Cyber Security Best Practices Eric Weston Senior Auditor Cyber Security WECC Reliability and Security Workshop San Diego CA – October 23-24, 2018 Western Electricity Coordinating Council

Western Electricity Coordinating Council Cyber Risks “One of the main cyber-risks is to think they don’t exist. The other is to try to treat all potential risks. Fix the basics, protect first what matters for your business and be ready to react properly to pertinent threats.” Stephane Nappo: GCISO Société Générale Western Electricity Coordinating Council

Western Electricity Coordinating Council Agenda Prevent What You Can Detect What You Can’t Prevent Be Prepared to Recover Western Electricity Coordinating Council

Putting Things in Perspective What are your risks and challenges What is important with different systems Confidentiality Integrity Availability Western Electricity Coordinating Council

Jess Smith, Nathan Kipp, Dennis Gammel, Tim Watkins: EEA Conference June 2016

Preventative Measures Tightening down perimeter protections Perform regular reviews of firewall configurations Remove/Disable outdated and unneeded rules and objects Be cautions with “maintenance” rules Review rules which generate few if any hits Ensure all rules have detailed descriptions Rules should be as specific as possible Commit to continual improvements Review access rules holistically Western Electricity Coordinating Council

Preventative Measures Reviewing Access Rules Holistically access-list esp_in extended permit tcp ems dmzwks2 eq ssh access-list esp_in extended permit ip host1 host2 range 0 512 access-list esp_in extended permit tcp ems subwks1 eq 2000 access-list esp_in extended permit ip host1 host2 range 513 25000 access-list esp_in extended permit udp 10.0.1.1 172.36.5.1 eq 2355 access-list esp_in extended permit ip host1 host2 range 25001 65535 access-list esp_in extended permit ip 10.0.1.1 172.36.5.1 eq dns access-list esp_in extended permit ip host1 host2 eq any Western Electricity Coordinating Council

Preventative Measures Utilize the tools you have Host based firewalls/iptables System hardening Windows Security Templates Vendor Specific Recommendations Don’t reinvent the wheel Other methods, tools, etc. Western Electricity Coordinating Council

Prevention/Detection Active Defense Passive Defense Firewalls Traditional Anti-Virus Systems Other measures Active Defense2 Threat and Environment Manipulation Threat Intelligence Consumption Network Security Monitoring Incident Response 2https://digital-forensics.sans.org/media/Poster_DFIR_Threat-Intel_2017.pdf Western Electricity Coordinating Council

Detecting Abnormalities Leveraging your environment The glass is half full Operational technology (OT) environments change infrequently Users and systems should only be performing specific tasks on OT networks Traffic should be relatively predictable Western Electricity Coordinating Council

Detecting Abnormalities Establishing normal Identifying Assets and Communications Paths Physical Inspection Router/Firewall configurations Network Traffic Analysis Identifying and Validating Network Traffic Firewall/Router Logs Western Electricity Coordinating Council

Detecting Abnormalities Becoming more situationally aware Are monitoring systems tailored to your environment? Western Electricity Coordinating Council

Be Prepared for the When Western Electricity Coordinating Council

Western Electricity Coordinating Council Recovery 2018 Atlanta SamSam Ransomware Attack One third of the cities 424 software programs affected Potential Cost of $9.5 Million Some data will never be recovered https://www.reuters.com/article/us-usa-cyber-atlanta-budget/atlanta-officials-reveal-worsening-effects-of-cyber-attack-idUSKCN1J231M?feedType=RSS&feedName=technologyNews Western Electricity Coordinating Council

Western Electricity Coordinating Council Recovery Regularly back up data and verify the integrity of those backups Secure backups Ensure backups are not connected to the computers and networks they are backing up https://www.ic3.gov/media/2016/160915.aspx Western Electricity Coordinating Council

Western Electricity Coordinating Council Recovery Practice, Practice, Practice During an event is not the first time a recovery processes should be performed Be creative during recovery exercises Ensure everyone knows their part and has the needed tools and knowledge Continually learn and improve processes Western Electricity Coordinating Council

Western Electricity Coordinating Council Cybersecurity is a shared responsibility, and it boils down to this: In Cybersecurity, the more systems we secure, the more secure we all are. Jeh Johnson: Secretary of Homeland Security Western Electricity Coordinating Council