A service computer or a USB drive is the shortest path between an office network and a substation network. CIP-010-3, requirement R4, orders them controlled through a plan: authorize users, locations and uses; reduce software vulnerabilities; prevent malicious code; limit unauthorized use; and scan drives on a machine outside the control system before connecting them. Third-party computers are reviewed before they are connected.
Why it is a risk of its own
A substation can be well segmented and have a firewall at the edge and still have a door the firewall cannot see: the technician’s port. A laptop that was earlier in an office, at another plant or at the technician’s home, or a USB drive that has already passed through several machines, goes straight to the relay or the switch.
This is the case where network rules do not help, because the device comes in from the inside. The NERC CIP series regulates it in CIP-010, requirement R4, for high and medium impact systems. This guide explains its criteria and how to carry them into a substation or industrial plant. The standard described is CIP-010-3.
The standard’s three categories
| Category | Example | Attachment 1 section |
|---|---|---|
| Transient asset managed by the entity | The company’s service laptop | 1 |
| Transient asset managed by a third party | A vendor’s or contractor’s laptop | 2 |
| Removable media | USB drive, external disk | 3 |
Own service laptops (section 1)
The entity’s plan must cover five points:
- How they are managed. Continuously, to comply at all times; on demand, applying the requirements before each connection; or both.
- Authorization. Users (by person, group or role), locations and uses are authorized, and uses are limited to what is necessary for the work.
- Software vulnerabilities. One or more of these methods: security patching (manual or managed), operating system and software that run only from read-only media, system hardening or another method.
- Malicious code. Antivirus with signature updates, application whitelisting or another method.
- Unauthorized use. Restricted physical access, full-disk encryption with authentication, multi-factor authentication or another method.
Methods apply «per the capability» of the device. If a device cannot use a method, the evidence can be documentation from the vendor or the entity saying so.
Third-party laptops (section 2)
The entity does not control the vendor’s computer, but it does decide whether to connect it. The standard asks to review, according to the device’s capability:
- For vulnerabilities: the installed security patches, the third party’s patching process or other mitigation it applies.
- For malicious code: the antivirus update level, the update process, the use of whitelisting, the use of an operating system from read-only media, or system hardening.
- Then decide whether something more is needed and apply it before connecting.
Evidence can be a record of the review, emails or contracts where the third party describes its process, and the entity’s documented acceptance.
USB drives and other removable media (section 3)
- Authorization of users and locations for each medium or group of media.
- Prior scan with a malicious-code detection method, using a machine that is not the control system or one of its associated protected assets.
- Mitigation of anything detected before connecting the medium.
The practical rule is that the drive is never scanned on the same machine it is going to be connected to.
How it applies to a field intervention
The standard sets criteria. How they are met in an intervention depends on the device. These practices follow those criteria and are not requirements of the standard:
| Situation | Practice that follows the criterion |
|---|---|
| Configuring or testing a relay | A service laptop dedicated to OT, with no email or browsing, individual accounts and an encrypted disk |
| Loading a settings file or an SCD | Controlled version repository; file copied from a review machine, not from the technician’s email |
| Updating firmware | File downloaded from the manufacturer’s source, with identity and integrity verification where the manufacturer offers a method (CIP-010 part 1.6) |
| Contractor with their own computer | Prior review and a record of who connected what and when |
| Drive arriving from outside | Scan on a separate machine; media labelled, with an owner and a location |
What must not happen: a machine connected to the substation network and, the same day, to the internet through the technician’s phone.
Related guides
- To know what the device has and which ports it exposes: IED and SCD configuration management.
- For the accounts and access levels of relays: relay access levels and passwords.
- For the zones and conduits where the service port sits: IEC 62443-3-2 risk assessment, which cites maintenance laptops as a typical case.
Need rules for your maintenance team?
At Tiza Group we define with you the connection rules for laptops and media for your substations and plant, and we apply them when we configure and test your equipment, within our substation and plant cybersecurity service. For devices that need no site visit, we also configure relays remotely.
More guides
- NERC CIP-010: change and vulnerability management
- NERC CIP requirements and what to adopt elsewhere
- Patches and firmware in relays and IEDs
- IED and SCD configuration management
- Secure remote access to substations
- Relay access levels and passwords
References
- NERC, CIP-010-3, Cyber Security – Configuration Change Management and Vulnerability Assessments: requirement R4 and Attachment 1, sections 1 to 3.
Frequently asked questions
What is a transient cyber asset?
A computer or other programmable device connected to a covered network or device for a limited time, such as the laptop a technician uses to configure or test a relay. Removable media, such as a USB drive, are treated separately in the same standard.
What must be done before connecting a USB drive to a control system?
Scan it with a malicious-code detection method, using a machine that is not the control system or one of its protected assets, and mitigate whatever is detected before connecting it. In addition, each drive or group of drives has authorized users and locations.
What about a contractor's or vendor's laptop?
The standard treats it as a device managed by a third party. Before connecting it, the installed patches or the third party's patching process are reviewed, along with its malicious-code measures, such as the antivirus update level. If something more is needed, it is applied before the connection.