Compliance Risk and Issue Score Issue Review Next Steps Security - External
Standard CIP 005 4a Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-4a 3. Purpose: Standard CIP-005-4a requires the identification and protection of the Electronic Security Perimeter(s)
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 3 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
February 29, 2016 VIA ELECTRONIC FILING
VIA ELECTRONIC FILING Ms. Kimberly D. Bose Secretary Federal Energy Regulatory Commission 888 First Street, N.E. Washington, DC 20426 Re: NERC Full Notice of Penalty regarding, FERC Docket No. NP16-_-000
ERO Mitigation Plan Guide Revised April 2014
ERO Mitigation Plan Guide Revised April 2014 1 of 23 3353 Peachtree Road NE Suite 600, North Tower Atlanta, GA 30326 404-446-2560 www.nerc.com Table of Contents Table of Contents...2 Disclaimer...3 Document
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
CIP Cyber Security Configuration Change Management and Vulnerability AssessmentsManagement
The Background, VRF/VSLs, and Guidelines and Technical Basis Sections have been removed for this informal posting. The Project 2016-02 is seeking comments around the concept of the Requirement/Measure
The CISO is the owner of the vulnerability management process. This person designs the process and ensures is implemented as designed.
University of Alabama at Birmingham VULNERABILITY MANAGEMENT RULE May 19, 2017 Related Policies, Procedures, and Resources Data Protection and Security Policy Data Classification Rule 1.0 Introduction
Digital Wind Cyber Security from GE Renewable Energy
Digital Wind Cyber Security from GE Renewable Energy BUSINESS CHALLENGES The impact of a cyber attack to power generation operations has the potential to be catastrophic to the renewables industry as well
CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security System Security Management 2. Number: CIP-007-5 3. Purpose: To manage system security by specifying select technical, operational, and procedural requirements in
CIP Cyber Security Configuration Management and Vulnerability Assessments
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
Consideration of Issues and Directives Federal Energy Regulatory Commission Order No. 791 June 2, 2014
Federal Energy Regulatory Commission Order No. 791 June 2, 2014 67 and 76 67. For the reasons discussed below, the Commission concludes that the identify, assess, and correct language, as currently proposed
Analysis of CIP-006 and CIP-007 Violations
Electric Reliability Organization (ERO) Compliance Analysis Report Reliability Standard CIP-006 Physical Security of Critical Cyber Assets Reliability Standard CIP-007 Systems Security Management December
Summary of FERC Order No. 791
Summary of FERC Order No. 791 On November 22, 2013, the Federal Energy Regulatory Commission ( FERC or Commission ) issued Order No. 791 adopting a rule that approved Version 5 of the Critical Infrastructure
Registered Entity Self-Report and Mitigation Plan User Guide
Registered Entity Self-Report and Mitigation Plan User Guide June 2018 NERC Report Title Report Date I Table of Contents Preface...1 Disclaimer...2 Document Revisions...3 Introduction...4 Chapter 1: Description
Technical Guidance and Examples
Technical Guidance and Examples DRAFT CIP-0- Cyber Security - Supply Chain Risk Management January, 0 NERC Report Title Report Date I Table of ContentsIntroduction... iii Background... iii CIP-0- Framework...
Implementing Cyber-Security Standards
Implementing Cyber-Security Standards Greg Goodrich TFIST Chair, CISSP New York Independent System Operator Northeast Power Coordinating Council General Meeting Montreal, QC November 28, 2012 Topics Critical
This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective.
