Att A - Scope of Work.pdf

Attachment A

Scope of Work

COLORADO RIVER COMMISSION OF NEVADA

OT Cybersecurity Risk Assessment

SCOPE OF WORK

OCTOBER 2024

REVISION 0

2 | P a g e

Revisions

REVISION DESCRIPTION DATE

0 INITIAL ISSUE 10/30/2024

3 | P a g e

Table of Contents

01 00 00 – GENERAL REQUIREMENTS

01 11 00 - SUMMARY OF WORK

4 | P a g e

01 00 00 – GENERAL REQUIREMENTS

01 11 00 - SUMMARY OF WORK

1. Project Description

a. The Colorado River Commission of Nevada (CRCNV, Owner) Power Delivery

Group (PDG) and Information Technology (IT) Group are undertaking a project to perform a cybersecurity risk assessment of its Operational

Technology (OT) network.

b. This Scope of Work is to be used to define Contractor expectations. All items noted in this Scope of Work shall be addressed in the Contractor’s proposal.

Any items not specifically noted as “by Owner” shall be assumed to be by

Contractor.

c. There are currently five networks in existence at the main control room site.

These networks are the following:

i. CorpNet

1. State of Nevada Information Technology (IT) Network

2. Managed by CRCNV IT Group

ii. ManageNet

1. Ciena Switch Ring Network Management

2. Managed jointly by CRCNV IT Group and PDG

iii. SCADANet

1. Survalent SCADA System Network

2. Protection Relays

3. Communications Processors

4. PLCs

5. Managed jointly by CRCNV IT Group and PDG

iv. RevNet

1. Schneider Electric Revenue Metering Network

2. ION Revenue Meters

3. Managed jointly by CRCNV IT Group and PDG

v. Wonderware Modbus Plus Network

5 | P a g e

1. Original SCADA System Network

2. Managed by CRCNV PDG

d. Our networks spread over a large area and can ride near other traffic unrelated to CRCNV, notably riding on the Southern Nevada Water

Authority’s (SNWA) networks.

e. There are multiple data transfer points between other regional utilities, including the Western Area Power Administration (WAPA), Southern Nevada

Water Authority (SNWA), Clark County Water Reclamation District (CCWRD) and the City of Las Vegas (COLV)

2. Project Objective

a. The objective of this project is to comprehensively identify potential risks to our existing networks in their current configuration and provide a summary report with actionable solutions identified for management with estimated solution complexity, costs, and timelines for implementation.

3. Scope of Work

a. The assessment should include information security guidance that is aligned with industry standards, best practices and methodologies outlined in

National Institute for Standards and Technology (NIST), Cyber Security

Framework (CSF), ISO/IEC, IEEE, IEC, CIGRE etc.

b. The following shall be performed as a part of the risk assessment:

i. Preliminary Network Mapping

1. Contractor shall perform their own mapping of the network and

OT infrastructure prior to the start of penetration and perimeter testing.

2. This shall include on-site visits for discussions with the various stakeholders, collection of pertinent data whether it be drawings or in field data collection.

3. All testing and reporting shall be done referencing this network document.

4. At the end of the project this document should be finalized and issued to Owner as a .DWG CADD file as well as a PDF.

ii. Penetration Testing

6 | P a g e

1. Includes the entire perimeter and any critical systems, this includes both the internal (LAN to LAN) and external (public-facing) perimeters.

2. Should include penetration testing from multiple physical sites and network points with connections to our network (SNWA, CCWRD, etc.)

iii. Perimeter Testing

1. Includes the entire perimeter and any critical systems, this includes both the internal (LAN to LAN) and external (public-facing) perimeters.

2. Firewalls, authentication servers, etc. should be included in the testing.

3. Perform an in-depth cybersecurity vulnerability assessment and penetration testing of infrastructure of

a. Internal network – all internal systems including routers, switches, physical and virtual servers, data storage infrastructure, and public computers and other connected IT devices: including all Demilitarized (DMZ) systems to include flow of controls from external and internal systems.

b. External network - all external public-facing systems including firewalls, FTP, web servers, and web service interface points.

4. Enumerate systems on the network and validate them against known systems. Identify any unknown or unexpected systems.

5. Scan network systems and mainframe for potential vulnerabilities. Owner will provide the network ranges and any network/host exemptions to these scans.

6. Identify, analyze, and confirm vulnerabilities. It is expected that qualified Contractor personnel will know how to look deeper into potential vulnerabilities for other security holes, misconfigurations, and other problems to follow the vulnerability to its end. It is expected that the Contractor will

7 | P a g e share method and process (i.e., e-mail’s screen shots, files, etc.)

of successful penetration in addition to a list of open ports, missing patches, or possible vulnerabilities.

