Cover image for Industrial Cybersecurity - Second Edition

Industrial Cybersecurity - Second Edition

Author Pascal Ackerman
Release Date: 2021/10/01
ISBN: 9781800202092
Topic:
0%
29
Chapters
0-1
Hours read
0k
Total Words
    Start Reading Now    
       Add to Wishlist       
View table of contents

Get up and running with industrial cybersecurity monitoring with this hands-on book, and explore ICS cybersecurity monitoring tasks, activities, tools, and best practices

Key Features

  • Architect, design, and build ICS networks with security in mind
  • Perform a variety of security assessments, checks, and verifications
  • Ensure that your security processes are effective, complete, and relevant

Book Description

With Industrial Control Systems (ICS) expanding into traditional IT space and even into the cloud, the attack surface of ICS environments has increased significantly, making it crucial to recognize your ICS vulnerabilities and implement advanced techniques for monitoring and defending against rapidly evolving cyber threats to critical infrastructure. This second edition covers the updated Industrial Demilitarized Zone (IDMZ) architecture and shows you how to implement, verify, and monitor a holistic security program for your ICS environment.

You'll begin by learning how to design security-oriented architecture that allows you to implement the tools, techniques, and activities covered in this book effectively and easily. You'll get to grips with the monitoring, tracking, and trending (visualizing) and procedures of ICS cybersecurity risks as well as understand the overall security program and posture/hygiene of the ICS environment. The book then introduces you to threat hunting principles, tools, and techniques to help you identify malicious activity successfully. Finally, you'll work with incident response and incident recovery tools and techniques in an ICS environment.

By the end of this book, you'll have gained a solid understanding of industrial cybersecurity monitoring, assessments, incident response activities, as well as threat hunting.

What you will learn

  • Monitor the ICS security posture actively as well as passively
  • Respond to incidents in a controlled and standard way
  • Understand what incident response activities are required in your ICS environment
  • Perform threat-hunting exercises using the Elasticsearch, Logstash, and Kibana (ELK) stack
  • Assess the overall effectiveness of your ICS cybersecurity program
  • Discover tools, techniques, methodologies, and activities to perform risk assessments for your ICS environment

Who this book is for

If you are an ICS security professional or anyone curious about ICS cybersecurity for extending, improving, monitoring, and validating your ICS cybersecurity posture, then this book is for you. IT/OT professionals interested in entering the ICS cybersecurity monitoring domain or searching for additional learning material for different industry-leading cybersecurity certifications will also find this book useful.