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Description of Current Draft
External Supplier Control Obligations. Cyber Security
External Supplier Control Obligations Cyber Security Control Title Control Description Why this is important 1. Cyber Security Governance The Supplier must have cyber risk governance processes in place
Technical Reference [Draft] DRAFT CIP Cyber Security - Supply Chain Management November 2, 2016
![Technical Reference [Draft] DRAFT CIP Cyber Security - Supply Chain Management November 2, 2016](/thumbs/77/74828913.jpg "Technical Reference [Draft] DRAFT CIP Cyber Security - Supply Chain Management November 2, 2016")
For Discussion Purposes Only Technical Reference [Draft] DRAFT CIP-013-1 Cyber Security - Supply Chain Management November 2, 2016 Background On July 21, 2016, the Federal Energy Regulatory Commission
CIP Cyber Security Personnel & Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-5.1 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the BES from individuals
Cyber Security Standards Drafting Team Update
Cyber Security Standards Drafting Team Update Michael Assante, VP & Chief Security Officer North American Electric Reliability Corp. February 3, 2008 Overview About NERC Project Background Proposed Modifications
BERGRIVIER MUNICIPALITY
BERGRIVIER MUNICIPALITY PATCH MANAGEMENT POLICY APRIL 2012 C:\Users\HJanuarie\Desktop\New folder (6)\INFORMATION TECHNOLOGY\Patch Management Policy.docx/cmd 1 CONTENTS Version Control.. Document History.
Consideration of Issues and Directives Federal Energy Regulatory Commission Order No. 791 January 23, 2015
Federal Energy Regulatory Commission Order No. 791 January 23, 2015 67 and 76 67. For the reasons discussed below, the Commission concludes that the identify, assess, and correct language, as currently
Carbon Black PCI Compliance Mapping Checklist
Carbon Black PCI Compliance Mapping Checklist The following table identifies selected PCI 3.0 requirements, the test definition per the PCI validation plan and how Carbon Black Enterprise Protection and
CYBER SECURITY POLICY REVISION: 12
1. General 1.1. Purpose 1.1.1. To manage and control the risk to the reliable operation of the Bulk Electric System (BES) located within the service territory footprint of Emera Maine (hereafter referred
Standard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard is adopted by the NERC Board of Trustees (Board).
Cyber Security Incident Report
Cyber Security Incident Report Technical Rationale and Justification for Reliability Standard CIP-008-6 January 2019 NERC Report Title Report Date I Table of Contents Preface... iii Introduction... 1 New
NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION
NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION NARUC Energy Regulatory Partnership Program The Public Services Regulatory Commission of Armenia and The Iowa Utilities Board Janet Amick Senior Utility
Critical Infrastructure Protection Version 5
Critical Infrastructure Protection Version 5 Tobias Whitney, Senior CIP Manager, Grid Assurance, NERC Compliance Committee Open Meeting August 9, 2017 Agenda Critical Infrastructure Protection (CIP) Standards
ISE North America Leadership Summit and Awards
ISE North America Leadership Summit and Awards November 6-7, 2013 Presentation Title: Presenter: Presenter Title: Company Name: Embracing Cyber Security for Top-to-Bottom Results Larry Wilson Chief Information
Ben Christensen CIP Enforcement Analyst. Root Cause Analysis for Commonly Violated Requirements June 6, 2013 CIPUG
Ben Christensen CIP Enforcement Analyst Root Cause Analysis for Commonly Violated Requirements June 6, 2013 CIPUG Agenda Methodology Individual Standard Requirements o Root Causes o Effective Solutions
THE TRIPWIRE NERC SOLUTION SUITE
CONFIDENCE: SECURED BUSINESS INTELLIGENCE SOLUTION BRIEF THE TRIPWIRE NERC SOLUTION SUITE A TAILORED SUITE OF PRODUCTS AND SERVICES TO AUTOMATE NERC CIP COMPLIANCE u u We ve been able to stay focused on
