Latest / CMMC Compliance Guide / CMMC for Machine Shops: Windows 7 CNC Controllers, Shared Shop Logins, Encrypted USB Drives, and MFA Without Personal Phones

Transcript

CMMC for Machine Shops: Windows 7 CNC Controllers, Shared Shop Logins, Encrypted USB Drives, and MFA Without Personal Phones · CMMC Compliance Guide

• 0:21
  SPEAKER_01: Hey there, welcome to the Siemens C Compliance Guide Podcast.
• 0:24
  SPEAKER_01: I'm Stacey from Justice IT Consulting, where we help businesses like yours navigate Siemens C and NIST 800-171 compliance.
• 0:33
  SPEAKER_01: We're hired guns getting companies fast-tracked to compliance, but today we're here to give you all the secrets for free.
• 0:39
  SPEAKER_01: So if you want to tackle it yourself, you're equipped to do so.
• 0:42
  SPEAKER_01: Let's dive into today's episode and keep your business on track.
• 0:46
  SPEAKER_01: Today we're leaving the front office and walking out onto the shop floor.
• 0:50
  SPEAKER_01: Most MMC advice stops at the office store, but if you run a machine shop, a lot of your COI lives right next to the machines.
• 0:59
  SPEAKER_01: We're covering the 400,000 machines with a Windows 7 controller that you do not have to replace, the shared shop one login that fails three separate requirements at once, the one multi-factor requirement that can never be pushed onto a POM, and the coffee can of unlabeled thumb drives that make an assessor ask who owns them, what's on them, and where they've been.
• 1:22
  SPEAKER_01: If you run or work in a CNNC or aerospace shop, this is the walkthrough to follow with your own floor in mind.
• 1:30
  SPEAKER_01: All right, Brooke, let's start with what a lot of owners tell us.
• 1:34
  SPEAKER_01: So we hear our CLI is in the office, the guys on the floor just run parts.
• 1:39
  SPEAKER_01: So why would any of this apply out there?
• 1:41
  SPEAKER_01: And if the drawing is just printed on a traveler at the machine, is that even a computer problem?
• 1:48
  Brooke: Uh good question.
• 1:49
  Brooke: All of them are good questions.
• 1:50
  Brooke: We, you know, we have lots of people that uh say, hey, these are just our one our computers in office, and everything out there is out of scope.
• 1:57
  Brooke: You know, that's nice.
• 1:58
  Brooke: If it were that way, that would be wonderful.
• 2:01
  Brooke: Uh, but the shop floor would still be in scope for physical CUI and uh for controlling it there.
• 2:07
  Brooke: Um while that's not uh quite as many things to do as uh for the you know running it over the network out there, then but there's still stuff to do.
• 2:17
  Brooke: So uh yes, it still comes in scope.
• 2:19
  Brooke: If you don't, if you just use paper travelers, um, you know what it what happens with that, you've got to describe the process.
• 2:25
  Brooke: So you you've got to protect CUI whether it's uh digital or whether it's paper or you know, physical CUI.
• 2:32
  Brooke: Uh I guess you could print them out, print them out on a stone tablet, you know, and that would that might not be paper, but it would be physical CUI.
• 2:39
  Brooke: But um, so we're talking digital and physical CUI.
• 2:42
  Brooke: Uh physical CUI, if it's just for instance, uh printed out on a on a uh traveler and it goes out through the uh through the uh shop floor, um, what happens to that?
• 2:53
  Brooke: How does it get locked up?
• 2:54
  Brooke: What about when nobody's using it?
• 2:56
  Brooke: What about even when somebody walks away from it?
• 2:58
  Brooke: You know, uh you gotta you gotta think about that and think about those uh CUI drawings, the drawings, the specs, the the cut instructions or whatever it may be uh that they're taking out there.
• 3:09
  Brooke: Is it really CUI?
• 3:11
  Brooke: And if it is CUI, how do you protect that physical CUI?
• 3:14
  SPEAKER_01: Here's the one that keeps shop owners up at night.
• 3:17
  SPEAKER_01: We've got a$400,000 machine with a PC on it running Windows 7, and the manufacturer won't update it.
• 3:25
  SPEAKER_01: Do we have to replace the machine to pass or can we just ignore it altogether?
• 3:29
  Brooke: You know, this is uh one way, I mean this is common, it happens all the time, right?
• 3:34
  Brooke: Uh so uh, you know, yeah, the the uh the the vendor will do something about that.
