0% found this document useful (0 votes)

80 views161 pages

ICS Cybersecurity Evaluation Guide

Uploaded by

ianlokejj

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

80 views161 pages

ICS Cybersecurity Evaluation Guide

Uploaded by

ianlokejj

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0

Industrial Control System (ICS)

Cybersecurity Evaluation (401 – Virtual)
Trainee Guide

R01M00
ICS Cybersecurity
Evaluation (401 Virtual) Training
Disclaimer .............................................................................................................................................. 5
Introduction ......................................................................................................................................... 6
Course Requirements ......................................................................................................................... 7
Trainee Guide ..................................................................................................................................... 7
Cyber Security Evaluation Tool CSET® ............................................................................................... 8
How to Login to NetLab ...................................................................................................................... 8
LO1. Apply Components of an ICS Evaluation ....................................................................................... 9
ICS Evaluation Components ............................................................................................................... 9
What are Cybersecurity Performance Goals (CPGs)? ........................................................................ 9
CPGs Compared to 401 Questions ................................................................................................... 10
Managing Risk .................................................................................................................................. 10
Assessment vs. Analysis and Evaluation .......................................................................................... 10
Why Establish an ICS Evaluation Program? ..................................................................................... 10
Changing the Culture ........................................................................................................................ 11
ICS Evaluation Components ............................................................................................................. 12
Evaluation Entry Qualifiers / Organizational and Technical ............................................................... 12
ICS Cybersecurity Policy and Procedure .......................................................................................... 13
Establish Expected Outcomes and Products..................................................................................... 13
Criticality Analysis ............................................................................................................................. 14
Perfume Specialty Chemical Scenario .............................................................................................. 14
LO2. Identify Assets Within ICS Networks ........................................................................................... 17
Identify Assets .................................................................................................................................. 17
Asset Inventory ................................................................................................................................. 17
Asset Inventory Prioritization Activity ................................................................................................ 18
Common Issues ................................................................................................................................ 18
Cybersecurity Performance Goals (CPGs) ........................................................................................ 19
LO3. Create a Segmented Network Using Taught Principles ............................................................... 20
Network Segmentation ...................................................................................................................... 20
Network Segmentation Exercise ....................................................................................................... 29
Common Issues ................................................................................................................................ 31
Cybersecurity Performance Goals (CPGs) ........................................................................................ 31
LO4. Understand Wireless Vulnerabilities in ICS Environments ........................................................... 32
Wi-Fi Assessment: Concepts and Analysis ....................................................................................... 32
Radio Spectrum ................................................................................................................................ 32
Omni-Directional Antennas ............................................................................................................... 33

1|Page
ICS Cybersecurity
Evaluation (401 Virtual) Training
Directional Antennas ......................................................................................................................... 33
Wi-Fi Access Points (APs) ................................................................................................................ 34
Wi-Fi Spectrum ................................................................................................................................. 34
Wi-Fi Encryption Types ..................................................................................................................... 35
Beacons ........................................................................................................................................... 36
Probe Request .................................................................................................................................. 36
Wi-Fi Threats .................................................................................................................................... 37
Wi-Fi Analyzers for Android .............................................................................................................. 44
Wi-Fi Monitoring Hardware ............................................................................................................... 44
IEEE 802.11[x] Support Tools ........................................................................................................... 45
Common Issues ................................................................................................................................ 45
Cybersecurity Performance Goals (CPGs) ........................................................................................ 45
LO5. Evaluate Network Monitoring in ICS Environments ..................................................................... 46
Philosophies ..................................................................................................................................... 47
Network Monitoring Types ................................................................................................................ 47
Logging Architecture ......................................................................................................................... 48
Monitoring Control System ................................................................................................................ 51
Evaluating Network Monitoring.......................................................................................................... 51
Network Monitoring Policy................................................................................................................. 51
Data ........................................................................................................................................... 52
Log Sources...................................................................................................................................... 52
Snort IDS/IPS ................................................................................................................................... 52
What to Monitor? .............................................................................................................................. 53
Network Monitoring Concerns ........................................................................................................... 53
How is Incident Response Supposed to Work?................................................................................. 53
Incident Response Plan .................................................................................................................... 53
Incident Response Questions ........................................................................................................... 54
Cybersecurity Performance Goals (CPGs) ........................................................................................ 55
LO6: Identify Risk Using OPSEC and OSINT ...................................................................................... 57
Threats ........................................................................................................................................... 57
Threat Example ................................................................................................................................ 58
ICS Incidents .................................................................................................................................... 58
Operations Security (OPSEC) ........................................................................................................... 59
Identify Critical Information (CI) ......................................................................................................... 60
Identify CI (Continued) ...................................................................................................................... 62

2|Page
ICS Cybersecurity
Evaluation (401 Virtual) Training
Open-Source Intelligence (OSINT) ................................................................................................... 62
OSINT Historical Examples............................................................................................................... 62
Hawaii Emergency Management Agency OPSEC Exercise .............................................................. 66
Analyze Threats ................................................................................................................................ 67
Analyze Vulnerabilities ...................................................................................................................... 67
Assess Risk ...................................................................................................................................... 67
Apply Countermeasures.................................................................................................................... 67
Common Issues ................................................................................................................................ 68
OPSEC Exercise – VLP .................................................................................................................... 69
Cybersecurity Performance Goals (CPGs) ........................................................................................ 69
LO7. Evaluate Adversarial Risk to an ICS Environment ....................................................................... 71
Phishing Exercise ............................................................................................................................. 72
Adversarial Tactics and Techniques ................................................................................................. 72
Common Issues ................................................................................................................................ 81
Cybersecurity Performance Goals (CPGs) ........................................................................................ 81
LO8. Determine ICS Dependencies ..................................................................................................... 83
Infrastructure and Dependencies ...................................................................................................... 83
Dependency and Dependency Types ............................................................................................... 84
Deer Island Treatment Plant Wastewater Collection and Treatment ................................................. 86
Define Business Process Functions .................................................................................................. 88
Define Auxiliary Functions: What Other Factors Are Around the Process? ....................................... 88
Understand Criticality and Risk ......................................................................................................... 88
Interdependencies Exercise .............................................................................................................. 89
Common Issues ................................................................................................................................ 89
LO9. Analyze Supply Chain Risk ......................................................................................................... 90
Why Attack the Supply Chain? .......................................................................................................... 90
Vulnerabilities ................................................................................................................................... 91
Supply Chain Considerations ............................................................................................................ 91
Use Cases ........................................................................................................................................ 92
Supply Chain Exercise ...................................................................................................................... 93
Third-Party Access Considerations ................................................................................................... 93
Onsite Access ................................................................................................................................... 93
Remote Access................................................................................................................................. 94
Third-Party Access Use Case - Trisis................................................................................................ 94
Self-Reflection Scenario.................................................................................................................... 95

3|Page
ICS Cybersecurity
Evaluation (401 Virtual) Training
Common Issues ................................................................................................................................ 96
Cybersecurity Performance Goals (CPGs) ........................................................................................ 96
LO10. Provide Risk Management and Mitigation Methods ................................................................... 98
Manage Risk ..................................................................................................................................... 98
Continuous Monitoring .................................................................................................................... 100
Management Respond.................................................................................................................... 100
Responding to ‘Risk’ ....................................................................................................................... 101
Recommend Points of Contact ....................................................................................................... 101
Report Recommendations / Document Actions ............................................................................... 101
Review / Update ............................................................................................................................. 102
CSET® Guide Introduction ................................................................................................................. 103
Disclaimer ....................................................................................................................................... 103
Learning Objectives ........................................................................................................................ 103
1. Discuss the purpose and benefits of CSET® ............................................................................... 104
2. Describe the steps to conduct a CSET® evaluation. .................................................................... 107
Executive Summary Report ............................................................................................................ 123
Site Detail Report ............................................................................................................................ 125
Acronyms........................................................................................................................................... 128
CSET® Report.................................................................................................................................... 129
LO2 Evaluation Questions .............................................................................................................. 129
LO3 Evaluation Questions .............................................................................................................. 130
LO4 Evaluation Questions .............................................................................................................. 130
LO5 Evaluation Questions .............................................................................................................. 131
LO6 Evaluation Questions .............................................................................................................. 132
LO7 Evaluation Questions .............................................................................................................. 132
LO8 Evaluation Questions .............................................................................................................. 133
LO9 Evaluation Questions .............................................................................................................. 134
Final Exercise .................................................................................................................................... 135
Team Members............................................................................................................................... 135
Appendix A. Content References ....................................................................................................... 139
Appendix B: OSINT Framework and Google Hacking Exercise ......................................................... 140
Appendix C. Network Architecture Examples ..................................................................................... 144
Appendix D: Cross-Sector Dependencies Sample Exercise Answer .................................................. 146
Appendix E. Cybersecurity Performance Goals (CPGs)..................................................................... 147
Appendix F. How to Login to NetLab.................................................................................................. 150

4|Page
ICS Cybersecurity
Evaluation (401 Virtual) Training
Disclaimer
This presentation is intended for informational and discussion purposes only.
The U.S. Department of Homeland Security (DHS) does not provide any warranties of any kind
regarding this information. In no event shall the United States Government or its contractors or
subcontractors be liable for any damages, including but not limited to, direct, indirect, special or
consequential damages, arising out of, resulting from, or in any way connected with this information,
whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of
negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance
upon the information.
The display of the DHS official seal or other DHS visual identities, including the Cyber and
Infrastructure Security Agency (CISA) name or logo shall not be interpreted to provide any person or
organization the authorization to use the official seal, insignia or other visual identities of the DHS,
including CISA. The DHS seal, insignia, or other visual identities shall not be used in any manner to
imply endorsement of any commercial product or activity by DHS, CISA or the United States
Government. Use of the DHS seal without proper authorization violates federal law (e.g., 18 U.S.C. §§
506, 701, 1017), and is against DHS policies governing usage of its seal.
DHS does not endorse any commercial product or service, including any subjects of analysis. Any
reference to specific commercial products, processes, or services by service mark, trademark,
manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or
favoring by DHS.
Training personnel do not discriminate on the basis of race, color, religion, national origin, sexual
orientation, physical or mental disability, or gender expression/identity. Nor do they possess proprietary
interest in any product, instrument, device, service or material discussed in this course.

Trainee Guide
This guide contains content taught in the online version of the course. The activities used in the course
are located on the CISA VLP as downloadable PDFs or NetLab activities. We recommend
downloading and completing the activities as trainees navigate through each video within each
module. Trainees may print this Trainee Guide or use the PDF version. This guide is for trainee benefit
only.

How to Login to NetLab

Instructions can be found in Appendix F of this trainee guide.

What are Cybersecurity Performance Goals (CPGs)?

When conducting a course evaluation, there are a variety of question sets available depending on the
type of evaluation you are conducting, how in-depth you want to be, and what requirements you need
to meet. For this course, the 401 Virtual question set was created. However, CISA created a set of
questions that can be used as well in industry called the Cybersecurity Performance Goals. We will
include the CPGs at the end of each module that they align with so you can familiarize yourself with
them.

• A prioritized subset of cybersecurity practices

• For IT and OT
• Prioritized for risk reduction
• Informed by threats observed by CISA and its
government and industry partners
• Applicable across all CI sectors
• Intended to meaningfully reduce risks to both CI
operatives and the American people

Managing Risk
This equation is a simple structure to focus
cybersecurity efforts to directly impact risk.

When each variable is considered and addressed,

it helps to mitigate and defend critical infrastructure
by reducing the overall risk.

Assessment vs. Analysis and Evaluation

Assessment Analysis & Evaluation
 Generally, a ‘point-in-time’ activity  Emphasis in ongoing, over-time activity
 Compliance against (internal or external)  Not compliance focused – incorporated as
standards required
 Diagnostic in nature – ‘scored’ against a  Judgmental in nature – measured against
process product value
 Measurement – absolute per standard  Measurement – comparative against
 Security posture re-assessed at long-term business objectives
intervals  Security posture re-evaluated continuously

Why Establish an ICS Evaluation Program?

According to a statement made by John Fryer, Senior Director of Product Management & Marketing
at Stratus Technologies, the number of connected devices by 2020 will range from 50 billion to more
than 200 billion – “Many of these devices will be industrial machines – from production line equipment
to pipeline pumps and monitors – transforming manufacturing and process automation.”
Many evaluation programs / systems are based on compliance. The process taught in this class is
meant to be a business enabler and is not focused on regulatory compliance.

IMPORTANT: No organization will ever be ‘completely’ secure. However, if the only reason an organization
evaluates its own systems is based on regulation, they are more vulnerable than secure. Creating an ICS
cybersecurity self-evaluation process is critical to sustainable practice.

Changing the Culture

“Cooperation on a consistent security strategy across both IT and OT is essential for the future.”
“For IT security pros that want to start to cooperate on security with OT,
learning about how OT works is a great starting place.”
This CPG incorporates Changing the Culture by recommendation a “pizza party” or other social event
annually to encourage IT/OT relationships.

Evaluation Entry Qualifiers / Organizational and Technical

Many of these qualifiers come from the Defense-in-Depth Strategy Elements found in the NCCIC_ICS-
CERT_Defense_in_Depth_2016_S508C.pdf. That document broke up elements into Organizational
and Technical Qualifiers an evaluator should use when the goal is to fully complete an evaluation.
Evaluating an ICS environment is not an exact science. As such, the idea of having qualifiers to bind
your evaluation topics and resulting artifacts will vary by the business / industry / sector. The table
below is provided as an example and is not meant to be prescriptive.

Organizational Evaluation (Qualifiers) * Technical Evaluation (Qualifiers)*

Leadership-Mgmt. Roles/Responsibilities IT/OT Technical Roles/Responsibilities
Ownership of ICS Assets Existing Infrastructure
Business Policies and Procedures Hardware Inventory
Asset Classification Policy Software Inventory
Business Impact Analysis Data Storage
ICS Cybersecurity Plan Back Up Processes
Disaster Recovery Plan (DRP) Disaster Recovery Mechanisms
Continuity of Operations Plan (COOP) User Access
Business Continuity Plan (BCP) Identification and Authentication
Technical Procedures / Policies / SOPs Maintenance / Upgrades
Change Management Plan Cloud Presence / IoT Integration
Configuration Management Plan Systems Administration
Incident Response Plan Technical Change Control Points
Continuous Monitoring Plan Technical Configuration Control Points

Establish Expected Outcomes and Products

Qualitative vs. Quantitative
When it comes to understanding how to ‘report’ evaluation outcomes it is very important to understand
qualitative vs. quantitative reporting. It is always nice to be able to report to managers a quantitative number,
but, for the most part, all aspects of risk management are generally qualitative.

Reporting Outcomes: Considering the evaluation process is meant to result in recommendations, it is

critical to ensure these recommendations are:
 Standardized – you would not want to do three different evaluations and have the same
findings without a standardized approach to risk mitigation.
 Practical – your recommendations should balance the complexity of the solution as well as the
cost-effectiveness of the solution as part of the consideration.
 Reliable / Repeatable – the results of your recommendations, when tested should perform in a
reliable state. It is a good idea to recommend tested solutions vs. just hypothetical solutions that
could cause more harm than help. Results should be repeatable each time.
 Valid – It is critical you make sure you can validate your claim when making a recommendation.
Seek outside help and do not just rely on textual recommendations. Consider suggesting to
businesses they also validate internal recommendations before implementing a solution.
Evaluation Products:
 Issues and findings report  Update or establish cybersecurity policy
 Final report and procedures

Perfume Specialty Chemical Scenario

This is a simple scenario to practice with. Applying to your own organization will have many more
functions, components, and subcomponents to consider.
Perfume Specialty Chemical is a company specializing in the manufacture, sales, and distribution of a
variety of perfumes and other body products. The company has a large domestic sales network with
over a dozen storage warehouses and three manufacturing plants. Two of the three manufacturing
plants are located outside of the United States – one in Toronto, Canada and another in Beijing, China.
A sales team resides in both San Diego, CA and New York City, NY.