Positioning Your Organization to Mitigate CASL Liability Through the Due Diligence Defence. Roadmap
Positioning Your Organization to Mitigate CASL Liability Through the Due Diligence Defence Association of Corporate Counsel Wednesday, February 7, 2018 Andrew Nunes Daniel Fabiano Stephen Cheeseman Roadmap
Standard CIP Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-1 3. Purpose: Standard CIP-005 requires the identification and protection of the Electronic Security Perimeter(s)
Access Control and CIP 10/20/2011
Access Control and CIP 10/20/2011 Agenda Access Control Requirements Impact on Entities Risk Discussion Response Discussion Future pursuit 2 RELIABILITY ACCOUNTABILITY Let s Talk CIP 3 RELIABILITY ACCOUNTABILITY
Cyber Security Reliability Standards CIP V5 Transition Guidance:
Cyber Security Reliability Standards CIP V5 Transition Guidance: ERO Compliance and Enforcement Activities during the Transition to the CIP Version 5 Reliability Standards To: Regional Entities and Responsible
Internal Controls Procedure
Internal Controls Procedure September 30, 2017 MON-114 3000 Bayport Drive, Suite 600 Tampa, Florida 33607-8411 (813) 289-5644 - Phone (813) 289-5646 Fax www.frcc.com Table of Contents Page 3 of 7 Page
CIP Configuration Change Management & Vulnerability Assessments
CIP-010-2 Configuration Change Management & Vulnerability Assessments FRCC Spring RE Workshop April 17-18, 2018 Objective Change Management to prevent unauthorized modifications to Bulk Electric Systems
December 30, 2015 VIA ELECTRONIC FILING
VIA ELECTRONIC FILING Ms. Kimberly D. Bose Secretary Federal Energy Regulatory Commission 888 First Street, N.E. Washington, DC 20426 Re: NERC Full Notice of Penalty regarding, FERC Docket No. NP16-_-000
Education Network Security
Education Network Security RECOMMENDATIONS CHECKLIST Learn INSTITUTE Education Network Security Recommendations Checklist This checklist is designed to assist in a quick review of your K-12 district or
Information Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV
Information Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV Location: https://www.pdsimplified.com/ndcbf_pdframework/nist_csf_prc/documents/identify/ndcbf _ITSecPlan_IDGV2017.pdf
White Paper. Why IDS Can t Adequately Protect Your IoT Devices
White Paper Why IDS Can t Adequately Protect Your IoT Devices Introduction As a key component in information technology security, Intrusion Detection Systems (IDS) monitor networks for suspicious activity
UNITED STATES OF AMERICA BEFORE THE FEDERAL ENERGY REGULATORY COMMISSION ) )
UNITED STATES OF AMERICA BEFORE THE FEDERAL ENERGY REGULATORY COMMISSION Cyber Security Incident Reporting Reliability Standards ) ) Docket Nos. RM18-2-000 AD17-9-000 COMMENTS OF THE NORTH AMERICAN ELECTRIC
CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security System Security Management 2. Number: CIP-007-6 3. Purpose: To manage system security by specifying select technical, operational, and procedural requirements in
How AlienVault ICS SIEM Supports Compliance with CFATS
How AlienVault ICS SIEM Supports Compliance with CFATS (Chemical Facility Anti-Terrorism Standards) The U.S. Department of Homeland Security has released an interim rule that imposes comprehensive federal
CIP Cyber Security Personnel & Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-6 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the Bulk Electric
RBI GUIDELINES ON CYBER SECURITY AND RAKSHA APPROACH
RBI GUIDELINES ON CYBER SECURITY AND RAKSHA APPROACH RBI GUIDELINES ON CYBER SECURITY AND RAKSHA APPROACH CONTEXT RBI has provided guidelines on Cyber Security Framework circular DBS. CO/CSITE/BC.11/33.01.001/2015-16
Implementation Plan for Version 5 CIP Cyber Security Standards
Implementation Plan for Version 5 CIP Cyber Security Standards April 10September 17, 2012 Note: On September 17, 2012, NERC was alerted that some references in the Initial Performance of Certain Periodic
CIP-014. JEA Compliance Approach. FRCC Fall Compliance Workshop Presenter Daniel Mishra
