NIST SP 1800-23 Energy Sector Asset Management: For Electric Utilities, Oil & Gas Industry

こんにちは、丸山満彦です。

NISTから電気事業、石油およびガス産業向けの資産管理のガイドが発行されてますね。OT資産を特定して管理し、それらに関連するサイバーセキュリティリスクを検出する方法についての手順を説明したものですね。。。

内容的には、３つに分かれていて

• NIST SP 1800-23A: Executive Summary　

• NIST SP 1800-23B: Approach, Architecture, and Security Characteristics – what we built and why 

• NIST SP 1800-23C: How-To Guides – instructions for building the example solution

● NIST - ITL

・2020.05.20 SP 1800-23 Energy Sector Asset Management: For Electric Utilities, Oil & Gas Industry
・[PDF]

・Supplemental Material:
　Web version (other)
　Project Homepage (other)

・Document History:
　2019.09.23: SP 1800-23 (Draft)
　2020.05.20: SP 1800-23 (Final)

NIST SP 1800-23

Volume A

• Executive Summary
  • Challenge
  • Solution
  • Benefits
  • Share Your Feedback
  • Technology Partners/Collaborators

Volume B

• 1 Summary
  • 1.1 Challenge
  • 1.2 Solution
    • 1.2.1 Relevant Standards and Guidance
  • 1.3 Benefits
• 2 How to Use This Guide
  • 2.1 Typographic Conventions
• 3 Approach
  • 3.1 Audience
  • 3.2 Scope
  • 3.3 Assumptions
  • 3.4 Risk Assessment
    • 3.4.1 Threats
    • 3.4.2 Vulnerabilities
    • 3.4.3 Risk
    • 3.4.4 Security Control Map
    • 3.4.5 National Initiative for Cybersecurity Education Workforce Framework
  • 3.5 Technologies
• 4 Architecture
  • 4.1 Architecture Description
    • 4.1.1 High-Level Architecture
    • 4.1.2 Reference Architecture
  • 4.2 Example Solution
    • 4.2.1 UMD Site Topology
    • 4.2.2 Plano Site Topology
    • 4.2.3 Enterprise Location Topology
    • 4.2.4 Asset Management Dashboard
• 5 Functional Test Plan
  • 5.1 Test Cases
    • 5.1.1 ESAM-1: New Device Attached
    • 5.1.2 ESAM-2: Vulnerability Notification
    • 5.1.3 ESAM-3: Device Goes Offline
    • 5.1.4 ESAM-4: Anomalous Device Communication
    • 5.1.5 ESAM-5: Remote Devices with Cellular Connectivity
• 6 Security Characteristic Analysis
  • 6.1 Assumptions and Limitations
  • 6.2 Analysis of the Reference Design’s Support for Cybersecurity Framework Subcategories
    • 6.2.1 ID.AM-1: Physical Devices and Systems Within the Organization Are Inventoried
    • 6.2.2 ID.RA-2: Threat and Vulnerability Information Is Received from Information-Sharing Forums and Sources
    • 6.2.3 PR.DS-2: Data in Transit Is Protected
    • 6.2.4 PR.MA-1: Maintenance and Repair of Organizational Assets Are Performed and Logged in a Timely Manner with Approved and Controlled Tools
    • 6.2.5 PR.MA-2: Remote Maintenance of Organizational Assets Is Approved, Logged, and Performed in a Manner that Prevents Unauthorized Access
    • 6.2.6 PR.PT-4: Communications and Control Networks Are Protected
    • 6.2.7 DE.AE-1: A Baseline of Network Operations and Expected Data Flows for Users and Systems Is Established and Managed
    • 6.2.8 DE.AE-2: Detected Events Are Analyzed to Understand Attack Targets and Methods
  • 6.3 Lessons Learned
• 7 Future Build Considerations
• Appendix A List of Acronyms
• Appendix B References

Volume C

• 1 Introduction
  • 1.1 Practice Guide Structure
  • 1.2 Build Overview
  • 1.3 Typographic Conventions
  • 1.4 Logical Architecture Summary
• 2 Product Installation Guides
  • 2.1 ConsoleWorks
    • 2.1.1 ConsoleWorks Configurations at the NCCoE
      • 2.1.1.1 VM Configuration
      • 2.1.1.2 Network Configuration
      • 2.1.1.3 Installation
      • 2.1.1.4 Configuration
      • 2.1.1.5 ConsoleWorks Configurations UMD
      • 2.1.1.6 VM Configuration
      • 2.1.1.7 Network Configuration
      • 2.1.1.8 Installation
      • 2.1.1.9 Configuration
  • 2.2 Forescout CounterACT
    • 2.2.1 CounterACT Enterprise Manager Configuration
      • 2.2.1.1 VM Configuration
      • 2.2.1.2 Network
      • 2.2.1.3 Installation
      • 2.2.1.4 Configuration
    • 2.2.2 CounterACT Appliance Configuration
      • 2.2.2.1 Host Configuration
      • 2.2.2.2 Network
      • 2.2.2.3 Installation
      • 2.2.2.4 Configuration
  • 2.3 Dragos Platform
    • 2.3.1 Dragos Sitestore Configuration
      • 2.3.1.1 Host Configuration
      • 2.3.1.2 Network
      • 2.3.1.3 Installation
      • 2.3.1.4 Configuration
    • 2.3.2 Dragos Midpoint Sensor
      • 2.3.2.1 Network
      • 2.3.2.2 Configuration
    • 2.3.3 Dragos Splunk Integration
  • 2.4 FoxGuard Patch and Update Management Program
    • 2.4.1 Patch Report
  • 2.5 Kore Wireless
    • 2.5.1 Bridge Configuration
      • 2.5.1.1 Installation
      • 2.5.1.2 Network
    • 2.5.2 Virtual Private Network Configuration
  • 2.6 pfSense VPN
    • 2.6.1 Plano and UMD VPN Configuration
  • 2.7 Splunk
    • 2.7.1 Splunk Enterprise Configuration
      • 2.7.1.1 VM Configuration
      • 2.7.1.2 Network
      • 2.7.1.3 Installation
      • 2.7.1.4 Universal Forwarder
      • 2.7.1.5 Reports and Alerts
  • 2.8 Tripwire Industrial Visibility
    • 2.8.1 Tripwire Industrial Visibility Configuration UMD
      • 2.8.1.1 VM Configuration
      • 2.8.1.2 Network Configuration
      • 2.8.1.3 Installation
      • 2.8.1.4 Configuration
    • 2.8.2 Tripwire Industrial Visibility Configuration Plano
      • 2.8.2.1 VM Configuration
      • 2.8.2.2 Network Configuration
      • 2.8.2.3 Installation
      • 2.8.2.4 Configurations
    • 2.8.3 Tripwire Industrial Visibility Configuration National Cybersecurity Center of Excellence
      • 2.8.3.1 VM Configuration
      • 2.8.3.2 Network Configuration
      • 2.8.3.3 Installation
      • 2.8.3.4 Configurations
      • 2.8.3.5 Tripwire Splunk Integration
• Appendix A List of Acronyms