Securing control systems v0.4

•Télécharger en tant que ODP, PDF•

0 j'aime•720 vues

An introduction to Security in Control Systems. Includes a brief description of what a Control System is, and what the basic constraints that are encountered when attempting to secure these systems

Technologie Business

[object Object],Crispin Harris Security Specialist [email_address] 10 th May, 2010

[object Object],Part 1 – Understanding ,[object Object]

Understanding the risks Part 2 – Protection ,[object Object]

Vulnerability Management Part 4 - Summary ,[object Object]

US Gov Resources Part 3 – Governance ,[object Object]

[object Object],Be able to identify: ,[object Object]

Strengths and weaknesses of normal CS design

Safe & useful technical controls Be able to ,[object Object],But most importantly: Be able to ,[object Object]

Intro to Control Systems Security PART 1 – UNDERSTANDING CONTROL SYSTEMS

What is a Control System? A Control System is any computerised or automated system that is used to control, monitor, support or operate a known process. Most Control Systems manage an Industrial Process such as: ,[object Object],But they are also found where other repeatable processes occur: ,[object Object]

Road Infrastructure, Fleet Management, etc

[object Object],A “Control System” (“Industrial Control System”) is an umbrella term that refers to a broad set of control systems. These include: ,[object Object]

SIS (Safety Instrumentation System) And any other automated control system.

[object Object],Control Systems are designed to provide day-in, day-out management of a well known process. The integrity and continued operation of this process frequently has key safety or financial impact. Control Systems need: ,[object Object]

AVAILABILITY And a bit of: ,[object Object]

Contenu connexe

Tendances

Whitepaper Abstract Securing our nation's critical power infrastructure has never been more important. Utilities systems are vulnerable to cyber threats, which can be malicious attacks from hackers or terrorists, as well as unintentional damage done by employees. In response, industry regulators have implemented a number of regulations and standards to address these weaknesses and ensure the continued safe and reliable generation of electricity. This NetSpi whitepaper discusses the options — including application whitelisting — that are available to harden critical systems and meet key regulatory requirements. In particular, the paper identifies options for addressing NERC Critical Infrastructure Protection standards CIP-002 through CIP-009.

NetSpi Whitepaper: Hardening Critical Systems At Electrical Utilities

CoreTrace Corporation

Mission Impact Assessment for Industrial Control Systems

Marina Krotofil

System Security Plans 101

Donald E. Hester

Cyber Security: Differences between Industrial Control Systems and ICT Approach

Community Protection Forum

Dmitry Kurbatov. Five Nightmares for a Telecom

Positive Hack Days

PT-DTS SCADA Security using MaxPatrol

Shah Sheikh

Firewall audit

Velliyangiri K.S

Prioritized Approach Twenty Critical Controls 2008

Donald E. Hester

Hipaa checklist - information security

Vijay Sekar

Lumension Security Solutions

HassaanSahloul

NIST 800-37 Certification & Accreditation Process

timmcguinness

Securing Industrial Control System

Hemanth M

Using Assessment Tools on ICS (English)

Digital Bond

Nist 800 82 ICS Security Auditing Framework

MarcoAfzali

Security Management Strategies and Defense and their uses.

Computer engineering company

Firewalls continue to secure a countless number of organizations across the world and remain first line of defense against known cyber attacks and network risks. Avalanche of IT-led forces and evolution in threat landscape has brought increased onus on firewalls. On the other side, as enterprises extend their business leveraging internet driven business models and increasingly collaborative networks, embracing cloud and virtual environments, there's a need to understand how this ties with the changing role of security technologies such as a firewall. This webinar explains how a tectonic shift in enterprise networking requires rethinking firewall deployment and management for effective security management.

How to Audit Firewall, what are the standard Practices for Firewall Audit

keyuradmin

Security and Control Issues in information Systems

Dr. Rosemarie Sibbaluca-Guirre

10. industrial networks safety and security tom hammond

PROFIBUS and PROFINET InternationaI - PI UK

Nist.sp.800 82r2

vimal Kumar Gupta

6 Physical Security

Alfred Ouyang

Tendances (20)

NetSpi Whitepaper: Hardening Critical Systems At Electrical Utilities

Mission Impact Assessment for Industrial Control Systems

System Security Plans 101

Cyber Security: Differences between Industrial Control Systems and ICT Approach

Dmitry Kurbatov. Five Nightmares for a Telecom

PT-DTS SCADA Security using MaxPatrol

Firewall audit

Prioritized Approach Twenty Critical Controls 2008

Hipaa checklist - information security

Lumension Security Solutions

NIST 800-37 Certification & Accreditation Process

Securing Industrial Control System

Using Assessment Tools on ICS (English)

Nist 800 82 ICS Security Auditing Framework

Security Management Strategies and Defense and their uses.

How to Audit Firewall, what are the standard Practices for Firewall Audit

Security and Control Issues in information Systems

10. industrial networks safety and security tom hammond

Nist.sp.800 82r2

6 Physical Security

En vedette

The 4horsemen of ics secapocalypse

Christiaan Beek

Industrial protocols for pentesters

Positive Hack Days

Security testing in critical systems

Peter Wood

Protecting Industrial Control Systems V1.2, Ahmad Alanazy, 2012

Ahmed Al Enizi

2012 02 14 Afcom Presentation

Eric Gallant

[Bucharest] From SCADA to IoT Cyber Security

OWASP EEE

SCADA and HMI Security in InduSoft Web Studio

AVEVA

SCADA Security Webinar

AVEVA

This webinar will help you get more informed on PenTesting in SCADA and also best practices and methods used on risk assessment. Learning about the criticality in industry, makes you more flexible to boost the skills. Main points covered: • The SCADA ICS function in critical infrastructure industry • Risk exposure of IT vs. SCADA ICS from Cyber Security Perspective • Do's and don’ts of Vulnerability Assessment and Penetration Testing in SCADA ICS Environment Presenter: This webinar was presented by Pedro Putu Wirya, an IT and ICS Security Consultant with an extensive experience in ISMS, and PECB Certified Trainer. Link of the recorded session published on YouTube: https://youtu.be/icq-RTwusZ8

Vulnerability Assessment and Penetration Testing in online SCADA ICS Environm...

PECB

Scada Security & Penetration Testing

Ahmed Sherif

Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...

arnaudsoullie

Attacking SCADA systems: Story Of SCADASTRANGELOVE

Aleksandr Timorin

Industrial protocols for pentesters

Aleksandr Timorin

PLC and SCADA in Industrial Automation

Nikhil nnk

DTS Solution - SCADA Security Solutions

Shah Sheikh

PLC and SCADA

Suman Sourabh

SCADA hacking industrial-scale fun

Jan Seidl

Scada classification

Ahmed Sebaii

C-SCAD is an information gathering and penetration testing tool written to assess the security issues present in the Web-X (Internet Explorer-based web interface) client used to interact with the ClearSCADA server. WebX client is hosted on the embedded web server which is shipped as a part of complete ClearSCADA architecture. Primarily, the WebX client is restricted to perform any configuration changes but it can reveal potential information about the ClearSCADA server and associated components. Insecure deployments of WebX client can reveal potential information about the various functions such as alarm pages, SQL lists, and diagnostic checks including various reports.

BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...

Aditya K Sood

scada systems

Shovana Khan Yusufzai

En vedette (20)

The 4horsemen of ics secapocalypse

Industrial protocols for pentesters

Security testing in critical systems

Protecting Industrial Control Systems V1.2, Ahmad Alanazy, 2012

2012 02 14 Afcom Presentation

[Bucharest] From SCADA to IoT Cyber Security

SCADA and HMI Security in InduSoft Web Studio

SCADA Security Webinar

Vulnerability Assessment and Penetration Testing in online SCADA ICS Environm...

Scada Security & Penetration Testing

Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...

Attacking SCADA systems: Story Of SCADASTRANGELOVE

Industrial protocols for pentesters

PLC and SCADA in Industrial Automation

DTS Solution - SCADA Security Solutions

PLC and SCADA

SCADA hacking industrial-scale fun

Scada classification

BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...

scada systems

Similaire à Securing control systems v0.4

02 ibm security for smart grids

IBM Italia Web Team

Our audits are designed to help you determine your SAP landscape's actual risk exposure and pinpoint areas that are open to potential attacks. They include everything from your infrastructure and SAP system parameters to individual component configurations and authorizations. Also if your company's migration to SAP HANA or S/4HANA is right around the corner. An audit offers an ideal solution for safeguarding your systems and taking all the necessary security measures before you start your transition. Our approach is based on SAP's security guidelines, the recommendations of the German Federal Office for Information Security (BSI), and the information security standard DIN ISO 27001. Topics of focus: • Challenges, tools and proven methods • Advantages of a root cause analysis and of the resulting risks for your company • Quick check vs. audit vs. penetrationtest • Our project approach at a glance • Recommendations for the follow-up of an Audit ----------------------------------------------------------------------------------------- Für Informationen auf Deutsch, sprechen Sie uns gerne an: sast@akquinet.de

SAP Security & Compliance Audits. Find your vulnerabilities before you get hu...

akquinet enterprise solutions GmbH

Over the past few years, penetration testing has gotten easier. What used to take a week of scanning, analysis, and exploit research now happens in one day on average in a common IT environment. The efficiency of compromise has increased based on several factors including increased knowledge sharing, more robust computing, and automated exploitation tools. OT environments are often utilizing the same operating systems and are prone to many of the same attacks. The main differences are the presence of custom protocols, embedded systems, and lack of formal security programs to address the gaps created by two-way data communication networks. This talk will show the most common attacks which our team currently uses to gain access and control over the networks and systems we test. More importantly, we will discuss the “top 10” things an organization can do to mitigate, remediate, and have active visibility into critical systems.

Slide Griffin - Practical Attacks and Mitigations

EnergySec

ICAB - ITA Chapter 5 class 7-8 - Controls and Standards

Mohammad Abdul Matin Emon

SegurançA Da InformaçãO Faat V1 4

Rodrigo Piovesana

Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger

Information Security Awareness Group

CISSP Cheatsheet.pdf

shyedshahriar

Data Security Solutions @ISACA LV Chapter Meeting 15.05.2013 SIEM based …

Andris Soroka

Security Architecture

amiable_indian

AMI Security 101 - Smart Grid Security East 2011

dma1965

compTIA guide to get the CERTIFICATION EMERSON EDUARDO RODRIGUES

EMERSON EDUARDO RODRIGUES

CIA-Triad-Presentation.pdf

BabyBoy55

Cloud Computing

Commit Software Sh.p.k.

It Audit And Forensics

JED Consulting Services LLC

Audit of it infrastructure

pramod_kmr73

The 300 Leonidas Solution

matthew.maisel

Advantages And Disadvantages Of Nc

Kristen Wilson

17-MOD 6 Conducting Security Audits & MOD 7 Information Security Audit Prepar...

abhichowdary16

Integrating Physical And Logical Security

Jorge Sebastiao

Cisco Connect 2018 Thailand - Security automation and programmability mr. kho...

NetworkCollaborators

Similaire à Securing control systems v0.4 (20)

02 ibm security for smart grids

SAP Security & Compliance Audits. Find your vulnerabilities before you get hu...

Slide Griffin - Practical Attacks and Mitigations

ICAB - ITA Chapter 5 class 7-8 - Controls and Standards

SegurançA Da InformaçãO Faat V1 4

Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger

CISSP Cheatsheet.pdf

Data Security Solutions @ISACA LV Chapter Meeting 15.05.2013 SIEM based …

Security Architecture

AMI Security 101 - Smart Grid Security East 2011

compTIA guide to get the CERTIFICATION EMERSON EDUARDO RODRIGUES

CIA-Triad-Presentation.pdf

Cloud Computing

It Audit And Forensics

Audit of it infrastructure

The 300 Leonidas Solution

Advantages And Disadvantages Of Nc

17-MOD 6 Conducting Security Audits & MOD 7 Information Security Audit Prepar...

Integrating Physical And Logical Security

Cisco Connect 2018 Thailand - Security automation and programmability mr. kho...

Dernier

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Juan lago vázquez

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

Axa Assurance Maroc - Insurer Innovation Award 2024

The Digital Insurer

As privacy and data protection regulations evolve rapidly, organizations operating in multiple jurisdictions face mounting challenges to ensure compliance and safeguard customer data. With state-specific privacy laws coming up in multiple states this year, it is essential to understand what their unique data protection regulations will require clearly. How will data privacy evolve in the US in 2024? How to stay compliant? Our panellists will guide you through the intricacies of these states' specific data privacy laws, clarifying complex legal frameworks and compliance requirements. This webinar will review: - The essential aspects of each state's privacy landscape and the latest updates - Common compliance challenges faced by organizations operating in multiple states and best practices to achieve regulatory adherence - Valuable insights into potential changes to existing regulations and prepare your organization for the evolving landscape

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

TrustArc

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

MadyBayot

Whatsapp Number Escorts Call girls 8617370543 Available 24x7 Navi Mumbai Call Girls Service Offer Genuine VIP Model Escorts Call Girls in Your Budget. Navi Mumbai Call Girls Service Provide Real Call Girls Number. Make Your Sexual Pleasure Memorable with Our Navi Mumbai Call Girls at Affordable Price. Top VIP Escorts Call Girls, High Profile Independent Escorts Call Girls, Housewife Women Escorts Call Girl, College Girls Escorts Call Girls, Russian Escorts Call girls Service in Your Budget.

Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model

Deepika Singh

Abhishek Deb(1), Mr Abdul Kalam(2) M. Des (UX) , School of Design, DIT University , Dehradun. This paper explores the future potential of AI-enabled smartphone processors, aiming to investigate the advancements, capabilities, and implications of integrating artificial intelligence (AI) into smartphone technology. The research study goals consist of evaluating the development of AI in mobile phone processors, analyzing the existing state as well as abilities of AI-enabled cpus determining future patterns as well as chances together with reviewing obstacles as well as factors to consider for more growth.

Exploring the Future Potential of AI-Enabled Smartphone Processors

debabhi2

In the thrilling conclusion to 2023, ransomware groups had a banner year, really outdoing themselves in the "make everyone's life miserable" department. LockBit 3.0 took gold in the hacking olympics, followed by the plucky upstarts Clop and ALPHV/BlackCat. Apparently, 48% of organizations were feeling left out and decided to get in on the cyber attack action. Business services won the "most likely to get digitally mugged" award, with education and retail nipping at their heels. Hackers expanded their repertoire beyond boring old encryption to the much more exciting world of extortion. The US, UK and Canada took top honors in the "countries most likely to pay up" category. Bitcoins were the currency of choice for discerning hackers, because who doesn't love untraceable money?

Ransomware_Q4_2023. The report. [EN].pdf

Overkill Security

Real Time Object Detection Using Open CV

Khem

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

A Beginners Guide to Building a RAG App Using Open Source Milvus

Zilliz

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

ICT role in 21st century education and its challenges

rafiqahmad00786416

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

Zilliz

Created by Mozilla Research in 2012 and now part of Linux Foundation Europe, the Servo project is an experimental rendering engine written in Rust. It combines memory safety and concurrency to create an independent, modular, and embeddable rendering engine that adheres to web standards. Stewardship of Servo moved from Mozilla Research to the Linux Foundation in 2020, where its mission remains unchanged. After some slow years, in 2023 there has been renewed activity on the project, with a roadmap now focused on improving the engine’s CSS 2 conformance, exploring Android support, and making Servo a practical embeddable rendering engine. In this presentation, Rakhi Sharma reviews the status of the project, our recent developments in 2023, our collaboration with Tauri to make Servo an easy-to-use embeddable rendering engine, and our plans for the future to make Servo an alternative web rendering engine for the embedded devices industry. (c) Embedded Open Source Summit 2024 April 16-18, 2024 Seattle, Washington (US) https://events.linuxfoundation.org/embedded-open-source-summit/ https://ossna2024.sched.com/event/1aBNF/a-year-of-servo-reboot-where-are-we-now-rakhi-sharma-igalia

A Year of the Servo Reboot: Where Are We Now?

Igalia

MINDCTI Revenue Release Quarter One 2024

MIND CTI

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Dernier (20)

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

How to Troubleshoot Apps for the Modern Connected Worker

Axa Assurance Maroc - Insurer Innovation Award 2024

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Powerful Google developer tools for immediate impact! (2023-24 C)

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model

Exploring the Future Potential of AI-Enabled Smartphone Processors

Ransomware_Q4_2023. The report. [EN].pdf

Real Time Object Detection Using Open CV

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

A Beginners Guide to Building a RAG App Using Open Source Milvus

Apidays New York 2024 - The value of a flexible API Management solution for O...

ICT role in 21st century education and its challenges

Data Cloud, More than a CDP by Matt Robison

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

A Year of the Servo Reboot: Where Are We Now?

MINDCTI Revenue Release Quarter One 2024

AWS Community Day CPH - Three problems of Terraform

Securing control systems v0.4

4. Why they are different?

5. Key attributes

7. Hosts & Operating Systems

8. Applications & Vendors

10. Web Resources

11. Aus Gov Resources

12.

13. (Penetration) Testing

14. Vendor Relationships

15. Information/Software stores

16.

17. Strengths and weaknesses of normal CS design

18. Useful non-technical controls

19.

20. Intro to Control Systems Security PART 1 – UNDERSTANDING CONTROL SYSTEMS

21.

22. Road Infrastructure, Fleet Management, etc

23.

24. DCS (Distributed Control System)

25. PCS (Process Control System)

26. EMS (Emergency Management System)

27. AS (Automated System)

28. SIS (Safety Instrumentation System) And any other automated control system.

29.

30.

31.

32. Stable

33. Well documented

34. Old & un-patched systems

35. Isolated*

36. Internally redundant

37. Small*

38. Rare/Obscure Customised Applications

39. Self Contained

40.

41.

42. Disclosure

43. Denial of Access Insults to the System Insults to the data Generated by the system, and USED by the business

44.

45.

46.

47. Design assumptions have proved inaccurate

48. Networks already experience many transient failures

49. Custom or insecure network protocols

50. Immature network tunnelling/bridging techniques.

51.

52. Well Known & Stable operation

53. Custom/Uncommon software

54. Generally well documented

55.

56. Gateway Access Controls

57.

58. Intro to Control Systems Security PART 2 – PROTECTIONS FOR CONTROL SYSTEMS

59.

60. Process

61.

62. Assess

63. Review All the standard security tools, processes and concepts apply. Security is a Process not a Product

64.

65. Give them somewhere 'safe' to play.

66. Already have a “safety culture”. Add “systems security increases your safety”.

67. Operators know how their systems work.

68.

69. System owner

70.

71. Incident & Anomaly Reporting

72.

73. Related & Ancillary packages

74. Operating System Updates

75. Protections – Technical Defence in Depth

76.

77. Increases time-to-compromise

78. Decreases vulnerable devices at each step

79. Isolates fragile devices

80. Not applicable on some older legacy networks

81. Difficult to retro-fit

82.

83.

84. ARP security

85.

86. File Integrity Checking

87. Process Privilege Escalation

88. Host-Based IPS

89. Host Firewalls

90. Host Authentication (Active Directory)

91. Centralised Logging

92.

93. Default database/application/server passwords

94. Vulnerable web services

95.

96.

97.

98. Network Access Control Policy

99. 3 rd Party access and Remote Access Policies

100.

101. Change Management

102.

103. NISTA 52

104.

105. Router/Switch/Firewall configuration Audit

106.

107. Configuration Testing &

108. Gateway traffic analysis

109.

110. Source Code

111.

112. Authentication Systems (AD, LDAP, DB etc)

113.

114.

115. Network Separation

116. Network Modelling &

117. Network Anomaly Detection & IDS

118. Testing (Penetration & Compliance)

119. Auditing (Policies, Controls & Processes)

120. Stay (as) current (as you can be)

121.

122. NIST SP 800-82 – Guide for Industrial Control Systems (ICS) Security

123.

124. DHS CSSP - Control Systems Defence in Depth Strategies

125. http://www.us-cert.gov/control_systems/practices/documents/Defense_in_Depth_Oct09.pdf

126.

127. Department of Broadband, Communication and the Digital Economy

128. Department of the Attorney General

129.

130. US Department of Homeland Security & US Department of Energy

131. UK Centre for the Protection of National Infrastructure

132.

133. DHS Cyber Security Evaluation Tool (CSET) http://www.us-cert.gov/control_systems/satool.html

134. SANS http://sans.org.au/

135. CPNI SCADA Guidelines & Recommendations http://www.cpni.gov.uk/scada

136.

137. Firewalls

138. Intrusion Management: Detection vs. Prevention

139. Penetration Testing

140. ISA95 – Control Hierachy Levels

141. ISA95 – IT Systems View

Notes de l'éditeur

Talk briefly about the different types of control systems, and w
A quick review of the sensitivities that Control Systems have to Impact & Change
Firewalls, IPS, Anti-Virus, Structural Separation,
See StuxNet & the public knowledge/understanding of attacks against Firmware. How safe is YOUR firmware library

Securing control systems v0.4

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (20)

Similaire à Securing control systems v0.4

Similaire à Securing control systems v0.4 (20)

Dernier

Dernier (20)

Securing control systems v0.4

Notes de l'éditeur