CIP-010 R3 Vulnerability Assessment and Patch Management

The North American Electric Reliability Corporation (NERC) is a not-for-profit international regulatory authority whose mission is to assure the reliability of the bulk power system in North America. NERC Reliability Standards define the reliability requirements for planning and operating the North American bulk power system, which serves more than 334 million people. NERC is committed to protecting the bulk power system against cyber security compromises that could lead to misoperation or instability. The NERC Critical Infrastructure Protection (CIP) Standards provide a cyber security framework for the identification and protection of Bulk Electric System (BES) Cyber Systems, to support the reliable operation of the North American bulk power system.

The purpose of CIP-010 R3 (Vulnerability Assessments) is to establish that active vulnerability assessments of BES Cyber Systems be performed. The purpose of CIP-007 R2 (Security Patch Management) is to establish a patch management process to mitigate discovered vulnerabilities. Dangerous vulnerabilities can lead to critical failures, potential network compromise, and intrusion attacks, negatively impacting the reliable operation of the BES. Vulnerability assessments and patch management go hand-in-hand. Vulnerabilities must be mitigated before any costly damage occurs, but mitigations cannot be carried out until vulnerabilities are first discovered and remediations evaluated and prioritized.

For organizations that are required to be CIP compliant, Tenable.sc Continuous View (CV) can lead the way to compliance. This dashboard can assist with detecting vulnerabilities, prioritizing remediations, and tracking patch management progress. The severities of vulnerabilities are assigned based on their Common Vulnerability Scoring System (CVSS) scores. The Security Patch Management component specifically addresses CIP-007 R2 requirements to evaluate and install patches within given time frames. This dashboard can assist an organization in monitoring and improving its vulnerability management program, which will aid in meeting the CIP-010 R3 and CIP-007 R2 requirements and measures. Analysts can also use this dashboard to easily drill down and gain more detailed vulnerability information.

The CIP standards recommend categorizing BES Cyber Assets into different impact categories. An asset's impact category is based on the adverse impact to BES reliability that would occur if the asset was unavailable, degraded, or misused. Once the impact categories of systems have been determined, asset groups in Tenable.sc CV can be used to group together machines in each impact category. Asset groups can then be applied to this dashboard to narrow the focus and enable more accurate reporting on systems in specific impact categories. For more information on using assets with dashboards, see How to Add Assets in SecurityCenter and How to Use Assets with Dashboards. Alternatively, if the assets are in separate subnets, then subnet filters can be easily applied to narrow the focus of this dashboard.

This dashboard and its components are available in the Tenable.sc Feed, a comprehensive collection of dashboards, reports, Assurance Report Cards, and assets. The dashboard can be easily located in the SecurityCenter Feed under the category Compliance & Configuration Assessment. The dashboard requirements are:

• SecurityCenter 5.2.0
• Nessus 8.4.0
• NNM 5.8.1
• LCE 6.0.0

Tenable's Tenable.sc Continuous View (CV) is the market-defining continuous network monitoring solution. For Supervisory Control and Data Acquisition (SCADA) systems, where reliability and not interfering with normal operations is a concern, Tenable.sc CV includes passive vulnerability detection with Tenable’s Nessus Network Monitor (NNM), as well as log correlation with Tenable’s Log Correlation Engine (LCE). Where possible, active vulnerability detection and compliance scanning with Nessus can also be done. Using Tenable.sc CV, an organization will obtain the most comprehensive and integrated view of its SCADA network.

The following components are included in this dashboard:

• Vulnerability Summary - 3-Month Trend of Vulnerabilities: This component is a 3-month summary chart tracking unmitigated vulnerabilities of low, medium, high, and critical severity.
• CIP - SCADA Vulnerabilities: This table presents the current actively and passively detected SCADA vulnerabilities.
• Understanding Risk - Most Severe: This table presents the most severe vulnerabilities found to exist in the environment.
• Understanding Risk - Remediation Opportunities: This table displays the top remediations for the network.
• CIP - Security Patch Management: The matrix presents vulnerability summary information in several rows: total vulnerabilities, vulnerabilities known to be exploitable, vulnerabilities that are likely accessible from external network addresses, and vulnerabilities by severity.
• Vulnerability Summary - Exploitable Vulnerabilities: This matrix displays warning indicators for exploitable vulnerabilities actively and passively detected on the network.