The threat of debilitating cyber-attacks is at an all-time high. It seems as if cyber criminals are now more sophisticated, more determined, and better funded to work around security measures in pursuing their ultimate target.
The threats against critical infrastructure are increasing at an alarming rate. According to a recent global study from PwC, the number of security incidents across all industries rose by 38 percent in 2015 -- the biggest increase in past 12 years.
The report also found a huge spike in vulnerabilities within the public sector, with the theft of intellectual property among power and utility companies tripling from 2014 to 2015 -- up 234 percent.
North American Electric Reliability Corp. (NERC) cybersecurity standards were put in place to ensure the security and reliability of the electric grid and ensure reliable operation in the face of potential cyber-attacks. NERC continues to enhance its CIP standards and step up enforcement as the threat level continues to grow.
While many utilities have been able to apply for and receive exemptions for their existing systems, the combination of end of life on support policies (Windows operating system and application hardware/software) and new vulnerabilities being exploited in aging equipment it's uncertain how much longer NERC will accept these exemptions. Forward looking utilities are starting to understand that now is the time to take the challenge of cybersecurity requirements seriously.
One simple and powerful piece of the solution? Secure KVM (keyboard, video and mouse) switches. Secure KVM switches have been used effectively to protect high security government and military networks for years and can be equally effective in helping utilities meet CIP standards for maintaining guaranteed isolation between multiple classes of network assets. Further, secure KVMs can enhance operator efficiency by eliminating desktop clutter and allowing one keyboard and mouse to control multiple systems, without the possibility of sharing any data between them.
These devices are a win-win solution for utilities, helping meet CIP requirements while simultaneously delivering greater efficiency and effectiveness for operators.
CIP Requirements: A Primer
NERC has designated nine mandatory CIP standards. KVM solutions are particularly relevant to these four requirements:
- CIP-002: Mandates that utilities document and group their computer systems and networks used for SCADA systems, ADMS systems, and corporate communications into distinct and isolated groups based on their potential impact to critical systems. These systems can converge and be monitored and managed by one operator or individual operators assigned to each. Secure KVMs are essential anytime one operator may need to monitor or interact with more than one critical asset within the utility.
- CIP-003: Requires that utilities have minimum security management controls in place to protect the critical assets identified in CIP-002. It establishes the need to physically and logically separate critical systems from less critical systems using networking tools such as firewalls, Access Control Lists (ACLs) and more, ensuring you have provisions to limit and monitor access between these groupings. Secure KVMs maintain this segregation at the operator's desktop, ensuring that one system cannot impact the other by deploying an air-gap network.
- CIP-005: Outlines the electronic security requirements, including analysing packets, for detection and containment of infected or compromised systems so they can't damage other systems. Secure KVMs, by their design, isolate one system from the other, ensuring that no information passes between these systems.
- CIP-007: Requires documenting and limiting open ports on devices, restricting physical or logical access to those who need it, having a robust patch management process, and methods to deter and mitigate the impact of malicious code. It also includes cybersecurity best practices such as password strength and expiration policies and documenting and notifying of any lapses. As a hardware appliance, Secure KVMs use fundamental physics to provide for isolation between multiple ports and don't require firmware updates nor security patches. The network security principals used elsewhere on the network are simply guaranteed at the desktop, where these network assets may converge for a single operator.
A Powerful Cyber-Security Tool, With Added ROI
KVM switches are one of the least understood and most under-used preventative measures for thwarting cyber-attacks. Here's how.
- Creating an airgap: Secure KVMs maintain the cybersecurity measures taken at the network level to segregate and isolate cyber assets by creating an air-gap network between different servers and networks at the desktop. Each port has its own processor and data path, preventing data leakage and signaling attacks. Tamper proof housing, a kill switch, and no programmable memory prevents physical or electronic attempts to use the KVM to launch attacks on other assets. Uni-directional data flows ensure signaling attacks can't reach their targets and also physically isolates compromised cyber assets from potentially being used as launch pads to attack more sensitive systems.
- Isolating USB ports: Secure KVMs also enhance security measures by isolating exposed USB ports. The USB ports on the secure KVMs only allow keyboard/mouse HID commands to be transmitted to connected servers. Assuming servers are deployed in racks or data rooms with adequate physical access controls, the KVM will block attempts to use USB flash drives or other USB peripherals that may push malware onto the server. Advanced display plug-and-play emulation prevents potential attacks using a monitor's EDID information. Only audio output can be switched inside the KVM, preventing a built-in microphone from potentially being used to launch a signaling attack.
- Support for CAC cards and Biometric Readers: Utilities wishing to deploy multi-factor authentication can deploy CAC (common access cards used in the military and other DoD applications) or biometric readers to authenticate operators
Meeting the highest cybersecurity standards: Secure KVM functionality, construction, and production processes are tested, audited, and certified by NIAP for the highest level of cybersecurity protection for classified networks and systems. When selecting secure KVMs, always look for ones certified to the NIAP Protection Profile 3.0 or higher, the latest cybersecurity standard mandated and used by the US federal government. - Available as KVM, KM, or Windowing KVMs: KVMs provide for a physical switch to change the display(s) from one computer to another. KMs allow for a monitor wall to be constructed by attaching monitors directly to individual servers and switching the USB keyboard/mouse controls from one to the other by simply moving the mouse from one monitor to the other. KMs are an intuitive and effective way of managing a small monitor wall with guaranteed system isolation. Windowing KVMs create a 2x2 composite of the video output from multiple PCs onto one or two monitors, allowing an operator to simultaneously monitor multiple systems on one or two monitors. Windowing KVMs are highly effective where full-time monitoring of multiple systems is required but desk space may be at a premium.
With cyber-attacks on the rise and NERC likely stepping up enforcement of its CIP standards, now is the time to act. By integrating secure KVM solutions in their operations, utilities can proactively meet requirements and gain a powerful edge in protecting their assets, all while greatly increasing efficiency and effectiveness of their personnel and operations.