• 3:41
  Brooke: They'll update it, they'll sell you a whole new machine for another half a million dollars.
• 3:45
  Brooke: And no, they won't just update the computer.
• 3:47
  Brooke: Actually, in some cases, they will update the computer uh and they'll give you a whole new controller and stuff like that to connect to that machine, but uh that still costs money.
• 3:55
  Brooke: And it, you know, who knows how much it'll be, tens of thousands of dollars, uh whatever it might be.
• 4:01
  Brooke: So some people ought to go that route because uh the when you step back and think about it, uh, and this is going a little bit different direction, uh, but when you step back and think about it, that old crappy Windows 7 machine that's been out there for however many years now running that machine, uh running that CNC machine or whatever it is, uh it's been running fine and been okay.
• 4:23
  Brooke: What happens if that hard drive gets corrupted?
• 4:26
  Brooke: What happens if the hard drive fails?
• 4:28
  Brooke: What happens if uh, you know, maybe it maybe it's completely offline, but hardware fails, um you know, things get corrupted, uh, you know, things happen sometimes.
• 4:41
  Brooke: So yeah, it's been going well, it's been going great, but if that thing breaks, what do you do with it?
• 4:47
  Brooke: You've got to have a contingency plan that's quite outside of CMMC, but isn't something to think about.
• 4:52
  Brooke: Uh, but as far as the Windows 7 machine goes, uh there's a million different ways to handle that.
• 4:58
  Brooke: The easiest way to handle that is to take it off the network or put it on its own uh untrusted network, uh, keep it from hitting the internet, uh, so that way it's not connected to anything corporately, it's not connected to the internet.
• 5:13
  Brooke: Uh, and you know, then you're you you're good as far as that goes.
• 5:17
  Brooke: Uh, and then how to get your uh CUI over to it, you can use an encrypted uh USB stick.
• 5:23
  Brooke: You know, like one of those apricorns or apricorns, whatever you want to call it.
• 5:26
  Brooke: It's got the little uh little uh keypad on it, little digits on it that you can uh unlock it with.
• 5:35
  Brooke: Uh those are actually really good.
• 5:36
  Brooke: Uh apricorn's not the only one that makes them, but they're they're that's what we recommend, and most people know about them.
• 5:43
  Brooke: Um but those kind are good because uh you can use those USB sticks, put it in, unlock it with your uh with your key that nobody else knows, and uh then at that point it looks like just a regular old USB drive.
• 5:56
  Brooke: Uh and old equipment generally can read that just fine, right?
• 6:01
  Brooke: Um so if you try to get into using BitLocker on thumb drives and stuff like that, then you know you get into some other issues, and those apricorns are really good.
• 6:11
  Brooke: So if you keep it out of scope, in other words, that machine that's Windows 7, and uh come up with some sort of uh uh disaster recovery plan for it, but keep that you know off your corporate network, uh off the internet, and just plug it in with USB stick uh that's covered and listed inventory and everything else, uh then that's a great way to handle that.
• 6:34
  Brooke: If it does have to be uh connected to the network for some reason to be able to pull stuff off of a server or some common point, um, you can do that.
• 6:45
  Brooke: There's different ways to go about it depending on what you need.
• 6:48
  Brooke: Um, but you've got to make sure you put the proper restrictions in place.
• 6:53
  SPEAKER_01: So what I'm hearing is the machine itself gets some breathing room.
• 6:57
  SPEAKER_01: What about the computer that sends the programs to the machine?
• 7:01
  Brooke: Uh so uh I think I jumped ahead a little bit.
• 7:04
  Brooke: But yeah, so the computer that sends a program to the machine, uh you the easiest, cleanest way to do that is just say it's off the network and we use a USB that's inventory that's encrypted with FIPS validated encryption, uh, the whole nine yards, and that's then that's covered.
• 7:21
  Brooke: All right, and so you know the point about that is the machine, the computer that sends that uh uh CUI to that machine, uh it is in scope, and you you can't take it out of scope.
• 7:31
  Brooke: So um, I guess you I should say I shouldn't say never, uh that it's you know, that is always in scope, but um uh you know, with there may be some specialized circumstances that you have to worry about, and then that also has to be segmented.
• 7:48
  Brooke: But aside from that, the general easiest way to do it is that the computer that uh you know makes the drawing and and sends it or the instructions you know to the machine, it's gonna be sneaker net from now on.
• 7:59
  Brooke: Sneakernet, for those of you that don't know, is uh you put it on a in the old days it was a floppy drive, but now you put it on a USB stick and you stand up and you walk in your sneakers over to the machine and you plug it in.
