We are going to take the assessment approach, explained in the previous section and explore some details by applying it step by step to a fictive system under consideration. Let's imagine that the Slumbertown Mill from the previous chapter decided to hire a security consultant to help them assess and address risk to their ICS network. After outlining contractual details such as scope, timelines and deliverables, a security consultant will typically plan a site visit to start gathering information needed to complete the assessment.
- Preface
- Industrial Control Systems
- Insecure by Inheritance
- Anatomy of an ICS Attack Scenario
- Industrial Control System Risk Assessment
- The Purdue Model and a Converged Plantwide Ethernet
- The Defense-in-depth Model
- Physical ICS Security
- ICS Network Security
- Designing network architectures for security
- Network segmentation
- Resiliency and redundancy
- Architectural overview
- Firewalls
- Security monitoring and logging
- Network packet capturing
- Event logging
- Security information and event management
- Summary
- Designing network architectures for security
- ICS Computer Security
- ICS Application Security
- ICS Device Security
- The ICS Cybersecurity Program Development Process
- The NIST Guide to Industrial control systems security
- The ICS security program development process
- Security policies, standards, guidelines, and procedures
- Defining ICS-specific security policies, standards, and procedures
- Defining and inventorying the ICS assets
- Performing an initial risk assessment on discovered ICS assets
- Defining and prioritizing mitigation activities
- Defining and kicking off the security improvement cycle
- Summary
A risk assessment example
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.