NERC CIP Compliance Software

Table R1– Ports and Services
CIP-007-6 R1 (1.1)

Where technically feasible, enable only logical network accessible ports that have been determined to be needed by the Responsible Entity, including port ranges or services where needed to handle dynamic ports. 

BrowseControl

• Disable unneeded TCP/UDP ports at the endpoint level to reduce the attack surface of Transient Cyber Assets
• Restrict browser access to authorized websites and intranet portals to prevent the introduction of malicious code from high-risk websites

Table R1– Ports and Services
CIP-007-6 R1 (1.2)

Protect against the use of unnecessary physical input/output ports used for
network connectivity, console
commands, or Removable Media

AccessPatrol

• Block a variety of peripherals including removable media devices, wireless devices, and serial/parallel communication ports.
• Lock down endpoints by disabling Bluetooth, USB Network Adapters, Network Drives, and WiFi hardware when not explicitly required
• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets

Learn More: Which devices can I control with AccessPatrol?

Table R3 – Malicious Code Prevention
CIP-007-6 R3 (3.1)

Deploy method(s) to deter, detect, or
prevent malicious code.

AccessPatrol

• Block unauthorized removable media devices to mitigate the risk of employees and contractors introducing malicious code
• Lock down removable media virus scanning machines (“Sheep Dip”) by disabling Bluetooth, USB Network Adapters, Network Drives, and WiFi hardware when not explicitly required
• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets
• Get alerts of attempts to use unauthorized removable media devices

BrowseControl

• Disable unneeded TCP/UDP ports at the endpoint level to reduce the attack surface of Transient Cyber Assets
• Restrict browser access to authorized websites and intranet portals to prevent the introduction of malicious code from high-risk websites
• Block known malicious domains with predefined web content categories

BrowseReporter

• Get alerts when users attempt to visit known high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage

Learn More: CurrentWare’s endpoint security solutions

Table R4 – Security Event Monitoring
CIP-007-6 R4 (4.1.1; 4.2; 4.4)

Log events at the BES Cyber System
level (per BES Cyber System capability)
or at the Cyber Asset level (per Cyber
Asset capability) for identification of,
and after-the-fact investigations of,
Cyber Security Incidents that includes, as a minimum, each of the following
types of events:

4.1.1. Detected successful login
attempts;

4.1.2. Detected failed access
attempts and failed login
attempts;

4.1.3. Detected malicious code.

──

4.2

Generate alerts for security events that the Responsible Entity determines necessitates an alert.

──

4.4

Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater than 15 calendar days to identify undetected Cyber Security Incidents.

enPowerManager

• Maintain a log of each successful login attempts including timestamps and duration of each logon event

AccessPatrol

• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets
• Get alerts of attempts to use unauthorized removable media devices
• Get alerts when specific file operations occur such as attempts to transfer files with extensions associated with BCSI
• Automate the sending of user activity reports to designated email addresses at a set schedule

BrowseReporter

• Get alerts when users attempt to visit known high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage
• Automate the sending of user activity reports to designated email addresses at a set schedule

CurrentWare Web Console

• CurrentWare admin activity logs provide details of configuration changes to monitor for malicious or negligent admin activity within the CurrentWare Suite

Table R4 – Security Event Monitoring
CIP-007-6 R4 (4.3)

Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days except under CIP Exceptional Circumstances.

• The CurrentWare Suite is hosted and managed by your organization, giving you full control over data retention.
• Using the Auto Delete Scheduler you can automate the deletion of historical user activity data after 90+ days

Table R2 – Configuration Monitoring
CIP-010-4 R2 (2.1)

Monitor at least once every 35 calendar days for changes to the baseline configuration. Document and investigate detected unauthorized changes.

BrowseReporter

• Monitor user computer activity for the use of shadow IT and other unauthorized software
• Automate the sending of user activity reports to designated email addresses at a set schedule

CurrentWare Web Console

• CurrentWare admin activity logs provide details of configuration changes to monitor for malicious or negligent admin activity within the CurrentWare Suite

Table R1 – Information Protection Program
CIP-011-3 R1 (1.2)

Method(s) to protect and securely handle BCSI to mitigate risks of compromising confidentiality.

AccessPatrol

• Block data transfers to portable storage devices to prevent data theft or loss by employees and contractors
• Lock down removable media virus scanning machines (“Sheep Dip”) by disabling Bluetooth, USB Network Adapters, Network Drives, and WiFi hardware when not explicitly required
• Maintain a log of each removable media device introduced to BES Cyber Systems and Transient Cyber Assets
• Get alerts of attempts to use unauthorized removable media devices

BrowseControl

• Disable unneeded TCP/UDP ports at the endpoint level to reduce the attack surface of Transient Cyber Assets
• Prevent users from launching applications that are known to be a risk to BCSI such as cloud storage apps
• Restrict browser access to authorized websites and intranet portals to prevent the introduction of malicious code from high-risk websites
• Block known malicious domains and internet-based data egress points such as cloud storage sites with predefined web content categories

BrowseReporter

• Get alerts when users attempt to visit known high-risk websites
• Monitor user computer activity for high-risk web browsing or app usage

Learn More: CurrentWare’s data loss prevention solutions