CIP-007 R1 Ports and Services

The North American Electric Reliability Corporation (NERC) is a not-for-profit international regulatory authority whose mission is to assure the reliability of the bulk power system in North America. NERC Reliability Standards define the reliability requirements for planning and operating the North American bulk power system, which serves more than 334 million people. NERC is committed to protecting the bulk power system against cyber security compromises that could lead to misoperation or instability. The NERC Critical Infrastructure Protection (CIP) Standards provide a cyber security framework for the identification and protection of Bulk Electric System (BES) Cyber Systems, to support the reliable operation of the North American bulk power system.

The purpose of CIP-007 R1 (Ports and Services) is to reduce the attack surface of the network by disabling unnecessary logical ports and services. If a network port or service is not needed, then there is no reason to leave it open and available where an attacker might be able to make use of it. This "least functionality" approach is a standard security best practice.

For organizations that are required to be CIP compliant, Tenable.sc Continuous View (CV) can lead the way to compliance. This dashboard can assist in identifying ports and services that are open versus those that are actively being used. Any unused ports and services should be disabled. Other components on this dashboard note new open ports, encrypted ports, and vulnerabilities associated with ports. The Exploitable Internet Services component indicates those ports and services that have known exploitable vulnerabilities and that are accessible from outside the network; these vulnerabilities are particularly dangerous. To enable detection of systems that are accessible from outside the network, IP address ranges for the internal network can be configured within the Nessus Network Monitor (NNM); see the user guide. This dashboard can assist in discovering ports and services that can be disabled on the network, which will aid in meeting the CIP-007 R1 requirements and measures. Analysts can also use this dashboard to easily drill down and gain more detailed information.

The CIP standards recommend categorizing BES Cyber Assets into different impact categories. An asset's impact category is based on the adverse impact to BES reliability that would occur if the asset was unavailable, degraded, or misused. Once the impact categories of systems have been determined, asset groups in Tenable.sc CV can be used to group together machines in each impact category. Asset groups can then be applied to this dashboard to narrow the focus and enable more accurate reporting on systems in specific impact categories. For more information on using assets with dashboards, see How to Add Assets in SecurityCenter and How to Use Assets with Dashboards. Alternatively, if the assets are in separate subnets, then subnet filters can be easily applied to narrow the focus of this dashboard.

This dashboard and its components are available in the Tenable.sc Feed, a comprehensive collection of dashboards, reports, Assurance Report Cards, and assets. The dashboard can be easily located in the Tenable.sc Feed under the category Compliance & Configuration Assessment. The dashboard requirements are:

• SecurityCenter 5.2.0
• Nessus 8.4.0
• NNM 5.8.1
• LCE 6.0.0
• Tenable Network Monitor
• Tenable NetFlow Monitor

Tenable's Tenable.sc Continuous View (CV) is the market-defining continuous network monitoring solution. For Supervisory Control and Data Acquisition (SCADA) systems, where reliability and not interfering with normal operations is a concern, Tenable.sc CV includes passive vulnerability detection with Tenable’s Nessus Network Monitor (NNM), as well as log correlation with Tenable’s Log Correlation Engine (LCE). Where possible, active vulnerability detection and compliance scanning with Nessus can also be done. Using Tenable.sc CV, an organization will obtain the most comprehensive and integrated view of its SCADA network.

The following components are included in this dashboard:

• Network Mapping - Top Open Ports: This table presents the top ports that were detected to be open by various active scanning techniques.
• Network Mapping - Top Active Services: This table enumerates the top services that were active and listening on the network.
• Indicators - Exploitable Internet Services: This component indicates if PVS has detected any Internet facing exploitable services.
• CIP - Top Ports with Most SCADA Events: This table presents the top ports associated with SCADA events on the network within the last 15 days.
• CIP - Activity on Standard SCADA Ports: This matrix component presents indicators of detected network activity on standard ports used by SCADA protocols.
• CIP - Activity on SCADA Vendor Specific Ports: This matrix component presents indicators of detected network activity on ports used by specific SCADA vendors.
• Vulnerabilities by Common Ports - CVSS Vulnerability Counts Per Port: This matrix uses a combination of CVSS scores and severity to communicate the risk of discovered vulnerabilities.
• Verizon 2015 DBIR - Top Most Active Ports: This table provides a list of the top 100 ports in use on the network.
• Firewall Events - New Open Ports: This component displays a 25-day trend of the new open port events discovered by PVS.
• Network Encryption Anomalies - Encrypted Ports: This bar chart provides a port summary for all detected encrypted sessions.