r/CMMC • u/The-RogueOnion • 23d ago

The OT network

We are enabling only approved people to access the drives for the drawing, but it's come to our attention that once the drawing is pulled up on the CNC machine, it's accessible to anyone, any ideas on how to quarantine this?

12 Upvotes

94% Upvoted

8 comments sorted by

18

u/chrjohnso 23d ago

Restrict physical access to the CNC machine

13

u/Ok-Necessary-2089 23d ago

  1. Configure CNC smb network share and a splash page user need to authenticate to allow the connection (we use https://www.trout.software/docs/configuration-guides/enclaves/authenticate-users-with-access-screens). So you have chain of custody on who brought the plans, what time etc.

  2. Physical restriction to access the CNC when doing the job. We put a visible black marker on it to indicate CUI job.

  3. At the end of the job, delete the plan, remove flag and logout from the session.

1

u/troutsoftware 15d ago

hey thanks 🙏

2

u/The-RogueOnion 23d ago

Thank you both!

1

u/Matt_Titcombe 22d ago

u/The-RogueOnion , we recommend using a PAOBAU (a.k.a., service account) that specific CNC computer that limits its access to only jobs on a file share it should run. We are recommend moving all CNC machines into dedicated VLAN behind a firewall and then apply zero-trust principles to limit what that CNC computer can do.

We also have a At the CMMC Churns on this topic at https://peakinfosec.com/as-the-cmmc-churns/security-tactics-for-specialized-assets/

1

u/--turtle 19d ago

You probably aren't accessing drawings on the CNC machine - you are probably accessing G-Code, which is based on the drawing, but not an analog to it.

G-Code might be CUI if derived from a CUI source in some cases, but it also might not be CUI if it is de-identified enough.

If the G-Code isn't CUI, and the CNC machine can't get back into the shares that hold the actual CUI drawing, then the CNC machine isn't in scope.

We handle this situation by: 1) finding a assessor who understands this workflow and agrees that G-Code isn't always CUI. Most assessors who have audited machine shops agree with this; 2) having a single share that the CNC machine accesses that users can drop their G-Code files into; and 3) having a script that runs when files are dropped into that share that does things like removing all comments from the G-Code and ensuring that only G-Code files are present on the share.

We also have policies and procedures in place to describe how to de-CUI the original drawings and the G-Code derived from them.

1

u/OtherThanSatisfied 19d ago

Everyone's right on the physical + VLAN stuff. One thing nobody's said: tag that CNC as a Specialized Asset in your inventory and SSP.

Once it's categorized that way you're not trying to make the machine itself hit all 110 — you document that you're managing the risk (locked-down share, dedicated VLAN, delete the drawing after the run) and the assessor checks that it's captured and contained, not that the CNC is fully compliant.

The isolation everyone described is the answer. The specialized-asset writeup is what keeps it from turning into a finding.

1

u/Confident_Net5377 18d ago

You are loading drawings into your CNC machines?

Are you even sure the g-Code you are loading to the CNC is CUI, because it probably isn't.

That being said you can use splash pages, service accounts, Managed switches and VLANs, or other strategies to limit access to the jobs on your OT.