 Perfume business/sales

 Perfume distribution

 Perfume feedback storage

After identifying the business functions, outline the relationship between them.
 Draw connecting lines representing process flow
 Perfume manufacturing/blending
 Perfume business/sales is connected upward and downward
 Perfume has both a distribution and storage component
 Based on the example to the right:
 Which is the most critical function?
 What are the major systems in the diagram?
 What are the subsystems in the diagram?

Consider which functions are the most important and which are less important. This does not mean
something is unimportant, but rather that there is a ranking of importance.

Cyber Security Evaluation Tool (CSET®)

 Self-contained software tool (runs on a desktop or laptop)
 Provides a systematic, repeatable approach for evaluating security posture
 Guides asset owners and operators step-by-step to evaluate ICS security practices

The CSET® introduction utilizes the CSET® Guide located after LO10 in
the back of this Trainee Guide.

Identify Assets

Asset Inventory
It’s accurate and complete…right?
• Asset inventory is vital, but many times elusive
• You cannot defend what you do not know
“Understanding and solving the asset inventory and device visibility problem is critical in
managing a business’ security program.”
– Implementation guide to ICS

17 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Asset Inventory Management versus Inventory Management
It is important not to confuse general inventory with asset inventory. Below is a table to help
differentiate each one.

Asset Inventory Management Inventory Management

Something the organization operates Something the organization consumes

Tracking sensitive information Tracking items in stock

Analyzing what to secure Analyzing usage

What is exactly is an ICS asset inventory?

A repository of all relevant information about hardware and software that is in current operation.

Why is your asset inventory challenging?

• Dual-homing and isolation
• Mixtures of old and new devices from multiple vendors, lack of up-to-date diagrams, unique
industry and application-specific protocols (some of which are not IP-based), and the
difficulty in conducting physical inventories in dispersed or hostile environments compound
these challenges.

Asset Inventory Prioritization Activity

You can find and download this activity as a PDF from the VLP.

Common Issues
What might be some common issues you will face in your own organizations?
 No process governing the implementation of remote access
 Remote Access does not use multifactor authentication
 Control System resides on same system / network as Enterprise/IT network
 Laptops can be used across domains
 No notification of user / employee change
 No mobile device policy
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________

18 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Cybersecurity Performance Goals (CPGs)
This is one of the CPGs associated with asset inventory management. You will complete an evaluation
using CSET® at the conclusion of this training.
MEDIUM-LOW COST
HIGH IMPACT
MEDIUM
COMPLEXITY

19 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO3. Create a Segmented Network Using Taught Principles
Now that we have identified and prioritized our assets, next we determine how/if these assets are
connected appropriately. This brings us to determining ICS connectivity.

Network Segmentation: Examining captured packets from an existing network can help reveal if other
networks exist. How is the network designed? Is it a single network or is it divided into several? Why
divide it into more than one network? Another hands-on demo will encourage you to consider ways to
further segment an existing design and rebuild it into your own network.
Critical Data Points: Significant connections for mission success. What data paths traverse the
network segments that represent critical data? Are these fragile links well understood? Are they
documented? Which personnel are aware of them? Is there a plan to recover these paths if something
goes wrong? These are some example concerns to consider. There may not be a perfect answer to
each, but simply bringing the concerns to light, sets in motion the steps needed to help an organization
become ready.

Network Segmentation
A control system can exist on a single network. However, that may not be the wisest design plan. It is a
single network to target. Instead of a single network, smaller networks connected by routes, performed
by routers or firewalls, can provide barriers with rules. This is a common concept in network security.
Network security can be applied to control system networks.

20 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Let’s look at a
simple network, built
with no
segmentation. This
is a relatively simple
ICS network. A
couple of PLCs
driving some factory
equipment, a pair of
HMI stations to
operate from, and a
Historian collecting
data from the
operation and
storing it to a server
for safe keeping.
This is a single
network. Nothing is
work Segmentation segmented. All
devices above and
below the network
pipe are connected
to the same low-
level network.

After some time

passes, we added a
couple of
Engineering
Workstations (EWS)
for new crew
positions. Policies
are implemented
that require more
security, resulting in
URITY &
CTURE new IP surveillance
AGENCY
equipment. Where
do these new
devices connect?
The company just
adds them to the
existing network.

21 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
More time passes and
production is going well.
More workforce is needed.
New employees will need
desktop computers.
Additionally, to serve the
various departments, an IP
phone system is deployed.

Later, it is decided a
dedicated IT staff is
needed. To support the
staff, a Domain Controller
is set up and integrated
with desktops and
equipment. Employees
need to store and
exchange a variety of files
on a File Server. Being
able to view the data from
production can be
complicated, so IT creates
a web server to make it
presentable in visually
appealing dashboards.
The data for the
dashboards is pulled from
the Historian database.

22 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
More advanced OT
equipment is
needed in
manufacturing. New
components are
deployed, resulting
in more servers and
operation client
terminals.

Finally, the
employees are
going to need
Internet access for
communicating with
businesses. All
these additions are
added to the same
base network we
started with. It is
getting crowded on
this network. Our
network is singular,
and now only one
device isolates this
control system from
the public Internet.

23 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
The resulting network appears rather crowded:
 Forward or reverse attacks need only circumvent one point
 Difficult to control access across employee positions
 Troubleshooting may be challenging
 Difficult to grow

Let’s attempt to segment this…but how?

There is no single answer for how

to segment such a network. Here
is one idea. It is an architecture
design provided by DHS. Dividing
networks into zones can assist in
creating security boundaries.
Understanding how to segment
networks is vital to creating
architectural zones within and
around control system
environments.
The basic idea is to introduce a
DMZ between IT and OT
operations. This idea can be
applied in multiple areas of the
same production, depending on
needs. It creates the ability to
introduce access control between
segments. Not all segmenting
ideas require placing a DMZ
buffer between them.
Reference: NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf; page 18
Debate over the relevance of the
Purdue Model does exist.
Depending on your
organization’s design needs, it can give or take value from this debate. Regardless, using it can still be
a first step in further improving your security model. It can also be a great introduction to someone who
has never experienced network segmentation.

24 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Looking back at the same network we saw grow, we attempted to segment this into smaller, more
controllable zones. When evaluating a network, you may or may not encounter similar designs.

Critical Data Paths

All the mission critical data that flows within your network makes up your critical data paths. With
improved segmentation, we can
• Restrict access more realistically
• Monitor network connections
• Troubleshoot
• Scale our network with company growth better

25 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

Now, a security officer can monitor last night’s surveillance video, which was delivered to video storage.

Note the direction of the arrows indicating which device is initiating the connection, and where it is
going for access. In other words, the video footage is not pushed from the production network to the
engineering workstation. It is accessed via the access controls available in the segmented networks.
These data paths traverse firewalls with access rules.
Historian data are sent to another Historian to mirror the data. A backup is replicated for long-term
storage.

26 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

An engineer monitors the past week’s results from production by accessing a web server. The web
server accesses the database mirror for the engineer’s queries. It does not query the primary Historian
in the production network. The web server can do this, even though the networks have been
segmented.

Logical vs. Physical location. When reading this map, the segments do not necessarily suggest
physical placement. Note the colored highlights, and the matching physical room name. When reading
our network segmentation map, this can illustrate how different hosts connected to a common segment
are not actually in the same room next to each other.

27 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

The above is achieved more realistically, by implementing network segmentation.

28 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Real-World Examples
Example 1: Ukrainian Kyivoblenergo Power Grid - December 23, 2015
 Open-source information available from RTU vendors
 VPNs (plural) into the ICS network, lacked multifactor authentication
 Firewall allowed egress, aiding remote connectivity
 No network security monitoring
Consequence: Power interruptions to 225,000 customers across various locations
Reference: E-ISAC, Analysis of the Cyber Attack on the Ukrainian Power Grid, March 18, 2016

Example 2: RWE AG Power Plant - April 26, 2016 (media reported)

 Infected with [Link] and Conficker
 USB drives also discovered, containing copies of same malware
 Infected ICS hosts, were normally isolated networks
 Infected office hosts, passing the USB drives, also were isolated networks
Consequence: Lack of Internet connectivity for the segments rendered the infection harmless.
Cybersecurity increased upon discovery, without being overwhelmed.
Reference: Reuters, ‘German nuclear plant infected with computer viruses’, April 26, 2016

Network Segmentation Exercise

You will be given questions to guide you as you improve the network segmentation of a
provided network diagram. A debrief video will follow the activity. Activity resources can
be found on the CISA VLP.

29 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

30 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Common Issues
 Existing staff have technical capacity to operate the existing implementation, but not
recreate it.
 Staff do not have knowledge of control system network traffic in detail.
 Packets are believed to be captured for analysis but are not capturing correctly.
 Documentation struggles to exist, due to continued irregular adjustments to the existing
design.
 Purdue model, or similar segmentation, is not observed in the network.
 Public traffic can be accessed from OT-based network hosts.
 Critical data points are not understood.
 Restarting a system is the only known solution to combating a critical data flow issue.
 Fear of debugging systems exists across the IT and OT staff.

Cybersecurity Performance Goals (CPGs)

This is one of the cybersecurity performance goals associated with network segmentation. You will
complete an evaluation using CSET® at the conclusion of this training.
MEDIUM-HIGH COST
HIGH IMPACT
HIGH COMPLEXITY

Wi-Fi Assessment: Concepts and Analysis

 High-level Wireless Communications Discussion
 IEEE 802.11 Protocols, a.k.a., Wi-Fi, and Threats

Radio Spectrum
The image below
depicts the frequency
allocation map of the
U.S. radio spectrum.
Other frequency
allocation maps exist for
other countries as they
use other parts of the
spectrum differently
than the U.S. However,
most of the world uses
the same frequencies
as the U.S.

[Link]

Directional Antennas
Unlike an omni-directional antenna, a directional antenna can only transmit in one direction. Think of a
directional antenna as being like a flashlight. When you turn on a flashlight you can only send light in
one direction.
There is some residual light that shines
behind the flashlight but most of the light
can be seen in front. A directional antenna
does something similar. It can transmit in one direction and
receive from one direction. It can receive from behind, but like a
flashlight, the signal will much weaker.
A directional antenna is very useful in locating a transmitter
because when it is pointed in a certain direction, it will only receive
a signal from that direction. If monitoring the power level of
transmitted signals, the levels will rise significantly as the antenna
is pointed in the direction of a transmitting device. It is very
effective in giving you a general direction of a transmitted signal.

Wi-Fi Spectrum
There are two spectrum bands on which Wi-Fi runs. The first, and most popular, is 2.4 GHz, which
operates from around 2.412 GHz to 2.495 GHz. There are 11 channels in the U.S. and 14 channels in
other countries (for example, Japan). The main channels in use in the U.S. are Channels 1, 6, and 11.
Other channels can be used, but most people do not use them due to overlapping issues, which can
cause network congestion if the two APs are in close proximity. There is even more congestion went
two wireless APs are using the same channel in close proximity. Most default to Channel 6, and so we
find most operators and users plug in a wireless access point, configure the name, leave the channel
alone, and cause network congestion or interference. Other channels can be used as long as the
channels do not overlap.
For 2.4 GHz bands, the
channel width is usually
20-40 MHz depending on
the wireless AP
manufacturer and the
IEEE 802.11 protocol
being used.
Source: [Link]

Wi-Fi Encryption Types

Open – No encryption.

Wired Equivalent Privacy (WEP) – Developed in 1997 and proven to be weak and easily
breakable. An attacker can break through it in a matter of minutes.

Wi-Fi Protected Access (WPA) – Developed as a second-generation to WEP. Additional

encryption was applied to the same algorithms, but it’s not much stronger than WEP.

Wi-Fi Protected Access Version 2 (WPA2) – A complete rewrite of the algorithm in

2004. Worked for years without problem, but there are some issues with it.

Wi-Fi Protected Setup (WPS) – Uses an 8-digit code to protect the passing of a secret
key between two parties (usually the AP and the connecting device such as a laptop).

Wi-Fi Protected Access Version 3 (WPA3) – Next generation of WPA. Provides many
updates to protect users, such as stronger encryption and better password usage.

Wi-Fi CERTIFIED Enhanced Open – A Wi-Fi alliance certification that preserves the
convenience open networks offer while reducing some of the risks.

An AP is constantly broadcasting its own information, so clients are aware of its existence. This
broadcast is called a beacon so devices such as smart phones, laptops, and tablets will be able to
access it and know about its capabilities. The broadcast typically transmits every 50 to 100 ms,
depending on configuration. This broadcast usually contains the name, the source MAC (BSSID),
destination MAC, power, channel, encryption type, cipher type, auth type, name (ESSID), and some
other items.
Wi-Fi clients do not transmit the beacon unless they are acting as a hot spot or AP. As such, a client
does transmit when it is trying to find an AP. When a client sees an AP, it will try to connect to it from a
list of APs it has connected to in the past. Otherwise, it will list the known APs to the user in the
immediate area where it is receiving a signal.

Probe Request

Usually, when the Wi-Fi client is not connected to an AP, the client will send out probe requests in two
ways:
 A general broadcast to all APs in RF range (FF:FF:FF:FF:FF:FF) to get a response from any AP
 A probe request to a specific AP by ESSID and by MAC address.
In a general broadcast, all APs respond with a Probe Response that looks very similar to a Beacon.

Wi-Fi Threats
There are several different ways in which an attacker can access your network. Let’s cover some of
those attack types.
 WEP Attack
 WPS Attack
 Wi-Fi Deauthentication DoS
 Evil Twin (Machine-in-the-Middle) Attack
 WPA/WPA2 Handshake Attack
 QPA2 Key Reinitialization Attack or KRACK

If an access point is configured with WEP, then it will literally be minutes before it is broken into by an
attacker. WEP has been deprecated for many years.
If the Wi-Fi access point is very popular, all the attacker must do is sit and listen for what is called the
initialization vector packets. After the attacker collects enough of these IV packets, they run a cracking
program that will use statistical analysis to derive the WEP encryption key. Then all that is left to do is
to login to the victim’s Wi-Fi access point.
If the access point is not very popular and not many people access it, the attacker can then collect the
right packets and force the access point to deliver the number of IV packets required to crack the
encryption key.
So, the way to do this is to force an unsuspecting user to disconnect from the Wi-Fi access point by
sending a deauthentication (deauth) packet, which will force the unsuspecting Wi-Fi user to handshake
with the access point again, which generates another set of ARP packets that can be used by the
attacker to generate more IV packets. The attacker will send an enormous number of artificially
generated ARP packets to the access point, which then causes the IV to be generated. This process
can be automated so it only takes a few minutes to collect enough data to decrypt the key. Once there
is enough IV data, it is literally seconds for the decryption of the key to take place.

This attack type only requires WPS beacon. Typically, the WPS beacon is broadcast when the button
on the Wi-Fi access point is pressed.

A simple Denial-of-Service (DoS) attack. The attacker broadcasts deauth packets to each Wi-Fi client
trying to connect to the AP. The deauth packet forces the user to disconnect from the AP and to
reauthenticate. The packet is a spoof that looks like it came from the AP but is in fact from the attacker.
Since the packets are continuously broadcast, the users cannot maintain a connection to the AP. This
would allow an attacker sole access to the AP.
Simple devices, such as the Raspberry Pi and ESP 8266, can be configured to spew deauth packets as
the MAC address of each user is learned. The packets can also be broadcast to all clients by NOT
specifying a specific address when using Aireplay-ng, making the attack even simpler and easy to
execute. Problem is, the broadcasts deauth the attackers as well.

