Index
A
AC
Accounts, default
306Active Directory server
120Adobe Postscript Document Format (PDF) exploits
46Advanced persistent diligence
50Advanced persistent threats (APT)
37, 43–44, 115, 311–312cyber war and
41–52defending against
50defined
41–42information targets of
42tmethods used
44progression of
49–50responding to
50–51trends in
45–49Agent.btz worm
37Alerts
241American National Standards Institute (ANSI)
ISO/IEC 27002:2005 by
252AMI Headend
Anomaly detection
178–179, 194–199see alsoBehavioral anomaly detection
analysis tool selection for
199defined
189effectiveness of
189tools
198–199Anti-virus
39Anti-Virus systems
184Application/protocol monitoring
179–181Application whitelisting (AWL)
184–185see alsoBehavioral whitelisting
vs. application behavior whitelists
203Attack vectors
2–3Audit, security practices and
309–310Audit and accountability (AU)
16auditd
220Aurora Project
36–37Authentication, monitoring
223–225Automated security systems, improper implementation of
311–312Automatic Generation Control (AGC)
35Awareness, vs. real security
304B
Backtrack
33Bare metal reload
51Behavioral anomaly detection
192–199anomaly detection
baselines measurement
192–194IT vs. OT metrics, analyzing
198methods
192suspicious anomalies (examples)
196–197ttools for
198–199Behavioral whitelisting
199–200, 204tsee alsoApplication whitelisting (AWL)
application behavior whitelists
202–205asset whitelists
200–202overview
189–190Smart-Lists
203–205user whitelists
199–200Behavior analysis
228Bilateral table
62–63Billing Systems
107–108Book audience
1–2Book organization
3–5Book overview
1Botnet operators
122Broadband over Powerline (BPL)
83–84Business area networks (BAN)
83–84Business information consoles
96Business information management
104–105Business network
311C
Canary Labs
94–95CC
CENTCOM breach
37Certified Information Systems Security Professional (CISSP) certification
1–2Chemical facilities
10–11Chemical Facility Anti-Terrorism Standards (CFATS)
11, 16–17, 250, 251–252, 257–267t, 269–278t, 280–292t, 294–298tRisk-based Performance Standards ( RBPSs)
16–17CIP
Closed loop
101Common criteria (CC), for information technology security evaluation
293–300Common Industrial Protocol (CIP)
78Compensating controls
254Complacency
303–305air gap myth
304–305real security vs. policy and awareness
304vulnerability assessments vs. zero-days
303–304Compliance officer
2Compliance requirements, mapping of
Configuration, monitoring
220–221Control Network Power Line (PL) Channel Specification
83–84Control system assets
89–97business information consoles
96dashboards
96Data Historians
94–95human machine interfaces (HMIs)
93–94intelligent electronic device (IED)
89–90printers and print servers
96programmable logic controller (PLC)
90–93remote terminal unit (RTU)
90supervisory workstations
94Control system operations
100–106business information management
104–105control processes
102–103feedback loops
103–104overview
100Covert botnet, command, and control rule
208tCritical Cyber Asset Identification
13Critical digital assets
14Critical infrastructure
8–11chemical facilities
10–11critical versus noncritical industrial networks
11electricity generation/distribution, bulk
9–10industrial networks and
7–12nuclear facilities
9utilities
9Critical Infrastructure Protection Act of 2001
11Critical systems, identification of
18–19Customer information systems
107–108D
Database activity monitors (DAM)
230Data enrichment
208–209Data Historians, in security monitoring
236Default accounts/passwords, use of
306Demand response systems
107–108Demilitarized zone (DMZ)
12–13Department of Energy (DoE)
250Device removal and quarantine
144Dial-up connections
perimeters identification and
161Digital Bond
61Direct monitoring
230Distributed Network Protocol (DNP3)
56, 66–73functions of
66–67SCADA-IDS/IPS
73security concerns
71–72security recommendations
72–73vs. Modbus
70Distribution management systems
107–108DMZ
DNS information
114DoS
Dynamic Host Configuration Protocol (DHCP)
208–209E
Electricity generation/distribution, bulk
9–10Enclaves
26–27, 27f, 147defined
147establishing
161–166functional groups identification
identification using functional groups
159–160monitoring
network alterations
164perimeters security
166–181devices implementation
169–172devices selection
166–167IDS/IPS configuration guidelines
