ICS456: Essentials for NERC Critical Infrastructure Protection

Overview

A transition is underway from NERC CIP programs that are well-defined and understood to a new CIP paradigm that expands its scope into additional environments and adds significantly more complexity. On day 1, students will develop an understanding of the electric sector’s regulatory structure and history as well as an appreciation for how the CIP Standards fit into the overall framework of the reliability standards. Key NERC terms and definitions related to NERC CIP are reviewed using realistic concepts and examples that prepare students to better understand their meaning. We will explore multiple approaches to BES Cyber Asset identification and learn the critical role of strong management and governance controls. We will also examine a series of architectures, strategies, and difficult compliance questions in a way that highlights the reliability and the cybersecurity strengths of particular approaches.

Full Lab Details

• Virtual Machine Setup: Windows, Kali Linux, and Security Onion VM will be utilized throughout the five-day course
• Checkpoint exercise: Ensure familiarity with the NERC website for locating standards, and cover entity registrations, the Functional Model, and a glossary of terms
• Protocol Primer: Use Wireshark to analyze packet captures
• Analysis of Facility Environments: Walk through assets owned by a fictitious company to determine in-scope assets and approaches to generation segmentation
• CSET Facility Assessment: Utilize the ICS-CERT's Cybersecurity Evaluation Tool (CSET) to perform a self-assessment on a model network compared to industry standards, including NERC CIP

Full Topic Details

• Regulatory History and Overview
• NERC Functional Model
• NERC Reliability Standards
• CIP History
• Terms and Definitions
• CIP-002: BES Cyber System Categorization
• CIP-003: Security Management Controls

Overview

Strong physical and cyber access controls are at the heart of any good cybersecurity program. On day 2 we move beyond the what of CIP compliance to understanding the why and the how. Firewalls, proxies, gateways, IDS, and more - you'll learn where and when they help as well as practical implementations to consider and designs to avoid. Physical protection includes more than fences, and you'll learn about the strengths and weaknesses of common physical controls and monitoring schemes. Labs will re-inforce the learnings throughout the day and will introduce architecture review and analysis, firewall rules, IDS rules, compliance evidence demonstration, and physical security control reviews.

Full Lab Details

• Wireshark Analysis and Network Visualization: Utilize Wireshark to analyze real packet captures from an ICS/OT environment and introduce the Dragos Security CyberLens tool, which can be used to passively discover ICS/OT assets and visualize their network placement and communications
• Firewall Rule Development and Analysis: Utilize the Common Open Research Emulator (CORE) to emulate a live network and to understand the effect of firewall rules on the network communications
• ICS Signatures and Alerting: Utilize the Squil (pronounced squeal) network security monitoring tool to create event driven IDS alerts when replaying pcap packet captures from an ICS/OT environment
• Breach of Physical Controls: Learn the basics of lock picking with your very own clear padlock and pick tool set
• Physical Security Review and Response Exercise: Analyze physical security camera images and perimeter access logs to identify potential security and compliance problems

Full Topic Details

• CIP-005: Electronic Security Perimeter(s)
• Interactive Remote Access
• External Routable Communication and Electronic Access Points
• CIP-006: Physical Security of BES Cyber Systems
• Physical Security Plan
• Visitor Control Programs
• PACS Maintenance and Testing
• CIP-014: Physical Security

Overview

CIP-007 has consistently been one of the most violated standards going back to CIP version 1. With the CIP Standards moving to a systematic approach with varying requirement applicability based on a system impact rating, the industry now has new ways to design and architect system management approaches. Throughout day 3, students will dive into CIP-007. We'll examine various Systems Security Management requirements with a focus on implementation examples and the associated compliance challenges. We'll also cover the CIP-010 requirements for configuration change management and vulnerability assessments that ensure systems are in a known state and under effective change control. We'll move through a series of labs that reinforce the topics covered from the perspective of the CIP practitioner responsible for implementation and testing.