A Wi-Fi AP could be configured to look like others in the network. The MAC address could be
duplicated to look like the real thing. The victim will attempt to connect to the access point to establish a
connection. When the connection is attempted, the “Evil Twin” will take the victim’s credentials and
send them on to the intended access point and establish a connection for themselves, as well as a
connection for the victim. The victim thinks they have a connection to the real network, but are
connected to the Evil Twin, opening all connection elements for the attacker.
The list of things in the bottom-left allow the bad guy to steal passwords, access corporate networks,
capture documents, launch other attacks, and a host of other things.
Another reason the victim will connect to the Evil Twin before it connects to the intended access point is
due to the power level of the Evil Twin. The Evil Twin will be configured so it broadcasts at a higher
power level, leading victims to choose the attacker’s access point because the victim believes it is
nearer with a better signal.

The WPA or WPA2 attack is very straightforward and simple. All that is required is to collect the WPA
handshake that occurs when a user connects to the Wi-Fi access point.
If the attacker cannot get the WPA handshake by just listening, the attacker can send a deauth packets
to force the user to disconnect and then reconnect – a process that will expose the WPA handshake.
Once the WPA handshake is captured, the attacker can go away and do some decryption on the WPA
handshake at home or wherever there are computing resources.
If the WPA password is very weak, then it will be a matter of seconds or minutes to crack the
handshake – especially if the password is a dictionary word or a password found in a common
password list. If the password is strong or long and complex, this attack becomes quite difficult and
would require significant computing power.
Once the WPA password is cracked, it is just a matter of logging into the access point and accessing
resources on that network.

This attack came out in 2017 and was a big surprise to the Wi-Fi community. We thought our WPA2
configured Wi-Fi APs were very secure before this attack strategy. It is a simple and straightforward
attack, and surprisingly it did not come out sooner. Again, it is an attack on the 4-way handshake, which
exchanges the encryption key. Once the handshake is complete, the key can be replaced in a new
session with a key the attacker prefers instead of the original key. So, it was just a matter of replacing
the original key with a new key because the standard for WPA2 does not enforce using the key only
once. Newly patched Wi-Fi APs will only allow use of the key once.
Some manufacturers have supplied patches to guard against this attack. This includes commercial
grade APs and home APs. Not all WPA2 APs have a patch, and most APs have not been patched or
do not have a patch. Mitigations must be in place to guard against attacks of this type, and an
organization should measure its risk level and apply the appropriate protections.

Wi-Fi Monitoring Hardware

Wi-Fi monitoring hardware is a small subset of all Wi-Fi hardware devices available. Most of the
hardware built into laptops will not go into monitor mode, meaning an external dongle with a compatible
chipset is required. There are open-source drivers available that have been modified to allow most
Linux installations and a few Windows installations. The majority of installations are Linux on a wide
variety of platforms, from Raspberry Pi to high-end laptops to portable units.
The most important thing to note is the chipset. There are a few compatible
chipsets, including Atheros, Ralink, and Realtek.
This image shows compatible devices widely known to work. The TP-Link
WN722N Version 1 is not the only version that works, but it works best and
has a very low price point, although only in 2.4GHz. The manufacturer
changed the chipset in Version 2 and later, and no longer works with Linux.

IEEE 802.11[x] Support Tools

Tools will capture data for:
 IEEE 802.11[b,g,n] @ 2.4 GHz
 IEEE 802.11[a,n,ac] @ 5.8 GHz
NOTE: There is growing support for IEEE 802.11ac due to some hardware with the correct chipset.

Common Issues
 No communication encryption – Encryption is not used to protect information passed
within to system.
 Wireless access control – There is no mechanism to verify or limit connections to
company-owned devices.
 Direct access to control system via Wi-Fi – Wi-Fi connected devices have the ability
to control and make changes to the ICS.

Cybersecurity Performance Goals (CPGs)

This is one of the CPGs associated with wireless. You will complete an evaluation using CSET® at the
conclusion of this training.
MEDIUM-HIGH COST
HIGH IMPACT
HIGH COMPLEXITY

“The collection, analysis, and escalation of indications and warnings to detect and
respond to intrusions. NSM is a way to find intruders on your network and do something
about them before they damage your enterprise.”
– The Practice of Network Security Monitoring

Having an electronic boundary around the ICS is not sufficient to protect critical assets from
unauthorized access. This is true because for each protection put into place in a network environment,
threat actors can find a method around it.
ICS environments provide a unique opportunity when considering protection mechanisms to place on
the network. Despite considerable network traffic, that traffic is very predictable. For example, in a
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
46 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
typical ICS environment, the PLC communicates in a standardized way with the HMI and the Historian;
all applications and services on the process control system (PCS) network are known (or should be);
and the protocols, web traffic, and proprietary traffic are known and predictable.
Asset owners can use an intrusion detection system (IDS) solution to easily monitor and create alarms
for any traffic outside normal operations. An IDS is based on the passive monitoring of network traffic.
Expected network traffic is deterministic, and deviations are used as triggers for alerting. Simple rules
can be written to monitor for IP sources and destinations, protocols, lengths of packets, etc.

Philosophies
"Even the bravest cyber defense will experience defeat when weaknesses are neglected."
- Stephane Nappo
"As we've come to realize, the idea that security starts and ends with the purchase of a
prepackaged firewall is simply misguided."
-Art Wittmann
"If security were all that mattered, computers would never be turned on, let alone hooked
into a network with literally millions of potential intruders."
-Dan Farmer

Network Monitoring Types

Passive monitoring / discovery silently analyzes network traffic through
a span port or tap to identify endpoints and traffic patterns.
• NIDS/HIDS
• Full packet capture
• Centralized logging
• System Monitoring
Active monitoring / discovery works by sending test traffic into the
network and polling endpoints that traffic contacts.
• Scanning – Nmap or Nessus
• PenTesting
• Policy Based – Allow-listing, GPO, Tripwire

Hybrid solutions - For an ICS to be successful, a hybrid monitoring

solution is needed. OT environments require both passive and active monitoring to be effective.
• Security information and event monitoring (SIEM)
People!!

48 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
 A central log server can
assist in threat
identification or incident
investigation by
providing a
chronological list of
events – providing a
more complete, bigger
picture.
 Correlating with other
logs can sometimes
make the difference
between recognizing an
event for what it is (true
or false) and then
acting accordingly.
 Physical Security logs
can help to identify an
insider threat that has
physically accessed the
computer systems.

49 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
 In this example, we
send our logs to
the central control
centers and field
devices to an ICS
Log Server.
 The ICS Log
Server forwards
data to the
Centralized Log
servers
 These Log servers
should be placed in
a high security
area of the
network.

50 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Monitoring Control System
 Monitoring and management of control system
 Devices, protocols, communications, user accounts, product / firmware versions, device
settings
 Host intrusion detection (HIDS)
 Network intrusion detection (NIDS)
 Protection of control system
 Boundary and security zone (Firewalls / Data Diodes)
 Application and Media allow-listing
 Compliance audit and change management

Evaluating Network Monitoring

 NIST 800-53 Control - AU-6 - Audit Review, Analysis, and Reporting
• Consistently part of CISA AES - Validated Architecture Design Review (VADR) findings.
 Control:
a. Reviews and analyzes information system audit on at least on a weekly basis for
indications of inappropriate or unusual activity; and
b. Reports findings to organization-defined personnel or roles.
 Additional Guidance
a. Process Integration
b. Correlate Audit Repositories
c. Integration of Scanning and Monitoring Capabilities
d. Correlation of Physical Monitoring
 Policy needed to govern review of log data analysis

Network Monitoring Policy

 Log and Monitoring Policy should define:
 Purpose of monitoring and logging
 Who is responsible for audit logging and review
 Frequency of log and audit review
 Requirements for system owners
 Activities to be logged (systems, applications)
 Format of logs and storage
 Protecting logs from risk
 Administrative responsibilities

51 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Data
There are many data types and collection tools. A few of which are listed in the table below:

Log Sources
Below are some commonly used logs, many of which are used in ICS environments. ICS vendors may
be able to provide additional information on application-specific logs or third-party tools.

• Firewalls
• IDS Logs (Zeek and Snort)
• VPN Servers (may be part of Firewall logs)
• Operating Systems (e.g., Windows, *nix, Mac)
• Proxy Server
• Web Servers (e.g., IIS, Apache, Nginx)
• Databases (e.g., MS SQL, Oracle, MySQL)
• Other (e.g., PLCs, HMIs)

Snort IDS/IPS
Snort is an open-source deep packet inspection intrusion detection system (IDS) or intrusion prevention
system (IPS). Snort is widely used and has become the standard for IPS/IDS. Learning to write Snort
rules is useful because most IPS/IDS applications will either use the Snort rule format or provide a way
to import Snort rules.
In an ICS environment, Snort is beneficial to ensure expected commands are being sent to your
devices. Snort has ICS-specific preprocessors that enable you to easily identify functions from Modbus
and DNP3 on your network. The following links provide more information about the Modbus and DNP3
preprocessors: [Link] [Link]

52 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
What to Monitor?
 Malware
 Failed Logins
 Specific Event Codes – OS / Network
 Unexpected Function Codes
 Unexpected IP Addresses
 Unexpected Protocols
 Anomalies
 Continuous Monitoring

Network Monitoring Concerns

False Positives - A legitimate network event alerted by the solution as a potential problem.
False negative - A malicious event that occurred but was not detected by the security architecture.
Unknown – Events detected by the solution requiring additional investigation.

How is Incident Response Supposed to Work?

Incident Response Plan

1. Overview, goals, and objectives 2. Response actions
3. Incident description 4. Communications
5. Incident detection 6. Forensics
7. Incident notification 8. Incident analysis
9. Additional sections – tabletops,
playbooks, contact lists, etc.
“Developing an Industrial Control Systems Cybersecurity Incident Response Capability,”
– DHS, October 2009

53 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Incident Response Questions
 Does the organization have written incident response procedures for the ICS Network that
include a definition of personnel roles for handling incidents?
 Does the organization conduct table-top exercises yearly to evaluate responses to a designated
threat scenario?
 Does the organization maintain third-party contact information to be used in security incident
reporting?
 Does the organization ensure incident handling team personnel understand current threats and
risks, as well as their responsibilities, by conducting periodic incident scenario sessions?
 Are auditable events adequate to support after-the-fact investigations of security incidents?

Review

54 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Little Bobby

Cybersecurity Performance Goals (CPGs)

This is one of the cybersecurity performance goals associated with network monitoring. You will
complete an evaluation using CSET® at the conclusion of this training.
LOW COST
HIGH IMPACT
LOW COMPLEXITY

LOW COST
HIGH IMPACT
LOW COMPLEXITY

55 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
MEDIUM-LOW COST
HIGH IMPACT
MEDIUM
COMPLEXITY

MEDIUM-HIGH
COST
HIGH IMPACT
LOW COMPLEXITY

56 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO6: Identify Risk Using OPSEC and OSINT
In this objective we will apply OPSEC and OSINT methods to identify potentially exposed information.

Threats
 Adversaries leverage public information to
develop attack paths and techniques
targeting company information
 Successful attackers learn about their
targeted organization’s security posture
through profiling and footprinting
 There is generally a TON of information
that can be found
 Critical Infrastructure and control systems
are increasingly popular targets

That same day as the Austrian ski resort shut down, a “malfunction” with the same HMI and controls
vendor in Gudauri, Georgia happened. Coincidence?

ICS Incidents
In the January 2019 Worldwide Threat Assessment Report, the Director of National Intelligence calls out
specific countries as actively mapping our Nation’s critical infrastructure for the purpose of causing
substantial damage to our way of life.

“[Nation States are] mapping our

critical infrastructure with the long-
term goal of being able to cause
substantial damage.”
– DNI

They are not targeting my network.

But what if they already know it better than you?
What can they do?

Bowman Avenue Dam

Purpose: Kept basements from flooding in a suburban neighborhood
Details: Began operation in 2013
• Sluice gate: 15 ft. wide x 2.5 ft. high
• SCADA system running a modern and complex array of sensors in the waterway used to
automatically control the sluice gate, adjusting flow rate accordingly
Specifics: Found by scanning the Internet for SCADA systems – connected via cellular modem. Attacked
by Iran’s Revolutionary Guards Corps.

Operations Security (OPSEC)

 Military origins – “Loose Lips Sink Ships”
 It is a process, NOT a set of rules
 Identify critical information
 Analyze threats
 Analyze vulnerabilities
 Assess risks
 Apply countermeasures
 Physical and cyber applications
 Should be part of your cybersecurity plan
 Should be integrated and synchronized throughout the organization

 Bits of information are puzzle pieces

 Even your small bits help complete
the picture

Open-Source Intelligence
(OSINT)
OSINT is gathering information from publicly
available sources to be used in an intelligence
context.
There are many tools and techniques available for gathering and organizing information. We will
introduce you to a few of the tools and techniques to highlight how and what types of information can
be gathered about an organization.
 Tools and techniques:
 Social media
 Internet Archive
 Builtwith
 [Link]
 [Link] / Shodan
 Google hacking
 Maltego
 Networking tools Nmap, nslookup, dig, etc.
 It is not just what you put out there, but what is publicly available about you (e.g., FCC,
regulatory info, contracts)
 Antennasearch – Strava

OSINT Historical Examples

Below are just a few categories and examples to learn from with regards to OSINT security.

Hi-res Angle of
Elliptical shape
image sun’s
of circular object
shadow

Even if information on the Internet is removed, there are various sources that archive old data, such as
the Internet archive or “Way Back Machine.” If information is critical, extra steps may need to be taken
to secure it.
[Link]
Sometimes useful information can be derived using other sources. Old websites or files thought
inaccessible can still be found using the correct tools or resources.
Example: “I’m a MAC, I’m a PC” campaign website.
Antennasearch
Some sources may be out
of your control.
This is an example of
antenna data that can
search a prescribed area
and report back information
on the local antennas,
including installation
location, contact
information, and more. When using certain tools or resources, certain information may leave your
control and it can be important to know what is publicly made available and be aware of it.
Mobile Phones Tracking (Strava)
This is an image of a health application creating a “heat map” using
user tracking data.
If you knew an app tracked not only movement, but also when and
how long a person was stationary, what detail can you infer from this
heat map image?
Strava originally had an “opt-out” option that required participants to
manually opt-out of being tracked. When soldiers installed it on their
phones, heat maps of their movement were tracked and displayed
on Strava’s website. Several military installation locations were revealed for multiple countries.

Hawaii Emergency Management Agency OPSEC Exercise

Identify as many
OPSEC errors as
you can from the
image and record
them.
Activity resources
can be found on the
CISA VLP.

Analyze Vulnerabilities
In simple terms, threat can be thought of as the strength of the adversary, and vulnerability the
weakness of an organization. Identify OPSEC indicators and compare them against the adversary’s
intelligence gathering capabilities. How would someone exploit the network, employees, or operations
to get inside and do damage? IT and OT leaders should be sure they know the network in order to
determine its potential flaws. Employees should be aware of potential social engineering attacks. Every
machine should be audited regularly to ensure it is free of spyware and malware.

Assess Risk
Risk is based on the amount of harm a vulnerability may allow if exploited by an adversary, combined
with the probability of the vulnerability being exploited.

The probability of compromise is greatest when the threat is very capable and dedicated, while friendly
organizations are simultaneously exposed. Threats range from low to high. Once you know what kind of
security threats you have and where your most vulnerable areas are, you can determine the risk and
what needs to be done. Analyze vulnerabilities along with available countermeasures. You can
outsource your operations, but you cannot outsource your risk!

