This is part 3 in a series of posts designed to get you and your organization up to speed on the changes that the Nerc CIP v5 updates will bring about. You can find the previous post in this series, Are You Ready for NERC CIP Version 5? Part Two: CIP 003, by clicking here
Next month, all electric reliability organizations managing both physical and digital assets connected to the U.S. energy grid will be required to upgrade their reliability standards so they align with new Critical Infrastructure Protections handed down by the North American Electric Reliability Corporation, as dictated by the Federal Energy Regulatory Commission.
Part three of this continuing series on NERC CIP version 5 and what EROs should anticipate focuses on CIP 005. CIP 005 builds off the cybersecurity foundation for bulk electric systems established in CIP 003. Primarily, CIPs pertaining to BES cybersecurity aim to accomplish one goal: advancing security protocols directly related to how asset personnel control and interact with a given BES to prevent service disruptions from unauthorized change. As the energy grid modernizes, it becomes increasingly reliant on virtual assets assessing functionality and integrating change where it's necessary. In turn, BES supervisors must scale security measures parallel to modernization, as greater digital connectivity throughout grid operations inevitably leads to a heightened potential for risk.
CIP 005's sole concern revolves around Electronic Security Perimeters, the network of checks and balances surrounding all BES cyber assets. What must change managers understand about ESPs to stay compliant with NERC CIP version 5?
Starting From Scratch
If an ERO's cyber assets are sheep and ESPs are the fences protecting them from wolves, "Responsible Entities" are the shepherds. As described in CIP 002, Responsible Entities consist of a single person or group of people charged with overseeing adherence to NERC compliance. Before actively practicing the minimal protocols discussed in CIP 005, Responsible Entities must confirm the structure of their BES security is sound by ensuring all high- and medium-impact BES cyber assets already exist within ESPs and connect via a routable protocol. Next, external routable connectivity must have clearly defined electronic access points. Every good fence needs a gate, but it's up to the Responsible Entities to identify those gates so they can adequately defend them.
Securing the Perimeter
To grant or deny access to high- and medium-impact BES cyber assets, ESPs must perform three actions, according to NERC CIP 005:
- Understand what constitutes potential access credentials
- Verify those credentials
- Identify "malicious communications," as well as deny access by default
All access must have legitimate, documented reasons as both a means of limiting change to only those with the permission to enact it and as a method for backtracking should certain changes adversely impact grid operations.
Preserving Remote Capabilities
The ability to access BES cyber assets from a remote location brings just as many new possibilities for the industries as it does new hurdles to jump over. NERC CIP 005 calls for third-party authentication between cyber assets facilitating remote access and BES cyber assets an operator attempts to interact with. Furthermore, encryption should not traverse the intermediary between the cyber assets.
Lastly, remote access permissions should include "multi-factor authentication." EROs may want to invest in biometric scanning to use in conjunction with a standard password, however, smart cards, PINs and digital authenticators like certificates or tokens will suffice.