Support Site

Updates

TDi Technologies and Other Vendors Selected by NCCoE to Collaborate on Asset Management Project for the Energy Sector

by

Project Aims to Help Energy Providers Monitor, Manage, and Secure Their Assets

ForeScout Technologies, Tripwire, Dragos, Splunk, KORE Wireless, TDi Technologies, FoxGuard Solutions, and Veracity Industrial Networks have joined the National Cybersecurity Center of Excellence (NCCoE) as technology collaborators in the Energy Sector Asset Management (ESAM) Project.*

In response to a call in the Federal Register, these companies submitted capabilities that aligned with desired solution characteristics listed in the project description. These technology collaborators were extended a cooperative research and development agreement (CRADA; see example), allowing them to participate in a consortium where they will contribute expertise and hardware or software to help refine a reference design and build an example standards-based implementation.

As part of this collaboration, the NCCoE will compose and release a publicly available National Institute of Standards and Technology (NIST) Cybersecurity Practice Guide (Special Publication 1800 series), which will document the reference design and help organizations in the energy sector effectively identify, control, and monitor their operational technology (OT) assets.

NCCoE Focuses on Critical Infrastructure Through Operational Technology Assets

OT /Industrial Control Systems (ICS) are used in the energy sector and other critical infrastructure sectors to manage industrial operations. Disruptions to OT/ICS assets can result in economic loss and interruption of critical services to millions of consumers. Energy providers recognize the need to improve their OT asset management capabilities, especially for remote assets, to mitigate vulnerabilities and opportunities for malicious attacks.

The project will aim to address the following characteristics of asset management:

  • Asset Discovery: establishment of a full baseline of physical and logical locations of assets
  • Asset Identification: capture of asset attributes, such as manufacturer, model, operating system, internet protocol (IP) addresses, media access control addresses, patch-level information, and firmware versions
  • Asset Visibility: continuous identification of newly connected or disconnected devices, and IP (routable and non-routable) and serial connections to other devices
  • Asset Disposition: the level of criticality (high, medium, or low) of an asset, its relation to other assets within the OT network, and its communication (including serial) with other devices
  • Alerting Capabilities: detection of a deviation from the expected operation of assets

Collaborating on an Advanced Strategy

In partnership with the selected technology collaborators, the NCCoE will implement the collaborators’ commercially available products in a laboratory environment to build a standards-based, modular, end-to-end example solution that will address the security challenges of OT asset management for the energy sector.

Business Benefits

The example solution for this project aims to provide the following business benefits:

  • reduces cybersecurity risk and potentially reduces impact to safety and operational risk such as power disruption
  • develops and executes a strategy that provides continuous OT asset management and monitoring
  • enables faster responses to security alerts through automated cybersecurity event/attack capabilities
  • implements current cybersecurity standards and best practices while maintaining the performance of energy infrastructures

How to Participate

Interested parties are encouraged to engage with us through our project web page.

If you have additional comments or questions or would like to join the community of interest that is helping guide this project and provide feedback, please email us at Energy_nccoe@nist.gov.

*Certain commercial entities, equipment, products, or materials may be identified to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST or NCCoE, nor is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose.

Energy Sector Asset Management Architecture

 This diagram depicts the proposed high-level architecture to help improve an energy provider’s asset management capabilities. This architecture demonstrates a single physically remote site that contains the sensor and remote monitoring technologies specific to this project. This individual remote site is modular and can be scaled to represent other remote locations that feed information back to a single centralized enterprise location. There may be more than one remote site in this build.  

 

ConsoleWorks Addresses GDPR | Secure & Controlled Access

by

EU GENERAL DATA PROTECTION REGULATION (GDPR)

GDPR Data Security Compliance for Privileged Users

The EU General Data Protection Regulation (GDPR) has been designed to protect how personal data of EU citizens is collected, processed and stored. This requires companies to evaluate their data security strategy as to how they collect and store data, who has access to the data and implement policies to ensure compliance with GDPR Data Security for Secure Access.

Secure and Controlled Access to Data

GDPR requires companies to implement granular controls to protect access, and set and enforce clear roles and responsibilities for access to the systems that hold personal data. ConsoleWorks Privileged Interactive Access enables companies to proactively protect their privileged credentials and secure remote access to devices and systems for inside privileged users, vendors, and contractors.

ConsoleWorks ensures that every remote access connection made by our customers, whether a privileged user connecting to a critical system or device or a help desk connecting to a user, is secure. ConsoleWorks protects critical systems and data while helping companies meet the data privacy requirements of GDPR.

  • Ensure Data Protection
    Control and limit access to sensitive personal data to only the privileged users’ authorized level.
  • Streamline Regulatory Compliance
    Automatically capture detailed audit trail that documents all session activities and credential usage.
  • Simplify Audit & Reporting
    Significantly reduce the time involved in collecting the data required to support an audit and producing the reports to prove compliance.

ConsoleWorks 5.1 Release

by

ConsoleWorks 5.1 release contains a number of new capabilities that greatly enhance the usability of the product. Starting with the complete re-write of the Online Help and improvements in updating the UI, such as the ability to retain a filter window view. There are a number of these types of features that you will find improved in ConsoleWorks 5.1.