Apply Countermeasures
OPSEC planning is useless without OPSEC application. Threats are different for different
organizations, but every identified weakness or vulnerability deserves focused attention. Whether you
are implementing policy improvements or buying a new security appliance, the costs of good security
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
67 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
are generally far less than the costs of a breach or production outage. Doing something is better than
doing nothing.
Below are recommendations for an OPSEC plan — the format is organization-specific; however, plans
should generally include:
 References
 General mission / program description
 Security responsibilities
 Critical information list (CIL)
 Indicators
 Threat
 Vulnerabilities
 Risk determination
 Countermeasures
 Management decision on which countermeasures to implement
 Public affairs
 Training
 Supporting units / associated programs
 Resources utilized

Common Issues
Common issues associated with OPSEC/OSINT include:
 Content published by the organization is not reviewed for security risks and sensitive
information
 No password policy, potentially leaving default passwords on Internet-connected devices.
Passwords on sticky notes
 Social media posts revealing sensitive company information
 No governance on system deployments resulting in unidentified assets potentially open
externally
 Use of unsupported or unpatched software on external systems
 Flat network architecture and use of routable IP addresses exposing control systems externally
 Use of non-company-owned devices accessing information systems
 Staff are not trained on OPSEC and cybersecurity issues
 Laptops are not protected from loss outside of the facility; No full disk encryption
 Physical access is not monitored
 Computing equipment tossed in the trash without proper data destruction or sanitization

Cybersecurity Performance Goals (CPGs)

This is one of the CPGs associated with OSINT and OPSEC. You will complete an evaluation using
CSET® at the conclusion of this training.
LOW COST
HIGH IMPACT
MEDIUM
COMPLEXITY

LOW COST
HIGH IMPACT
LOW
COMPLEXITY

MEDIUM-HIGH
COST
MEDIUM
IMPACT
MEDIUM
COMPLEXITY

Normally, risk assessment is a determination of quantitative or qualitative risk related to a well-defined

situation and a recognized threat based on magnitude of potential loss, and the probability loss will
occur. However, in evaluating adversarial risk we will be looking at various ways an aggressor looks at
and traverses a victim's network to identify potential attack targets and paths to achieve their goals.
Armed with this aggressor perspective, it is easier to identify and apply appropriate mitigations to
minimize adversarial risk.

71 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Phishing Exercise
You will learn about and craft a phishing email, as well as evaluate other sample
phishing emails for how effective they may be. Activity resources can be found on
the CISA VLP.

Adversarial Tactics and Techniques

Attackers use several tactics and techniques to initially access and then move through a network. The
ICS Matrix is constantly being updated and improved to include new and different tactics and
techniques and can be found at [Link] The following flowchart will walk you through
several adversarial tactics and associated techniques used in those tactics.

Reference: © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE
Corporation.

Initial Access
Drive-by Compromise – Adversaries may gain access to
a system during a drive-by compromise, when a user
visits a website as part of a regular browsing session. With
this technique, the user's web browser is targeted and
exploited simply by visiting the compromised website.
Exploit Public-Facing Application – Adversaries may
leverage weaknesses to exploit Internet-facing software
for initial access into an industrial network. Internet-facing
software may be user applications, underlying networking implementations, an assets operating
system, weak defenses, etc.
Exploitation of Remote Services – Adversaries may exploit a software vulnerability to take advantage
of a programming error in a program, service, or within the operating system software or kernel itself to
enable remote service abuse.

72 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
External Remote Services – Adversaries may leverage external remote services as a point of initial
access into your network. These services allow users to connect to internal network resources from
external locations. Examples are VPNs, Citrix, and other access mechanisms.
Internet Accessible Device – Adversaries may gain access into industrial environments through
systems exposed directly to the Internet for remote access rather than through External Remote
Services. Internet Accessible Devices are exposed to the Internet unintentionally or intentionally without
adequate protections.
Remote Services – Adversaries may leverage remote services to move between assets and network
segments. These services are often used to allow operators to interact with systems remotely within the
network, some examples are RDP, SMB, SSH, and other similar mechanisms.
Replication Through Removable Media – Adversaries may move onto systems, such as those
separated from the enterprise network, by copying malware to removable media that is then inserted
into the control systems environment. The adversary may rely on unknowing trusted third parties, such
as suppliers or contractors with access privileges, to introduce the removable media.
Rogue Master – Adversaries may set up a rogue master to leverage control server functions to
communicate with outstations. A rogue master can be used to send legitimate control messages to
other control system devices, affecting processes in unintended ways.
Spear Phishing Attachment – Adversaries may use a spear phishing attachment, a variant of spear
phishing, as a form of a social engineering attack against specific targets. Spear phishing attachments
are different from other forms of spear phishing in that they employ malware attached to an email.
Supply Chain Compromise – Adversaries may perform supply chain compromise to gain control
systems environment access by means of infected products, software, and workflows. Supply chain
compromise is the manipulation of products, such as devices or software, or their delivery mechanisms
before receipt by the end consumer.
Transient Cyber Asset – Adversaries may target devices that are transient across ICS networks and
external networks. Normally, transient assets are brought into an environment by authorized personnel
and do not remain in that environment on a permanent basis.
Wireless Compromise – Adversaries may perform wireless compromise as a method of gaining
communications and unauthorized access to a wireless network. Access to a wireless network may be
gained through the compromise of a wireless device.
As noted, there are many ways to get initial access to a system. Some require user interaction, some
do not. By far the easiest way is through email phishing. A well written phishing email message is
relatively easy to deliver but hard to defend against.
Execution
Change Operating Mode – Adversaries may
change the operating mode of a controller to gain
additional access to engineering functions such
as Program Download. Programmable controllers
typically have several modes of operation that
control the state of the user program and control
access to the controller’s API.

73 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Command-Line Interface – Adversaries may utilize command-line interfaces (CLIs) to interact with
systems and execute commands. CLIs provide a means of interacting with computer systems and are a
common feature across many types of platforms and devices within control systems environments.
Execution through API – Adversaries may attempt to leverage Application Program Interfaces (APIs)
used for communication between control software and the hardware. Specific functionality is often
coded into APIs, which can be called by software to engage specific functions on a device or other
software.
Graphical User Interface – Adversaries may attempt to gain access to a machine via a Graphical User
Interface (GUI) to enhance execution capabilities. Access to a GUI allows a user to interact with a
computer in a more visual manner than a CLI.
Hooking – Adversaries may hook into application programming interface (API) functions used by
processes to redirect calls for execution and privilege escalation means. Windows API functions are
typically stored in dynamic-link libraries (DLLs) as exported functions. One type of hooking seen in ICS
involves redirecting calls to these functions via import address table (IAT) hooking. IAT hooking uses
modifications to a process IAT, where pointers to imported API functions are stored.
Modify Controller Tasking – Adversaries may modify the tasking of a controller to allow for the
execution of their own programs. This can allow an adversary to manipulate the execution flow and
behavior of a controller.
Native API – Adversaries may directly interact with the native OS application programming interface
(API) to access system functions. Native APIs provide a controlled means of calling low-level OS
services within the kernel, such as those involving hardware / devices, memory, and processes.
Scripting – Adversaries may use scripting languages to execute arbitrary code in the form of a pre-
written script or in the form of user-supplied code to an interpreter. Scripting languages are
programming languages that differ from compiled languages, in that scripting languages use an
interpreter, instead of a compiler.
User Execution – Adversaries may rely on a targeted organization’s user interaction for the execution
of malicious code. User interaction may consist of installing applications, opening email attachments, or
granting higher permissions to documents. Adversaries may embed malicious code or visual basic
code into files such as Microsoft Word and Excel documents or software installers.
Persistence
Modify Program – Adversaries may modify or add a
program on a controller to affect how it interacts with
the physical process, peripheral devices and other
hosts on the network. Modification to controller
programs can be accomplished using a Program Download in addition to other types of program
modification such as online edit and program append.
Module Firmware – Adversaries may install malicious or vulnerable firmware onto modular hardware
devices. Control system devices often contain modular hardware devices. These devices may have
their own set of firmware separate from the firmware of the main control system equipment.
Project File Infection – Adversaries may attempt to infect project files with malicious code. These
project files may consist of objects, program organization units, variables such as tags, documentation,
and other configurations needed for PLC programs to function.

74 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
System Firmware – System firmware on modern assets is often designed with an update feature.
Older device firmware may be factory installed and require special reprogramming equipment. When
available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades.
Valid Accounts – Adversaries may rely on a targeted organization’s user interaction for the execution
of malicious code. User interaction may consist of installing applications, opening email attachments, or
granting higher permissions to documents.
Privilege Escalations
Exploitation for Privilege Escalation –
Adversaries may exploit software vulnerabilities
in an attempt to elevate privileges. Exploitation
of a software vulnerability occurs when an adversary takes advantage of a programming error in a
program, service, or within the operating system software or kernel itself to execute adversary-
controlled code.
Hooking – Adversaries may hook into application programming interface (API) functions used by
processes to redirect calls for execution and privilege escalation means.
Evasion
Change Operating Mode – Operating modes can be
physically selected using a key switch on the face of
the controller but may also be selected with calls to
the controller’s API.
Exploitation for Evasion – Adversaries may exploit a
software vulnerability to take advantage of a programming error in a program, service, or within the
operating system software or kernel itself to evade detection. Vulnerabilities may exist in software that
can be used to disable or circumvent security features
Indicator Removal on Host – Adversaries may attempt to remove indicators of their presence on a
system in an effort to cover their tracks. In cases where an adversary may feel detection is imminent,
they may try to overwrite, delete, or cover up changes they have made to the device.
Masquerading – Adversaries may use masquerading to disguise a malicious application or executable
as another file, to avoid operator and engineer suspicion. Disguises for these masquerading files can
include commonly found programs, expected vendor executables and configuration files, and other
commonplace applications and naming conventions.
Rootkit – Adversaries may deploy rootkits to hide the presence of programs, files, network
connections, services, drivers, and other system components. Rootkits are programs that hide the
existence of malware by intercepting and modifying operating system API calls that supply system
information.
Spoof Reporting Message – Adversaries may spoof reporting messages in control system
environments for evasion and to impair process control. In control systems, reporting messages contain
telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process.
Discovery
Network Connection Enumeration – Adversaries
may perform network connection enumeration to
discover information about device communication
patterns. If an adversary can inspect the state of a
network connection with tools, such as Netstat, in
75 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
conjunction with System Firmware, then they can determine the role of certain devices on the network.
The adversary can also use Network Sniffing to watch network traffic for details about the source,
destination, protocol, and content.
Network Sniffing – Network sniffing is the practice of using a network interface on a computer system
to monitor or capture information regardless of whether it is the specified destination for the information.
Remote System Discovery – Adversaries may attempt to get a listing of other systems by IP address,
hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement
or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities
available on the operating system or vendor software could also be used.
Remote System Information Discovery – An adversary may attempt to get detailed information about
remote systems and their peripherals, such as make / model, role, and configuration. Adversaries may
use information from Remote System Information Discovery to aid in targeting and shaping follow-on
behaviors.
Wireless Sniffing – Adversaries may perform wireless compromise as a method of gaining
communications and unauthorized access to a wireless network. Access to a wireless network may be
gained through the compromise of a wireless device. Adversaries may also utilize radios and other
wireless communication devices on the same frequency as the wireless network.
Lateral Movement
Default Credentials – Adversaries may leverage
manufacturer or supplier default credentials on
control system devices. These default credentials
may have administrative permissions and may be
necessary for initial configuration of the device.
Exploitation of Remote Services – Adversaries may exploit a software vulnerability to take advantage
of a programming error in a program, service, or within the operating system software or kernel itself to
enable remote service abuse. A common goal for post-compromise exploitation of remote services is
for initial access into and lateral movement throughout the ICS environment to enable access to
targeted systems.
Lateral Tool Transfer – Adversaries may transfer tools or other files from one system to another to
stage adversary tools or other files over the course of an operation. Copying of files may also be
performed laterally between internal victim systems to support Lateral Movement with remote Execution
using inherent file sharing protocols such as file sharing over SMB to connected network shares.
Program Download – Adversaries may perform a program download to transfer a user program to a
controller. Variations of program download, such as online edit and program append, allow a controller
to continue running during the transfer and reconfiguration process without interruption to process
control.
Remote Services – Adversaries may leverage remote services to move between assets and network
segments. These services are often used to allow operators to interact with systems remotely within the
network, some examples are RDP, SMB, SSH, and other similar mechanisms. Remote services could
be used to support remote access, data transmission, authentication, name resolution, and other
remote functions.
Valid Accounts – Adversaries may steal the credentials of a specific user or service account using
credential access techniques. In some cases, default credentials for control system devices may be
publicly available.
76 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Collection
Automated Collection – Adversaries may automate
collection of industrial environment information using
tools or scripts. This automated collection may
leverage native control protocols and tools available
in the control systems environment.
Data from Information Repositories – Adversaries
may target and collect data from information
repositories. This can include sensitive data such as
specifications, schematics, or diagrams of control system layouts, devices, and processes.
Detect Operating Mode – Adversaries may gather information about a PLC or controller’s current
operating mode. Operating modes dictate what change or maintenance functions can be manipulated
and are often controlled by a key switch on the PLC (e.g., run, prog [program], and remote).
I/O Image – Adversaries may seek to capture process values related to the inputs and outputs of a
PLC. During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. The
image table is the PLCs internal storage location where values of inputs / outputs for one scan are
stored while it executes the user program.
Machine-in-the-Middle – Adversaries with privileged network access may seek to modify network
traffic in real-time using machine-in-the-middle (MiTM) attacks. This type of attack allows the adversary
to intercept traffic to and/or from a particular device on the network.
Monitor Process State – Adversaries may gather information about the physical process state. This
information may be used to gain more information about the process itself or used as a trigger for
malicious actions.
Point & Tag Identification – Adversaries may collect point and tag values to gain a more
comprehensive understanding of the process environment. Points may be values such as inputs,
memory locations, outputs, or other process specific variables. Tags are the identifiers given to points
for operator convenience.
Program Upload – Adversaries may attempt to upload a program from a PLC to gather information
about an industrial process. Uploading a program may allow them to acquire and study the underlying
logic.
Screen Capture – Adversaries may attempt to perform screen capture of devices in the control system
environment. Screenshots may be taken of workstations, HMIs, or other devices that display
environment-relevant process, device, reporting, alarm, or related data. These device displays may
reveal information regarding the ICS process, layout, control, and related schematics.
Wireless Sniffing – Adversaries may seek to capture radio frequency (RF) communication used for
remote control and reporting in distributed environments. RF communication frequencies vary between
3 kHz to 300 GHz, although are commonly between 300 MHz to 6 GHz. The wavelength and frequency
of the signal affect how the signal propagates through open air, obstacles (e.g. walls and trees) and the
type of radio required to capture them.
Command and Control
Commonly Used Port – Adversaries may
communicate over a commonly used port to
bypass firewalls or network detection systems
and to blend in with normal network activity,
77 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
to avoid more detailed inspection. They may use the protocol associated with the port, or a completely
different protocol.
Connection Proxy – Adversaries may use a connection proxy to direct network traffic between
systems or act as an intermediary for network communications. The definition of a proxy can also be
expanded to encompass trust relationships between networks in peer-to-peer, mesh, or trusted
connections between networks consisting of hosts or systems that regularly communicate with each
other.
Standard Application Layer Protocol – Adversaries may establish command and control capabilities
over commonly used application layer protocols such as HTTP(S), OPC, RDP, Telnet, DNP3, and
Modbus. These protocols may be used to disguise adversary actions as benign network traffic.
Inhibit Response Function
Activate Firmware Update Mode –
Adversaries may activate firmware update
mode on devices to prevent expected
response functions from engaging in reaction
to an emergency or process malfunction.
Alarm Suppression – Adversaries may
target protection function alarms to prevent
them from notifying operators of critical
conditions. Alarm messages may be a part of
an overall reporting system and of particular
interest to adversaries.
Block Command Message – Adversaries may block a command message from reaching its intended
target to prevent command execution. In OT networks, command messages are sent to provide
instructions to control system devices. A blocked command message can inhibit response functions
from correcting a disruption or unsafe condition.
Block Reporting Message – Adversaries may block or prevent a reporting message from reaching its
intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values)
pertaining to the current state of equipment and the industrial process. By blocking these reporting
messages, an adversary can hide their actions from an operator.
Block Serial Communication – Adversaries may block access to serial communication ports (COM) to
prevent instructions or configurations from reaching target devices. Serial COM allow communication
with control system devices.
Data Destruction – Adversaries may perform data destruction over the course of an operation. The
adversary may drop or create malware, tools, or other non-native files on a target system to accomplish
this, potentially leaving behind traces of malicious activities.
Denial-of-Service – Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected
device functionality. Examples of DoS attacks include overwhelming the target device with a high
volume of requests in a short period and sending the target device a request it does not know how to
handle.
Device Restart / Shutdown – Adversaries may forcibly restart or shutdown a device in an ICS
environment to disrupt and negatively impact physical processes. Methods of device restart and
shutdown exist in some devices as built-in, standard functionalities.

