Nuclear Automation Cyber Security Services: Ovation™ Security Background Description U.S. Nuclear Regulatory Commission (NRC) requirements for cyber security create a challenge for existing plant control systems. NRC Regulatory Guide 5.71 and Nuclear Energy Institute (NEI) document NEI 08-09 detail the requirements to comply with 10 CFR 73.54, “Protection of digital computer and communication systems and networks.” As a long-time supplier of Ovation products and custom content for nuclear plant instrumentation and control systems, Westinghouse is well equipped to maintain the security of Ovation systems and to meet the regulatory requirements for controls. Plants that use Ovation™ control systems have tools available to secure their control systems and comply with current cyber security regulations. Westinghouse uses a standard configuration to harden new Ovation systems. This framework can be adapted to existing systems, based on custom settings and legacy versions of Ovation. Westinghouse also can build new Ovation systems in a secure development and operating environment (SDOE) to maintain the integrity of the system and protect it from tampering. New Ovation systems can be built on the Westinghouse Isolated Development Infrastructure (IDI) to meet the need for an SDOE. In addition, Westinghouse has partnered with McAfee® to provide antivirus solutions, making Westinghouse an excellent choice for securing Ovation systems. Solutions are based on customer needs. The Ovation Security Center (OSC) contains thirdparty products configured and validated to run with Ovation. Westinghouse offers additional security functions through McAfee. These solutions allow plants to choose the options that meet their needs. Westinghouse cyber security experts customize and install the selected solution. Benefits With Westinghouse, there are multiple resources for solving Ovation security issues – OSC and McAfee – and the expertise to implement them. These solutions can include: • Security Incident and Event Management (SIEM)* – Collects, stores and correlates system and security asset event logs. The Westinghouse SIEM product includes incident handling and replicates logs across a data diode. • Application control* – A software agent on each client permits only white-listed applications to execute. • Antivirus software*– Quarantines system files if they match signatures of known malware. • Patch management* – Manages and installs operating system and some application patches from a central server. • Backup and restore* – Backs up each client host to a file server so the machine can be restored in the event of a system failure. • Network and attached storage* – Provides highperformance storage to share and protect critical data. • Vulnerability management* – Scans system assets to detect vulnerabilities and configuration changes. Authenticated scans can be used to avoid conflicts caused by probing network ports. • Device control – Monitors the use of devices such as removable media. Restricts permission to devices based on user, computer or device type. • Network Intrusion Detection System (NIDS) – Monitors and analyzes system network traffic for indications of malicious activity. • File integrity monitoring or Host Intrusion Detection System (HIDS) – Monitors certain system files, folders and configuration settings for changes. • Host Intrusion Prevention System (HIPS) – Provides behavioral analysis, and a dynamic, stateful firewall at the host level. While regulatory compliance depends on the Ovation security products that are implemented, the controls that may be addressed include, but are not limited to, the following: RG 5.71 NEI 08-09 Control Title B.2 B3.21 B5.1 D.2 D3.20 D5.1 B5.2 B5.3 D5.2 D5.3 B5.4 B5.5 D5.4 D5.5 C.3 C3.2 C3.3 C3.4 C3.7 C.9.6 C.9.7 C11.3 C11.4 C11.6 C11.7 C11.8 C11.9 E.3 E3.2 E3.3 E3.4 E3.7 E.8.5 E.8.6 E10.3 E10.4 E10.6 E10.7 E10.8 E10.9 Audit and Accountability Heterogeneity Removal of Unnecessary Services and Programs Host Intrusion Detection System Changes to File System and Operating System Permissions Hardware Configuration Installing Operating Systems, Applications, and Third Party Software Updates System and Information Integrity Flaw Remediation Malicious Code Protection Monitoring Tools and Techniques Software and Information Integrity CDA Backups Recovery and Reconstitution Baseline Configuration Configuration Change Control Access Restrictions for Change Configuration Settings Least Functionality Component Inventory *OSC Features Ovation is a trademark or registered trademark of Emerson Process Management. Westinghouse Electric Company 1000 Westinghouse Drive Cranberry Township, PA 16066 www.westinghousenuclear.com McAfee is a trademark or registered trademark of McAfee, Inc. Other names may be trademarks of their respective owners. July 2013 NA-0144 ©2015 Westinghouse Electric Company LLC. All Rights Reserved