The Data Diode Question

All opinions expressed herein are mine, not necessarily those of Honeywell International, Inc.

In our recent webinar with EnergySec on CIP Version 4, we got two questions on data diodes, and I had two organizations call me to discuss the question afterwards.  I suspect these are just the tip of the iceberg.  As organizations look at the cost of complying with CIP Version 4 (or Version 3, for that matter), it has to be very tempting to think that there might be a simple fix to the whole problem: just install a data diode device.  This will break your external routable connectivity and result in a Critical Asset not having any Critical Cyber Assets, per CIP-002-4 R2.

You can read our response in the Q&A document.  But I’ll summarize this for you: Data diodes are a wonderful security measure for critical infrastructure; almost nobody disputes that.  But you shouldn’t rely on them to be a “get out of jail free” card for NERC CIP compliance.[i]

Most of you know that NERC put out a Compliance Application Notice (CAN-0024) on data diodes more than a year ago.  While a draft said that it shouldn’t be assumed that any data diode would break the external routable connection, the final version actually changed this tune.  It said that “embedded” data diodes break the routable connection, but “non-embedded” ones do not (or at least, it can’t be assumed they do).  I know a number of people – including CIP auditors – were mystified by the reasoning used to justify this distinction. 

In any case, CAN-0024 was rescinded by NERC in March (indeed, NERC is moving away from CANs altogether).  This means that there is no longer any official NERC guidance on the subject of data diodes.  You may ask, “This applies to CIP Version 3.  What about Version 4?”  The answer is, since CIP-003 through CIP-009 are exactly the same in V4 as in V3, this action applies to V4 as well.  There is now no official guidance for data diodes in V3 or V4. 

Does this mean that implementing a data diode device will or won’t break the external routable protocol connection – or more importantly, what will the auditors say about it?  Fortunately, a CIP auditor with one of the regions discussed this at length with me after the webinar.  He said that his team will evaluate each instance of a data diode on its own merits.  They will look at the details, diagram the situation, and make the decision in each case whether the routable protocol connection is present or absent.  Moreover, he said this has always been their approach (remember, the CANs are only advisory). 

I asked him the $64,000 question: How likely is it that an entity will not be assessed any potential violations if they have a data diode in place at a facility that is a Critical Asset, and have not otherwise taken the normal CIP-required steps to protect cyber assets at the facility?  He said that there was always this possibility, but there was always the possibility that he would issue PV’s for lack of compliance with every CIP requirement that hadn’t been implemented.[ii]

Think what this means.  Say you don’t comply with maybe 20 of the 40-odd CIP requirements at the facility, because you are counting on your data diode to be your get-out-of-jail-free card for CIP V4.  April 1, 2014 comes and goes, and nothing bad happens.  Are you feeling good about your decision?  If so, you’re like the guy who jumps off the top of a 30-story building; as he passes the second floor he yells out, “So far, so good!”

Let’s further say your next CIP audit is two years later, in April of 2016.  Your auditor comes by, looks at your data diode and your network, and says, “Nope, you still have an external routable protocol connection here.”  What is your potential fine?  Let’s see, $1MM a day per requirement violated X 20 requirements X 730 days.  I don’t have enough zeroes in my calculator to figure that out, but I’d say it’s a lot of money.  Of course, your fine wouldn’t be anything near that, but it’s not likely to be anywhere near zero, either.  Is this worth the risk?  The answer is left as an exercise for the reader.

There’s another reason not to look to data diodes as the knight that will ride in to save you from CIP.  CIP Version 5 will almost certainly come into effect within 2-3 years after Version 4.   In V5, cyber assets (BES Cyber Systems, to be exact) that don’t have external routable connectivity are still subject to most of the requirements. 

There are some requirements of V5 that only apply to BES cyber systems with such connectivity, but most of the requirements don’t care whether that connectivity is there or not (and given the experience of Stuxnet, which was spread at the Natanz uranium enrichment facility in Iran through USB sticks - there being no external routable connectivity at the facility - this is understandable.  Of course, Stuxnet came into view long after CIP Versions 1 to 3 were drafted, but was very much on the SDT’s mind when Version 5 was drafted).  This means that, even if you get a pass from your auditor on V4 compliance due to your data diode, you are still going to have to implement most of the CIP controls to comply with Version 5 later.

I won’t say any more, except to emphasize again that data diodes are a wonderful security control for any critical infrastructure facility.  However, the question whether they will drastically lower your CIP compliance costs – without subjecting you to high fines in the future – is very much an open one.


P.S. Be sure to sign up for Honeywell’s upcoming webinar with EnergySec, “Covering your Assets in CIP Version 5”.  You can sign up for it here.  The webinar is on August 21st 10:30CDT.  If you can’t make the webinar but want to see the video, sign up anyway.  You’ll get the link to the video as soon as it is posted after the webinar.

---

[i] When Stacy read the question on data diodes in the webinar, I at first tried to break in to say that we shouldn’t be addressing theological questions (since I consider this question to be almost a matter of religious preference).  However, my phone connection was suddenly lost and I had to dial back in.  Coincidence?  I’ll let you be the judge.

[ii] I’ve talked to other auditors who are not so kind toward data diodes – they say that there are few if any cases where they would judge them to have broken the external routable protocol connection.