Full Lab Details

• Windows System Assessment: Utilize tools including Windows Baseline Security Analyzer, NetStat, and Windows Firewall Configurator to analyze the security posture of a provided Windows VM
• Validating Findings and Demonstrating Impact: Utilize the provided Kali Linux VM and favorite red-team tools such as Cain & Able, remote desktop, and Metasploit Framework to gain unauthorized access to the Windows VM, demonstrating the risks of insecure configuration
• System Hardening: Learn from the red team's action and use a number of native Windows tools to harden the Windows VM and prevent future exploitation
• System Log Management: Use Splunk Enterprise to analyze a Windows event log to identify events of interest
• Basic Change Management from the Command Line: Use hashing techniques and Tripwire to identify system file and configuration changes
• Vulnerability Assessment Tool Capability: Gain familiarity with Nmap, SNMP, and the OpenVAS vulnerability scanning framework

Full Topic Details

• CIP-007: System Management
• Physical and Logical Ports
• Patch Management
• Malicious Code Prevention
• Account Management
• CIP-010: Configuration Change Management and Vulnerability Assessments
• Change Management Program
• Baseline Configuration Methodology
• Change Management Alerting/Prevention

Overview

Education is key to every organization's success with NERC CIP, and ICS456 graduates will be knowledgeable advocates for CIP when they return to their place of work. Regardless of their role, students can be a valued resource to their organization's CIP-004 training program and the CIP-011 information protection program. Students will be ready with resources for building and running strong awareness programs that reinforce the need for information protection and cybersecurity training. On day 4, we'll examine CIP-008 and CIP-009, covering identification, classification communication of incidents, and the various roles and responsibilities needed in an incident response or a disaster recovery event. Labs will introduce tools to ensure file integrity and the sanitization of files to be distributed, how to best utilize and communicate with the E-ISAC, and how to preserve incident data for future analysis.

Full Lab Details

• Information Leakage Awareness: Walk through creating a Shodan account and using it to discover all sorts of interesting Internet-connected devices
• Steganography Lab: Use the S-Tools application to conceal and identify data hidden in plain sight in order to understand the risk of data exfiltration in your environment
• Yara Introduction: Learn the basics of Yara, the "Pattern Matching Swiss Knife for Malware," utilizing indicators of compromise (IOC's) to detect malware in memory images
• Incident Response TTX: Walk through a tabletop exercise that you can take back to your organization and play with your larger team to test incident response capability and security policy/plan effectiveness
• Forensic Data Preservation: Use FireEye's free Redline tool to learn how to collect and analyze forensic data and the FTL Imager tool to create a system image for data preservation

Full Topic Details

• CIP-004: Personnel and Training
• Security Awareness Program
• CIP Training Program
• PRA Evaluation Process
• CIP-011: Information Protection
• Information Protection Program
• Data Sanitization
• CIP-008: Incident Reporting and Response Planning
• Incident Response Plan/Testing
• Reporting Requirements
• CIP-009: Recovery Plans for BES Cyber Systems
• Recovery Plans
• System Backup

Overview

On the final course day students will learn the key components for running an effective CIP compliance program. We will review the NERC processes for standards development, violation penalty determination, Requests for Interpretation, and recent changes stemming from the Reliability Assurance Initiative. Additionally, we'll identify recurring and audit-related processes that keep a CIP compliance program on track: culture of compliance, annual assessments, gap analysis, TFE's, and self-reporting. We'll also look at the challenge of preparing for NERC audits and provide tips to be prepared to demonstrate the awesome work your team is doing. Finally, we'll look at some real-life CIP violations and discuss what happened and the lessons we can take away. At the end of day 5, students will have a strong call to action to participate in the on-going development of CIP within their organization and in the industry overall as well as a sense that CIP is do-able! Labs on day 5 will cover DOE C2M2, audit tools, and an audit-focused take on a "blue team - red team" exercise.

Full Lab Details

• Auditor Tools: NERC CIP auditors use NP-View to analyze their environment, and you should too! In this lab you will analyze firewall configurations for an example electric entity to determine and visualize network communications
• Power Shell: Learn the basics and get an appreciation for the power of PowerShell for task automation and configuration management
• Auditor/Defender: Whether you play the role of auditor or audited entity, this exercise will challenge your NERC CIP knowledge and ability to present material to tell a compelling story of compliance

Full Topic Details

• CIP Processes for Maintaining Compliance
• Preparing for an Audit
• Audit Follow-Up
• CIP Industry Activities
• Standards Process
• CIP of the Future