78 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Manipulate I/O Image – Adversaries may manipulate the I/O image of PLCs through various means to
prevent them from functioning as expected. Methods of I/O image manipulation may include overriding
the I/O table via direct memory manipulation or using the override function used for testing PLC
programs.
Modify Alarm Settings – Adversaries may modify alarm settings to prevent alerts that may inform
operators of their presence or to prevent responses to dangerous and unintended scenarios.
Rootkit – Adversaries may deploy rootkits to hide the presence of programs, files, network
connections, services, drivers, and other system components. Rootkits are programs that hide the
existence of malware by intercepting and modifying operating system API calls that supply system
information.
Service Stop – Adversaries may stop or disable services on a system to render those services
unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or
aid in the adversary's overall objectives to cause damage to the environment.
System Firmware – System firmware on modern assets is often designed with an update feature.
Older device firmware may be factory installed and require special reprogramming equipment. When
available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades.
Impair Process Control
Brute Force I/O – Adversaries may
repetitively or successively change I/O point
values to perform an action. Brute Force I/O
may be achieved by changing either a range
of I/O point values or a single point value
repeatedly to manipulate a process function.
Modify Parameter – Adversaries may modify parameters used to instruct industrial control system
devices. These devices operate via programs that dictate how and when to perform actions based on
such parameters.
Module Firmware – Adversaries may install malicious or vulnerable firmware onto modular hardware
devices. Control system devices often contain modular hardware devices. These devices may have
their own set of firmware separate from the firmware of the main control system equipment.
Spoof Reporting Message – Adversaries may spoof reporting messages in control system
environments for evasion and to impair process control. In control systems, reporting messages contain
telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process.
Unauthorized Command Message – Adversaries may send unauthorized command messages to
instruct control system assets to perform actions outside their intended functionality, or without the
logical preconditions to trigger their expected function.

79 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Impact
Damage to Property – Adversaries may
cause damage and destruction of property to
infrastructure, equipment, and the
surrounding environment when attacking
control systems. This technique may result in
device and operational equipment
breakdown, or represent tangential damage
from other techniques used in an attack.
Denial-of-Control – Adversaries may cause
a denial-of-control to temporarily prevent
operators and engineers from interacting with process controls. An adversary may attempt to deny
process control access to cause a temporary loss of communication with the control device or to
prevent operator adjustment of process controls.
Denial-of-View – Adversaries may cause a denial-of-view in an attempt to disrupt and prevent operator
oversight on the status of an ICS environment. This may manifest itself as a temporary communication
failure between a device and its control source, where the interface recovers and becomes available
once the interference ceases.
Loss of Availability – Adversaries may attempt to disrupt essential components or systems to prevent
owners / operators from delivering products or services. Adversaries may leverage malware to delete or
encrypt critical data on HMIs, workstations, or databases.
Loss of Control – Adversaries may seek to achieve a sustained loss of control or a runaway condition
in which operators cannot issue any commands even if the malicious interference has subsided.
Loss of Productivity and Revenue – Adversaries may cause loss of productivity and revenue through
disruption and even damage to the availability and integrity of control system operations, devices, and
related processes. This technique may manifest as a direct effect of an ICS-targeting attack or
tangentially, due to an IT-targeting attack against non-segregated environments.
Loss of Protection – Adversaries may compromise protective system functions designed to prevent
the effects of faults and abnormal conditions. This can result in equipment damage, prolonged process
disruptions and hazards to personnel. Many faults and abnormal conditions in process control happen
too quickly for a human operator to react to.
Loss of Safety – Adversaries may compromise safety system functions designed to maintain safe
operation of a process when unacceptable or dangerous conditions occur. Safety systems are often
composed of the same elements as control systems but have the sole purpose of ensuring the process
fails in a predetermined safe manner.
Loss of View – Adversaries may cause a sustained or permanent loss of view where the ICS
equipment will require local, hands-on operator intervention; for instance, a restart or manual operation.
By causing a sustained reporting or visibility loss, the adversary can effectively hide the present state of
operations. This loss of view can occur without affecting the physical processes themselves.
Manipulation of Control – Adversaries may manipulate physical process control within the industrial
environment. Methods of manipulating control can include changes to set point values, tags, or other
parameters. Adversaries may manipulate control systems devices or leverage their own, to
communicate with and command physical control processes.

80 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Manipulation of View – Adversaries may attempt to manipulate the information reported back to
operators or controllers. This manipulation may be short term or sustained. During this time the process
itself could be in a much different state than what is reported. Operators may be fooled into doing
something harmful to the system in a loss of view situation.
Theft of Operational Information – Adversaries may steal operational information on a production
environment as a direct mission outcome for personal gain or to inform future operations. This
information may include design documents, schedules, rotational data, or similar artifacts that provide
insight on operations.
Additional Resources
MITRE ATT&CK® Knowledge Base
Pre-Att&ck Matrix – [Link]
Enterprise Matrix – [Link]
Industrial Control System Matrix – [Link]

Common Issues
 No general cybersecurity awareness training – staff are not receiving cybersecurity awareness
training
 Multi-use systems – Particular host is used to perform multiple tasks that increase risk because
of the multiple resources they access
 Systems diagrams and documentation is missing / incomplete

Cybersecurity Performance Goals (CPGs)

These are several of the cybersecurity performance goals associated with adversarial risk. You will
complete an evaluation using CSET® at the conclusion of this training.
Low Cost
HIGH IMPACT
LOW COMPLEXITY

MEDIUM-HIGH
COST
MEDIUM IMPACT
HIGH COMPLEXITY

81 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

82 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO8. Determine ICS Dependencies
In this objective we will delve into infrastructure dependencies, both internal and external to ICS
systems. This brings us to determining ICS dependencies.

Infrastructure and Dependencies

Infrastructure: Engineered systems and facilities that enable and enhance a community’s ability to
meet societal demands by facilitating the production, transport (transmission), and consumption of
goods and services.
Dependency: A relationship between two infrastructures through which the state of the providing
infrastructure influences the other.
Critical Infrastructure Sectors and
Lifeline Sectors
Of the 16, four are essential to the
operation of the other critical infrastructure
sectors. These are called “Lifeline”
sectors:
• Water / Wastewater Systems
• Energy
• Communications
• Transportation
Every critical infrastructure sector relies
on one or more of the lifeline sectors
(Water, Energy, Communications, and
Transportation) to maintain functionality.
But this reliance upon those sectors is
also true of each of the lifeline sectors themselves. For example, the Energy and Communications
sectors have a foundational role in the operations of other sectors’ systems. But both Energy and
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
83 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Communications services are also reliant on each other to maintain that baseline functionality – in the
case of the Energy Sector, Industrial Control System and vulnerability management is dependent on
reliable network service; for the Communications Sector, electricity underpins the ability for those and
other network capabilities. In addition, the Energy Sector is reliant upon both the Water and
Transportation sectors, for cooling and the transit of precursor materials, respectively.

Dependency and Dependency Types

What is your company dependent on
from the outside?
Cross-Sector Dependency: A dependency between
infrastructure from different sectors (e.g., water and
energy).
Interdependency: The products or services provided to
one infrastructure by another external infrastructure that
are necessary to support its operations and functions.
Intradependency: The interactions among internal
operations, functions, and missions of the infrastructure.
Internal dependencies are the internal links among the
assets constituting a critical infrastructure (e.g., an
electric generating plant that depends on cooling water
from its own onsite water well).

Example of dependency flow from source to

distributor to consumer.

Interdependencies
Looking at the example image above, find where the flow of water starts and map it to the various
destinations. At what points does the water move from one infrastructure to another?
__________________________________________________________________________________
__________________________________________________________________________________
Intradependency
Looking at the example image again, identify the potential internal links within an infrastructure. Which
ones do you notice?
__________________________________________________________________________________
__________________________________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
85 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Deer Island Treatment Plant Wastewater Collection and Treatment

Where Does All the Sewage Come From?

From people using water in kitchens and bathrooms in their homes and from commercial and industrial
use. Nearly half the state's population, over 2 million people in 43 communities, send sewage to
MWRA's treatment plants on the shores of Boston Harbor. Over 5,500 businesses and industries
contribute wastewater as well. In addition, nearly half of the total flow in MWRA sewers is from rainy-
weather street runoff and from below-ground cracks and faulty connections that allow groundwater into
the system.

______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
86 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
How Does Sewage Get to the Treatment Plants?
Sewage travels through three different sets of pipes. Water used in a home or industry is flushed
through a building's pipes until it reaches local sewers owned and operated by city and town sewer
departments. These 5,100 miles of local sewers transport the wastewater into 227 miles of MWRA
interceptor sewers. The interceptor sewers, ranging from 8 inches to 11 feet in diameter, carry the
region's wastewater to two MWRA treatment plants. Though most of the wastewater flows by gravity
some low-lying areas require pumping.
How Does Sewage Treatment Work?
MWRA provides preliminary primary and secondary treatment to its wastewater flows at the Deer Island
Treatment Plant. The first phase of secondary treatment began operating in July 1997. The treatment
process is as follows:
 Collection and Pumping
Sewage is piped from communities to several headworks where bricks, logs and other large
objects are screened out. Pumps draw the sewage through deep-rock tunnels under the harbor
to Deer Island.
 Preliminary Treatment
Mud and sand settle in a tank called a grit chamber. Later, this material, known as grit and
screenings, is taken to a landfill for environmentally safe disposal.
 Primary Treatment
The sewage then flows to primary settling tanks where up to 60% of the solids in the waste
stream settle out as a mixture of sludge and water. This primary treatment removes very few
toxic chemicals.
 Secondary Treatment
In the secondary treatment plant oxygen is added to the wastewater to speed up the growth of
micro-organisms. These microbes then consume the waste and settle to the bottom of the
secondary settling tanks. After secondary treatment, 80-90% of human waste and other solids
have been removed. A significant proportion of toxic chemicals are also removed by this
process.
Where Does all the Treated Wastewater and Sludge Go?
The remaining wastewater is disinfected before it is discharged to the receiving waters (Massachusetts
Bay). This stream of treated wastewater, known as effluent, travels through a 9.5-mile Outfall
Tunnel bored through solid rock more than 250 feet below the ocean floor. The tunnel's final 1¼ mile
include 55 separate release points known as "diffusers." By extending to an area with water depths up
to 120 feet, this outfall provides a much higher rate of mixing and/or dilution than is possible with
present discharges into the shallow waters of Boston Harbor.
Sludge from primary and secondary treatment is processed further in sludge digesters, where it is
mixed and heated to reduce its volume and kill disease-causing bacteria. It is then transported through
the Inter-Island Tunnel to the pelletizing plant in Quincy, where it is dewatered, heat-dried and
converted to a pellet fertilizer for use in agriculture, forestry and land reclamation.
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
87 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Define Business Process Functions
 How do you define Business Process Functions?
o Functions that are directly part of the ICS Network.
o Will depend on your site.
o Parts of the site process that control in the ICS and monitor.
 Some examples Deer Island could have:
o PLC
o RTU
o DCS computers
o Network switches
o Firewalls
o Network traffic flow

Define Auxiliary Functions: What Other Factors Are Around the

Process?
 How do you define Auxiliary Functions?
o Functions that are not directly part of the ICS network.
o Depends on your site.
o May include items attached to the Business Process Function but on separate networks.
 Some examples Deer Island could have.
o Map out what they have.
o Talk to Site Security Specialist.
o Talk to Site engineers.

Understand Criticality and Risk

Criticality: The quality, state, or degree of being of the highest importance
Risk: A situation involving exposure to danger

 Focus on Risk and Criticality inside your Asset (Functions).

 Evaluate the Risk and Criticality on both an Interdependency and Intradependency level. The
main purpose is to focus on anything that falls into a high category, depending on your site.

Interdependencies Exercise
Complete the Interdepencies exercise found on the CISA VLP.

Common Issues
 Network – Connections to systems
 Physical Access – Enforcement
 Configuration – Change Management
 Network – Wireless and Radio

Why Attack the Supply Chain?

Why pay attention to supply chain risks? Attacks on a supply chain can compromise an organization’s
operations unnoticed. Supply chain attacks can be done without a vendor’s knowledge, especially in
today’s environment because vendors do not make the physical equipment anymore – it is typically
outsourced.
Types of Attacks:
 Shipment intercept
 Hardware or hardware
manipulation
 Manufacturing
 Misconfiguration
(intentional / unintentional)

Supply Chain Considerations

Map your supply network:
 Identify your Tier 1 supplier
 Identify the upstream Tier 2, 3, 4 … suppliers to the Tier 1
Potential questions:
 What is the health of these companies?
 Have they had a cyber incident of which you are not aware?
 Does their location have potential for geographic, political, or weather-related risks?
Ensure you identify where your supplies are coming from. What are the upstream vendors?
Look into the risk of your supply chain. What is their history, normal business and cyber? How long
have you used them? How hard is it to get the correct part you need consistently?

Use Cases
 In 2012, a third-party factory that produced switches designed by a U.S. company installed
infected compact flash cards during production. The U.S. company warned that using an
infected component could compromise the system and spread the malware within the network.
Source: [Link]
[Link]
 In 2015, a U.S. citizen imported thousands of counterfeit integrated circuits from China and
Hong Kong. He resold them to U.S. customers, including to Defense contractors supplying them
to the U.S. Navy for use in nuclear submarines. Source: [Link]
security/americas-military-breached-by-counterfeit-electronics-12dc207f257c

Third-Party Access Considerations

Third-party access is an important aspect for ICS or OT
systems. Third-party access is defined as a vendor or
contractor that needs access to a local site or remote site
ICS system. This access may be for maintenance,
upgrades, administration, etc.
First, we need to look at considerations for access – that
is, why does the contractor or vendor need access to the
ICS network? Most of this revolves around who maintains
the systems for your organization.
 So, we need to ask: Why is access needed?
o First, we need to verify the purpose of third-
party access.
o Is it the vendor or a contractor working on the
equipment?
 How does your company do a proper vetting of the
contractor / vendor?
 Have you done a background check?
 What is the safety record of the contractor / vendor? It is important third parties are safe when
they come onsite, and some sites require they have a good safety record. Make sure you know
what is required before contractors / vendors are scheduled for access.
Training. Training when coming onsite is also important. What is needed for access? Contractors /
vendors will need to understand your network layout and what they will have access to. Make sure you
understand the Management of Change (MOC) process.
What in your site network segmentation is important for these third parties to understand? How do
you protect other systems both logically and physically?
How will third parties be monitored? What do you have in place to keep an eye on their activities?
Always insist on knowing precisely what they are working on and how changes could affect systems.

