Eaton Network-M3 User Manual

Cybersecurity considerations for electrical distribution systemsSecuring the Network Management Module – 208••••••••••••••••••Existing (traditional) IT standards and policies may not apply (or have not been considered) for control systems. A gap analysisshould be performed to determine which components are not covered (or not adequately covered) by existing policies.Relationships with existing policies and standards should be explicitly identified and new or supporting policies should bedeveloped. It is important that industrial control system administrators have proper authorizations and full support of theirmanagement to implement policies that will help secure the ICS network.5.1.7.4 ICS hardeningThe goal for system hardening is to reduce as many security risks as possible by securely configuring ICS networks. The idea is toestablish configurations based on what is required and eliminate unnecessary services and applications that could potentiallyprovide another possible entry point to an intruder.Minimum security baselines should be established for the various platforms and products deployed (operating system, application,and infrastructure elements such as drives, meters, HMI devices). The following actions should be implemented where applicable:Disable unnecessary servicesDisable anonymous FTPDo not use clear text protocols (e.g., use SSH v2 instead of Telnet)Install only required packages/applications/featuresDeploy antivirus solutions (where possible)Disable or otherwise control use of USB devicesEstablish a warning bannerChange default passwords (e.g., SNMP)It may be easier to implement these actions on devices for which you control the base operating system platform. However,severalof the items listed above can be configured from the product specific configuration options.Changes such as these could potentially impact the functionality of a control system device. Extensive testing needs to beconducted before deployment to minimize this impact.5.1.7.5 Continuous assessment and security trainingIt is critical that ICS network administrators and regular users be properly trained to ensure the security of the ICS and the safety ofthe people who operate and depend on it.Ongoing vulnerability assessments are critical to identify issues and understand the effectiveness of other defensible networkelements.Assessments should include testing and validating the following:Monitoring capabilities and alerts are triggered and responded to as expectedDevice configuration of services and applicationsExpected connectivity within and between zonesExistence of previously unknown vulnerabilities in the environmentEffectiveness of patchingA program should be established for performing assessments.The actual assessment should be performed by a qualified resource, which can be an in-house or third-party organization.Regardless of who performs the assessments, in-house resources need to be involved in the planning, scoping, and supporting ofassessment activities and must be appropriately trained to do so.Assessments should be conducted according to a methodology that is clearly defined to address:Physical securityPeople and processesNetwork securityHost securityApplications security (both internally developed and commercially off-the-shelf (COTS))5.1.7.6 Patch management planning and proceduresA patching and vulnerability management process should be established based on the timely awareness of issues and appropriateaction. This process should take all of the elements that make up the control system environment into consideration.Information resources should be identified for vulnerability and advisory information for the various components in the environment.These should include vendor-specific sources as well as other public or commercial services that provide vulnerability advisoryinformation. For example, the National Vulnerability Database (NVD) provides information related to vulnerabilities identified in