Support Site

cybersecurity

Substation Remote Access: Beyond the HMI

by

 

 

SUBSTATION REMOTE ACCESS WEBINAR  RECORDING FROM 12.7.17

The ability to have direct access to, not only the HMI but also to relays and other substation equipment is becoming more critical to substation automation and NERC CIP compliance.  The webinar shows a high-level demo of ConsoleWorks and the benefits of substation remote access – an easy, secure connection for direct access to support substation devices, operations, and security. The ConsoleWorks Platform automates a secure connection to the devices eliminating truck rolls and human error.

 

 

We will continue to highlight additional aspects of the ConsoleWorks platform that support automation and compliance to the substation. Stay tuned to the Events page for more upcoming demos and discussions regarding password management, patch management and more.

Webinar: Supply Chain Security

by

Cybersecurity Supply Chain Security: What Can Be Expected From CIP-013-01?

TDi Technologies and Archer Security Group teamed for this cybersecurity supply chain security webinar offering potential solutions for ensuring a secure supply chain in Energy companies.  Cybersecurity risks exist throughout all aspects of a utility company. The threats are real and the potential attacks are largely unpredictable. There have been several real-world examples over the years of security attacks coming in the form of malware being embedded in products purchased, software installed, access given to aid in the deployment of new systems and poor security requirements stemming from the procurement of solutions.

In the very near future, registered utilities will need to address the mandatory requirements in NERC CIP Standards – CIP-013-1.

This new requirement introduces 4 key requirements:

1) Software integrity and authenticity
2) Vendor remote access
3) Information system planning
4) Vendor risk management and procurement controls

This webinar explores these 4 key requirements and the potential solutions that would be expected of your organization to satisfy compliance and, more importantly, support a more secure supply chain for your organization.

PDF of Slides

Other Collaborations with Archer Security Group

Cyber Resilience in Critical Infrastructure

by

Many organizations responsible for critical infrastructures such as electric, gas, and oil have long been practicing resilience in their core operations. I would go so far as to say that those industries are actually quite good at building cyber resilience in critical infrastructure. However, the modernization of our critical infrastructure continues at a rapid pace. The need to obtain more data, control more “stuff”, and operate from anywhere is resulting in once isolated systems becoming being easy attack targets for bad actors, increasing risk of unintended cyber faults, and additional opportunities for misuse.

Cyber systems in operational technology (OT) are often bolt-on solutions or are delivered as part of a turn-key solution purchased outside of traditional IT departments. For example, a generation plant may purchase some “big iron” equipment that comes with several monitors, servers, databases, and perhaps even its own network. However, such systems may show little design consideration with respect to the resiliency of particular components.

More importantly, the included cyber systems often have become critical for the functionality of this “big iron” equipment where previously such equipment was operated manually without the assistance of fancy cyber parts. Why? There are at least two reasons that come to mind:

  • Operating staff have become reliant on keyboards and monitors to run these systems and, more often than not, from a distance (even from foreign countries).
  • Manual just isn’t fast enough, efficient enough, effective enough in the modern world.

It is upon us as technologists – IT/OT engineers, cyber security consultants, CIOs/CTOs, etc. – to begin evaluating and remediating gaps in cyber resilience capabilities throughout the enterprise. Resilience isn’t an option in critical infrastructure, it is an obligation. In many cases, operational technology modernization efforts have not focused on assuring that this additional connectivity and capability provided by cyber systems has not sacrificed the level of resilience we may have once had, or actually need.

I highly suggest a review of the documentation that can be found at the U.S. Resilience Project. That is a great start to understanding more about the importance of strong resilience program or department within critical infrastructure organizations. Keep in mind, that resilience solutions are not done in a day. Part two of our blog series will discuss what is needed to build an effective resilience program and what type of cyber security tools can help.

Additional Collaborations with Archer Security Group:

Stacy Bresler is a Managing Partner for Archer Security Group. He has been supporting critical infrastructure organizations with their cybersecurity needs for over 20 years with a focus on operational technology security practices.

 

ConsoleWorks and FoxGuard Team-Up to Provide Patch Gap & Update Management

by

The new product offering for patch gap and update management, being marketed by FoxGuard Solutions is a result of a multi-year project and a $4.3 million Cooperative Agreement awarded in 2013 from the U.S. Department of Energy’s Cybersecurity for Energy Delivery Systems (CEDS) division.

FoxGuard Solutions leveraged the ConsoleWorks Platform along with their own technologies to develop a solution to help companies identify and mitigate gaps in the security of their systems for IT & OT assets.

The ConsoleWorks Platform can determine the current patch level across all assets. FoxGuard extended the capability to determine which patches are security related and the priority level. By analyzing the relationships between packages, updates, and dependencies, FoxGuard’s Patch Gap product can lay out the shortest, most secure, and safest path for a cyber asset.