Onsite Access
It is also important to inform third parties of policies that affect access to the systems. Be very careful
with any outside hardware that needs to be attached to your system. Be sure to properly vet outside
hardware, and ensure it is secure (up-to-date audio / visual (AV), no dual-homing, up-to-date patching,
and scanned before attaching to the network or device). Never connect an outside laptop to your
network unless it is secured.
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
93 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Only allow what is needed. Do not give full network or physical access to third parties if they do not
need it. Only allow a limited user account for system access.
Third parties need to be overseen by ICS staff onsite. If they need to work during off hours, allowances
can be made and signed for by management. This should all be well documented and allow for no
changes without ICS management staff onsite. Third parties should be escorted onsite unless they are
properly trained for a site emergency.

Remote Access
Third-party remote access did not used to be a big issue. Now we need to plan for remote access to
everything. Remote access is a risk that should not be taken lightly. For a contractor / vendor to need
remote access to an ICS system, there needs to be significant security in place.
The best practice is to avoid remote access whenever possible. When considering third-party remote
access, start by asking why the third-party needs network access, and if there is a reasonable
alternative. If remote access is required, always ensure there are strong security policies in place to
protect your organization’s interests, and that those policies are enforced.
Network access:
 What is needed to get the work done?
 How is access granted?
 Who is in control of the access?
 Authentication – multifactor?
 Jump box in the DMZ
 Hours allowed to access the system
 How are you going to monitor the connection (logging, IDS)?
 VPN / connection policy
o Remote computer security policy verification
o What does the connection have access to on the network (only necessary access)?

Third-Party Access Use Case - Trisis

What: An oil and gas plant in Saudi Arabia
Event: In late August 2017, Trisis malware infected ICS computers
Impact: Complete shutdown of the entire facility
Specifics: [Link] program along with [Link] were download to the affected computers. Can
cause problems with an SIS system. Could have been spread by USB or email.
Lessons learned:
 SIS systems need to be isolated
 This could have been much worse, but the actor made a mistake in the code
 Could easily be installed at the vendor level before installation at the site
 Scan all computers

1. Who is responsible for handling this request?

2. What questions would you ask of the vendor before considering this request?

3. What mitigation would you put in place if remote access is required to have support from this
vendor?

Cybersecurity Performance Goals (CPGs)

This is one of the cybersecurity performance goals associated with supply chain and supply risk. You
will complete an evaluation using CSET® at the conclusion of this training.
LOW COST
HIGH IMPACT
LOW
COMPLEXITY

LOW COST
HIGH IMPACT
LOW
COMPLEXITY

Our purpose here is to produce recommendations from the issues collected throughout the evaluation
process. It is very important to understand that, as evaluators, we are not doing the work but
recommending solutions that can/should be deployed.

Manage Risk
When wanting to reduce risk, you need to
consider the variables that combine to
create risk.
• Threats
• Vulnerabilities
• Consequences

Threats
A threat only exists if the right conditions are met. A threat must
be capable, have an opportunity, and possess hostile intent.
The level of each variable can vary depending on the other two.
For example, a person without great technical knowledge about
a system can still cause significant harm if they are in an area
with sensitive equipment. A slightly disgruntled person may
think nothing of a flipped switch, but the widespread effect it
could have can be exponential.
Threat Sources
Sources of a threat can vary from individuals on their home
computer to large, organized crime groups, up to large nation
states. The focus of these different categories of threat groups
may vary.

o Industrial spies o Hackers o Activist groups

o Criminal elements o Foreign government agencies

Environmental Sources
• Such sources are usually disruptive natural events, or significant human-caused accidents
such as an aircraft crash, or oil refinery explosion
• Examples could include:
o fire
o floo
o storm
Strategies to Deter Threats
A proactive approach is a strong deterrent to threats.
Asset inventory, network segmentation, network monitoring,
OPSEC/OSINT, an incident response plan – these measures can
help solidify a system’s defense and mitigate the influence of a
threat within the system.
Vulnerabilities
Vulnerabilities are the various ways your resources and assets are exposed to an attack. Poor firewall
rules, improper network segmentation, poor or non-existent policies directing vendor or company
access are just a few vulnerabilities to keep in mind.
With all vulnerabilities, humans can be the greatest vulnerability or the greatest defense of a system.
Training, awareness, and practice across all levels of a company can help avoid a simple phishing
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
99 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
email click from toppling larger corporations such as Maersk and causing significant financial and
physical harm.
Consequences
Consequences can be minor or major. Proper preparation can see a ransomware attack successfully
walled off in an area where it cannot harm physical components. Alternatively, we can see results that
lead to a loss of money and trust, and harm to physical components and personnel.
What are the risks within your company?
Consider your own company. Do you have proper physical security? Cybersecurity?
What are natural disasters that could occur in your region?
How resilient are your systems against a power outage?
Prioritize: Basic Risk Outlined
As you work to better protect your systems, it is important to
prioritize where to focus first.
List your risks based on the likelihood and the impact they would
have on your organization. This can give you a starting point to
prioritizing your efforts.

Continuous Monitoring
 Defined system by understanding (Complete)
o Assets and business impacts
o Security / threat / vulnerability and risk
 Established metrics / evaluation frequency (Done)
o Process for evaluation
o Evaluation architecture
 Implement and Analyze - Report (Accomplished)
o Collected data with initial analysis
o Provided report outlining critical risk and mitigations

Management Respond
 Respond (to issues)
o Handle Risk – What decision will be made for each risk?
 Accept Risk
 Avoid Risk
 Share Risk
______________________________________________________________
______________________________________________________________
______________________________________________________________
______________________________________________________________
100 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
 Transfer Risk
 Mitigate Risk
 Review / Update
o Review evaluation processes
o Establish change / configuration management process

Responding to ‘Risk’
 Accept – within risk tolerance so (COA): ‘Accept’ the risk completely without action
 Avoid – exceeds risk tolerance (COA): ‘Avoid’ the risk completely by taking specific actions
 Share – shifts a portion of risk responsibility (liability) to other organizations
 Transfer – shifts the entire risk to another entity; generally, insurance companies
 Mitigate –‘risk reduction’
o When a ‘portion’ of the risk cannot be accepted, avoided, shared, or transferred.
o For example, deploying multifactor authentication mitigates risk against compromised
passwords.

Recommend Points of Contact

Find the people in your organization to reach out to for potential issues. When an issue comes up, you
want to know who to call instead of trying to figure out who to call.

Report Recommendations / Document Actions

Document your findings and recommendations. Evaluation tools such as CSET® can provide records to
use to help track progress and stay on task.

Disclaimer
This presentation is intended for informational and discussion purposes only.
Training personnel do not discriminate on the basis of race, color, religion, national origin, sexual
orientation, physical or mental disability, or gender expression/identity. Nor do they possess proprietary
interest in any product, instrument, device, service or material discussed in this course.

Learning Objectives
Upon completion of this training, trainees will be able to:
1. Discuss the purpose and benefits of CSET®.
2. Describe the steps to conduct a CSET® assessment.

103 | P a g e
1. Discuss the purpose and benefits of CSET®
The Cyber Security Evaluation Tool (CSET®) is a
DHS product that assists organizations in
protecting their key national cyber assets. The tool
provides users with a systematic, disciplined, and
repeatable approach for evaluating an
organization’s security posture. It does not require
connection to the Internet or to any control system
or corporate network. CSET® does not transmit
information to DHS or any government or
commercial entity, and does not report information
to anyone except the person using the tool.

CSET® assists users in performing a self-assessment of their cybersecurity posture to establish a

security baseline as a starting point for continuous improvement. It guides asset owners and operators
through a step-by-step process to evaluate ICS and IT network security practices. When a user selects
one or more of the standards, CSET® opens a set of questions to be answered. The answers to these
questions are compared against a selected security assurance level, and a detailed report is generated
showing areas for cybersecurity improvement.

DHS offers CSET® at no cost to end users.

It is available for download at: [Link]

104 | P a g e
Your Organization’s
Cybersecurity Posture
Are you confident in the cybersecurity
posture of your organization? Have
you asked yourself where do you stand
now? Where do you start? What are
your priorities? CSET® can help you
answer these questions.
The Department of Homeland Security
is developing methods to assess the
security posture of the control systems
at critical infrastructure facilities, and
CSET® is the cornerstone of building
this capability. CSET® is a self-
contained software tool that runs on a
desktop or laptop computer. It does not
transmit information to DHS or any
government or commercial entity and
does not report information to anyone except the person using the tool.
It provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security
posture. CSET® guides asset owners and operators through a step-by-step process to evaluate ICS
and IT network security practices. DHS developed the CSET® application and offers it at no cost to end
users.

105 | P a g e
CSET® Capabilities

CSET® is designed to assist you in evaluating your control system network. It can provide solutions,
recommendations, and best practices. It can also provide focused solution assistance. For example, as
part of its solution library, CSET® contains firewall configuration whitepapers. A baseline of security
posture provides for a comparison between assessments performed on a periodic basis.
CSET® cannot scan a network and provide a detailed topology analysis. Nor will it identify every
cybersecurity vulnerability in the system. The tool is only as good as the responses you provide it.
Furthermore, CSET® cannot actually implement controls or mitigate vulnerabilities, but it does help you
establish a prioritized list to help focus your cybersecurity efforts.

106 | P a g e
2. Describe the steps to conduct a CSET® evaluation.
ICS Evaluation Components

The above slide may look familiar, it was presented earlier this week. You have been using this
information for performing an evaluation. This slide will be referred to throughout this presentation to
show where CSET® can assist with the performance of an evaluation.
The above slide may look familiar; it was presented earlier this week. You have been using this
information for performing an evaluation. This slide will be referred to throughout this presentation to
show where CSET® can assist with the performance of an evaluation.

By selecting “My Assessments” you will navigate to this page. Here if you select “Start a New
Assessment” you will move to the previous page, or you can select “Import an Existing Assessment” to
import an assessment.

107 | P a g e
Start the CSET® Assessment

This is the opening page the first time you start CSET®. From here you can start a new assessment
based on specific standards or guidelines or select “My Assessments” to see existing assessments. For
this presentation I have selected “My Assessments” to use an existing assessment.

For the exercises you will select “DHS401 ICS System Evaluation and Analysis Course Question Set”
under the assessment group “Other.”

108 | P a g e
ICS Evaluation Components

This is one component that does not map directly to part of the process in CSET®. The next step in
CSET® is to detail the evaluation information about the organization.

Once you have started / created as assessment you can double-click the assessment name to enter
the tool.

109 | P a g e
Navigation Approach
CSET® is designed to focus user time in the areas most effective for
conducting an assessment. The high-level navigation is divided into
three main areas:
The Preparation portion is necessary for each assessment but is
accessed very little once the selection process and network
diagramming activities are completed.
• Assessment Configuration
• Assessment Information
• Security Assurance Level (SAL)
The Assessment portion is where users spend most of the time
answering assessment questions.
• Standard Questions
The Results portion has two sections: Analysis and Reports. The
Analysis section can be used repeatedly to judge the completeness
of the assessment.
• Standard Results
• High-Level Assessment Description, Executive Summary &
Comments
• Reports
• Feedback

110 | P a g e
Begin the evaluation by filling out information about the assessment. This includes the assessment
name and date, facility name, City or Site name, State / Province / Region, and Assessment type. This
assessment has a specific 401 CSET® question set.

111 | P a g e
The Sector Demographics page is used to indicate which of the critical sectors this assessment
pertains to. The gross value of the facility, length of the assessment, organization name and type,
Facilitator and Point of Contact.

112 | P a g e
ICS Evaluation Components

Now we need to establish the evaluation team. CSET® allows you to capture the team members’
information.

Evaluation Team – Required Interviews / Participants

CSET® assessments are most effective when completed by a cross-functional team. A cross-functional
team consisting of representatives from operational, maintenance, information technology, business,
and security areas is essential because no one individual typically has the span of responsibility or
knowledge to effectively answer all the questions. The representatives must be subject matter experts
(SMEs) with significant expertise in their respective areas.

A cross-functional team consisting of representatives from operational, maintenance, information

technology, business, and security areas is essential because no one individual has the span of
responsibility or knowledge to effectively answer all the questions. When the appropriate people are
brought together, they are often able to recognize areas of weakness and improvement that can bring
about significant changes to the organization.

113 | P a g e
114 | P a g e
Add team member information here.

115 | P a g e
ICS Evaluation Components

This bullet item is not part of the CSET® process. But CSET® can be executed, and 6 to 12 months
later can be executed again. The results can be compared to determine the progress being made.

116 | P a g e
Security Assurance Level (SAL)

The Security Assurance Level (SAL) directly correlates to the number of questions asked during the
evaluation. For the first evaluation, I suggest selecting “Low” across the board. This will allow your team
to get their feet wet and then adjust the SAL as required.
The expected outcome would be to understand the cybersecurity posture of your environment based on
standards and/or requirements for your industrial sector.

117 | P a g e
CSET® Basis
Evaluation Section – Questions Mode

Once the security assurance level (SAL) has been selected, select “Next” to move to the Questions
Mode screen. All questions will be answered as either Yes, No, Not Applicable (N/A), or through an
Alternate method (ALT).
The process of answering questions is straightforward. You can select the “down arrow” to expand
individual questions or select <- -> to expand all the questions.

118 | P a g e
The process of answering questions is straightforward. You can select the “down arrow” to expand the
question or select “Expand All” to have all the questions expanded.
As a team, start with Question 1 and continue through each subject area or category until all questions
have been discussed and answered.
You can select any icon to get or create more information for the question. Icons are: Details / Standard,
Supplemental, Comments, Documents, References, Observations and Feedback. You can also indicate the
question has been reviewed if you have a review process in place.

119 | P a g e
ICS Evaluation Components

This bullet item can be related to the Analysis section or Dashboard.

Results Section – Analysis Dashboard

The Results Overview screen shows the results of the evaluation in clear to understand charts and
graphics.

It shows the overall positive score based on “Yes” or “Alt” versus total number of questions.

120 | P a g e
Control Priorities

The Control Priority page is the mitigation hit list of “No” or “Unanswered” questions. They are ranked
based on cost and time to mitigate along with the severity of the deficiency.
Standards Summary

121 | P a g e
Executive Summary, Overview and Comments Section

This section is available to the team for summarizing highlights, issues and follow-up needs for
executives. High-level evaluation description of the process and work performed. And any additional
general comments to include in the final reports.

The final bullet is producing a Final Report. CSET® has a reporting capability to create reports for
different levels of the organization.
Results Section – Reports

The intent of the reporting functionality is to provide the user with a way to print evaluation information,
including summary charts and lists. It also provides a hardcopy of the results to be used in meetings,
for communications to management, and to assign tasks to technical staff. Combined with the online
analysis, these reports can help the user clearly understand where weaknesses are and where
improvements should be made.
122 | P a g e
Executive Summary Report
From the executive to the site summary and the site detail reports, each report provides increased
levels of detail. Finally, the security plan report provides a template for documenting the required
cybersecurity controls and the degree to which they are met.

The printable reports contain charts, lists, and detailed information found on the analysis screen.

123 | P a g e
Returning to the reports page, you can select the “Site Detail Report”.

124 | P a g e
Site Detail Report
Here are examples of charts and lists from the Site Detail Report.

125 | P a g e
Data and reports generated by the tool should be managed securely and marked, stored, and
distributed in a manner appropriate to their sensitivity.

126 | P a g e
Download the latest CSET® tool from the link above or here [Link]
NOTE: This course uses CSET® v11.5.0.0 for the Final Exercise and can be downloaded through
the online VLP.