Other significant features in ConsoleWorks 5.1 release includes:

• Device and Device Type resources
• A new Chained Console connector type
• File Monitor Console type
• WEF feature to retrieve Windows Events on a Console reconnect

In addition to these powerful features, there are also a number of security improvements with this release.

Support Site for Complete 5.1 Information

To access product downloads, you must be a TDi customer with a current Maintenance and Support Agreement and a valid login. To get a login please contact support@tditechnologies.com.

ConsoleWorks 5.1 Release

Substation Remote Access: Beyond the HMI

by

 

 

SUBSTATION REMOTE ACCESS WEBINAR  RECORDING FROM 12.7.17

The ability to have direct access to, not only the HMI but also to relays and other substation equipment is becoming more critical to substation automation and NERC CIP compliance.  The webinar shows a high-level demo of ConsoleWorks and the benefits of substation remote access – an easy, secure connection for direct access to support substation devices, operations, and security. The ConsoleWorks Platform automates a secure connection to the devices eliminating truck rolls and human error.

 

 

We will continue to highlight additional aspects of the ConsoleWorks platform that support automation and compliance to the substation. Stay tuned to the Events page for more upcoming demos and discussions regarding password management, patch management and more.

Webinar | Archer Security Group & TDi

by

TDi Technologies and Archer Security Group teamed for this security compliance webinar directed at the security compliance needs of the Energy sector. There is no questioning the fact that security compliance requirements are often a burden to implement and your organization spends a tremendous amount of time, money & resources to achieve a state of compliance. Compliance must be addressed to avoid fines, sanctions or loss of political chips. Basically, your organization cannot be considered by auditors as being non-compliant. Too often organizations find themselves in a fire drill loop where they are always in an audit or preparing for an audit. This action disrupts the normal course of business and can cause havoc between compliance and operations.

In this webinar, we discussed:

  • Moving beyond the compliance treadmill and start building compliance into day-to-day operations so it is no longer an audit-is-coming scramble.
  • A focus on operational excellence that supports all security compliance requirements for an organization, resulting in audit-ready evidence outputs.
  • Next level of security compliance, a concept of ‘mission assurance’ and how this practice can be transformational for an organization regarding security and compliance initiatives.

Additional Collaborations with Archer Security Group:

Slides PDF

 

 

 

 

ConsoleWorks | Automated Patch Analysis Process

by

Available Q2 2018

The new, Automated Patch Analysis Process from ConsoleWorks will be applicable to various IT/OT patching processes including, PCI-DSS, NIST 800-53, HIPAA, NERC CIP and others.

Automated Patch Analysis Process Use Case: NERC CIP-007-6/R2

NERC CIP-007-6 / R2 requires a patch management process for tracking, evaluating, and installing cybersecurity patches for applicable Cyber Assets, including device drivers. Many utilities see this is a grueling task, requiring many, many man-hours to meet the “every 35-day analysis” required by NERC CIP.

Many utilities are in various stages of implementation of an effective solution with most relying on a manual update of a database, or spreadsheet, that contains the latest patch versions entered for each asset. Traditionally, the asset information has been manually gathered and manually entered since these approaches are disconnected from the assets. These and other manual approaches not only result in inconsistencies and errors, but are enormously labor intensive.

The ConsoleWorks Automated Patch Analysis solution greatly simplifies the process of gathering the information required for patching IT and OT devices – beyond the HMI.

For meeting NERC CIP compliance, ConsoleWorks establishes a secure access to access all devices and then is configured via a schedule to perform the patch analysis every 35 days, keeping a log, for audit purposes, of when the analysis was run. Once the current patch state is gathered by ConsoleWorks, ConsoleWorks can integrate with industry or custom solutions to assist in automating the patch gap analysis. In these cases, ConsoleWorks sanitizes, anonymizes, and encrypts the data before initiating the secure transfer of the collected device information.

After the initial collection is sent, ConsoleWorks can be configured to continually monitor for the patch gap analysis results. When available, ConsoleWorks automatically downloads and processes the results, using ConsoleWorks Events as an indication to the user when patches are available. Event Severities further indicate whether an available patch is a security patch.

Finally, ConsoleWorks produces dashboard report views to organize and communicate the current patch state. ConsoleWorks presents a summary report containing information on patch gaps that may exist for each asset, including links to any available patch for downloading directly from the vendor site.

At this point, a utility will evaluate the available security patch for applicability and make the decision to install the patch or initiate a mitigation plan. ConsoleWorks’ integration with workflow management solutions enables utilities to further automate the patching and mitigation processes as required by NERC.

 

 

The patch analysis features will be available in ConsoleWorks in Q2, 2018, and are part of a larger cybersecurity and operations platform solution addressing IT/OT patching processes for PCI-DSS, NIST-800-53, HIPAA, NERC CIP V6 ( CIP-005, CIP-007, CIP-010, and CIP-013) requirements for Secure Remote Access, Asset and Configuration Monitoring, Endpoint Password Management, Logging and Situational Awareness and Supply Chain.

 

We can help

Reach out today, and we'll talk through how we might be able to help!

Contact us