Governance & Risk Management
,
Operational Technology (OT)
,
Standards, Regulations & Compliance
New Rules Tell Power Grid Operators to Log All OT Network Traffic
A new reliability standard for U.S. and Canadian electric grid tells major power companies to monitor and log traffic on their operational technology and industrial control systems networks. Operators, regulators said, should be able to detect, prevent and respond to unauthorized intrusions aimed at sabotaging the North American power supply.
See Also: OnDemand | Navigating the SEC Rules for Enhanced Cybersecurity in IT and OT Environments
OT security experts say that the new rules – mandated after attacks on the Ukrainian electric grid by Russian hackers and the discovery of Chinese threat actors prepositioned in the networks of U.S. power companies – will be a heavy lift for the electricity sector.
The mandate may seem simple enough, but the breadth of the new requirements and the complexity of the systems they cover are anything but effortless. “The mandate covers not just ‘North-South’ traffic [from outside the OT network], but ‘East-West’ traffic [within the OT network], too,” explained Carlos Buenano, a control systems engineer who is CTO for OT at Armis, a cyber firm specializing in OT and IoT security.
“That’s not just from the firewall to the last device in the switch room, but beyond that, the traffic from the operator and engineer stations, the human interface workstations … to the controllers and then from there to the field devices.”
Depending on the architecture of the networks that have to be monitored, Buenano said, that could involve placing new hardware sensors in “in every cabinet or in every switch within every substation.”
“So from a deployment perspective it can be quite complicated,” he said.
The inclusion of ‘East-West’ traffic in the new standard is significant, said Kristine Martz, principal product advisor for Dragos, the OT cybersecurity firm. Previous cybersecurity mandates imposed by the North American Electric Reliability Corporation all concerned perimeter security.
The new standard, known as NERC-CIP-15-1, “Is just a little bit different, because what they’re trying to do is say, ‘Okay, but what if somebody bypassed that perimeter security … and they’re inside the trust zone and they’re doing things in your network – communicating with those crown jewel assets – that you don’t want them to be able to do.'”
CIP-15-1 adopts a zero trust approach, “Acknowledging that sophisticated attackers will inevitably breach the perimeter,” said Dan Hewitt, product manager for OT Security at Tenable. The new rule “mandates a critical shift from a purely preventive model to a detect-and-respond framework,” he said via email.
In addition to monitoring and logging, the new standard requires the companies to detect and analyze anomalous traffic for determining how to respond to intrusions.
Detecting anomalies means establishing a baseline by building a model of daily traffic, Martz said. “What does normal look like? And once you’ve got that picture, you can continuously monitor that network traffic and identify any deviations from that norm.”
Like SIEMs and other security tools used on IT networks, the specialized tools used to monitor OT networks typically provide a queue of alerts that have to be triaged by human analysts in a security operations center, said Martz. But there are specialist skills involved in understanding and evaluating those alerts.
“One model I’ve seen be successful is when you have a single SOC, and two teams under it,” she said. One dealing with the corporate IT networks – “because that’s also a unique skillset” – and the other with OT. “Having them unified underneath one centralized SOC is helpful, because it helps them to bring together the conversations about consequences. Things that happen in the IT environment that might be of interest to OT and vice versa.”
The rule shows that, at least in highly regulated industries like electric utilities, it is possible to improve cybersecurity by regulation, Martz said.
“The drafting team did a really nice job on this,” she said. The standard calls for a risk-based approach, but didn’t mandate particular approaches or technologies that could quickly become outdated.
But that meant companies had to make decisions about which network data feeds to store. “It can be overwhelming. There’s a tuning aspect that’s part of implementing any sort of tool for internal network security monitoring. What to keep and what not,” Martz said.
The regulation leaves a lot up to the regulated companies, Buenano said. “The mandate is to protect these assets by understanding anomalous behaviors. It doesn’t really specify how deep you have to go to do that.” High-level monitoring could detect certain kinds of anomalous traffic – like that from an unknown IP address or using an unexpected communications protocol or port – but to examine the contents of communications, to detect malicious instructions sent via authorized channels is harder. “How deep do you want to go? This stuff is expensive,” said Buenano.
Adding to the complexity, a company that operates at numerous locations might find that only some of them are covered by the new rules, which apply only to “high impact” and “medium impact” systems – the ones most critical to the maintenance of electrical power supply. Legacy systems may be present at some sites and not at others, Buenano said. “As much as we would like to be able to roll this out in a standardized way,” in reality, the question of how to meet the requirements will have to be answered “site by site, and sometimes even switch by switch.”
The rule has a three year implementation period for high impact sites and five years for medium impact sites, meaning the measures have to be in place by Oct. 1, 2028 for the critical networks and two years later for the merely important ones.
That might seem like a long time, but it’s not, especially for companies working from a standing start. “If you have to start with an RFP process and invite several vendors to tender, these processes take time,” Buenano said.
“We’re talking about critical infrastructure that has to work 24/7, 100%,” he said. “You have to be very careful. You have to have change management, program management, you have to start planning these changes” months before they can be implemented.
The new rules affected companies of all sizes, Buenano said, and while it was impossible to generalize, “You are talking about hundreds of thousands if not millions of dollars” invested.