P83003_Amd2_ICS-Chklst.pdf

NOTES/COMMENTS Operating System

Application Network Devices

CTR

Init's

GOV

Witness

DESCRIPTION

Remove all Software and Services not required for operation and/or maintenance of the product:

If removal is not technically feasible, then disable software not required for the operation and/or maintenance of the product. This removal shall not impede the primary function of the product. If software that is not required cannot be removed or disabled, document a specific explanation and provide risk mitigating recommendations and/or specific technical justification.

Provide documentation on what is removed and/or disabled. The software/service to be removed and/or disabled shall include, but not be limited to:

• Games

• Device drivers for product components not procured/delivered

• Messaging services (e.g., email, instant messenger, peer-to-peer file sharing)

• Source code

• Software compilers in user workstations and servers

• Software compilers for programming languages that are not used in the energy delivery system

• Unused networking and communications protocols

• Unused administrative utilities, diagnostics, network management, and system management functions

• Backups of files, databases, and programs used only during system development

• All unused data and configuration files Provide documentation of software/firmware that supports the product, including scripts and/or macros, run time configuration files and interpreters, databases and tables, and all other included software (identifying versions, revisions, and/or patch levels, as delivered). The listing shall include all ports and authorized services required for normal operation, emergency operation, or troubleshooting.

Remove and/or disable, through software, physical disconnection, or engineered barriers, all services and/or ports in the procured product not required for normal operation, emergency operations, or troubleshooting. This shall include communication ports and physical input/output ports (e.g., USB docking ports, CD/DVD drives, video ports, and serial ports). Provide documentation of disabled ports, connectors, and interfaces.

Configure the product to allow the ability to re-enable ports and/or services if they are disabled by software.

Disclose the existence of all known methods for bypassing computer authentication in the product, often referred to as backdoors, and provide written documentation that all such backdoors created have been permanently deleted from the system.

Provide summary documentation of the procured product’s security features and security-focused instructions on product maintenance, support, and reconfiguration of default settings.

Access Control Implement a warning banner on terminal interfaces that conforms to DoD warning banner guidelines Configure each component of the product to operate using the principle of least privilege. This includes operating system permissions, file access, user accounts, application-to-application communications, and energy delivery system services.

Provide user accounts with configurable access and permissions associated with one or more organizationally defined user role(s), where roles are used.

Provide a system administration mechanism for changing user(s’) role (e.g., group) associations.

Configure the product such that when a session or interprocess communication is initiated from a less privileged application, access shall be limited and enforced at the more critical side.

Provide a method for protecting against unauthorized privilege escalation.

Document options for defining access and security permissions, user accounts, and applications with associated roles. Configure these options, as specified.

Prevent unauthorized changes to the Basic Input/Output System (BIOS) and other firmware and document if not feasible, provide mitigation recommendations.

Verify and provide documentation for the procured product, attesting that unauthorized logging devices are not installed (e.g., key loggers, cameras, and microphones).

Account Management Document all accounts (including, but not limited to, generic and/or default) that need to be active for proper operation of the product.

Change default account settings to specific settings (e.g., length, complexity, history, and configurations) provided by government rep. Changed account information will not be published.

All new account information will be provided by a protected mechanism.

Remove or disable any accounts that are not needed for normal or maintenance operations of the energy delivery system.

Accounts for emergency operations shall be placed in a highly secure configuration and documentation on their configuration.

Session Management Configure system to disallow multiple concurrent logins using the same authentication credentials, allow applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins.

Implement account-based and group-based configurable session-based logout and timeout settings (e.g., alarms and human-machine interfaces).

Authentication/Password Policy and Management Document the levels, methods, and capabilities for authentication and authorization. Deliver a product that adheres to standard authentication protocols.

Implement a configurable account password management system that allows for, but is not limited to, the following:

• Changes to passwords (including default passwords)

• Selection of password length

• Frequency of change

• Setting of required password complexity

• Number of login attempts prior to lockout

• Inactive session logout

• Screen lock by application

• Comparison to a library of forbidden strings

• Derivative use of the user name

• Denial of repeated or recycled use of the same password Ensure/verify that passwords are not stored within or around the system in clear text, and not hardcoded into software or scripts.

Implement a centralized and local account management interface.

Implement a secure method of authentication (e.g., strong two-factor authentication) to allow for single sign-on authentication to a suite of applications.

