Industrial Cybersecurity - Second Edition

Industrial Cybersecurity - Second Edition

by Pascal Ackerman
Released October 2021
Publisher(s): Packt Publishing
ISBN: 9781800202092

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

A second edition filled with new and improved content, taking your ICS cybersecurity journey to the next level

Key Features

  • Architect, design, and build ICS networks with security in mind
  • Perform a variety of security assessments, checks, and verifications
  • Ensure that your security processes are effective, complete, and relevant

Book Description

With Industrial Control Systems (ICS) expanding into traditional IT space and even into the cloud, the attack surface of ICS environments has increased significantly, making it crucial to recognize your ICS vulnerabilities and implement advanced techniques for monitoring and defending against rapidly evolving cyber threats to critical infrastructure. This second edition covers the updated Industrial Demilitarized Zone (IDMZ) architecture and shows you how to implement, verify, and monitor a holistic security program for your ICS environment.

You'll begin by learning how to design security-oriented architecture that allows you to implement the tools, techniques, and activities covered in this book effectively and easily. You'll get to grips with the monitoring, tracking, and trending (visualizing) and procedures of ICS cybersecurity risks as well as understand the overall security program and posture/hygiene of the ICS environment. The book then introduces you to threat hunting principles, tools, and techniques to help you identify malicious activity successfully. Finally, you'll work with incident response and incident recovery tools and techniques in an ICS environment.

By the end of this book, you'll have gained a solid understanding of industrial cybersecurity monitoring, assessments, incident response activities, as well as threat hunting.

What you will learn

  • Monitor the ICS security posture actively as well as passively
  • Respond to incidents in a controlled and standard way
  • Understand what incident response activities are required in your ICS environment
  • Perform threat-hunting exercises using the Elasticsearch, Logstash, and Kibana (ELK) stack
  • Assess the overall effectiveness of your ICS cybersecurity program
  • Discover tools, techniques, methodologies, and activities to perform risk assessments for your ICS environment

Who this book is for

If you are an ICS security professional or anyone curious about ICS cybersecurity for extending, improving, monitoring, and validating your ICS cybersecurity posture, then this book is for you. IT/OT professionals interested in entering the ICS cybersecurity monitoring domain or searching for additional learning material for different industry-leading cybersecurity certifications will also find this book useful.

Table of contents

  1. Industrial Cybersecurity Second Edition
  2. Contributors
  3. About the author
  4. About the reviewers
  5. Preface
    1. Who this book is for
    2. What this book covers
    3. To get the most out of this book
    4. Download the color images
    5. Conventions used
    6. Get in touch
    7. Share Your Thoughts
  6. Section 1: ICS Cybersecurity Fundamentals
  7. Chapter 1: Introduction and Recap of First Edition
    1. Industrial Cybersecurity – second edition
    2. Recap of the first edition
    3. What is an ICS?
      1. ICS functions
      2. ICS architecture
      3. The Purdue model for ICSes
      4. IT and OT convergence and the associated benefits and risks
      5. Example attack on the Slumbertown papermill
      6. The comprehensive risk management process
      7. The DiD model
      8. ICS security program development
      9. Takeaway from the first edition
    4. Summary
  8. Chapter 2: A Modern Look at the Industrial Control System Architecture
    1. Why proper architecture matters
    2. Industrial control system architecture overview
      1. The Enterprise Zone
      2. The Industrial Demilitarized Zone
      3. The Industrial Zone
      4. The hardware that's used to build the ICS environment
      5. ICS environment and architecture management
    3. Summary
  9. Chapter 3: The Industrial Demilitarized Zone
    1. The IDMZ
      1. Fundamental concept
      2. IDMZ design process
      3. Design changes due to an expanding ICS environment
    2. What makes up an IDMZ design?
      1. The Enterprise Zone
      2. IDMZ firewalls
      3. IDMZ switches
      4. IDMZ broker services
      5. The Industrial Zone – Level 3 Site Operations
    3. Example IDMZ broker-service solutions
    4. Summary
  10. Chapter 4: Designing the ICS Architecture with Security in Mind
    1. Typical industrial network architecture designs
      1. Evolution from standalone islands of automation
    2. Designing for security
      1. Network architecture with security in mind
    3. Security monitoring
      1. Network choke points
      2. Logging and alerting
    4. Summary
  11. Section 2:Industrial Cybersecurity – Security Monitoring
  12. Chapter 5: Introduction to Security Monitoring
    1. Security incidents
    2. Passive security monitoring
    3. Active security monitoring
    4. Threat-hunting exercises
    5. Security monitoring data collection methods
      1. Network packet capturing
      2. Event logs
    6. Putting it all together – introducing SIEM systems
    7. Summary
  13. Chapter 6: Passive Security Monitoring
    1. Technical requirements
    2. Passive security monitoring explained
      1. Network packet sniffing
      2. Collection and correlation of event logs
      3. Host-based agents
    3. Security Information and Event Management – SIEM
      1. What is a SIEM solution?
      2. How does a SIEM solution work?
    4. Common passive security monitoring tools
      1. NSM
      2. IDS
      3. Event log collection and correlation
    5. Setting up and configuring Security Onion
    6. Exercise 1 – Setting up and configuring Security Onion
      1. Deploying the Security Onion VM
      2. Configuring Security Onion
      3. Deploying Wazuh agents
    7. Exercise 2 – Setting up and a configuring a pfSense firewall
      1. Deploying a pfSense VM
      2. Configuring pfSense
    8. Exercise 3 – Setting up, configuring, and using Forescout's eyeInsight (formerly known as SilentDefense)
      1. Deploying the SilentDefense sensor and Command Center VMs
      2. Configuration of the SilentDefense setup
      3. Example usages of the SilentDefense setup
    9. Summary
  14. Chapter 7: Active Security Monitoring
    1. Technical requirements
    2. Understanding active security monitoring
      1. Network scanning
      2. Endpoint inspection with host-based agents
      3. Manual endpoint inspection/verification
    3. Exercise 1 – Scanning network-connected devices
      1. Dangers of scanning in the ICS environment
      2. Nmap
      3. Assets scan
      4. Interrogating Windows machines
      5. Exploring Modbus
      6. Getting EtherNet/IP information
      7. Scanning Siemens S7 (iso-tsap)
      8. Manual vulnerability verification
      9. Scanning for vulnerabilities
    4. Exercise 2 – Manually inspecting an industrial computer
      1. Pulling Windows-based host information
      2. Configured users
    5. Summary
  15. Chapter 8: Industrial Threat Intelligence
    1. Technical requirements
    2. Threat intelligence explained
    3. Using threat information in industrial environments
    4. Acquiring threat information
      1. Your own incidents and threat hunting efforts
      2. Vendor reports
      3. Your own honeypots
      4. Peers and sharing communities
      5. External/third-party free and paid-for feeds
    5. Creating threat intelligence data out of threat information
    6. Exercise – Adding an AlienVault OTX threat feed to Security Onion
    7. Summary
  16. Chapter 9: Visualizing, Correlating, and Alerting
    1. Technical requirements
    2. Holistic cybersecurity monitoring
      1. Network traffic monitoring
      2. Network intrusion monitoring
      3. Host-based security monitoring
    3. Exercise 1 – Using Wazuh to add Sysmon logging
    4. Exercise 2 – Using Wazuh to add PowerShell Script Block Logging
    5. Exercise 3 – Adding a Snort IDS to pfSense
    6. Exercise 4 – Sending SilentDefense alerts to Security Onion syslog
    7. Exercise 5 – Creating a pfSense firewall event dashboard in Kibana
    8. Exercise 6 – Creating a breach detection dashboard in Kibana
      1. NIDS alerts
      2. Zeek notices
      3. Zeek Intel logs
      4. Suspicious process and file creation
      5. Suspicious PowerShell commands
      6. Suspicious egress connections
      7. Suspicious ingress connections
      8. Failed user login attempts
      9. New user creation and changes to user accounts
      10. Downloaded files
      11. SilentDefense alerts
      12. Finishing up the dashboard
    9. Summary
  17. Section 3:Industrial Cybersecurity – Threat Hunting
  18. Chapter 10: Threat Hunting
    1. What is threat hunting?
    2. Threat hunting in ICS environments
    3. What is needed to perform threat hunting exercises?
      1. Network traffic logs
      2. Endpoint OS and application event logs
      3. Making modifications to PLC, HMI, and other control systems and equipment
      4. Tracking new and changed devices on the (industrial) network
      5. Network services event logs
      6. SIEM
      7. Network packet captures
      8. Research, lookups, and comparison resources
    4. Threat hunting is about uncovering threats
    5. Correlating events and alerts for threat hunting purposes
    6. Summary
  19. Chapter 11: Threat Hunt Scenario 1 – Malware Beaconing
    1. Forming the malware beaconing threat hunting hypothesis
    2. Detection of beaconing behavior in the ICS environment
      1. Malware beaconing explained
      2. Data exfiltration
      3. Legitimate application beaconing
      4. Using Security Onion to detect beaconing behavior
      5. Using RITA to detect beaconing behavior
    3. Investigating/forensics of suspicious endpoints
      1. Finding the suspicious computer
      2. Find the beaconing process – netstat
      3. Upload executable to VirusTotal
      4. Rudimentary inspection of the suspicious executable – malware analysis 101
    4. Using indicators of compromise to uncover additional suspect systems
      1. Discovered IOCs so far
      2. Searching for network-specific indicators of compromise
      3. Searching for host-based indicators of compromise
    5. Summary
  20. Chapter 12: Threat Hunt Scenario 2 – Finding Malware and Unwanted Applications
    1. Technical requirements
    2. Forming the malicious or unwanted applications threat hunting hypothesis
    3. Detection of malicious or unwanted applications in the ICS environment
      1. Comparing system snapshots to find artifacts
      2. Looking for application errors to find artifacts
      3. Looking for malicious network traffic to find artifacts
      4. Comparing port scans to find artifacts
      5. Inventorying currently running processes in the ICS environment
      6. Inventorying startup processes in the ICS environment
    4. Investigation and forensics of suspicious endpoints
      1. Securely extracting the suspicious executables
    5. Using discovered indicators of compromise to search the environment for additional suspect systems
      1. Using YARA to find malicious executables
      2. Using file strings as an indicator of compromise
    6. Summary
  21. Chapter 13: Threat Hunt Scenario 3 – Suspicious External Connections
    1. Forming the suspicious external connections threat hunting hypothesis
    2. Ingress network connections
      1. Mayhem from the internet
      2. Attacks originating from the enterprise network
    3. Summary
  22. Section 4:Industrial Cybersecurity – Security Assessments and Intel
  23. Chapter 14: Different Types of Cybersecurity Assessments
    1. Understanding the types of cybersecurity assessments
    2. Risk assessments
      1. Asset identification
      2. System characterization
      3. Vulnerability identification
      4. Threat modeling
      5. Risk calculation
      6. Mitigation prioritization and planning
    3. Red team exercises
      1. How do red team exercises differ from penetration tests?
    4. Blue team exercises
    5. Penetration testing
    6. How do ICS/OT security assessments differ from IT?
    7. Summary
  24. Chapter 15: Industrial Control System Risk Assessments
  25. Chapter 16: Red Team/Blue Team Exercises
    1. Red Team versus Blue Team versus pentesting
      1. Penetration-testing objective – get to the objective at any cost
      2. Red Team exercise objective – emulate real-world adversary TTPs
      3. Blue Team objective – detect and respond to security incidents as quickly as possible
    2. Red Team/Blue Team example exercise, attacking Company Z
      1. Red Team strategy
      2. Blue Team preparation
      3. The attack
    3. Summary
  26. Chapter 17: Penetration Testing ICS Environments
    1. Practical view of penetration testing
    2. Why ICS environments are easy targets for attackers
    3. Typical risks to an ICS environment
    4. Modeling pentests around the ICS Kill Chain
      1. The Cyber Kill Chain explained
      2. The Intrusion Kill Chain
      3. The ICS Cyber Kill Chain
      4. Pentest methodology based on the ICS Kill Chain
    5. Pentesting results allow us to prioritize cybersecurity efforts
    6. Pentesting industrial environments requires caution
      1. Creating an approximation of the industrial environment
    7. Exercise – performing an ICS-centric penetration test
      1. Preparation work
      2. Setting up the test environment
      3. Pentest engagement step 1 – attacking the enterprise environment
      4. Pentest engagement step 2 – pivoting into the industrial environment
      5. Pentest engagement step 3 – attacking the industrial environment
      6. Testing Level 3 Site Operations
      7. Testing the lower layers
      8. Pentest engagement step 4 – reaching the objective of the attack
    8. Summary
  27. Section 5:Industrial Cybersecurity – Incident Response for the ICS Environment
  28. Chapter 18: Incident Response for the ICS Environment
    1. What is an incident?
    2. What is incident response?
    3. Incident response processes
      1. Incident response preparation process
      2. Incident handling process
    4. Incident response procedures
      1. Incident response preparation process
      2. Incident handling process
    5. Example incident report form
    6. Summary
  29. Chapter 19: Lab Setup
    1. Discussing the lab architecture
      1. The lab hardware
      2. The lab software
    2. Details about the enterprise environment lab setup
      1. ENT-DC
      2. ENT-SQL and ENT-IIS
      3. ENT-Clients
      4. Active Directory/Windows domain setup
    3. Details about the industrial environment – lab setup
      1. Servers
      2. Workstations
      3. HMIs
      4. PLCs and automation equipment
      5. Active Directory/Windows domain setup
    4. How to simulate (Chinese) attackers
    5. Discussing the role of lab firewalls
    6. How to install the malware for the lab environment
    7. Configuring packet capturing for passive security tools
    8. Summary
    9. Why subscribe?
  30. Other Books You May Enjoy
    1. Packt is searching for authors like you
    2. Share Your Thoughts

Product information

  • Title: Industrial Cybersecurity - Second Edition
  • Author(s): Pascal Ackerman
  • Release date: October 2021
  • Publisher(s): Packt Publishing
  • ISBN: 9781800202092