Industrial Cybersecurity

Pascal Ackerman

• Publisher: Packt Publishing
• Year: 2021
• ISBN:
  9781800205826
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

A second edition filled with new and improved content, taking your ICS cybersecurity journey to the next level

Key Features

• Architect, design, and build ICS networks with security in mind
• Perform a variety of security assessments, checks, and verifications
• Ensure that your security processes are effective, complete, and relevant

Book Description

With Industrial Control Systems (ICS) expanding into traditional IT space and even into the cloud, the attack surface of ICS environments has increased significantly, making it crucial to recognize your ICS vulnerabilities and implement advanced techniques for monitoring and defending against rapidly evolving cyber threats to critical infrastructure. This second edition covers the updated Industrial Demilitarized Zone (IDMZ) architecture and shows you how to implement, verify, and monitor a holistic security program for your ICS environment.You'll begin by learning how to design security-oriented architecture that allows you to implement the tools, techniques, and activities covered in this book effectively and easily. You'll get to grips with the monitoring, tracking, and trending (visualizing) and procedures of ICS cybersecurity risks as well as understand the overall security program and posture/hygiene of the ICS environment. The book then introduces you to threat hunting principles, tools, and techniques to help you identify malicious activity successfully. Finally, you'll work with incident response and incident recovery tools and techniques in an ICS environment.By the end of this book, you'll have gained a solid understanding of industrial cybersecurity monitoring, assessments, incident response activities, as well as threat hunting.

What you will learn

• Monitor the ICS security posture actively as well as passively
• Respond to incidents in a controlled and standard way
• Understand what incident response activities are required in your ICS environment
• Perform threat-hunting exercises using the Elasticsearch, Logstash, and Kibana (ELK) stack
• Assess the overall effectiveness of your ICS cybersecurity program
• Discover tools, techniques, methodologies, and activities to perform risk assessments for your ICS environment

Who this book is for

If you are an ICS security professional or anyone curious about ICS cybersecurity for extending, improving, monitoring, and validating your ICS cybersecurity posture, then this book is for you. IT/OT professionals interested in entering the ICS cybersecurity monitoring domain or searching for additional learning material for different industry-leading cybersecurity certifications will also find this book useful.

]]>

Section 1: ICS Cybersecurity Fundamentals

In part one, we will briefly recap the first edition of the book to outline what was covered and to point out the content that is still very relevant and that will be built upon in this second edition. The remainder of part one will be dedicated to discussions around a revised IDMZ architecture, resulting from many deployments, experience in the field, practice, and feedback. Part one will conclude with a deep dive into how to design for security, architecture that allows all the tools, techniques, and activities discussed in the rest of the book to be implemented effectively and easily.

This section comprises the following chapters:

• Chapter 1, Introduction and Recap of the First Edition
• Chapter 2, A Modern Look at the Industrial Control System Architecture
• Chapter 3, The Industrial Demilitarized Zone
• Chapter 4, Designing the ICS Architecture with Security in Mind

Chapter 1: Introduction and Recap of First Edition

Welcome to the second edition of Industrial Cybersecurity. Over the next 24 chapters, we will discuss the next logical steps after building a secure Industrial Control System (ICS) environment and defining a comprehensive set of policies, procedures, and standards, discussed in detail in the first edition.

We are going to start off this second edition with a brief recap of topics and material that were covered in the first edition of Industrial Cybersecurity. This has mainly been added to get you up to speed with the terminologies, technologies, and principles that are expanded upon throughout the rest of this book. The remainder of the book concentrates on security monitoring and verification of the ICS security posture and the various tools, techniques, and activities involved.

This chapter will be a review of the first edition of this book. We will go over all the topics and material that were covered in the first edition, which should give you a solid base for the topics covered in this book. The chapter will conclude with an explanation of what to expect in the rest of this second-edition book.

In this chapter, we'll cover the following topics:

• What is an ICS?
• Information Technology (IT) and Operational Technology (OT) convergence and the associated benefits and risks
• The comprehensive risk management process
• The Defense-in-Depth (DiD) model
• ICS security program development

Industrial Cybersecurity – second edition

The way I am positioning the first and second editions of Industrial Cybersecurity is with the first edition focusing on ICS cybersecurity fundamentals and ICS cybersecurity program design and implementation. The second edition should be a logical addition by taking these core concepts and expanding upon them with tools, techniques, and activities that are aimed at verifying, monitoring, checking, improving, and correcting the overall security posture of the ICS environment. Some topics we will be covering on this continued journey include the following:

• Architecture design with security in mind
• Active and passive security monitoring
• Industrial threat intelligence
• Visualizing, correlating, and alerting (Security Information and Event Management (SIEM))
• Incident response activities
• Security assessments (penetration testing, red/blue team exercises)
• Threat-hunting exercises

As mentioned earlier, this book will expand upon the topics of the first edition, so let's first recap on what we covered back in 2017.

