Do you know that they are and how to apply standards for cybersecurity NERC CIP 002 to 009 to an electrical system?
The North American Electric Reliability Corporation (NERC) is a nonprofit corporation based in Atlanta, Georgia, and formed on March 28, 2006, as the successor to the North American Electric Reliability Council (also known as NERC). The original NERC was formed on June 1, 1968, by the electric utility industry to promote the reliability and adequacy of bulk power transmission in the electric utility systems of North America.
The North American Reliability Corporation’s (NERC) mission is to ensure reliability North American bulk power system. NERC is certified by the Federal Energy Regulatory Commission (FERC) to establish and enforce reliability standards. NERC Critical Infrastructure Protection (CIP), or NERC CIP, is a set of regulatory standards adopted in 2006. These standards specify the minimum requirements to support the reliability of the electrical system.
In 2003, a blackout occurred in the northeast United States, some still believe worm MSBlast was the causing, although reports presented, even NERC reports, show causes different. In 2005 when attacks with worms (informatics virus worms) reached peak, first NERC-CIP version was almost complete, approval by FERC (Federal Energy Regulation Commission) took place in January 2008, version 2 was approved in 2009, 3th version in 2010, version 4 was withdrawn, instead version 5 was approved in November 22, 2013 with some suggestions of modifications by FERC.
Using NERC CIP – 002 to 009 like reference and mapping your requirements of security level for network conditions in equipment, considering scenarios of incidents of cybersecurity and possible attacks on SCADA systems, secure SCADA systems and network protocols, security management keys and secure network control technologies, management of backups, in graph 1 shows a reference for control SCADA networks architecture and explains primary features and principal components. It is important to note NERC-CIP standards, must be read and understood as a group of standards and not on an individual basis therefore is not shown mapping requirements NERC CIP-002 to 009 as a whole and are not segregated one by one.
Displayed architecture includes:
- Communication Network for Substations.
- Communication Network in Control Center.
- Core Network (Intranet Usually).
- Firewall (for separate SCADA and Servers Networks).
Control Network must be planned with security policy for achieve comply NERC-CIP-002 to 009, set of regulatory standards, evaluating several factor such as organization, risk-based assessment, SCADA System security, included situations emergency handling. Core Network, usually is a private IP network, constituted by routers & switch like used for general public net. Substation’s net and control center net, typically are Ethernet only run local like LAN (Local Area Network), communicated to Core net, through firewalls, traffic segregation is accomplished by VLANs (Virtual Local Area Network) use. Core network can be implemented on single Ethernet network using only switches.
Corporative net and SCADA net are separated by firewall, for protect Control Network from eventually security and performance errors and problem in these networks. Corporate network and Control network must not communicate directly; instead you must define areas DMZ (Demilitarized Zone) where are servers and workstations for accessed from the corporate network.
Substation security perimeter must have a firewall only like an access point to substation, firewall can connect to one or several routers on Core IP Network, this firewall can be on Core IP Network.
It is necessary configure VPN (Virtual Private Network), for access SCADA Network from internet such ensure authentication, confidentiality and integrity where typically protocol IPSEC has excellent responds to this need. VPN site-to-site, allow connect two complete networks through a tunnel that passes across an insecure network, or can access a network with a secure perimeter through a computer and a remote access VPN.
All device configurations must be using safe channels like ssh, https or by default SNMP V3 (Simple Network Management Protocol) version 3, considering different network management level. Same way equipment must allow managing strong passwords use and different access privilege levels, or be on centralized access management with protocols such as RADIUS, AAA or some like that.
Entire network activity must be monitored by NOC (Network Operations Center) with alarms, log and services monitored, finally all safe right configurations should be stored and backup it for execute an eventually plans restore in possible failure
Reference
[1] North American Electric Reliability Council (NERC), Critical Infraestructure Protection
Committee, NERC Standard CIP-002 a 009
http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
[2] Mira Zafirovic, Roger Moore, Michael Lesle, Rene Midence, Marzio Pozzuoli, Ruggedcom
Inc. Securing SCADA Communications following NERC CIP Requirements. Asia Energy
Week 2008, Kuala Lumpur, Malaysia, May 2008.