Table of Contents

  1. Industrial Cybersecurity Second Edition
  2. Contributors
  3. About the author
  4. About the reviewers
  5. Preface
    1. Who this book is for
    2. What this book covers
    3. To get the most out of this book
    4. Download the color images
    5. Conventions used
    6. Get in touch
    7. Share Your Thoughts
  6. Section 1: ICS Cybersecurity Fundamentals
  7. Chapter 1: Introduction and Recap of First Edition
    1. Industrial Cybersecurity – second edition
    2. Recap of the first edition
    3. What is an ICS?
    4. ICS functions
    5. ICS architecture
    6. The Purdue model for ICSes
    7. IT and OT convergence and the associated benefits and risks
    8. Example attack on the Slumbertown papermill
    9. The comprehensive risk management process
    10. The DiD model
    11. ICS security program development
    12. Takeaway from the first edition
    13. Summary
  8. Chapter 2: A Modern Look at the Industrial Control System Architecture
    1. Why proper architecture matters
    2. Industrial control system architecture overview
    3. The Enterprise Zone
    4. The Industrial Demilitarized Zone
    5. The Industrial Zone
    6. The hardware that's used to build the ICS environment
    7. ICS environment and architecture management
    8. Summary
  9. Chapter 3: The Industrial Demilitarized Zone
    1. The IDMZ
    2. Fundamental concept
    3. IDMZ design process
    4. Design changes due to an expanding ICS environment
    5. What makes up an IDMZ design?
    6. The Enterprise Zone
    7. IDMZ firewalls
    8. IDMZ switches
    9. IDMZ broker services
    10. The Industrial Zone – Level 3 Site Operations
    11. Example IDMZ broker-service solutions
    12. Summary
  10. Chapter 4: Designing the ICS Architecture with Security in Mind
    1. Typical industrial network architecture designs
    2. Evolution from standalone islands of automation
    3. Designing for security
    4. Network architecture with security in mind
    5. Security monitoring
    6. Network choke points
    7. Logging and alerting
    8. Summary
  11. Section 2:Industrial Cybersecurity – Security Monitoring
  12. Chapter 5: Introduction to Security Monitoring
    1. Security incidents
    2. Passive security monitoring
    3. Active security monitoring
    4. Threat-hunting exercises
    5. Security monitoring data collection methods
    6. Network packet capturing
    7. Event logs
    8. Putting it all together – introducing SIEM systems
    9. Summary
  13. Chapter 6: Passive Security Monitoring
    1. Technical requirements
    2. Passive security monitoring explained
    3. Network packet sniffing
    4. Collection and correlation of event logs
    5. Host-based agents
    6. Security Information and Event Management – SIEM
    7. What is a SIEM solution?
    8. How does a SIEM solution work?
    9. Common passive security monitoring tools
    10. NSM
    11. IDS
    12. Event log collection and correlation
    13. Setting up and configuring Security Onion
    14. Exercise 1 – Setting up and configuring Security Onion
    15. Deploying the Security Onion VM
    16. Configuring Security Onion
    17. Deploying Wazuh agents
    18. Exercise 2 – Setting up and a configuring a pfSense firewall
    19. Deploying a pfSense VM
    20. Configuring pfSense
    21. Exercise 3 – Setting up, configuring, and using Forescout's eyeInsight (formerly known as SilentDefense)
    22. Deploying the SilentDefense sensor and Command Center VMs
    23. Configuration of the SilentDefense setup
    24. Example usages of the SilentDefense setup
    25. Summary
  14. Chapter 7: Active Security Monitoring
    1. Technical requirements
    2. Understanding active security monitoring
    3. Network scanning
    4. Endpoint inspection with host-based agents
    5. Manual endpoint inspection/verification
    6. Exercise 1 – Scanning network-connected devices
    7. Dangers of scanning in the ICS environment
    8. Nmap
    9. Assets scan
    10. Interrogating Windows machines
    11. Exploring Modbus
    12. Getting EtherNet/IP information
    13. Scanning Siemens S7 (iso-tsap)
    14. Manual vulnerability verification
    15. Scanning for vulnerabilities
    16. Exercise 2 – Manually inspecting an industrial computer
    17. Pulling Windows-based host information
    18. Configured users
    19. Summary
  15. Chapter 8: Industrial Threat Intelligence
    1. Technical requirements
    2. Threat intelligence explained
    3. Using threat information in industrial environments
    4. Acquiring threat information
    5. Your own incidents and threat hunting efforts
    6. Vendor reports
    7. Your own honeypots
    8. Peers and sharing communities
    9. External/third-party free and paid-for feeds
    10. Creating threat intelligence data out of threat information
    11. Exercise – Adding an AlienVault OTX threat feed to Security Onion
    12. Summary
  16. Chapter 9: Visualizing, Correlating, and Alerting
    1. Technical requirements
    2. Holistic cybersecurity monitoring
    3. Network traffic monitoring
    4. Network intrusion monitoring
    5. Host-based security monitoring
    6. Exercise 1 – Using Wazuh to add Sysmon logging
    7. Exercise 2 – Using Wazuh to add PowerShell Script Block Logging
    8. Exercise 3 – Adding a Snort IDS to pfSense
    9. Exercise 4 – Sending SilentDefense alerts to Security Onion syslog
    10. Exercise 5 – Creating a pfSense firewall event dashboard in Kibana
    11. Exercise 6 – Creating a breach detection dashboard in Kibana
    12. NIDS alerts
    13. Zeek notices
    14. Zeek Intel logs
    15. Suspicious process and file creation
    16. Suspicious PowerShell commands
    17. Suspicious egress connections
    18. Suspicious ingress connections
    19. Failed user login attempts
    20. New user creation and changes to user accounts
    21. Downloaded files
    22. SilentDefense alerts
    23. Finishing up the dashboard
    24. Summary
  17. Section 3:Industrial Cybersecurity – Threat Hunting
  18. Chapter 10: Threat Hunting
    1. What is threat hunting?
    2. Threat hunting in ICS environments
    3. What is needed to perform threat hunting exercises?
    4. Network traffic logs
