The Federal Energy Regulatory Commission (FERC) announced on Jan. 20 that they’re proposing to direct the North American Electric Reliability Corporation (NERC) to develop and submit new or modified Reliability Standards to require high- and medium-impact cyber systems to include network security monitoring. This Notice of Proposed Rulemaking (NOPR) is aligned with the objective of improving cyber resiliency through better visibility and understanding.
As stated in the NIST SP 800-160 on developing cyber resilient systems, analytic monitoring and dynamic representation are two fundamental building blocks to gain comprehensive visibility over the environment we have to protect. Indeed, internal network security monitoring (INSM) and network access modeling (NAM) are the two sides of a holistic network visibility approach that enables network traffic alerts to be contextualized with in-depth knowledge of network access policies and network segmentation.
The draft NOPR is seeking comments from the community for a period of 60 days following publication in the Federal Register. We look forward to participating in this request for feedback to advocate about the important complementarity between INSM and NAM for greater visibility and resiliency.