• 8:11
  Brooke: That's that's SneakerNet.
• 8:12
  Brooke: So uh that's that's a good way to handle that and make a nice, uh, a clean uh distinction right there.
• 8:20
  SPEAKER_01: Something we hear from machine shop owners pretty often is this scenario.
• 8:24
  SPEAKER_01: So they have one terminal at each cell, and everybody uses the same login so they can full up the job.
• 8:30
  SPEAKER_01: And they usually say that their guys are not going to type in a 14-character password with gloves on.
• 8:36
  SPEAKER_01: So what's actually wrong with a shared login in that scenario?
• 8:41
  Brooke: Nothing at all if you don't touch any CUI.
• 8:43
  Brooke: So the second they uh touch CUI, then there's something big wrong with it, right?
• 8:48
  Brooke: Uh so um the issue is that uh everybody has to be identified that touches CUI individually, not as a group, not as shop, not as um anything else, but as as an individual, like Barney and Frank, and actually, I think that's uh uh some old politician's name, but never, but nevertheless, you know, George and Bill, you know, uh there has to be uh there has to be a login assigned to that person that accesses CUI because you've got to be able to track any problems that might arise back to an individual, not a group of individuals, whether it's two people or 500 people, you know, they can't log in as a group because you don't know who who did whatever action, right?
• 9:35
  Brooke: Uh so that's where the problem comes in.
• 9:37
  Brooke: Um the way we generally one way to handle that depending on what they need access to is uh for the group login, if they just need to clock in with it or something, you can leave that group login, you know, that's fine.
• 9:50
  Brooke: But use fast user switching uh with Windows 11, right?
• 9:54
  Brooke: That's fast user switching, and they can do the fast user switching over to their own profile, type in their password, and then they can get to CUI that way if they need to do that, right?
• 10:04
  Brooke: Um, but the point is that if it's a shared login, they can't access CUI or SCI with it.
• 10:12
  SPEAKER_01: Something else we hear from um machinists.
• 10:15
  SPEAKER_01: They say um half my machinists won't put a company app on their personal phone.
• 10:20
  SPEAKER_01: Can I make them and can we just put MFA on the PM and deal with it later?
• 10:25
  SPEAKER_01: What are your thoughts on that?
• 10:26
  Brooke: Uh no, you can't just put it on the poem and leave it for later.
• 10:29
  Brooke: Uh and actually, I guess you could if you're not ready to, you know, uh get any DOD contract, DLW contracts.
• 10:37
  Brooke: But uh, if you're trying to get ready to get DOW contracts, uh you've got to have all your PAM items that are five points, three points, or some of the one-pointers cleared up.
• 10:46
  Brooke: Um, and you've got to have a minimum score of 88.
• 10:49
  Brooke: So those are the requirements.
• 10:50
  Brooke: And this is this is one of those that can't be Poan, uh multi-factor authentication.
• 10:55
  Brooke: So uh you've got to implement it, but there's multiple ways to implement it.
• 10:58
  Brooke: You can use uh, for instance, select Duo or something like that on your phone uh where it pops up and says, Hey, are you trying to log in on this computer?
• 11:06
  Brooke: And you say yes or no.
• 11:08
  Brooke: If you you know if you're not trying to log in, you've got to say no.
• 11:11
  Brooke: But uh anyway, you can use duo to uh uh something like duo to address that.
• 11:16
  Brooke: Uh but you can also use uh a Fido key, like a UB key, a little hardware uh piece.
• 11:22
  Brooke: Uh you put it in your computer, you register it, and then you can use that hardware key as your multi-factor authentication uh to log in.
• 11:31
  Brooke: That's a really good option.
• 11:32
  Brooke: I will warn you that they're easy to lose.
• 11:35
  Brooke: Uh I lost mine on a plane one time and I didn't actually lose it, I dropped it in my pocket.
• 11:39
  Brooke: So um, but uh I was kind of freaking out about it.
• 11:43
  Brooke: Uh, but they are easy to lose uh because they are you can make them very tiny or you know, somewhat small.
• 11:50
  Brooke: And uh so uh be aware if it's uh a laptop somebody travels with, it'll be easy to lose.
• 11:57
  Brooke: So uh or if it's a desktop and somebody bumps it, knocks it out, or breaks it or whatever.
• 12:03
  Brooke: Um, I mean it could be it'll be replaced pretty easily, but you still got to go through the process of replacing it.