7. The Contractor shall conduct security risk assessment scans on 5 mission-critical applications. All vulnerabilities reported as

Critical/High shall be detailed in the ‘Findings’ section of the final deliverable. A complete list of vulnerabilities shall be provided in a separate appendix. Each vulnerability or risk identified shall be categorized as a Critical/High, Medium, or

Low.

8. The Contractor shall attempt to capture user credentials through industry best practices and common threat vectors.

9. User Privilege Escalation: Throughout the assessment, the

Contractor shall attempt to complete user privilege escalations in order to further compromise, or demonstrate the effectiveness of, the security of established controls within

Owner’s environment. This testing will assist in determining if access control systems are effectively enforcing user access and permission levels are configured correctly based on job function.

10. Segmentation Testing: The Contractor shall test the segmentation controls of all segregated network segments from a sample of completely isolated/segmented networks

(ensuring that each type of segmentation point is represented, such as firewalls, VLAN on switch, etc.).

11. Wireless Scanning (both private and guest): The service provider shall identify rogue wireless devices and additional security architecture weaknesses related to the wireless networks.

12. Applications

a. Provide authenticated application vulnerability scanning and penetration testing (At a minimum, the test should include OWASP Top 10). The security service

8 | P a g e provider will conduct security risk assessment scans on 5 external facing applications.

b. Identify application security vulnerabilities and perform active exploit through identified vulnerabilities (Note:

Exploit should stop at the point of proof of compromise but not causing any business interruption).

13. Database Assessment: We have approximately four database servers. In the database assessment phase, the Contractor shall take the following actions:

a. Assess the databases to look for common vulnerabilities such as buffer overflows, default accounts, or default permissions on database objects such as tables, views, and stored procedures.

14. Look for erroneous configurations that may lead to information leaks, theft of data, or even intrusion and denial of service attacks.

15. Examine several key functional areas that may include but not be limited to:

a. Authentication and Authorization to Control Database

Access

b. Password Complexity Verification

c. Restriction of access rights to privileged user IDs to least privileges necessary to perform job responsibilities.

d. Server Security

e. Database Connections

f. Table Access Control

g. Encryption Usage

h. Certificate Application

16. Brute Force Attack: The Contractor shall conduct a brute force attack to check for weak passwords. The objective of this test is to confirm whether passwords are meeting security best practices.

9 | P a g e

iv. Physical Security: Evaluate the physical access controls to critical IT and OT infrastructure.

v. Once the risk assessment and testing has been completed, the

Contractor must remove all backdoors, software, and personnel access utilized for the project, and scrub any trace of test from the

Owner’s infrastructure.

c. In addition to the risk assessment, an additional assessment shall be performed regarding the CRCNV PDG’s current state of compliance with applicable NERC CIP standards for the following NERC Function Type(s):

i. Transmission Owner (TO)

ii. Transmission Operator (TOP)

iii. Transmission Planner (TP)

iv. Transmission Service Provider (TSP)

v. Planning Authority / Planning Coordinator

vi. Distribution Provider

vii. Reliability Coordinator

4. Required Deliverables

a. Cybersecurity Risk Assessment Report

i. Executive Summary

1. Overall Report Results

2. Key Risk Areas

3. Maturity level score card against NIST CSF

4. Strategic Recommendations

5. NERC CIP Assessment Conclusions

ii. Report Details

1. Assessment Methodology

2. Detailed assessment results in both written and spreadsheet

(Excel) format.

3. Detailed score card for each NIST CSF subcategory

4. NERC CIP Assessment broken down by Functional Type and

NERC CIP Standard requirements

iii. Recommendations

1. Risk Assessment

10 | P a g e

a. Immediate remedies

i. Should identify issues that are simple to implement and will have a positive impact on

NIST scoring.

ii. Should be presented in a risk-ranked format with complexity, cost, and timeline rankings

b. Long-term remedies

i. Should identify issues that are complex to implement, require funding sources to be secured, and will have a significant positive impact on NIST scoring and the overall health of the Owner’s system.

ii. Should be presented in a risk-ranked format with complexity, cost, and timeline rankings

2. NERC CIP Assessment

a. Provide a list of requirements identified by each individual NERC CIP standard and provide guidance on current compliance with the requirements.

b. If compliance is lacking, provided recommended actions and mitigation methods to bring Owner into compliance assuming the associated NERC Functional

Type was in effect.

iv. Project Plan

1. Identification of security projects based on individual or combined remedies as noted above in the recommendations section, with detailed activities and action plans.

2. Should include at a minimum the following:

a. Project Description

b. Priority (based on NIST benefit impact)

c. Risk Rank

d. Complexity

e. Cost

f. Timeline

11 | P a g e

b. Network Mapping

i. Utilize drawing in references inside the report for consistent and agreed upon network perimeters

ii. CADD (.DWG) File of Network Map

iii. PDF File of Network Map