ieRoadmap Project Partner Releases No-Cost ANTFARM Tool to Map Control System Networks and Help Implement Cyber Security Standards

Tuesday, August 19, 2008

Funded under the Department of Energy's National SCADA Test Bed Program, Sandia National Laboratories recently released a new software tool that will aid energy utility owners in mapping and visualizing their control system networks–a critical first step in meeting the North American Electric Reliability Corporation's Critical Infrastructure Protection (NERC CIP) standards.

Sample network map created by ANTFARM.

The Advanced Network Toolkit for Assessments and Remote Mapping (ANTFARM) helps utilities meet NERC CIP-005, which requires that they identify their electronic security perimeter (ESP), inside which all critical cyber assets and external access points reside. By using a utility's existing network information and analysis tools, the ANTFARM tool provides utilities with a no-cost method to map network connections, outline a security perimeter, and visualize critical cyber assets and vulnerabilities within the perimeter.

Purchasing active, online scanning tools specifically for network mapping can be costly, and these tools can disrupt control system function. The ANTFARM tool remotely maps networks by parsing and analyzing multiple sources of network information, such as output from other network analysis tools (e.g., traceroute, Nmap), network device configuration files, traffic logs, etc. By correlating that data into a database, the tool can create a visual depiction of the network to help utilities better understand their security posture.

The tool is open source and available online under a no-fee, general-purpose license agreement at http://antfarm.rubyforge.org/.

View the ieRoadmap project page.

The National SCADA Test Bed (NSTB) is a multi-laboratory resource that partners with industry and other government programs to test, research, and help design cyber security solutions to enhance control systems security in the energy sector and reduce the risk of energy disruption due to cyber attack.

Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy's National Nuclear Security Administration under Contract DE-AC04-94AL85000.