127 | P a g e
Acronyms
AS Automation System
CSET® Cyber Security Evaluation Tool
DCS Distributed Control System
DHS Department of Homeland Security
DMZ Demilitarized Zone
ICS Industrial Control System
HMI Human Machine Interface
I/O Input/Output
ICS Industrial Control Systems
IED Intelligent Electronic Device
IT Information Technology
NCSD National Cyber Security Division
NIST National Institute of Standards and Technology
OPSEC Operational Security
OSINT Open-source Intelligence
OT Operational Technology
PCS Process Control System
PLC Programmable Logic Controller
RTU Remote Terminal Unit
SAL Security Assurance Level
SCADA Supervisory Control and Data Acquisition
SIEM Security Information and Event Management
SIS Safety Instrumented System
VPN Virtual Private Network

128 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
CSET® Report
Using the following information about your company, ACME, fill out your CSET® report using the 401
question set. As you complete the information, you will notice some information is missing, preventing
you from completing your report. As with a normal evaluation, you will have to find the missing
information later during the Final Exercise. For now, download CSET® from the VLP and the
corresponding question sets and complete your report as far as you can before beginning the Final
Exercise.

NOTE: There are no evaluation questions for LO1 or LO10.

LO2 Evaluation Questions

Open the CSET® tool. Using the information provided below,
answer the following questions to the best of your ability. Some questions may have
more information than others.
ACME has an inventory of networked connected devices. However, you do not know if a software
inventory exists. They also lack visibility into their remote field devices. They do patching during
maintenance downtimes every 3 months according to their ICS patching policy. Operating systems
range from Windows XP to Windows 7. They have an agreement with Microsoft for support to include
outdated versions.

Questions
 Are physical devices and systems within the organization inventoried?
– Configuration Management, Identify Assets (aligns with CPG 1.A)
 Are software platforms and applications within the organizations inventoried?
– Configuration Management, Identify Assets (aligns with CPG 1.A)
 Is the system updated or patched to the most current version?
– Configuration Management, Identify Assets
 Does the company have support for outdated versions of software?
– Configuration Management, Identify Assets

129 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO3 Evaluation Questions
Open the CSET® tool. Using the information provided below,
answer the following questions to the best of your ability. Some questions may have
more information than others.
ACME has a list of known protocols it uses in the production, supply, and distribution of its chemicals.
These protocols include S7comm, Modbus, dnp3, CIP and ENIP. IT and OT are segmented with
firewalls from each other with an ICS DMZ. All users must use a VPN to access the OT.

Questions
 Are OT and IT segmented from each other with the use of firewalls?
– System and Communication Protection, Network Segmentation (aligns with CPG 2.F)
 Is access to OT restricted through the use of a VPN?
– System and Communication Protection, Network Segmentation (aligns with CPG 2.F)
 Does an ICS DMZ exist to allow for the transfer of information between OT and business
functions?
– System and Communication Protection, Network Segmentation (aligns with CPG 2.F)

LO4 Evaluation Questions

Open the CSET® tool. Using the information provided below,
answer the following questions to the best of your ability. Some questions may have
more information than others.
Wireless access is fairly new to ACME OT. Vendors install the wireless systems and provide an
inventory of wireless APs installed. The wireless APs that are known / inventoried are authorized to
be on the network. Devices connected to the wireless system were installed by the vendor. To
future-proof deployments, omni-directional antenna are utilized to provide broad coverage. Physical
connectivity is preferred. Devices not utilizing wireless are installed with wireless capabilities turned
off.

Questions
 Does the organization maintain an inventory of authorized wireless APs connected to the OT
wired network?
– Portable / Mobile / Wireless, Wireless
 Does the company validate (through site surveys and configuration review) that only
authorized wireless APs are broadcasting?
– Portable / Mobile / Wireless, Wireless (aligns with CPG 1.A)
 Is each device connected to the wireless system authorized?
– Portable / Mobile / Wireless, Wireless

130 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO5 Evaluation Questions
Open the CSET® tool. Using the information provided below,
answer the following questions to the best of your ability. Some questions may have
more information than others.
ACME has 2 IDS sensors. One IDS monitors the ICS/OT network and ICS DMZ. The second IDS
monitors the Corporate/IT network and Corporate DMZ. The sensors are running Snort / Security Onion
and have appx 3,000 attack signatures. ACME has log monitoring capabilities for the windows systems
only. All logs are collected in the IDS area in a log server using Graylog. Logs are monitored
throughout the day. Any findings are reported to the cybersecurity lead daily. If ACME has an ICS
incident response plan is unknown.

Questions
 Does the organization deploy network-based IDS sensors?
– System and Communications Protection, Network Monitoring
 Does the organization collect logs for all system types (IT/OT)?
– System and Communications Protection, Network Monitoring (aligns with CPG 2.T)
 Does the organization deploy SIEM or log analytic tools for log aggregation?
– System and Communications Protection, Network Monitoring (aligns with CPG 2.U)
 Are logs reviewed and analyzed on a defined frequency, and are findings reported to
designated officials?
– System and Communications Protection, Network Monitoring
 Does an ICS incident response plan exist?
– Systems and Communications Protection, Network Monitoring (aligns with CPG 2.S)
 Is the ICS incident response plan tested on a regular basis?
– Systems and Communications Protection, Network Monitoring (aligns with CPG 2.S)

131 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO6 Evaluation Questions
Open the CSET® tool. Using the information provided below,
answer the following questions to the best of your ability. Some questions may have
more information than others.
ACME scans all systems, internally and externally, for vulnerabilities on a weekly basis. Findings are
reported to the Operations Team for resolution. Shodan is also checked weekly to ensure no new
externally available systems have been put into place without the knowledge of IT or OT. Passwords on
the Corporate side are enforced through Group Policy. All passwords on the OT side are local
passwords and are not changed regularly. Passwords on PLCs cannot meet corporate password
requirements and are managed locally. Facility walkdowns are performed monthly by management.
Any discrepancies are noted and fixed, if possible, prior to the next walkdown. All employees, including
OT personnel, go through yearly security awareness training that ‘includes OPSEC procedures. Each
department maintains their own critical information lists.

Questions
 Are externally facing machines regularly scanned for vulnerabilities?
– System and Communications Protection, OSINT OPSEC (aligns with CPG 1.E)
 Is an ICS password policy enforced?
– System and Communications Protection, OSINT OPSEC (aligns with CPG 2.B)
 Are facility walkdowns performed?
– System and Communications Protection, OSINT OPSEC
 Is a company defined critical information list in place and updated periodically?
– System and Communications Protection, OSINT
 Are employees trained on OPSEC practices?
– Training, OSINT OPSEC (aligns with CPG 2.I)
 Does the company regularly check a product, such as Shodan, for externally available systems?
– System and Communications Protection, OSINT OPSEC (aligns with CPG 2.W)

LO7 Evaluation Questions

Open the CSET® tool. Using the information provided below, answer the following
questions to the best of your ability. Some questions may have more information than
others.
ACME employees receive phishing email training quarterly through the cybersecurity awareness
program. Statistics show the training is working and the number of incidents from phishing emails is
down. OT personnel receive additional cybersecurity training specific to the OT environment. You just
completed your 401 course and are aware of adversarial tactics.

Questions
 Are employees trained on phishing emails on an annual or more frequent basis?
– Training, Adversarial Risk (aligns with CPG 2.I)
 Are managers aware of adversarial tactics and techniques?
– Training, Adversarial Risk (aligns with CPG 3.A)
132 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO8 Evaluation Questions
Open the CSET® tool. Using the information provided below, answer the following
questions to the best of your ability. Some questions may have more information than
others.
ACME Power and Light provides power for all ACME divisions including ACME Specialty Chemical,
ACME Supply and ACME Distribution. ACME Supply provides all necessary chemicals for ACME
Specialty Chemical. The output of ACME Specialty Chemical is sent to ACME Distribution for
distribution to vendors. Management is aware of the external and internal dependencies for the
manufacturing process. You do not know where the data flow diagrams exist.

Questions
 Does management know what external dependencies exist?
– Policies, Dependencies
 Does management know what intradependencies exist?
– Policies, Dependencies
 Does documentation of information / data / management flows exist?
– Policies, Dependencies

133 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
LO9 Evaluation Questions
Open the CSET® tool. Using the information provided below, answer the following
questions to the best of your ability. Some questions may have more information than
others.
ACME has a supply chain policy in the document management system and verifies vendors and
purchases. All vendors are vetted and ensured they follow all cybersecurity procedures when onsite
and when accessing the network remotely. Vendors are required to report security incidents to us if the
incidents affect our information, equipment, or VPN access. As part of the vetting process, vendors are
required to supply a third-party evaluation of security controls as well as certification that all materials
and equipment provided are genuine and not altered. Vendors can access the ACME OT network
remotely using a dedicated VPN connection. Each vendor is issued enough user accounts and
passwords for their application experts to support system requirements. If vendors come onsite, they
must use an ACME provided laptop for access to the systems.

Questions
 Is there a supply chain policy to verify vendors and purchases?
– Policies, Supply Chain
 Are vendors allowed remote access into the OT environment?
– Access Control, Supply Chain
 Are vendors given more than one account to ensure accounts are not shared?
– Access Control, Supply Chain (aligns with CPG 2.C)
 Do vendors supply a third-party evaluation (audit / assessment) of security controls?
– System and Services Acquisition, Supply Chain (aligns with CPG 1.I)
 Are vendors required to report a security incident to our company?
– System and Services Acquisition, Supply Chain (aligns with CPG 1.G)
 Can resellers validate materials are genuine and not altered?
– System and Services Acquisition, Supply Chain

134 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Final Exercise
During the training course, you compiled a report using the CSET® tool. However, you did not have all
the information you needed to complete the report and some questions were left unanswered. This is
pretty normal when compiling a report. You just do not have all the information at first. As a manager at
ACME, you will need to get to know and contact members of your team and try to fill in the gaps.

Team Members
Name: Anthony Cowan
Age: 49
Roles: Process Control Engineer (5 years); OT Application Admin (10
years); Database Engineer (10 years)
Time with company: 11 years
Bio: Enjoys fishing, skiing, and camping. Expert in collecting brass antiques.
Background: Knowledgeable of OT software in use.
Schedule: Busy, Anthony only has time for two interviews after which he will be
unavailable (You will only be able to ask him two questions, so choose wisely).

Name: Kevin McFarlane

Age: 55
Roles: IT Systems Engineer (15 years)
Time with company: 15 years
Bio: Was tragically born without a personality. Watches football and
follows the Denver Broncos. Divorced with two kids. Amateur radio hobbyist.
Background: Knowledgeable of IT processes.
Schedule: Available anytime.

135 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Name: Amy Nguyen
Age: 59
Roles: System Engineer (6 years); OT Network Admin (7 years)
Time with company: 7 years
Bio: Life accomplishment: “I once went an entire day without blinking.”
Married with two children. Life goal is to be able to raise a good family.
Background: Knowledgeable of OT network operations
Schedule: Available anytime.

Name: Klein Holts

Age: 42
Roles: Control Technician (3 years)
Time with company: 3 years
Bio: Hates drinking hot beverages from a mug. Cosplays Star Wars at
Comic-con. Has two dogs, Trooper and Storm. Enjoys hiking.
Background: Knowledgeable of OT hardware in use
Schedule: Available anytime.

Name: Nicole Baumgardener

Age: 34
Roles: IT Cybersecurity Analyst (8 years)
Time with company: 2 years
Bio: Enjoys March Madness. Competes in professional rose growing
competitions. Leads a company book club. Enjoys painting with watercolors.
Background: Knowledgeable of Cybersecurity processes and procedures
Schedule: Available most of the time, planning some personal leave on Day 3 so she will
be unavailable to answer questions then (During third round of questions).

136 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Notes:

137 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Notes:

138 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Appendix A. Content References
LO1: Discuss Components of an ICS Evaluation
• Gary Miller, “60% of small companies that suffer a cyberattack are out of business within six
months,” The Denver Post, Oct. 24, 2016 – quoting study by the National Cyber Security
Alliance
• Steve Morgan, “Cyber Crime Costs Projected to Reach $2 Trillion by 2019,” Forbes Jan. 17,
2016
• Verizon, 2016 Data Breach Investigations Report, p. 8-9
• Limor Kessem, “2016 Cybercrime Reloaded: Our Predictions for the Year Ahead,” Jan. 15, 2016
• FireEye, Inc, Mandiant M-Trends 2016, p. 4
• Patricia Harman, “50% of small businesses have been target of a cyber-attack,”
[Link], Oct. 7, 2015
• Mark Smith, “Huger rise in hack attacks as cyber-criminals target small business, "The
Guardian, Feb. 8, 2016
• Thor Olavsrud, “Companies complacent about data breach preparedness,” CIO, Oct. 28, 2016
• Jeff Goldman, “48 Percent of Companies don’t inspect the Cloud for Malware,” eSecurity Planet
(blog), Oct. 12, 2016
• Chris Brook, Kaspersky Lab, 91 Percent of Public-Facing ICS Components Are Remotely
Exploitable, July 11, 2016
• Mandiant M-Trends, p. 7 2016 Data Breach Investigation Report, p. 11

139 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Appendix B: OSINT Framework and Google Hacking Exercise
Optional Activity
The goal of this lab is to use Google and Shodan to practice finding and gathering as
much open-source information as possible about Internet-accessible ICS devices.
NOTE: This lab will involve searching the Internet for real-world devices
accessible from the Internet. The goal of this lab is passive reconnaissance of
those devices. Any attempt to connect to or manipulate these devices could
have legal ramifications. For the purposes of this lab, perform only passive reconnaissance.
You will use the Kali Linux VM (instructions below) on the laptop to perform the Google and Shodan
elements of this lab.
1. Click the “VMware Player” shortcut on the desktop
2. Open and run the Kali Linux 2019.3 VM
3. The Kali Linux VM should automatically login, but you may use the following credentials in case
it does not or if the screen locks:
a. Username: root
b. Password: toor
Searching for Vulnerabilities Using Google
1. Open the Firefox web browser
2. Navigate to [Link] take a few minutes and glance at the available
menu options
3. Click Search Engines > General Search > Google
4. Perform searches for vulnerabilities in ICS equipment using the following search terms:
5. “Allen Bradley Vulnerability”
6. “ControlLogix Vulnerability”
7. “ControlLogix 5570 Vulnerability”
8. “ControlLogix 1756-ENBT Vulnerability”
NOTE: Most of the vulnerabilities identified through Google Searches will likely lead to the
[Link] advisory pages, which will provide additional details about the vulnerability and
affected products.

140 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Example
The following images show an example of a webpage and part of its source code presented by the web
server running on the PLC. The title of the page is “Rockwell Automation,” which can be seen in the
source code for the page. This is generally a good search term to start with.
NOTE: View the source code or frame code by right-clicking on the page and selecting “view
source.”

Searching for Targets Using Google

Using the example above you will now use Google to identify Internet-connected devices. Identifying
information presented by web servers can be used to search for Internet-connected devices.
1. Search Google for keywords in the title of a page by using the advanced search parameter
“intitle”
a. Type in the following search term
b. intitle:”Rockwell Automation”

141 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
2. Add the model of the processor to narrow the previous search results
a. Type in the following search term
i. intitle:”Rockwell Automation” 1756 ENBT

3. Review the search results to identify an Internet-connected device. The highlighted result shown
below appears to be a PLC connected to the Internet.
NOTE: Your search results may vary. If the above query does not reveal any PLCs, try the
following search term: inurl:”Portal/[Link]”

*CAUTION*: Whenever connecting to any unfamiliar sites on the Internet, be very careful
connecting to devices identified through Google. These could be live systems, they could be
Honeypots used by researchers, or they could be a malicious attacker. There are many other
Google search options that can help narrow down search results to find an Internet-connected
device. Below are a few additional search options:
“inurl:<search string>” – Use this option to search the URL for a specific word
This could be useful if the webpage is known to be located at a specific path on the web server
“site:<search string>” – Use this option to search for information on a specific domain
To limit the search to a particular domain (e.g., [Link]), include
“site:[Link]” in the search query
Add a minus sign (-) at the beginning (e.g., –site:<search string>) to exclude a domain from the search
results
142 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
“filetype:<file type>” – Use this option to limit the search to a specific file type
This could be used to search for PLC configuration files being inadvertently hosted on a public web
server.
Try using some of these techniques to search your company domain to identify any Internet-connected
devices attached to your network, or to see if any private information is being leaked.