Recap of the first edition

If you have not yet read the first edition of Industrial Cybersecurity, now would be the time to do so. It covers in detail how to get from zero to hero on implementing an industrial cybersecurity program, to define a secure ICS environment and network architecture that fits your organization's needs and requirements.

Reading the first edition is not a requirement though, as the first four chapters of this book will recap on relevant topics and get you on track to follow along and understand the material presented in this second edition.

Without further ado, let's start our journey with a recap of ICS (cybersecurity) principles and practices.

What is an ICS?

The traffic lights on your way to work if you go by car; the collision avoidance system if you take the train or metro; the delivery of electricity that powers the light you use to read this book; the processing and packaging that went into creating the jug of milk in your fridge or the coffee grind for that cup of Joe that fuels your day... What all these things have in common is the ICS driving the measurements, decisions, corrections, and other miscellaneous actions that result in the end products and services we take for granted each day.

Strictly speaking, an ICS is a collection of equipment, devices, and communication methods that, when combined for the foundational system, perform a specific task, deliver a service, or create a particular product. Figure 1.1 shows an ICS architecture, spanning the various layers of functionality as described in the Purdue model (explained in a later section).

ICS functions

The following screenshot shows a typical ICS architecture, following the Purdue model and stretched out across the industrial and enterprise networks of an organization. It will be used as an illustration for the following sections:

Figure 1.1 – Typical ICS architecture

Within the ICS architecture shown in the preceding screenshot, the following main types of devices within the three main sections of the architecture can typically be distinguished:

• The Enterprise Zone is predominantly IT space. Devices, systems, and equipment typically found here are computer-related, such as servers, workstations, and laptops, as well as mobile devices such as phones, tablets, handhelds, and others. These devices are connected together with various Ethernet equipment and media, including switches, wireless access points, routers, firewalls, and the cables that connect all of these devices (Category 6 (Cat6)/Cat6e media).
• The Industrial Demilitarized Zone (IDMZ) functions as a barrier between the Enterprise Zone and the Industrial Zone and is typically implemented as a collection of virtualization hardware, firewalls, and switches.
• In the Industrial Zone, we can find a variety of regular off-the-shelf IT equipment, along with proprietary and specialized hardware that is used to run the production process. In an upcoming section, ICS architecture, we will discuss some of the more common systems that can be found in the Industrial Zone.

The ultimate goal of an ICS is to create a product or run a process. This goal is achieved by implementing distinct functions within the ICS that, when combined, allow for control, visibility, and management of the production or process control. We will now look at typical functions found within an ICS.

The view function

The view function encompasses the ability to watch the current state of the automation system in real time. This data can be used by operators, supervisors, maintenance engineers, or other personnel to make business decisions or perform corrective actions. For example, when an operator sees that the temperature of boiler 1 is getting low, they might decide ...

Table of contents

• Industrial Cybersecurity Second Edition
• Contributors
• Preface
• Section 1: ICS Cybersecurity Fundamentals
• Chapter 1: Introduction and Recap of First Edition
• Chapter 2: A Modern Look at the Industrial Control System Architecture
• Chapter 3: The Industrial Demilitarized Zone
• Chapter 4: Designing the ICS Architecture with Security in Mind
• Section 2:Industrial Cybersecurity – Security Monitoring
• Chapter 5: Introduction to Security Monitoring
• Chapter 6: Passive Security Monitoring
• Chapter 7: Active Security Monitoring
• Chapter 8: Industrial Threat Intelligence
• Chapter 9: Visualizing, Correlating, and Alerting
• Section 3:Industrial Cybersecurity – Threat Hunting
• Chapter 10: Threat Hunting
• Chapter 11: Threat Hunt Scenario 1 – Malware Beaconing
• Chapter 12: Threat Hunt Scenario 2 – Finding Malware and Unwanted Applications
• Chapter 13: Threat Hunt Scenario 3 – Suspicious External Connections
• Section 4:Industrial Cybersecurity – Security Assessments and Intel
• Chapter 14: Different Types of Cybersecurity Assessments
• Chapter 15: Industrial Control System Risk Assessments
• Chapter 16: Red Team/Blue Team Exercises
• Chapter 17: Penetration Testing ICS Environments
• Section 5:Industrial Cybersecurity – Incident Response for the ICS Environment
• Chapter 18: Incident Response for the ICS Environment
• Chapter 19: Lab Setup
• Other Books You May Enjoy