J-15_Cybersecurity.pdf

NOAA AGOR VARIANT (NAV)

DRAFT Cybersecurity Requirements for Control and Communication Systems

Attachment J-15

Version 1.0

26 April 2018

Solicitation No. N00024-18-R-2201

DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.

NOAA AGOR Variant (NAV) Cybersecurity Requirements for Control and Communication SystemsVersion 1.0 ii

Revision History

Rev.

No.

Rev. Date Comment

Affected

Section(s) Page(s)

1.0 26 April

Initial release. All All iii

Table of Contents

1.0 GENERAL

2.0 DOCUMENTATION

3.0 REMOVAL OF UNNECESSARY SERVICES AND PROGRAMS

4.0 HOST INTRUSION DETECTION SYSTEM

5.0 INTRUSION PROTECTION SYSTEM

6.0 SYSTEM AND INFORMATION INTEGRITY

7.0 CHANGES TO FILE SYSTEM AND OPERATING SYSTEM PERMISSIONS

8.0 HARDWARE CONFIGURATION

9.0 INSTALLING OPERATING SYSTEMS, APPLICATIONS, AND THIRD-PARTY

SOFTWARE UPDATES

10.0 FIREWALLS

11.0 IDENTIFICATION AND AUTHENTICATION

12.0 SYSTEMS AND COMMUNICATIONS PROTECTION

13.0 CONFIGURATION MANAGEMENT

14.0 CONTINGENCY PLANNING

15.0 TESTING

16.0 AUDIT AND ACCOUNTABILITY

1.0 GENERAL

The Contractor shall apply cybersecurity measures to all information technology associated with control and communication systems. For purposes of this contract, information technology is defined as any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, 5 interchange, transmission, or reception of data or information. Control and communication systems include all hardware and software included in machinery control systems, bridge systems, navigation systems, dynamic positioning systems, and exterior communication systems.

The Contractor shall ensure that development of all control and communication systems adhere to 10 software secure coding best practices, in accordance with the United States Computer Emergency

Readiness Team of the Department of Homeland Security and the Software Engineering Institute at Carnegie Mellon University. The Contractor shall ensure that control and communication systems are configured in accordance with applicable Security Technical Implementation Guides

(STIGs) published by the National Institute of Standards and Technology. 15

Before delivery, the Contractor shall assess and mitigate cybersecurity vulnerabilities in the control and communication systems. The assessment shall include:

a). Enumerating platforms, software flaws, and improper configurations; 20 b). Execution of checklists and test procedures; and c). Measuring vulnerability impact.

The Contractor shall analyze vulnerability scan reports and results from security control assessments, identify false positives with rationale and remediate identifiable vulnerabilities. 25

The Contractor shall identify and adjudicate with the Government any cybersecurity measure that causes timing, performance, or availability failures of control system requirements stated elsewhere in this specification.

2.0 DOCUMENTATION 30

The Contractor shall document control and communication systems in accordance with DI-063-02.

The Contractor shall provide an inventory by system of installed hardware and software by version.

3.0 REMOVAL OF UNNECESSARY SERVICES AND PROGRAMS 35

The Contractor shall install or enable, as applicable, only those applications, ports, protocols, services, and functions necessary for designed capabilities of a given control or communication system. Control and communication systems shall use enforcement mechanisms (such as, application whitelisting or equivalent technology) to prevent unauthorized software from executing on the systems. 40

The Contractor shall provide a listing of services required for any computer system running control or communication system applications or required to interface with the control or communication system applications in accordance with DI-063-03.

The Contractor shall provide appropriate software and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of 5 system security. These shall be documented in accordance with DI-063-03.

The Contractor shall remove and/or disable all software components that are not required for the operation and maintenance of the control or communication system prior to Factory Acceptance

Testing. The Contractor shall provide documentation on what is removed and/or disabled in 10 accordance with DI-063-03.

4.0 HOST INTRUSION DETECTION SYSTEM

The Contractor shall provide a configured host intrusion detection system (HIDS) in accordance with DI-063-04.

The Contractor shall configure the HIDS such that all system and user account connections are logged. This log will be configured such that an alarm can be displayed to the operator if an abnormal situation occurs.

The Contractor shall recommend a configuration for the HIDS in accordance with DI-063-04. 20

5.0 INTRUSION PREVENTION SYSTEM (IPS)

The Contractor shall employ an Intrusion Prevention System that is compatible with the information system. The Contractor shall employ malicious code protection mechanisms at control system entry and exit points to detect and eradicate malicious code. Means shall be provided to update the malicious code protection mechanisms to identify the latest malicious code. The 25

Contractor shall configure malicious code protection mechanisms to perform real-time scans of files from external sources at control system entry/exit points as the files are downloaded, opened, or executed; and prevent confirmed additions of executables/binaries from executing without interfering with real-time operation of the control systems. The malicious code protection mechanisms shall prevent the download and execution of Mobile Code from outside the control or 30 communication systems boundary.

