NERC CIP Compliance Software

Cyber Security Awareness
CIP-003-8 R1 (1.2.1)

Each Responsible Entity shall reinforce, at least once every 15 calendar months, cyber security practices.

BrowseReporter

• Get alerts when users attempt to visit high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage
• Phishing awareness training

AccessPatrol

• Get alerts when unknown or blocked removable media is inserted into endpoints within BES Cyber System(s)
• Monitor removable media activity for security policy violations

Cyber Security Incident Response
CIP-003-8 R1 (1.2.4)

Each Responsible Entity shall have one or more Cyber Security Incident response plan(s), either by asset or group of assets, which shall include identification, classification, and response to Cyber Security Incidents

BrowseReporter

• Get alerts when users attempt to visit known high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage

AccessPatrol

• Get alerts when unknown or blocked removable media is inserted into endpoints within BES Cyber System(s)
• Monitor removable media activity for cyber security incidents such as illicit transfers of BCSI

Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation
CIP-003-8 R1 (1.2.5)

Each Responsible Entity shall implement, except under CIP Exceptional Circumstances, one or more plan(s) to achieve the objective of mitigating the risk of the introduction of malicious code to low impact BES Cyber Systems through the use of Transient Cyber Assets or Removable Media.

AccessPatrol

• Block unauthorized removable media devices to mitigate the risk of employees and contractors introducing malicious code
• Lock down removable media virus scanning machines (“Sheep Dip”) by disabling Bluetooth, USB Network Adapters, Network Drives, and WiFi hardware when not explicitly required
• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets
• Maintain a log of all file operations to and from removable media devices introduced to BES Cyber Systems and Transient Cyber Assets

BrowseControl

• Lock down removable media virus scanning machines (“Sheep Dip”) by blocking TCP/UDP network ports and internet access over web browsers
• Restrict browser access to authorized websites and intranet portals to prevent the introduction of malicious code from high-risk websites
• Close unused network ports at the endpoint level to reduce the attack surface of Transient Cyber Assets

Table R1– Ports and Services
CIP-007-6 R1 (1.1)

Where technically feasible, enable only logical network accessible ports that have been determined to be needed by the Responsible Entity, including port ranges or services where needed to handle dynamic ports. 

BrowseControl

• Disable unneeded TCP/UDP ports at the endpoint level to reduce the attack surface of Transient Cyber Assets
• Restrict browser access to authorized websites and intranet portals to prevent the introduction of malicious code from high-risk websites

Table R1– Ports and Services
CIP-007-6 R1 (1.2)

Protect against the use of unnecessary physical input/output ports used for
network connectivity, console
commands, or Removable Media

AccessPatrol

• Block a variety of peripherals including removable media devices, wireless devices, and serial/parallel communication ports.
• Lock down endpoints by disabling Bluetooth, USB Network Adapters, Network Drives, and WiFi hardware when not explicitly required
• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets

Learn More: Which devices can I control with AccessPatrol?

Table R3 – Malicious Code Prevention
CIP-007-6 R3 (3.1)

Deploy method(s) to deter, detect, or
prevent malicious code.

AccessPatrol

• Block unauthorized removable media devices to mitigate the risk of employees and contractors introducing malicious code
• Lock down removable media virus scanning machines (“Sheep Dip”) by disabling Bluetooth, USB Network Adapters, Network Drives, and WiFi hardware when not explicitly required
• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets
• Get alerts of attempts to use unauthorized removable media devices

BrowseControl

• Disable unneeded TCP/UDP ports at the endpoint level to reduce the attack surface of Transient Cyber Assets
• Restrict browser access to authorized websites and intranet portals to prevent the introduction of malicious code from high-risk websites
• Block known malicious domains with predefined web content categories

BrowseReporter

• Get alerts when users attempt to visit known high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage

Learn More: CurrentWare’s endpoint security solutions

Table R4 – Security Event Monitoring
CIP-007-6 R4 (4.1.1; 4.2; 4.4)

Log events at the BES Cyber System
level (per BES Cyber System capability)
or at the Cyber Asset level (per Cyber
Asset capability) for identification of,
and after-the-fact investigations of,
Cyber Security Incidents that includes, as a minimum, each of the following
types of events:

4.1.1. Detected successful login
attempts;

4.1.2. Detected failed access
attempts and failed login
attempts;

4.1.3. Detected malicious code.

──

4.2

Generate alerts for security events that the Responsible Entity determines necessitates an alert.

──

4.4

Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater than 15 calendar days to identify undetected Cyber Security Incidents.

enPowerManager

• Maintain a log of each successful login attempts including timestamps and duration of each logon event

AccessPatrol

• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets
• Get alerts of attempts to use unauthorized removable media devices
• Get alerts when specific file operations occur such as attempts to transfer files with extensions associated with BCSI
• Automate the sending of user activity reports to designated email addresses at a set schedule

BrowseReporter

• Get alerts when users attempt to visit known high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage
• Automate the sending of user activity reports to designated email addresses at a set schedule

CurrentWare Web Console

• CurrentWare admin activity logs provide details of configuration changes to monitor for malicious or negligent admin activity within the CurrentWare Suite

Table R4 – Security Event Monitoring
CIP-007-6 R4 (4.3)

Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days except under CIP Exceptional Circumstances.

• The CurrentWare Suite is hosted and managed by your organization, giving you full control over data retention.
• Using the Auto Delete Scheduler you can automate the deletion of historical user activity data after 90+ days

Table R2 – Configuration Monitoring
CIP-010-4 R2 (2.1)

Monitor at least once every 35 calendar days for changes to the baseline configuration. Document and investigate detected unauthorized changes.

BrowseReporter

• Monitor user computer activity for the use of shadow IT and other unauthorized software
• Automate the sending of user activity reports to designated email addresses at a set schedule

CurrentWare Web Console

• CurrentWare admin activity logs provide details of configuration changes to monitor for malicious or negligent admin activity within the CurrentWare Suite

Table R1 – Information Protection Program
CIP-011-3 R1 (1.2)

Method(s) to protect and securely handle BCSI to mitigate risks of compromising confidentiality.

AccessPatrol

• Block data transfers to portable storage devices to prevent data theft or loss by employees and contractors
• Lock down removable media virus scanning machines (“Sheep Dip”) by disabling Bluetooth, USB Network Adapters, Network Drives, and WiFi hardware when not explicitly required
• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets
• Get alerts of attempts to use unauthorized removable media devices

BrowseControl

• Disable unneeded TCP/UDP ports at the endpoint level to reduce the attack surface of Transient Cyber Assets
• Prevent users from launching applications that are known to be a risk to BCSI such as cloud storage apps
• Restrict browser access to authorized websites and intranet portals to prevent the introduction of malicious code from high-risk websites
• Block known malicious domains and internet-based data egress points such as cloud storage sites with predefined web content categories

BrowseReporter

• Get alerts when users attempt to visit known high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage

Learn More: CurrentWare’s data loss prevention solutions