    5. Endpoint OS and application event logs
    6. Making modifications to PLC, HMI, and other control systems and equipment
    7. Tracking new and changed devices on the (industrial) network
    8. Network services event logs
    9. SIEM
    10. Network packet captures
    11. Research, lookups, and comparison resources
    12. Threat hunting is about uncovering threats
    13. Correlating events and alerts for threat hunting purposes
    14. Summary
  19. Chapter 11: Threat Hunt Scenario 1 – Malware Beaconing
    1. Forming the malware beaconing threat hunting hypothesis
    2. Detection of beaconing behavior in the ICS environment
    3. Malware beaconing explained
    4. Data exfiltration
    5. Legitimate application beaconing
    6. Using Security Onion to detect beaconing behavior
    7. Using RITA to detect beaconing behavior
    8. Investigating/forensics of suspicious endpoints
    9. Finding the suspicious computer
    10. Find the beaconing process – netstat
    11. Upload executable to VirusTotal
    12. Rudimentary inspection of the suspicious executable – malware analysis 101
    13. Using indicators of compromise to uncover additional suspect systems
    14. Discovered IOCs so far
    15. Searching for network-specific indicators of compromise
    16. Searching for host-based indicators of compromise
    17. Summary
  20. Chapter 12: Threat Hunt Scenario 2 – Finding Malware and Unwanted Applications
    1. Technical requirements
    2. Forming the malicious or unwanted applications threat hunting hypothesis
    3. Detection of malicious or unwanted applications in the ICS environment
    4. Comparing system snapshots to find artifacts
    5. Looking for application errors to find artifacts
    6. Looking for malicious network traffic to find artifacts
    7. Comparing port scans to find artifacts
    8. Inventorying currently running processes in the ICS environment
    9. Inventorying startup processes in the ICS environment
    10. Investigation and forensics of suspicious endpoints
    11. Securely extracting the suspicious executables
    12. Using discovered indicators of compromise to search the environment for additional suspect systems
    13. Using YARA to find malicious executables
    14. Using file strings as an indicator of compromise
    15. Summary
  21. Chapter 13: Threat Hunt Scenario 3 – Suspicious External Connections
    1. Forming the suspicious external connections threat hunting hypothesis
    2. Ingress network connections
    3. Mayhem from the internet
    4. Attacks originating from the enterprise network
    5. Summary
  22. Section 4:Industrial Cybersecurity – Security Assessments and Intel
  23. Chapter 14: Different Types of Cybersecurity Assessments
    1. Understanding the types of cybersecurity assessments
    2. Risk assessments
    3. Asset identification
    4. System characterization
    5. Vulnerability identification
    6. Threat modeling
    7. Risk calculation
    8. Mitigation prioritization and planning
    9. Red team exercises
    10. How do red team exercises differ from penetration tests?
    11. Blue team exercises
    12. Penetration testing
    13. How do ICS/OT security assessments differ from IT?
    14. Summary
  24. Chapter 15: Industrial Control System Risk Assessments
  25. Chapter 16: Red Team/Blue Team Exercises
    1. Red Team versus Blue Team versus pentesting
    2. Penetration-testing objective – get to the objective at any cost
    3. Red Team exercise objective – emulate real-world adversary TTPs
    4. Blue Team objective – detect and respond to security incidents as quickly as possible
    5. Red Team/Blue Team example exercise, attacking Company Z
    6. Red Team strategy
    7. Blue Team preparation
    8. The attack
    9. Summary
  26. Chapter 17: Penetration Testing ICS Environments
    1. Practical view of penetration testing
    2. Why ICS environments are easy targets for attackers
    3. Typical risks to an ICS environment
    4. Modeling pentests around the ICS Kill Chain
    5. The Cyber Kill Chain explained
    6. The Intrusion Kill Chain
    7. The ICS Cyber Kill Chain
    8. Pentest methodology based on the ICS Kill Chain
    9. Pentesting results allow us to prioritize cybersecurity efforts
    10. Pentesting industrial environments requires caution
    11. Creating an approximation of the industrial environment
    12. Exercise – performing an ICS-centric penetration test
    13. Preparation work
    14. Setting up the test environment
    15. Pentest engagement step 1 – attacking the enterprise environment
    16. Pentest engagement step 2 – pivoting into the industrial environment
    17. Pentest engagement step 3 – attacking the industrial environment
    18. Testing Level 3 Site Operations
    19. Testing the lower layers
    20. Pentest engagement step 4 – reaching the objective of the attack
    21. Summary
  27. Section 5:Industrial Cybersecurity – Incident Response for the ICS Environment
  28. Chapter 18: Incident Response for the ICS Environment
    1. What is an incident?
    2. What is incident response?
    3. Incident response processes
    4. Incident response preparation process
    5. Incident handling process
    6. Incident response procedures
    7. Incident response preparation process
    8. Incident handling process
    9. Example incident report form
    10. Summary
  29. Chapter 19: Lab Setup
    1. Discussing the lab architecture
    2. The lab hardware
    3. The lab software
    4. Details about the enterprise environment lab setup
    5. ENT-DC
    6. ENT-SQL and ENT-IIS
    7. ENT-Clients
    8. Active Directory/Windows domain setup
    9. Details about the industrial environment – lab setup
    10. Servers
    11. Workstations
    12. HMIs
    13. PLCs and automation equipment
    14. Active Directory/Windows domain setup
    15. How to simulate (Chinese) attackers
    16. Discussing the role of lab firewalls
    17. How to install the malware for the lab environment
    18. Configuring packet capturing for passive security tools
    19. Summary
    20. Why subscribe?
  30. Other Books You May Enjoy
    1. Packt is searching for authors like you
    2. Share Your Thoughts
3.16.70.101