6.0 SYSTEM AND INFORMATION INTEGRITY

Control and communication systems shall monitor inbound and outbound communications traffic for unauthorized activities or conditions. Monitoring shall be done at the entry/exit points and selected points at the intra-system network taps. These systems shall employ integrity verification 35 tools to detect unauthorized changes to the software, firmware and run-time behavior. These systems shall provide alerts when compromise or potential compromise occurs that changes the certified/qualified baseline configuration, to include software, hardware, firmware and run-time behavior. When compromise or potential compromise is detected, the control or communication system shall be configured to disable network access by the component and notify the 40

Administrator.

If the control or communication systems employ a network, the network shall implement a Host

Based Security System (HBSS), if compatible.

7.0 CHANGES TO FILE SYSTEM AND OPERATING SYSTEM

PERMISSIONS

The Contractor shall configure hosts with “least privilege” file and account access and provide 5 documentation of the configuration. The Contractor shall configure the necessary system services to execute at the least user privilege level possible for that service and provide documentation of the configuration in accordance with DI-063-05.

The control and communication systems shall enforce access restrictions and support auditing of 10 the enforcement actions. These systems shall prevent the installation of unauthorized software using detection/enforcement mechanisms (for example, hash authentication or equivalent technology) and validate authorized software being installed on the system.

The control and communication systems shall provide alerts when the unauthorized installation of 15 software is detected and shall prohibit user installation of software without explicit privileged status.

8.0 HARDWARE CONFIGURATION

The Contractor shall disable, through software or physical disconnection, all unneeded communication ports and removable media drives, or provide engineered barriers, and provide 20 documentation of the results in accordance with DI-063-05. The Contractor shall password protect the BIOS from unauthorized changes unless it is not technically feasible, in which case the

Contractor shall document this case and provide mitigation measures.

The Contractor shall configure the network devices to limit access to/from specific locations, 25 where appropriate, and provide documentation of the configuration in accordance with DI-063-05.

The Contractor shall configure the systems to allow the system administrators the ability to re-enable devices if the devices are disabled by software and provide documentation of the configuration. 30

9.0 INSTALLING OPERATING SYSTEMS, APPLICATIONS, AND

THIRD-PARTY SOFTWARE UPDATES

The Contractor shall have a patch management and update process documented in accordance with

DI-063-06. The Contractor shall remove previous versions of software and firmware as part of the update process. The Contractor shall provide notification of known vulnerabilities affecting 35

Contractor-supplied or required Operating System, application, and third-party software within a pre-negotiated period after public disclosure.

For any hardware or software items that are required to be serviced or repaired remotely, the

Contractor shall isolate the item prior to non-local maintenance and diagnostic services, and shall 40 sanitize the item with regard to potentially malicious software before removal and after the service is performed before reconnecting the item to the control system. The Contractor shall recommend spare parts for the controls and communication systems as part of the Vendor-Recommended

Spares listing to be able to maintain and repair the systems within 24 hours of a failure.

All information assurance (IA) and IA-enabled information technology products (e.g. servers, operating systems, routers, firewalls) shall be those that are on the approved National Information 5

Assurance Partnership (NIAP) list.

10.0 FIREWALLS

The Contractor shall provide firewalls and firewall rule sets between network zones or provide firewall rule sets if the firewalls are not provided by the Contractor. The Contractor shall provide firewall rule sets and/or other equivalent documentation in accordance with DI-063-07. The basis 10 of the rule set shall be “deny all,” with exceptions explicitly identified by the Contractor.

The Contractor shall change default passwords during implementation. Likewise, unnecessary default accounts shall be deleted or deactivated during implementation. No password shall be hardcoded into system files. The Contractor and its subcontractors shall assist the Government in 15 changing delivered passwords upon completion of the installation.

11.0 IDENTIFICATION AND AUTHENTICATION

The control and communication systems shall uniquely identify and authenticate organizational users. These systems shall implement multifactor authentication for access to administrator accounts. These systems shall implement replay-resistant authentication mechanisms for network 20 access to administrator accounts. If the control or communication system has role-based privileges, the system shall be configured with a minimum of a User role and an Administrator role. Security functions, such as account creation and configuring permissions, shall be limited to the

Administrator role.

The control and communication systems shall implement replay-resistant authentication mechanism for administrator accounts. These systems shall uniquely identify and authenticate all devices before establishing local and network connections. The systems shall authenticate any devices not a part of the configuration before establishing local or network connections using bidirectional authentication. 30

For password-based authentication, the control and communication systems shall:

a). Enforce minimum password complexity of mixed case sensitivity, minimum 15 characters, mix of upper-case letters, lower-case letters, numbers, and special characters; 35 b). Enforce at least 8 changed characters when new passwords are created;

c). Store and transmits only cryptographically-protected passwords;

d). Prohibit password reuse for 5 generations;

e). Require password reset every 60 days; and f). Allow the use of a temporary password for system logons with an immediate change to a 40 permanent password.

User accounts shall be locked out after 5 failed logon attempts; locked-out accounts shall be disabled until it is reset by an administrator or until the lockout duration for the account has expired.

The Contractor shall ensure that unencrypted static authenticators are not embedded in control or 5 communication systems' applications or access scripts or stored on function keys.

