Penetration Test Report (National Cybersecurity Assessments and Technical Services (NCATS)): VADR Sample Report 508C

ICS Assessment
February 26, 2018
Cyber Research Lab Assessment Report
ICS Assessment
February 26, 2018
Cyber Research Lab Assessment Report
Table of Contents
1. Introduction ....................................................... 3 5. Continuing Partnership ................................... 13
2. Systems Assessed ............................................ 4 6. Acronyms ....................................................... 14
3. Observed Strengths .......................................... 5
4. Discoveries ....................................................... 6
Tables
Table 1. Discovery Table ......................................... 7 Table 3. 180-Day Post-Assessment Report
Feedback Form .............................................. 15
Table 2. Network Analysis Observations and
Recommendations .......................................... 11
Cyber Research Lab Assessment Report
1. Introduction
As a core part of its mission to reduce risk to the Nation’s critical infrastructure (CI), Department of
Homeland Security (DHS) National Cyber Assessments and Technical Services (NCATS) subject
matter experts provide cybersecurity assessments to CI asset owners and operators to strengthen the
cybersecurity posture of their industrial control systems (ICS). NCATS on behalf of the National
Cybersecurity and Communications Integration Center (NCCIC) provides voluntary assessments based
on standards, guidelines, and best practices. The assessment methodology provides a structured
framework that asset owners and operators can leverage to evaluate and validate the cybersecurity of
their ICS networks. The information gained from these reviews provides stakeholders with the
understanding and context necessary to build effective defense-in-depth processes for enhancing their
cybersecurity posture.
NCATS’s Operational Assurance (OA) review includes evaluation of ICS design architecture,
verification and validation of network traffic, and system log review and analysis. An evaluation of the
design architecture includes a high-level preliminary evaluation of the site security posture, leveraging
the Cyber Security Evaluation Tool (CSET®), followed by an in-depth review and evaluation of the ICS
network design, configuration, and inter-connectivity to internal and external systems. This system
analysis provides ICS asset owners with a comprehensive cybersecurity evaluation focusing on
defensive strategies associated with their specific control systems network.
Network data traffic analysis provides asset owners with information to identify anomalous and
potentially suspicious communications sourced from, or destined for, control systems assets. This
service offering provides a sophisticated analysis of the asset owner’s network traffic, which the asset
owner collects from within their control system network environment. The OA assessment team
analyzes the captured network traffic using a combination of open source and commercially available
tools to develop a detailed representation of the communications, flows, and relationships between
devices.
The system log analysis provides evaluation of system log data. Asset owners submit useful system or
event logs, which provide a sampling of the central control system elements, such as an ICS server, a
historian/database collector, or a remotely connected human-machine interface (HMI) system. OA
provides SME consultation and a detailed final report including evaluation discoveries and
recommendations to support the requesting facility’s path to improved security and resiliency.
The NCATS OA team performed a Validated Architecture Design Review (VADR) of the Cyber
Research Lab from January 17 to January 19, 2018. The OA assessment team worked directly with the
information technology (IT), and management staff at Cyber Research Lab facilities to determine the
overall cybersecurity posture of its system. The objective of this assessment was to identify
vulnerabilities and weaknesses and recommend mitigations for Cyber Research Lab to consider. The
OA assessment team provided a closeout briefing to Cyber Research Lab participants and executive
personnel to highlight areas of strength and opportunities to enhance the organization’s cybersecurity
posture.
Page | 3 of 23
2. Systems Assessed
The Cyber Research Lab is a networked environment completely isolated from the campus network.
The purpose of this lab environment is to allow researchers to accomplish their cybersecurity missions
unhindered by typical cybersecurity controls such as those found in the business enterprise
environment. With a mission that includes active network scanning, vulnerability scanning, and
penetration testing, Cyber Research Lab teams rely heavily on the lab to conduct active engagements
as well as test new tactics, techniques, and processes to continuously improve their service offerings.
The lab environment is made up of many enclaves that keep the working environment separated based
on purpose. All of these enclaves are separated into different virtual local area networks (VLAN)
terminated at a Fortinet firewall for access control and monitoring. The two enclaves described to be of
most value to administrators were the management enclave and the data enclave. The management
enclave is used to connect to the management interfaces of network equipment and other important
infrastructure. The data enclave is used to store cyber data as well as scripts, configurations, and other
network storage purposes. Both of these enclaves require two-factor authentication, which grants the
required level of access based on the roles assigned to each user.
Page | 4 of 23
3. Observed Strengths
During the engagement, the OA assessment team identified various strengths regarding the existing
architecture, policies, and procedures that Cyber Research Lab facilities currently have in place. Those
strengths include the following:
3.1 Separation from Enterprise LAN
Separating the lab’s work and environment from the enterprise network has not only lab’s best interests
in mind but also allows the lab teams to accomplish their work in a safe manner given the nature of
their mission.
3.2 Good use of templates and images
The OA assessment team commends the sysadmin group in maintaining up-to-date and secure images
to be deployed in the static environment. The choice to reimage the operational/dynamic environment
equipment has proved effective in ensuring consistent delivery of services to the customers without the
threat of potentially exposing the customers to harmful content.
3.3 Cybersecurity maturity despite limited staff
Although staff members seem to be heavily burdened with administrative responsibilities, the
cybersecurity maturity of the organization is strong in both practices and culture.
Page | 5 of 23
4. Discoveries
Although the OA assessment team identified several strengths and good cybersecurity practices, they
also identified a number of discoveries with potential consequences and risks.
4.4 Cybersecurity Evaluation
During the system architecture review, the OA assessment team used CSET to identify key areas of
concern to assist in detailed focus areas. NCATS recommends asset owners use self-evaluation tools
on a regular basis to understand their security posture and to identify areas for improvement. The OA
assessment team has separately provided a detailed CSET analysis to the Cyber Research Lab.
Please consult the associated CSET file for details; the categories and areas of concern ranked from
the CSET:
4.4.1 Account Management.
4.5 Discovery Table
Table 1 summarizes OA assessment team’s discoveries during the cybersecurity assessment of the
Cyber Research Lab’s facilities. Specifically, the table categorizes potential weaknesses discovered
during the assessment based on National Institute of Standards and Technology (NIST) Special
Publication 800-53 security control categories; it explains the specific weakness found in the discovery;
it describes the pot