- Request a demonstration
Witness the power of ConsoleWorks with a knowledgable representative on hand to answer any questions.
- Read the white paper
Read a white paper with detailed information on how ConsoleWorks supports CIP Compliance.
- Learn more
Learn more about how ConsoleWorks benefits the Energy Industry.
The North American Reliability Council (NERC) Critical Infrastructure Protection (CIP) Standard was designed to ensure high availability and reliability in our nation's
bulk electric system. ConsoleWorks helps Energy companies achieve their CIP objectives by offering a web-based enterprise management solution,
providing real-time secure remote monitoring and management to ensure the security of mission critical
computer and control systems.
And while ConsoleWorks supports an organization's compliance goals, it also reduces system management overhead. Whereas most organizations utilize one application to monitor for equipment failures, another to detect attempted login failures and several more to provide remote management of all critical devices, ConsoleWorks delivers the same level of functionality in a single package with the convenience of a web browser.
CIP Requirements Summary and ConsoleWorks Support
| CIP Requirements |
ConsoleWorks Solution |
CIP-002-1 Critical Cyber Assets
The business and operations requirement for managing and maintaining a reliable bulk electric system
requires systems to communicate and necessitates controls associated with this interaction to protect the
integrity of the critical bulk electronic system assets. |
- All critical cyber assets, once defined and classified, are stored securely in the ConsoleWorks database.
- Complete logging of management interaction with audit trails for accountability to the responsible individual(s) and Regulatory Agencies if required.
- As a framework for managing heretofore unmanageable devices or integrating with existing monitoring tools, ConsoleWorks interfaces easily, non-intrusively, and provides a centralized global view of any critical enterprise infrastructure.
|
CIP-003-1 Security Management Controls
The Responsible Entity shall document and implement a cyber security policy that represents management’s commitment and ability to secure its Critical Cyber Assets.
|
- Secure user profiling to control access to managed components on a need-to-know basis. Various
secure privilege controls to permit the appropriate level access necessary for the individual’s job
function.
- Expandable knowledge base using Intelligent Event ModulesTM (IEMs) which contain the “best
available” event information for systems, devices, networks, internal and external interfaces, and
applications. Typically IEMs are produced from vendor error and recovery manuals and are the
equivalent of having a vendor expert watching your critical components 24x7 and advising you
the instant an anomaly occurs.
|
CIP-004-1 Personnel & Training
Recognizing that personnel having access to critical cyber assets, are given a higher level of trust, by
definition they are required to have a higher level of screening, training, security awareness, and record
retention of such activity, than personnel not provided access.
|
- Complete data stream monitoring and logging providing notification, via email, alarming, paging, etc. without limitation for specific event occurrences.
- Secure user profiling to control access to managed components on a need-to-know basis. Various secure privilege controls to permit the appropriate level access necessary for the individual’s job function.
- Complete logging of management interaction with audit trails for accountability to the responsible individual(s) and Regulatory Agencies if required.
|
CIP-005-1 Electronic Security
Electronic Security Perimeter — The Responsible Entity shall ensure that every Critical Cyber Asset resides within an Electronic Security Perimeter. |
- Real-time monitoring, notification, and management for systems, devices, networks, interfaces, including between companies and/or organizations, and applications, including their execution, without having to load agents on each system as with SNMP or agent-based monitoring tools.
- Full and secure end-to-end remote access via a secure Web browser.
|
CIP-006-1 Physical Security
In order to protect the critical cyber assets, it is necessary to identify the physical security perimeter(s)
within which these assets reside.
|
- With direct physical access to systems, devices, and network components under ConsoleWorks
management being greatly reduced, IT data center traffic is greatly reduced.
- Accounts and profiles configured on the ConsoleWorks server ensure only authorized personnel have virtual physical access to the critical IT components.
|
CIP-007-1 Systems Security Management
The implementation of a System Security Management Program minimizes or prevents the risk of failure or
compromise from misuse or malicious cyber activity. |
- ConsoleWorks can and will act as an ever vigilant operator, watching those
devices and applying TDi Intelligent Event Modules (IEMs) to incoming messages, thus providing the
ability to notify administrators and others of important events as they occur.
- Extensive reporting system provides a host of reports on the current status of your critical infrastructure.
- User/administrator account management includes strong password capability along with
integration to enterprise wide authentication system providing single logon capability.
|
CIP-008-1 Incident Reporting and Response Planning
Security measures designed to protect critical cyber assets from intrusion, disruption or other forms of
compromise must be monitored on a continuous basis. |
- ConsoleWorks monitoring and
logging capability provide keen insight of the historical recording of events and activity.
- While users can access the log information for reporting purposes through
ConsoleWorks, no direct access path is provided thus providing the security to maintain the integrity of the
data, which will be a critical requirement of all regulatory agencies.
- Real-time monitoring, notification, and management for systems, devices, networks, interfaces, including between companies and/or organizations, and applications, including their execution.
|
CIP-009-1 Recovery Plans
The entity performing the reliability authority, balancing authority, interchange authority, transmission
service provider, transmission operator, generator, or load-serving entity function must establish recovery
plans and put in place the physical and cyber assets necessary to put these recovery plans into effect once
triggered. |
- Having direct management capability, ConsoleWorks can issue first
level recovery commands, if desired; or allow administrators to interact directly with systems, devices, and
network components at the hardware level.
- The logs of ConsoleWorks would allow for a complete post analysis of an event and further for recommendations and procedures to prevent a reoccurrence of a
same or similar event/failure.
- During severe weather and natural disasters, ConsoleWorks can provide a secure method for administrators to continue to
monitor and securely manage the critical infrastructure elements from wherever they are using nothing
more than a web browser.
|
- Request a demonstration
Witness the power of ConsoleWorks with a knowledgable representative on hand to answer any questions.
- Read a white paper
Read an extended version of this document, with detailed information on how ConsoleWorks supports CIP Compliance.
- Learn more
Learn more about how ConsoleWorks benefits the Energy Industry.
It’s time for ConsoleWorks
Whether you are in the healthcare, energy management, financial services, government, telecom or manufacturing industry ... we understand your business. If your organization depends on business-critical infrastructure, you need ConsoleWorks.
|
