CIP-010 R4 Transient Cyber Assets and Removable Media

The North American Electric Reliability Corporation (NERC) is a not-for-profit international regulatory authority whose mission is to assure the reliability of the bulk power system in North America. NERC Reliability Standards define the reliability requirements for planning and operating the North American bulk power system, which serves more than 334 million people. NERC is committed to protecting the bulk power system against cyber security compromises that could lead to misoperation or instability. The NERC Critical Infrastructure Protection (CIP) Standards provide a cyber security framework for the identification and protection of Bulk Electric System (BES) Cyber Systems, to support the reliable operation of the North American bulk power system.

The purpose of CIP-010 R4 (Transient Cyber Assets and Removable Media) is to manage the use of removable media and other devices not connected to the network all the time (transient assets), and mitigate any potential risks their use or misuse might introduce. Unauthorized use of such devices must be detected. Mobile devices such as laptops that are not connected to the network all the time can present some significant risks, as they will be difficult to manage and keep patched, and they also can potentially introduce malware onto the network. Removable media such as CDs and USB flash drives can not only potentially introduce malware onto the network, but can also be used to exfiltrate sensitive BES system information off of the network.

For organizations that are required to be CIP compliant, Tenable.sc Continuous View (CV) can lead the way to compliance. This dashboard can assist with identifying and tracking the use of removable media and USB devices. Several components within this dashboard utilize plugins that detect the device type, vendor, and when the device was first connected. USB devices, external drives, mobile phones, tablets, and digital cameras all have the ability to store data. Detected devices from some of the top vendors and devices types are presented, and can be modified to fit organizational needs. Audit checks on removable devices and media, including CD-ROMs, floppies, and USB devices, are also presented. This dashboard can assist an organization in monitoring transient device and removable media activity on the network, which will aid in meeting the CIP-010 R4 requirements and measures. Analysts can also use this dashboard to easily drill down and gain more detailed information.

The CIP standards recommend categorizing BES Cyber Assets into different impact categories. An asset's impact category is based on the adverse impact to BES reliability that would occur if the asset was unavailable, degraded, or misused. Once the impact categories of systems have been determined, asset groups in Tenable.sc CV can be used to group together machines in each impact category. Asset groups can then be applied to this dashboard to narrow the focus and enable more accurate reporting on systems in specific impact categories. For more information on using assets with dashboards, see How to Add Assets in SecurityCenter and How to Use Assets with Dashboards. Alternatively, if the assets are in separate subnets, then subnet filters can be easily applied to narrow the focus of this dashboard.

This dashboard and its components are available in the Tenable.sc Feed, a comprehensive collection of dashboards, reports, Assurance Report Cards, and assets. The dashboard can be easily located in the SecurityCenter Feed under the category Compliance & Configuration Assessment. The dashboard requirements are:

• SecurityCenter 5.2.0
• Nessus 8.4.0
• NNM 5.8.1
• LCE 6.0.0

Tenable's Tenable.sc Continuous View (CV) is the market-defining continuous network monitoring solution. For Supervisory Control and Data Acquisition (SCADA) systems, where reliability and not interfering with normal operations is a concern, Tenable.sc CV includes passive vulnerability detection with Tenable’s Nessus Network Monitor (NNM), as well as log correlation with Tenable’s Log Correlation Engine (LCE). Where possible, active vulnerability detection and compliance scanning with Nessus can also be done. Using Tenable.sc CV, an organization will obtain the most comprehensive and integrated view of its SCADA network.

The following components are included in this dashboard:

• Event Trending By Type - USB: This component displays a 7-day trend analysis of USB events.
• Removable Media and Content Audits - USB Storage Audit Checks: This component focuses on compliance data, filtering on several strings containing 'USB' in the plugin name.
• Removable Media and Content Audits - CDROM, Floppy, Other Storage Audit Checks: This component focuses on compliance data, filtering on several strings containing CDROM, floppy, and other removable storage devices in the plugin name.
• CSF - Windows Detections of Removable Devices: This component presents a matrix of Windows detections of removable storage devices.
• CSF - Windows History of Removable Devices: This table presents a list of detected removable devices that have been connected to a Windows host at least once in the past.
• CSF - Windows Detections of Removable Storage Devices: This component presents a list of connected removable devices on Windows hosts.