172–181recommended IDS/IPS rules
177–178securing interiors
and security device configurations
164–166and security policy development
164Enterprise network hacking methods
116Ethernet
98Evaluation assurance level (EAL)
299–300Event correlation, for threat detection
206–211data enrichment
208–209defined
205–206process of
207frules of
208tExecutive override
307F
False positive
217–218Federal Energy Regulatory Commission (FERC)
250Feedback loops
103–104File integrity monitoring (FIM) products
220File system logs
220G
Government Accountability Office (GAO)
122H
Hacking techniques
111–112HANs
HIDS systems
Historized data
105Home Area Networks (HANs)
83–84Host firewalls
183–184Host IDS (HIDS) systems
184HTTP Command and Control rule
208tI
ICCP connections
Idaho National Laboratories (INL)
36–37Identification and authentication (IA)
16Identity access management (IAM) systems
225IDS devices
IDS/IPS
121IDS/IPS actions
174–175tIDS/IPS policy
172–181Incident investigation
241Incident Reporting and Response Planning
13Incident response
241Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)
37–38Industrial networks
7–12, 25critical infrastructure and
7–12critical versus noncritical
11incidents
34–36, 34fAdobe Postscript Document Format (PDF) exploits
46examples
36–41impact of
34–36safety controls
34–35social networking
47–48protocols
EtherCAT
seeEtherCAT
Ethernet/IP
seeEthernet/IP
Ethernet Powerlink
Modbus
overview of
55–56Profibus
seeProfibus
SERCOS III
security
importance of
31–33Industrial networks, accessing
123–124business network
124–126common vulnerabilities
127application backdoors
130asset controls
130diagnostic access/dial-up access/field access
131–132poorly configured firewalls
127–128remote access, VPNs and mobile apps
131unnecessary ports and services
128–130Wi-Fi access
131Control System
127smart grid
132Industrial networks, targeting
116–117disruption and penetration of industrial networks
121–122enumerating industrial networks
120industrial reconnaissance
117threat agents
122–123Industrial network security, mapping
254–293Industrial Protocol Filters
166Industrial security appliances
218Inferred monitoring
230–232Information collection
233–236Information technology (IT) systems
Inter Control Center Communication Protocol (ICCP) connections
functional group based on, for trading communication
153–154Inter Control Center Protocol/Telecontrol Application Service Element-2 (ICCP/TASE.2)
56, 61–66functions of
62malicious behaviors, detection of
65SCADA-IDS/IPS
65–66security concerns
63–64security recommendations
65–66vs. Modbus
64–65Interior security systems, enclaves
183–185Anti-Virus systems
184AWL solution
184–185external controls
185HIDS systems
184host firewalls
183–184International Society of Automation (ISA)
ISA standard 99 (ISA-99)
17–18Internet Control Message Protocol (ICMP)
114Intrusion detection system (IDS) devices
configuration guidelines
172–181Intrusion prevention, defined
172Intrusion prevention system (IPS) devices
configuration guidelines
172–181IPS devices
ISA-99
ISA standard 99 (ISA-99)
17–18IT systems
K
Kismet
230L
LAN
Local Area Network (LAN)
12–13Log collection
229–230Logical network boundaries
149Log management
for anomaly detection
198–199Logs
219Log search
233“Luigi Vulnerabilities”
49–50M
Maltego
113Mapping, compliance requirements
Master node address
120Master/slave relationships
116–117Master station
64Media protection (MP)
16Meter Data Management Systems
107–108Microsoft Active Directory
200Misconfigurations
305–308default accounts/passwords, use of
306executive override
307outbound security and monitoring, lack of
306–307Ronco perimeter
307–308Modbus
Modbus Organization
56Modicon
56Modicon Communication Bus (Modbus)
56–61, 98, 117functions of
56–57SCADA-IDS/IPS
61security concerns
59–60security recommendations
60–61vs. DNP3
70vs. ICCP
64–65Modiüs
94–95N
National Infrastructure Security Coordination Center (NISCC)
firewall configuration guidelines with enclave variables
170–171tNBAD tool
nCircle
220NERC
Network alterations
enclaves
164Network anomaly detection
178Network attached storage (NAS) devices
152Network connectivity
functional groups based on
149Network mask
114Network Probes
230Network whitelisting
40–41Night Dragon
41NIST 800-82
120Nmap scanner
114Noncritical assets
19Nonrepudiation
242North American Electric Reliability Corporation (NERC)