• 12:08
  Brooke: You gotta have another one on hand or wait for one to be ordered.
• 12:12
  Brooke: But uh it's easy to do, but um well, it's easy to break them, but it's also easy to replace them, but there's just a time factor involved, right?
• 12:21
  Brooke: Uh so but the photo keys, uh like UB keys and whatnot are are a really good thing to do.
• 12:25
  Brooke: Windows Hello for business.
• 12:27
  Brooke: Um, although Microsoft has a big old long article about how great it is and how it fits and uh it'll work for CMMC, uh, there's a lot of assessors that don't like it.
• 12:39
  Brooke: You can probably argue your point and and be okay with with uh some or a lot of assessors, but uh we just choose not to have that argument and we either use UV keys or duo, and that way that's not questionable, and we just do it, right?
• 12:55
  Brooke: Um so up to you.
• 12:57
  Brooke: You might be able to use Windows Hello for business, but uh some assessors don't like it and you might not pass.
• 13:04
  SPEAKER_01: So let's pivot and talk about the way programs actually move around a lot of shops.
• 13:09
  SPEAKER_01: So we move programs to the machines on USB drives.
• 13:13
  SPEAKER_01: Is that allowed?
• 13:14
  SPEAKER_01: And what do we do when the old controller can't read an encrypted drive?
• 13:19
  SPEAKER_01: What are your thoughts on that?
• 13:21
  Brooke: Absolutely, and this is another one where I got ahead of myself and uh and uh talked a little bit about it already.
• 13:26
  Brooke: Uh but yeah, um you can absolutely do that.
• 13:30
  Brooke: You just gotta make sure that you address all the controls that are involved here, right?
• 13:34
  Brooke: Um so uh it can CUI can go on those thumb drives, and uh but they have to be encrypted with uh with FIPS validated encrypt uh encryption or cryptography.
• 13:46
  Brooke: Um so uh there is some argument that they don't necessarily have to be encrypted if they're in the facility, but easy deal, just use use uh FIPS validated uh cryptography keys, like the Apricorn drives that we were talking about a little earlier.
• 14:03
  Brooke: Uh again, uh there are old there are a bunch of older controllers, older computers uh that can't read an encrypted drive, uh won't necessarily let you put in a code to open it up um you know on the screen uh or something like that, but they they just don't work.
• 14:20
  Brooke: So if you use those um use those FIPS validated cryptographic uh USBs that have a little keypad on them, like the Apricorns, uh you plug those in, you put, you type in your code, it opens it up, and it looks just like a regular old unencrypted USB.
• 14:36
  Brooke: And I wasn't at that point it is unencrypted, but uh, but it handles all that on device on that little USB, and you don't have to worry about it on a computer.
• 14:46
  Brooke: So uh those work really well.
• 14:49
  Brooke: Um there there may be some situations they don't work uh work in, um, but we've found that that works by far the best.
• 14:58
  SPEAKER_01: So for the machine shop owners with the junk drawers out there with old thumb drives in the programming office, can they just throw those away or is there something particular they need to do with them?
• 15:09
  Brooke: Uh bourman a furnace, you know.
• 15:13
  Brooke: They need to be uh any device, uh computer, printer, USB, whatever it is that has had CUI on it, uh needs to, if you're gonna dispose of it or put it to use somewhere else that's not CUI related, you can do that absolutely, but you have to sanitize it properly.
• 15:32
  Brooke: And the way to sanitize it properly is to use the uh NIST 800-88, I think it's revision two, um uh that's ballot right now, uh, but use that document.
• 15:44
  Brooke: There's a multitude of ways in there that you can destroy it or sanitize it and uh go through that and do it.
• 15:50
  Brooke: It's pretty simple.
• 15:51
  Brooke: Uh you just have to make sure you use the right methods, and then you can get rid of them, or you can put them used somewhere else after that.
• 15:58
  SPEAKER_01: You provided us with a lot of knowledge over all of these things that happened in a machine shop.
• 16:04
  SPEAKER_01: Um, if you had to sum it up in one thing for a shop owner listening, what would it be?
• 16:09
  SPEAKER_01: The biggest takeaway.
• 16:11
  Brooke: Really, it all goes back to scoping, the you know, the first thing you should really do, right?
• 16:16
  Brooke: Um, so think about where that that CUI comes, uh, and we're talking really about being out on the shop floor.
• 16:24
  Brooke: Um, so where it comes in at, what systems it goes to, and then how you how do you get that to the shop floor?