CIP-014 JEA Compliance Approach FRCC Fall Compliance Workshop Presenter Daniel Mishra Acronyms & Terminologies DHS Department of Homeland Security JEA It s not an acronym JSO Jacksonville Sheriff's Office
1. Post for 45-day comment period and pre-ballot review. 7/26/ Conduct initial ballot. 8/30/2010
Standard CIP 011 1 Cyber Security Protection Standard Development Roadmap This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes
You knew the job was dangerous when you took it! Defending against CS malware
You knew the job was dangerous when you took it! Defending against CS malware Presented By: Doug Cavit Microsoft Where PI geeks meet 9/23/2010 NERC HILF 6/10 Adequately addressing vulnerabilities will
Standard CIP-006-3c Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-3c 3. Purpose: Standard CIP-006-3 is intended to ensure the implementation of a physical security
Out-of-Band Management
Out-of-Band Management April 9, 2019 Holly Eddy, CISA, CRISC, CISSP Auditor, Cyber Security 2 3 Opening Statement Out-of-band management is often referred to as managing the keys to the kingdom given the
Ensuring Desktop Central Compliance to Payment Card Industry (PCI) Data Security Standard
Ensuring Desktop Central Compliance to Payment Card Industry (PCI) Data Security Standard Introduction Manage Engine Desktop Central is part of ManageEngine family that represents entire IT infrastructure
CIP 005 R2: Electronic Access Controls
CIP 005 R2: Electronic Access Controls Knowing who is in your network Steven Keller Senior Compliance Specialist CIP skeller.re@spp.org 501.688.1633 September 28, 2012 Objectives Improve your understanding
Industrial Defender ASM. for Automation Systems Management
Industrial Defender ASM for Automation Systems Management INDUSTRIAL DEFENDER ASM FOR AUTOMATION SYSTEMS MANAGEMENT Industrial Defender ASM is a management platform designed to address the overlapping
Surprisingly Successful: What Really Works in Cyber Defense. John Pescatore, SANS
Surprisingly Successful: What Really Works in Cyber Defense John Pescatore, SANS 1 Largest Breach Ever 2 The Business Impact Equation All CEOs know stuff happens in business and in security The goal is
Standard CIP Cyber Security Critical Cyber Asset Identification
Standard CIP 002 1 Cyber Security Critical Cyber Asset Identification Standard Development Roadmap This section is maintained by the drafting team during the development of the standard and will be removed
Make IR Effective with Risk Evaluation and Reporting
SESSION ID: AIR-R02 Make IR Effective with Risk Evaluation and Reporting Mischel Kwon President/CEO MKA Cyber @mkacyber Justin Monti Sr. VP Security Engineering MKA Cyber You ve Got an Incident Now What?
CIP Cyber Security Security Management Controls. Standard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
Information Technology General Control Review
Information Technology General Control Review David L. Shissler, Senior IT Auditor, CPA, CISA, CISSP Office of Internal Audit and Risk Assessment September 15, 2016 Background Presenter Senior IT Auditor
Standard CIP Cyber Security Critical Cyber Asset Identification
Standard CIP 002 1 Cyber Security Critical Cyber Asset Identification Standard Development Roadmap This section is maintained by the drafting team during the development of the standard and will be removed
CCISO Blueprint v1. EC-Council
CCISO Blueprint v1 EC-Council Categories Topics Covered Weightage 1. Governance (Policy, Legal, & Compliance) & Risk Management 1.1 Define, implement, manage and maintain an information security governance
A. Introduction. Page 1 of 22
The Background, VRF/VSLs, and Guidelines and Technical Basis Sections have been removed for this informal posting. The Project 2016-02 is seeking comments around the concept of the Requirement/Measure
Standard CIP-006-4c Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-4c 3. Purpose: Standard CIP-006-4c is intended to ensure the implementation of a physical security
Cyber Threats? How to Stop?