10, 250, 257–267t, 269–278t, 280–292t, 294–298tCIP of
250–251Novell
225Nuclear facilities
9O
Object Linking and Embedding for Process Control (OPC)
56, 73–78functions of
73–74OPC Express Interface (XI)
75OPC-UA
75SCADA-IDS/IPS
78security concerns
75–77security recommendations
77–78Object Linking and Embedding (OLE) protocol
for process control
73–78OPC Express Interface (OPC-XI)
75OPC-UA
75OPC-XI
Open loop
101Open Source Intelligence (OSINT)
44Operational technology (OT)
216–217Operational technology (OT) systems
Operation Aurora
37Oracle Identity Management
225OSINT
OSIsoft
94–95OT systems
Outbound security and monitoring, lack of
306–307Outbound Spambot behavior rule
208tP
Passive logging
230Patch management system
141–143Penetration test
Persistence
115Personnel & Training
13Physical air gap
15Physical network boundaries
149Physical Security of Critical Cyber Assets
13Ping sweep
114Pitfalls and mistakes
complacency
seeComplacency
compliance vs. security
308–310misconfigurations
scope and scale
310–312Plant operator
1–2Policy, and real security
304Process control systems (PCS)
7Profibus communications
119–120Programmable logic controllers (PLC)
37–38, 39, 56, 90–93, 117, 216–217operational flow diagram
93f“Step Logic”
93Protection profile (PP)
299Protocol data units (PDU)
57R
RA
Real security, vs. policy and awareness
304Recovery Plans for Critical Cyber Assets
13Relational Database Management System (RDBMS)
95Remote access servers (RAS)
154Remote Procedure Call (RPC)
73Retention, data
242–243Risk assessment (RA)
16rpcinfo
114“Rule-less” detection systems
178–179S
Sabotage reporting
13Safety controls
34–35Sandia National Laboratories
35SCADA buffer overflow attack
176SCADA DMZ systems
SCADA IDS/IPS devices
178SCADA Intrusion Detection System/SCADA Intrusion Prevention System (SCADA-IDS/IPS)
DNP3
73ICCP
65–66Modbus
61OPC
78Scalability
role in smart grid development
100Scope and scale, of network
310–312Secure sockets layer (SSL)
37Securing the Smart Grid: Next Generation Power Grid Security
2–3Security, real
vs.policy and awareness
304Security Device Event Exchange protocol (SDEE), of Cisco
230Security events
217–218Security functional requirements (SFR)
299Security Information and Event Management (SIEM) system
179, 185, 233–236, 235falerts
241for anomaly detection
198–199reports
240fSecurity management controls
13Security policy development
enclaves and
164Security targets (ST)
299Sentient Hyper-Optimized Data Access Network (SHODAN)
117SERCOS III
SERCOS III Master Data Telegram
119SERCOS (Serial Real-time Communications System) networks
119Serial Real-time Communications System (SERCOS III)
82–83security concerns
82–83security recommendations
83Set points
39Severity level (SL)
15SIEM system
Single-source correlation
cross-source vs.
211tSL
Smart grid
2–3, 83–85, 84f, 98–99disadvantages
108operations
107–108scalability and
100security concerns
84–85security recommendations
85Smart Meter
100Smart Phones, wireless networking in
311Snort
230Social Engineer Toolkit (SET)
113SP 800-82
13“Spamming”
65Standards and regulations
CFATS
251–252ISO/IEC 27002:2005
252–253NERC CIP
250–251NIST SP 800-82
253NRC Regulation 5.71
253“Step Logic”
93Storage area networks (SAN)
152Strong passwords, use of
306Structured query language (SQL)
237–238Supervisory workstations
94System and communication protection (SC)
16System and information integrity (SI)
16System logs
219System requirements (SRs)
17–18Systems security management
13T
“Tags,” defined
95TCP errors
TCP/IP networks
98Technical controls, ISO/IEC 27002:2005 and
252–253Time-series databases
for anomaly detection
198Title 10 Code of Federal Regulations (CFR), section 73.54 (10 CFR 73.54)
13–14Tivoli Identity Manager
225Transport layer security (TLS)
72U
Unified threat management (UTM) devices
166User Datagram Protocol (UDP) ports
114Utilities
9UTM devices
V
Variables
defined
165Virtual local area networks (VLAN)
149Virtual private networks (VPN)
154Vital Infrastructure, Networks, Information and Control Systems Management (VIKING)
35Vulnerabilities, determining
132–133assessment in industrial networks
137–138Cyber Security Evaluation Tool (CSET)
140scanning for configuration assurance
138–139VA scans
139–140Vulnerability
33Vulnerability management
140–141..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.