• 16:31
  Brooke: You know, how do you get it to the shop floor currently, and is that gonna have to change?
• 16:35
  Brooke: Uh and most well, half the time the answer is yeah, that's gotta change.
• 16:41
  Brooke: Um, you can't keep doing it like you're doing it.
• 16:43
  Brooke: But uh, you know, if it's uh if uh for instance it's a traveler, you're printing out a traveler, walk around out there and go from, you know, where does it go?
• 16:52
  Brooke: What does it do?
• 16:53
  Brooke: You're gonna have to write this down anyway, right?
• 16:56
  Brooke: Uh so you've got to document what you do and how it's how you accomplish this.
• 17:00
  Brooke: So go out to the different stations.
• 17:02
  Brooke: How does it get there?
• 17:03
  Brooke: What happens when everybody goes home for the day?
• 17:05
  Brooke: You know, uh, what do you do with it then?
• 17:07
  Brooke: What do you do with it when it moves from um, you know, uh from one station to another station, you know, uh from the cutting sign to the welding sign, or you know, what you know what happens to that that physical COI, that traveler that you've got.
• 17:23
  Brooke: And uh, you know, does it just stay out on the floor?
• 17:26
  Brooke: Is it toss it aside and you know, follow that around, document every single place that it touches, and figure out what you have to do.
• 17:34
  Brooke: And then what you have to do is likely one of the situations like we talked about.
• 17:38
  Brooke: Uh if it's a paper traveler, uh then you're likely gonna have to have uh it's gonna have to likely be locked up at the end of the day uh somewhere.
• 17:47
  Brooke: Um and uh the where whatever you lock any CUI up with, whether it's a uh proximity card, whether it's a physical key, whatever it is, it has to be inventory.
• 17:59
  Brooke: It has to be serialized, uh have a unique serial number, and it has to be inventory, and that has to be either assigned to someone or assigned to a well assigned to someone is the best.
• 18:10
  Brooke: Still, if it's assigned to a lockbox, then you you have to you have to have a checkout procedure and all that kind of fun stuff.
• 18:17
  Brooke: But um serialized key and it has to be that CUI has to be locked up.
• 18:23
  Brooke: If they're you know, unless you're running 24-7 and it's in somebody's hands all the time, whatever uh you leave for the day, if if you're not running that 24-7 shop, it needs to be locked up somewhere.
• 18:36
  Brooke: Some people want to like to do a lockbox, you know, attached to the machine with certain people that have keys.
• 18:42
  Brooke: That way they just open it up, drop it in there, lock it up, and leave for the day.
• 18:47
  Brooke: And then when they come back, they unlock it, get it out, and they start using it again.
• 18:52
  Brooke: It's right there when they need it.
• 18:54
  Brooke: Uh you know, you don't have to walk it all the way back up to the office and you know, put it on you know, Georgia's locking file cabinet or something like that.
• 19:01
  Brooke: So there's multiple ways to do that.
• 19:03
  Brooke: Um, but you have to follow that CUI, uh, what whatever is gonna be CUI, follow that around, walk around uh like you're going from station to station, figure out where it goes, how it's handled while it's out there.
• 19:16
  Brooke: And I'm talking my whole process, not just yeah, it goes out to the shop floor.
• 19:21
  Brooke: Okay, but what happens out there, right?
• 19:23
  Brooke: So you got to think about those things, and that's part of scoping.
• 19:27
  Brooke: And we've talked about scoping being the very first thing you do.
• 19:30
  Brooke: Actually, the very first thing you do, that's really kind of it's part of scoping, but the really the first thing you do is figure out uh what's what kind of CUI you have, you know, and uh why you know you have it, and then you can uh move on to scoping.
• 19:46
  Brooke: But yeah, it's uh that's all a scoping issue, and then figuring out what all is happening currently and what all needs to happen in the future to do it greater.
• 19:55
  SPEAKER_01: Well, thank you, Brick, as always, for your insight.
• 19:58
  SPEAKER_01: If you have questions about what we covered, reach out to us.
• 20:01
  SPEAKER_01: We're here to help fast track your compliance journey.
• 20:04
  SPEAKER_01: Text, email, or call in your questions, and we'll answer them for free here on the podcast.
• 20:10
  SPEAKER_01: You can find our contact info at cmc compliance guide.com.
• 20:16
  SPEAKER_01: Stay tuned for our next episode.
• 20:18
  SPEAKER_01: Until then, stay compliant, stay secure, and make sure to subscribe.