IC37 IEC62443 Flashcards
Scope
Determine the parameters of what is included in the assessment how it is performed.
Scope include
- IDENTIFY Requirement
- Specify Devices
- Select Collection Method
- Document
Key Components of Scope
- System Description
- Asset Inventory
- Criticality Assessment.
- System Architecture Design.
- Document Data flow
- Network Diagram .
Cybersecurity Vulnerability Assessment
defines, identify, and classifies the security vulnerabilities in industrial control system and its related network infra
Cybersecurity Vulnerability Assessment is
-Critical step in evaluating cyber risk
- Evaluate the IACS design, implementation, configuration, operation and management.
- Determines the adequacy of security measures and identify security deficiencies
Benefits of Cybersecurity risk assessment
- determine what plants/processes need to address and what order.
- Definition of threats, vulnerabilities, and consequences so they can be mitigated. - this is very time consuming.
- Design and apply countermeasures to reduce risk.
- Prioritize mitigation activities and resources.
- Evaluate countermeasures of effectiveness versus cost and complexity.
Cyber Risk Assessment Process
- Identify System under consideration.
- Conduct high-level cyber risk assessment.
- Partition the SUC into zones and conduits.
- perform detailed cybersecurity risk assessment for each zone and conduit.
- Document security requirement assumption and constrains.
for each zone and conduit you will need to run
IEC 62443-3-3
Detailed risk assessment process, this is section 5 of the detailed risk assessment. just an FYI, this include:
- Identify Threats
- Identify Vulnerabilities
- Determine consequences and Impact.
- Determine Likelihood
- Calculate unmitigated Cyber risk
- Determine Security Level target.
- Consider Existing Countermeasures.
- Reevaluate likelihood and impact.
- Calculate residual risk
- All risk mitigated or below tolerable risk
- Document the results.
You need Documentation to prove what you did `
Documents in general should be
- Revised
- Amended
- Reviewed,
- Approved.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@22
Review for the Design Chapter
remember the 4 T of Managing risk
- Tolerate - risk organizations are willing to take.
- Transfer - insurance.
- Terminate - block the risk
- Treat. - reduce the lielihood
Five D’s of treating Risk.
- Deter
- Detect
- Delay
- Deny
- Defeat.
Remember firewalls
block unauthorized access of firewall. Network and Host firewalls.
IDS are either
NIDS or HID -
- pre-defined rules signatures
- Anomaly - behavior
Remote access
Huge Operational Benefits
High Risk.
with ease huge operation benefits and high risk….
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Monitoring and Management
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
identify component of asset inventory
identify system harden
Asset Inventory
Maintain a list of database of all IACS and SCADA hardware - physical and virtual.
Asset inventory done through
- Documentation and site survey. this could take long time if the company is around for a long time.
- tools also can be used.-
if you use automations tools ensure that
- they don’t impact system availability or integrity
- introduced security Vulnerability.
Hardware include all
servers, computers, workstations, smart phones., PLC, DCS, VFD, RTU, etc, serial routable devices.
you will need to have record of
- Asset ID
Device Type
Function
Network interfaces.
Network Addresses
Manufacture
Model
Serial Number
Operation system and version
Firmware Version,
Physical location
Notes.
Device system name
VM all details needs to be documents - do not forget about this.
- all software- application, databases, firmware, operation system, patch process.
anything with ethernet and serial communication. routable serial. modbus, serial, profibus
Asset inventory for Software is also important. this should include
operation systems.
applications.
database
firmware.
Asset inventory tools are are either:
NETWORK MANAGEMNET TOOLS
SOFTWARE ASSET MANAGEMENT SAM TOOLS
CONFIGURATION MANAGEMENT TOOLS
Network Management tools.
- SolarWinds, OPenNMS, Siemens SNM, MOXa
software asset management SAM tools
- IT Asset tool, Microsoft system center.
Configuration Management Tools.
- Rockwell Asset center
PAS integrity
MDT autosave
System Hardening
the process of security a system by reducing its attack surface. this include
- Remove unnecessary software —
-Remote user accounts. —
-Enforce strong access control - multifactor authentication is important - Disable or remove services. this is important
-Install security patches. patches are also important.
which device can be hardened
any configurable device can be hardened. such as operation ystem, database, applications. managed switches, routers, firewalls, modems., PLCm IED, VFD.
operation system hardening - where to go? OS HARDEINING Very IMPORTANT
- NIST SP 800-123
Microsoft Security Guides
CIS security Benchmarks.
Disa STIGS,
Automation suppliers
REMEMNER 800-123 IS OS HARDENING —
Basic Step to secure operation system. OS
- Patches and update the OS
- Remove or disable services, application and network protocols.
configure access controls.
configure OS user authentication.
install and configuration additional security control
test the security of the OS, ‘
list of unnecessary softwares:
- Remove games.
- unused devicers.
- messaging services.
unused internet
software compliers
unused protocols.
Device Hardening Guidance DEVICE HARDENING 800-82
NIST SP 800-82
Always look for vendors.
HARDENING DEVICES INCLUDE
PLCs
MOTOROS AND DRIVES
I?O
HMI
Sensors
IEDs
Flow Computers.
Hardening of devices are
-disable program changes.
-install vendor firmware update
-compare file hash
-shutdown unused network interface.
-default password
-enable logging
-disable unused protocols.
-restrict remote access.
- protectet with ICS
-disable services not used.
- restict remote access.
Network Hardening NSA CISCO NIST
SANS
SECURITY CONFIGURATION CHECKLISTS
three functional planes of a network
- Management - IOS - SSH SNMP
- Control - EIGRP, BGP, OSPF
- Data actual data/
Network Hardening best practices
install firmware updates.
compare hash files
shutdown unused physical interfaces.
enable configuration access control
change and encrypt password
use snmp3
restict remote management
use secure protocols.
shutdown unused ervices.
enable logging.
ACCESS CONTROL
Policies, Procedures and technical controls that govern the use of system resources.
Access control ensure system only accessible to authorized users, programs, process and other systems.
ACCESS CONTROL ENFORCE the following:
separation of duties
least privilege
system notification.
previous login
concurrent session
session locking
unsuccessful login attempts
least privilege.
session termination
Access control involve
establishing.
activating
modifying
reviewing
disabling
removing accounts.
Access control best practices
- Develop access control policy to establish appropriate logical and physical rules
- segregate data with high sensitivity.
employ multiple authentication - make use of centralized identify
- use organization units.
use always multifactor authentications
something you know
something you have
something you are.
remote access
technology made it so easy.
VPN appliance is a network device enhanced with security features known as secure socket layer SSL.
A network using public telecommunication infrastructure such as internet and provide remote networks or computes with secure access to another network.
VPN security employs
- IPSec Internet protocol security
SSL\TLS transport layer security
DTLS datagram transport layer
MPPE microsoft point to point encyption
SSTP secure socket tunneling protocol
MPVPN
SSH