Cyber Threats? How to Stop? North American Grid Security Standards Jessica Bian, Director of Performance Analysis North American Electric Reliability Corporation AORC CIGRE Technical Meeting, September
Purpose. ERO Enterprise-Endorsed Implementation Guidance
Lesson Learned CIP Version 5 Transition Program CIP-002-5.1 Requirement R1: Impact Rating of Generation Resource Shared BES Cyber Systems Version: January 29, 2015 Authorized by the Standards Committee
Standard CIP Cyber Security Security Management Controls
A. Introduction 1. Title: Cyber Security Security Management Controls 2. Number: CIP-003-4 3. Purpose: Standard CIP-003-4 requires that Responsible Entities have minimum security management controls in
Vulnerability Management Policy
Vulnerability Management Policy Document Type: Policy (PLCY) Endorsed By: Information Technology Policy Committee Date: 4/29/2011 Promulgated By: Chancellor Herzog Date: 6/16/2011 I. Introduction IT resources
Submitted on behalf of the DOE National SCADA Test Bed. Jeff Dagle, PE Pacific Northwest National Laboratory (509)
Potential Mitigation Strategies for the Common Vulnerabilities of Control Systems Identified by the NERC Control Systems Security Working Group (CSSWG) Submitted on behalf of the DOE National SCADA Test
VIA ELECTRONIC FILING
VIA ELECTRONIC FILING Ms. Kimberly D. Bose Secretary Federal Energy Regulatory Commission 888 First Street, N.E. Washington, DC 20426 Re: NERC Full Notice of Penalty regarding Unidentified Registered Entity
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
CIP 010 1 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
This draft standard is being posted for an initial comment and ballot. The draft includes modifications to meet the directives of FERC Order No. 791.
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
OPUC Workshop March 13, 2015 Cyber Security Electric Utilities. Portland General Electric Co. Travis Anderson Scott Smith
OPUC Workshop March 13, 2015 Cyber Security Electric Utilities Portland General Electric Co. Travis Anderson Scott Smith 1 CIP Version 5 PGE Implementation Understanding the Regulations PGE Attended WECC
SAP Cybersecurity Solution Brief. Objectives Solution Benefits Quick Facts
SAP Cybersecurity Solution Brief Objectives Solution Benefits Quick Facts Secure your SAP landscapes from cyber attack Identify and remove cyber risks in SAP landscapes Perform gap analysis against compliance
AN IPSWITCH WHITEPAPER. The Definitive Guide to Secure FTP
AN IPSWITCH WHITEPAPER The Definitive Guide to Secure FTP The Importance of File Transfer Are you concerned with the security of file transfer processes in your company? According to a survey of IT pros
ERO Compliance Enforcement Authority Staff Training
ERO Compliance Enforcement Authority Staff Training Vision Comprehensive ERO CEA staff training program that promotes high quality and consistency in the conduct of audits The methods to accomplish the
Security Standards for Electric Market Participants
Security Standards for Electric Market Participants PURPOSE Wholesale electric grid operations are highly interdependent, and a failure of one part of the generation, transmission or grid management system
Presenter Jakob Drescher. Industry. Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks.
Presenter Jakob Drescher Industry Cyber Security 1 Cyber Security? Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks. Malware or network traffic
Compliance: Evidence Requests for Low Impact Requirements
MIDWEST RELIABILITY ORGANIZATION Compliance: Evidence Requests for Low Impact Requirements Jess Syring, CIP Compliance Engineer MRO CIP Low Impact Workshop March 1, 2017 Improving RELIABILITY and mitigating
Continuous protection to reduce risk and maintain production availability
Industry Services Continuous protection to reduce risk and maintain production availability Managed Security Service Answers for industry. Managing your industrial cyber security risk requires world-leading
Standard: Risk Assessment Program
Standard: Risk Assessment Program Page 1 Executive Summary San Jose State University (SJSU) is highly diversified in the information that it collects and maintains on its community members. It is the university
Table of Contents. Policy Patch Management Version Control
Table of Contents Patch Management Version Control Policy... 2 The Patch Management Version Control Process... 2 Policy... 2 Vendor Updates... 3 Concepts... 3 Responsibility... 3 Organizational Roles...
Cyber Hygiene: Uncool but necessary. Automate Endpoint Patching to Mitigate Security Risks
Cyber Hygiene: Uncool but necessary Automate Endpoint Patching to Mitigate Security Risks 1 Overview If you analyze any of the recent published attacks, two patterns emerge, 1. 80-90% of the attacks exploit
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise