Practical Industrial Cybersecurity

Chapter 10ICS Security Monitoring and Incident Response

OBJECTIVES

Upon completion of this chapter, you should be able to:

1. Demonstrate the knowledge of Change Management:
   • Baselines
   • Equipment connections
   • Configuration auditing
2. Demonstrate the knowledge of Distribution and Installation of Patches
3. Demonstrate the knowledge of Software Reloads and Firmware Management
4. Demonstrate the knowledge of event, network, and security monitoring:
   • Event monitoring
   • Network monitoring
   • Security monitoring
5. Demonstrate the knowledge of logging:
   • Event logging
   • Network logging
   • Security logging
   • Knowledge of archiving logs
6. Demonstrate the knowledge of incident recognition and triage:
   • Log analysis/event correlation
   • Anomalous behavior
   • Intrusion detection
   • Egress monitoring
   • IPS
7. Demonstrate the knowledge of incident response:
   • Recording/reporting
   • Forensic log analysis
   • Containment
   • Incident response team
   • Root cause analysis
   • Eradication/quarantine
8. Demonstrate the knowledge of incident remediation/recovery

Introduction

An organization's cybersecurity policy should contain several interdependent plans working together to address the following areas:

• Configuration management
• Patch management
• Patch testing
• Organization/local data backup/retrieval
• Incident response
• Disaster recovery

After the cybersecurity policy plan has been fully developed and implemented, it is important to periodically assess all of the components of the plan; review any change in system status, functionality, design, ...