12.0 SYSTEMS AND COMMUNICATIONS PROTECTION

The control and communication systems shall separate user functionality, including user interface services, from management functionality by either physical or logical means. This can be achieved by using different computers, different central processing units, different instances of operating 10 systems, different network addresses, virtualization techniques, or combinations of these or other methods, as appropriate.

These systems shall isolate security functions from non-security functions by controlling access to and protecting hardware, software, and firmware that perform those security functions. 15

These systems shall implement residual information protection by preventing object reuse between users of a shared resource.

These systems shall protect against or limit the effects of the following denial of service attacks: 20 consumption of scarce, limited, or non-renewable resources; destruction or alteration of configuration or configuration information; physical destruction or alteration of network components. Compensating controls shall include ensuring a loss of communication results in the systems operating in a nominal or safe mode. The systems shall restrict the ability of individuals to launch denial of service attacks on other components or information systems outside the enclave 25 boundary. Individuals shall not be able to connect and transmit arbitrary information on the transport medium. The systems shall be managed by establishing usage priorities, quotas, partitioning, and so forth, so that sufficient capacity is available to counter information flooding denial of service attacks. A tool shall be selected and employed to detect indicators of denial of service attacks against the systems and produce information that indicates if sufficient resources 30 exist to prevent denial of service attacks.

Where possible, the control and communication systems shall provide a display banner in accordance with Public Law 99-474 to users that the system is a Department of Commerce (DOC) information system: 35

**WARNING**WARNING**WARNING**

This is a United States (Department of Commerce) computer system, which may be accessed and used only for official Government business by authorized personnel. Unauthorized access or use of 40 this computer system may subject violators to criminal, civil, and/or administrative action.

All information on this computer system may be intercepted, recorded, read, copied, and disclosed by and to authorized personnel for official purposes, including criminal investigations. Access or use of this computer system by any person whether authorized or unauthorized, constitutes consent to these terms.

**WARNING**WARNING**WARNING**

13.0 CONFIGURATION MANAGEMENT

The Contractor shall develop and document a current baseline configuration at delivery of the control and communication systems to be maintained under configuration control in accordance with DI-063-05. The Contractor shall review and update the baseline configuration of the systems as a result of updates and patches. When patches are required, they shall be tested to determine the 10 potential for and acceptability of identified impacts generated by the patches. The Contractor shall provide the baseline configuration to the Government to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the systems to support rollback.

The Contractor shall test, validate, and document changes to the control and communication 15 systems before implementing the changes on the operational system. The systems shall issue audible alerts and notifications if baseline configurations are changed in an unauthorized manner.

For changes to control and communication systems hardware and software configurations, the

Contractor shall submit these changes to the Government as part of the Configuration

Management. The Contractor shall perform configuration management during system 20 implementation and operation; document, manage, and control the integrity of changes; implement only approved changes to the system; document approved changes to the system and the potential security impact of such changes; and track security flaws and flaw resolution within the system.

14.0 CONTINGENCY PLANNING

Control and communication systems shall contain automated back-up capability that does not 25 cause the system to fail existing timing or performance requirements. System-level information

(e.g. system state information, system data necessary to recover/restore system operation, and user data) shall be included in backups.

The Contractor shall provide system restoration media and procedures to recover or completely 30 rebuild disabled system components using only the material provided and routine backup data in accordance with DI-063-08.

Back-ups, other historical files, and network storage shall be protected by a Data-At-Rest solution approved by NIAP. 35

15.0 TESTING

The Contractor shall assist the Government in performing cybersecurity testing. The Contractor shall provide on-site attendance and support by knowledgeable subcontractor personnel for all supplied control and communication systems during this testing.

16.0 AUDIT AND ACCOUNTABILITY 40

In addition to the other audit requirements identified elsewhere, the control and communication systems shall generate audit records for the following events:

a). Account creation b). Account modification 5 c). Enabling, disabling, and removal actions related to each account d). Notification to the system administrator e). Changes to the approved baseline configuration f). Successful and unsuccessful logon attempts g). Concurrent logons from different workstations 10 h). All program initiations i). All direct access to the information system j). All kernel module load, unload, and restart k). Application-level failures l). Denial of access resulting from excessive number of logon attempts 15 m). Data required to audit the possible use of covert channel mechanisms.

n). Privileged activities and other system level access o). Successful and unsuccessful attempts to access security files.

p). Blocking a user ID, terminal or access port, and the reason for the action q). Activities that might modify, bypass or negate safeguards controlled by the system; and 20 r). System configuration file changes.

The control and communication systems shall generate audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects 25 associated with the event.

The auditing system shall provide an audit reduction and report generation capability that (1) supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and (2) does not alter the original content or time ordering of 30 audit records. The control and communication systems shall provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.

The auditing system shall use internal system clocks to generate time stamps for audit records that can be mapped to Coordinated Universal Time. The audit records shall be logged in one second 35 increments.

The audit system shall off-load audit records to an alternate system or media, which shall be capable of storing a minimum of 1 year of audit data.