ConsoleWorks takes the results generated by FoxGuard and produces simplified yet comprehensive dashboards and associated reports of the current patch situation – across all assets. The simplified view enables companies to assess risk according to their management policies and adhere to compliance and security priorities.

FoxGuard Solutions was tasked with researching, developing, and demonstrating technology and techniques to identify and verify the integrity of updates and patches for energy delivery systems software, hardware and firmware, while also facilitating the deployment of those updates.

Key Elements:
• Patch & Update Data Aggregator & Web Portal
• Patch & Update Authentication
• Validation Techniques
• Query Engine

The Patch and Update Management Program simplifies the process of understanding what patches are available for energy delivery industrial control system devices for both end users and equipment vendors, while also simplifying the ability for a utility to adhere to NERC CIP v6 requirements involving patching, ultimately leading to a safer grid. Read press release.

   

 

FoxGuard Solutions, Inc. and Partner TDi Technologies Unveil Joint Solution for U.S. Department of Energy’s Cybersecurity for Energy Delivery Systems

by

CHRISTIANSBURG, Va. July 13, 2017 – FoxGuard Solutions, Inc. and partner TDi Technologies recently completed a multi-year project to create a safer national power grid by simplifying the process of patching and updating energy delivery control system devices. The solution is the result of a $4.3 million Cooperative Agreement awarded in 2013 from the U.S. Department of Energy’s Cybersecurity for Energy Delivery Systems (CEDS) division.

“This is exactly why FoxGuard Solutions exists and this is where our team excels,” FoxGuard President & CEO, Marty Muscatello, said. “The solution developed comprises several elements that can each stand alone to improve security posture and, when integrated, provide a comprehensive solution to meet energy sector patch and update needs.”

Believing the nation’s security, economic prosperity, and the well-being of its citizens depends on reliable energy infrastructure, the DOE solicited FoxGuard Solution’s expertise to develop the patch and update management project for energy delivery systems. The energy sector places an emphasis on the availability and reliability of energy delivery operations. While best practice avoids the connection of energy delivery system devices to external networks, their increasing interconnectivity poses greater risk to cyber vulnerabilities, making proper and timely patches and updates critically important to maintaining system cybersecurity.

FoxGuard Solutions was tasked with researching, developing, and demonstrating technology and techniques to identify and verify the integrity of updates and patches for energy delivery systems software, hardware and firmware, while also facilitating the deployment of those updates.

Key Elements:
• Patch & Update Data Aggregator & Web Portal
• Patch & Update Authentication
• Validation Techniques
• Query Engine

The Patch and Update Management Program simplifies the process of understanding what patches are available for energy delivery industrial control system devices for both end users and equipment vendors, while also simplifying a utilities adherence to NERC CIP v6 requirements involving patching, ultimately leading to a safer grid.

About FoxGuard Solutions, Inc.
FoxGuard Solutions develops custom cyber security, compliance and industrial computing solutions. FoxGuard provides reliable, secure and configurable patch management reporting services, which include availability reporting and applicability analysis for information technology (IT) and operational technology (OT) assets used in critical infrastructure environments. Visit foxguardsolutions.com to learn more.

About TDi Technologies
TDi Technologies, based in Plano, TX, is the first solution provider to offer a unified system for cybersecurity/operation. Their patented technology provides flexibility, automation, optimization, control and management capabilities that dramatically improve the ability to meet operation and security demands. Visit tditechnologies.com to learn more.

About U.S. Department of Energy’s Cybersecurity for Energy Delivery Systems
In today’s highly interconnected world, reliable energy delivery requires cyber-resilient energy delivery systems. In fact, the nation’s security, economic prosperity, and the well-being of our citizens depends on reliable energy infrastructure. As such, a top priority for the Office of Electricity Delivery and Energy Reliability (OE) is to make the nation’s electric power grid and oil and natural gas infrastructure resilient to cyber threats. Visit energy.gov to learn more.

For Sales Inquires Contact FoxGuard.

Media Contact
Marcie Killen
Marketing Manager
p. 540.382.4234 x152

Webinar: ConsoleWorks | Archer Security Group

by

The 6 Areas Where a Centralized Access Management Approach Can Simplify Compliance Coverage

When researching solutions to address security and regulatory compliance, many utility organizations find themselves acquiring a number of point tools to address the various security/compliance gaps. This webinar recording will discuss how a centralized access management approach can simplify adherence to security and compliance by investigating its value and compliance coverage across both IT and OT devices for interactive access and authentication, password management, asset management, configuration monitoring, logging across various applications and devices, and patch gap analysis.

Other Collaborations with Archer Security Group:

 

We can help

Reach out today, and we'll talk through how we might be able to help!

Contact us