NAVFAC MARIANAS ICS CHECKLIST v3.0 FOR [SYSTEM NAME]

FOUO - FOR OFFICIAL USE ONLY - DO NOT DISTRIBUTE

AMENDMENT No. 0001

CUI - CONTROLLED UNCLASSIFIED INFORMATION - DO NOT DISTRIBUTE

AMENDMENT No. 0002

Ensure/verify the protection of key files and access control lists used by the authentication system from non-administrative user read, write, and delete access. The authentication system must resolve each individual user’s credentials, roles, and authorizations to each application.

Provide documentation on configuring a single-sign-on system, as well as documentation showing equivalent results in running validation tests against the direct login and the single sign-on.

Logging and Auditing Implement logging capabilities or the ability to support the existing logging system. Logging capabilities shall be configurable by the government and support the governments security auditing requirements. As specified by the government, the procured product shall cover the following events, at a minimum (as appropriate to their function):

• Information requests and server responses

• Successful and unsuccessful authentication and access attempts

• Account changes

• Privileged use

• Application start-up and shutdown

• Application failures

• Major application configuration changes Implement standard time synchronization in the procured product (e.g., Global Positioning System [GPS], Network Time Protocol [NTP], and IEEE 1508-2008). If not providing standard time synchronization and is providing an alternate authoritative time source, the procured product shall be configured to synchronize to that authoritative time source.

Ensure/verify that time stamp audit trails and log files are automatically generated, as specified by the Acquirer.

Provide a list of all log management capabilities that the product is capable of generating and the format of those logs. This list shall identify which of those logs are enabled by default.

Communication Restrictions Document all remote access entry pathways and ensure that they can be enabled or disabled by the Acquirer as needed.

Ensure/verify that a method is provided for managing the network components of the procured product and changing configurations, including hardware and software configurations (e.g., addressing schemes).

Verify and document how the network configuration management interface is secured.

Malware Detection and Protection Implement the capability to automatically scan any removable media that is introduced to the product being acquired.

Implement both of the following:

• Provide a host-based malware detection capability. Quarantine (instead of automatically deleting) suspected infected files. Provide an updating scheme for malware signatures. Test and confirm compatibility of malware detection application patches and upgrades.

• Provide an application whitelisting solution that is tested, validated, and documented that shall only permit approved applications to run.

Validate that cybersecurity services running on the procured product (e.g., virus checking and malware detection) do not conflict with other such services running on the procured product.

Reliability and Adherence to Standards Verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput specified.

Physical Access System Components Provide lockable or locking enclosures or rooms for energy delivery systems and system components (e.g., servers, clients, and networking hardware) and for the systems used to manage and control physical access (e.g., servers, lock controllers, and alarm control panels).

Provide a method for tamper detection on lockable or locking enclosures. If a physical security and monitoring system is used, tamper detection shall be compatible.

Change locks, locking codes, keycards, and any other keyed entrances or provide the tools and instructions for making these changes.

Verify that physical security features do not hamper energy delivery system operations.

Reprogram codes (e.g., remove default codes) on provided locks and locking devices so that the codes/passwords are unique and do not repeat codes used in the past. Convey all codes/passwords to the government at system operational turnover.

General Wireless Technology Provisions Document specific protocols and other detailed information required for wireless devices to communicate with the control network, including other wireless equipment that can communicate with the supplied devices.

Document use, capabilities, and limits for the wireless devices.

Document the power and frequency requirements of the wireless devices (e.g., microwave devices meet the frequency requirements of Generic Requirements [GR]-63 Network Equipment Building System [NEBS] and GR-1089).

Document the range of the wireless devices and verify that the range of communications is minimized to both meet the needs of the proposed deployment and reduce the possibility of signal interception from outside the designated security perimeter.

Document that the wireless technology and associated devices comply with standard operational and security requirements specified in applicable wireless standard(s) or specification(s) (e.g., applicable IEEE standards, such as 802.11).

Document the configuration control options that enable varying of the security level of the devices.

Recommend alarm settings in accordance with the needs of the system, and implement in accordance with government direction.

Patch Management and Updates Verify and document that all products (including third-party hardware, software, firmware, and services) have appropriate updates and patches installed.

SIGNATURE DATE

I, [name of contractor QC Manager], attest that all of the items on this checklist have been verified and witnessed, and that comprehensive information for each item has been provided as applicable

FOUO - FOR OFFICIAL USE ONLY - DO NOT DISTRIBUTE

AMENDMENT No. 0001

CUI - CONTROLLED UNCLASSIFIED INFORMATION - DO NOT DISTRIBUTE

AMENDMENT No. 0002