143 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Appendix C. Network Architecture Examples

144 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

145 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Appendix D: Cross-Sector Dependencies Sample Exercise
Answer

146 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Appendix E. Cybersecurity Performance Goals (CPGs)
ID Security Practice Outcome 401 Learning
(v.1.0.1) Objective(s)
1.A Asset Inventory Better identify known, unknown (shadow), and LO 2 Identify
unmanaged assets, and more rapidly detect Assets
and respond to new vulnerabilities. LO 4 Wireless
1.B Organizational A single leader is responsible and accountable
Cybersecurity for cybersecurity within an organization.
Leadership
1.C OT Cybersecurity A single leader is responsible and accountable
Leadership for OT-specific cybersecurity within an
organization with OT assets.
1.D Improving IT and OT Improve OT cybersecurity and more rapidly and LO 1 Evaluate
Cybersecurity effectively respond to OT cyber incidents. ICS
Relationships Components
1.E Mitigating Known Reduce the likelihood of threat actors
Vulnerabilities exploiting known vulnerabilities to breach
organizational networks.
1.F Third-Party Validation Identify TTPs that lack proper defenses and
of Cybersecurity establish confidence in organizational cyber
Control Effectiveness defenses.
1.G Supply Chain Incident Organizations more rapidly learn about and LO 9 Assess
Reporting respond to known incidents or breaches across Supply Risk
vendors and service providers.
1.H Supply Chain Organizations more rapidly learn about and LO 9 Assess
Vulnerability respond to vulnerabilities in assets provided by Supply Risk
Disclosure vendors and service providers.
1.I Vendor/Supplier Reduce risk by buying more secure products LO 9 Assess
Cybersecurity and services from more secure suppliers. Supply Risk
Requirements
2.A Changing Default Prevent threat actors from using default
Passwords passwords to achieve initial access or move
laterally in a network.
2.B Minimum Password Organizational passwords are harder for threat
Strength actors to guess or crack.
2.C Unique Credentials Attackers are unable to reuse compromised LO 9 Assess
credentials to move laterally across the Supply Risk
organization, particularly between IT and OT
networks.

147 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
2.D Revoking Credentials Prevent unauthorized access to organizational
for Departing accounts or resources by former employees.
Employees
2.E Separating User and Make it harder for threat actors to gain access
Privileged Accounts to administrator or privileged accounts, even if
common user accounts are compromised.
2.F Network Reduce the likelihood of adversaries accessing LO 3 Determine
Segmentation the OT network after compromising the IT ICS
network. Connectivity
2.G Detection of Protect organizations from automated, LO 5 Evaluate
Unsuccessful credential-based attacks. Network
(Automated) Login Monitoring
Attempts Capabilities
2.H Phishing-Resistant Add a critical, additional layer of security to
Multifactor protect assets accounts whose credentials have
Authentication (MFA) been compromised.
2.I Basic Cybersecurity Organizational users learn and perform more LO 7 Evaluate
Training secure behaviors. Adversarial Risk
2.J OT Cybersecurity Personnel responsible for securing OT assets
Training received specialized OT-focused cybersecurity
training.
2.K Strong and Agile Effective encryption deployed to maintain
Encryption confidentiality of sensitive data and integrity of
IT and OT traffic.
2.L Secure Sensitive Data Protect sensitive information from
unauthorized access.
2.M Email Security Reduce risk from common email-based threats,
such as spoofing, phishing, and interception.
2.N Disable Macros by Reduce the risk from embedded macros and
Default similar executive code, a common and highly
effective threat actor TTP.
2.O Document device More efficiently and effectively manage,
configurations respond to, and recover from cyberattacks
against the organization and maintain service
continuity.
2.P Document Network More efficiently and effectively respond to
Topology cyberattacks and maintain service continuity.

2.Q Hardware and Increase visibility into deployed technology

Software Approval assets and reduce the likelihood of breach by
Process users installing unapproved hardware,
firmware, or software.
148 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
2.R System Backups Organizations reduce the likelihood and
duration of data loss at loss of service delivery
or operations.
2.S Incident Response Organizations maintain, practice, and update LO 5 Evaluate
(IR) Plans cybersecurity incident response plans for Network
relevant threat scenarios. Monitoring
Capabilities
2.T Log Collection Achieve better visibility to detect and LO 5 Evaluate
effectively respond to cyberattacks. Network
Monitoring
Capabilities
2.U Secure Log Storage Organizations' security logs are protected from LO 5 Evaluate
unauthorized access and tampering. Network
Monitoring
Capabilities
2.V Prohibit Connection Prevent malicious actors from achieving initial
of Unauthorized access or data exfiltration via unauthorized
Devices portable media devices.
2.W No Exploitable Unauthorized users cannot gain an initial LO 6 OSINT and
Services on the system foothold by exploiting known OPSEC
Internet weaknesses in public-facing assets.
2.X Limit OT Connections Reduce the risk of threat actors exploiting or LO 6 OSINT and
to Public Internet interrupting OT assets connected to the public OPSEC
Internet.
3.A Detecting Relevant Organizations are aware of and able to detect LO 7 Evaluate
Threats and TTPs relevant threats and TTPs. Adversarial Risk
4.A Incident Reporting CISA and other organizations are better able to
provide assistance or understand the broader
scope of a cyberattack.
4.B Vulnerability Organizations more rapidly learn about
Disclosure/Reporting vulnerabilities or weaknesses in assets
discovered by security researchers; researchers
are more incentivized to responsibly share
findings.
4.C Deploy [Link] Allow security researchers to submit
Files discovered weaknesses or vulnerabilities faster.
5.A Incident Planning and Organizations are capable of safely and
Preparedness effectively recovering from a cybersecurity
incident.

149 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
Appendix F. How to Login to NetLab
When you find a NetLab activity like the example below, make sure all previous items are completed.
Then click on the NetLab activity.

Previous
Item

Depending on the browser and your security settings, you may get an error stating the site cannot be
opened. Click on “Open Site In New Window” and the site will open. Your pop-up blocker will also need
to be disabled. Do not close course lesson tab.

150 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

The first time you use NetLab, you will need to set your Time Zone. After setting your preference, click
“Submit”

You will receive this message. Click “Understood”

151 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

This is the NetLab Homepage and where you can reserve a lab.

Click on “New Lab Reservation,” Click on “Schedule Lab for Myself”

152 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

This image shows the “Pod Scheduler.” Click on your desired time slot. If your time slot is taken in the
farthest left column, you may choose a column to the right of the desired time as the NetLab
Introduction video described.

153 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

Once a time slot is selected, the above image will appear. Verify your start time and click “Submit”

A notification will appear. Click “OK”

154 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

During your scheduled time slot, the green Enter Lab button will appear on the NetLab home screen.
Click to enter the lab.

The “Topology” page inside each lab shows you what devices are in this lab.

Please send any questions to nhs-training@[Link]

Thank you.

155 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training
To End a NetLab Reservation Early
When you have finished recording any required data in your Trainee Guide to close NetLab, go to the
upper-right of the browser window.

Click the Reservation drop-down.

Click “End Reservation Now”

156 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

A warning will display. Click “Yes”

157 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

A notification the Reservation has ended will appear. Click “OK”

You will be returned to the NetLab homepage. You can now exit from this tab or window. Be careful not
to close your course’s training tab in the CISA VLP.

158 | P a g e
ICS Cybersecurity
Evaluation (401 Virtual) Training

After returning from the lab, click the next item in your list to proceed with the course.

Please send any questions to nhs-training@[Link]. Thank you.

159 | P a g e

Common questions

Network monitoring is central to enhancing ICS cybersecurity as it allows for the detection of anomalies and potential threats in real-time . Tools like CSET® can be used to evaluate network security performance goals. Network monitoring is high impact and relatively low in complexity and cost, making it an efficient strategy for improving cybersecurity posture . It involves the use of tools for inspecting traffic, analyzing connection patterns, and detecting unauthorized access .

Spoof Reporting Message attacks involve adversaries sending false telemetry data to control systems to evade detection and disrupt process control . These attacks can mislead operators into making decisions based on falsified data, potentially leading to equipment malfunction or operational inefficiencies . Such attacks compromise the integrity of monitoring systems and can result in serious process control impairments and safety risks.

Adversaries use masquerading in ICS environments by disguising malicious applications or executables as legitimate files to avoid detection . They employ commonly recognized programs and vendor executables to blend in with normal network operations . Rootkits further enhance evasion by hiding the existence of malicious software through intercepting and modifying OS API calls, thus concealing their activity from system monitoring tools . Both tactics undermine the security infrastructure and make it challenging to detect unauthorized presence and operations.

Conducting periodic risk assessments using OPSEC and OSINT methods is important for identifying exposed information and preventing adversaries from developing attack paths . These methods help in understanding how attackers profile and target organizations, allowing for proactive measures to mitigate potential threats. Such assessments are vital as they provide insight into the security posture of an organization and highlight vulnerabilities that may be exploited .

Optimizing incident response capabilities in an ICS environment involves having written procedures that clearly define personnel roles during an incident, conducting yearly table-top exercises to prepare for threat scenarios, and maintaining up-to-date third-party contact information . Furthermore, ensuring that incident handling team members are well-informed about current threats and risks through periodic training is essential . Collecting adequate auditable events supports thorough investigations after incidents occur .

Secure management of third-party remote access in control system networks involves asking crucial questions about the necessity and extent of access . Best practices include employing strict authentication mechanisms, such as multi-factor authentication, and using a DMZ with jump boxes to mediate access . Limiting access hours, implementing logging and intrusion detection systems, and strictly regulating what systems the third party can access are also recommended .

Network segmentation is crucial in securing control systems as it helps create security boundaries by dividing networks into zones. This segmentation allows for better access control, monitoring, troubleshooting, and scaling of the network. An effective implementation can involve introducing a DMZ between IT and OT operations, thereby providing controlled access and creating more manageable network sections . It is also important to understand the organization’s specific needs to determine whether the Purdue Model or another segmentation strategy is appropriate .

Maintaining isolated Safety Instrumented Systems (SIS) in ICS setups is significant because it prevents unauthorized access and potential manipulation through network-connected systems . The Trisis incident exemplified the risk: malware infection led to an entire facility's shutdown, highlighting the need for isolation to protect against such compromises . Potential vulnerabilities include the misuse of remote access points and insufficient security measures to monitor and control these critical systems .

Ensuring the integrity and security of ICS firmware during updates involves using secure methods to verify and authenticate the update files and the source . Careful coordination with the vendor to authenticate firmware authenticity is crucial, as is disabling unauthorized firmware modifications. Regularly scanning and monitoring firmware updates can also prevent the installation of malicious or vulnerable firmware . Additionally, organizations should maintain a strict firmware management protocol to prevent unauthorized personnel from applying updates .

Integrating more OT equipment into an existing network can lead to a crowded network, making it difficult to manage access and control, as well as troubleshoot and scale the infrastructure . Addressing these challenges involves segmenting the network to create distinct zones that can enhance security and facilitate clearer monitoring and management. This can be achieved by deploying more sophisticated architecture designs, such as the implementation of a DMZ, to separate IT and OT systems .

IoT Overview: Applications, Infrastructure, and Threats
No ratings yet
IoT Overview: Applications, Infrastructure, and Threats
197 pages
NIST CSF Questionnaire Template Guide
No ratings yet
NIST CSF Questionnaire Template Guide
101 pages
Chapter 6 - Slide
No ratings yet
Chapter 6 - Slide
57 pages
The Boardroom Cyber Playbook Research Edition
No ratings yet
The Boardroom Cyber Playbook Research Edition
19 pages
Q2 2025 Cybersecurity Market Insights
No ratings yet
Q2 2025 Cybersecurity Market Insights
40 pages
CTA Gen AI Report - Part II 2
No ratings yet
CTA Gen AI Report - Part II 2
13 pages
CIS Risk Assessment Method (RAM) : Core Document
No ratings yet
CIS Risk Assessment Method (RAM) : Core Document
27 pages
SANS Cybersecurity Training Roadmap
No ratings yet
SANS Cybersecurity Training Roadmap
1 page
Free Practice Questions For CompTIA SecOT+ (100+ MCQS)
No ratings yet
Free Practice Questions For CompTIA SecOT+ (100+ MCQS)
31 pages
Key Insights on the Cyber Resilience Act
No ratings yet
Key Insights on the Cyber Resilience Act
14 pages
NIST Privacy Framework Crosswalk Guide
No ratings yet
NIST Privacy Framework Crosswalk Guide
42 pages
Seatec's Information Security Policy
No ratings yet
Seatec's Information Security Policy
10 pages
Third-Party Risk Management Guide
No ratings yet
Third-Party Risk Management Guide
290 pages
NIST RMF Introductory Course Overview
No ratings yet
NIST RMF Introductory Course Overview
44 pages
Sy0-601 V18.02
No ratings yet
Sy0-601 V18.02
188 pages
Ai RMF 1.0 Part 2
No ratings yet
Ai RMF 1.0 Part 2
9 pages
SPIMACO OT Cybersecurity Initiative Report
No ratings yet
SPIMACO OT Cybersecurity Initiative Report
11 pages
NIST CSF 2.0: Key Changes and Resources
No ratings yet
NIST CSF 2.0: Key Changes and Resources
18 pages
IT Governance Implementation in Hotels
No ratings yet
IT Governance Implementation in Hotels
13 pages
Business Impact Analysis Questionnaire
No ratings yet
Business Impact Analysis Questionnaire
7 pages
NIST CSF 2.0 Training Resources
No ratings yet
NIST CSF 2.0 Training Resources
1 page
Enhancing Banking Security with SQUARE
100% (1)
Enhancing Banking Security with SQUARE
4 pages
HIPAA HITECH Security Crosswalk Guide
No ratings yet
HIPAA HITECH Security Crosswalk Guide
51 pages
90-Day CISO Transition Guide
No ratings yet
90-Day CISO Transition Guide
12 pages
CTA Gen AI Report - Part I 2
No ratings yet
CTA Gen AI Report - Part I 2
19 pages
CCZT Sample Questions
No ratings yet
CCZT Sample Questions
16 pages
Vulnerability Handling Workshop Overview
No ratings yet
Vulnerability Handling Workshop Overview
104 pages
CISO MindMap 2024 Overview
No ratings yet
CISO MindMap 2024 Overview
1 page
IoT and Security-ICACCA-DDn-RSS-16Sep17
No ratings yet
IoT and Security-ICACCA-DDn-RSS-16Sep17
33 pages
Risk Management Insights for CISOs
100% (1)
Risk Management Insights for CISOs
21 pages
CISM Process Life Cycle Overview
No ratings yet
CISM Process Life Cycle Overview
2 pages
CISM Certified Information Security Manager All-in-One Exam Guide 1st Edition - Ebook PDF
No ratings yet
CISM Certified Information Security Manager All-in-One Exam Guide 1st Edition - Ebook PDF
127 pages
Understanding Zero Trust Security Model
No ratings yet
Understanding Zero Trust Security Model
2 pages
NIST SP 800-55: Security Metrics Guide
100% (2)
NIST SP 800-55: Security Metrics Guide
99 pages
Analyzing AI Governance of Claude
100% (1)
Analyzing AI Governance of Claude
17 pages
Information Security Manual Overview
No ratings yet
Information Security Manual Overview
235 pages
Hierarchical Cybersecurity Governance Framework
No ratings yet
Hierarchical Cybersecurity Governance Framework
5 pages
Operational Excellence in National Data Index
No ratings yet
Operational Excellence in National Data Index
38 pages
Information Security Policy Essentials
No ratings yet
Information Security Policy Essentials
44 pages
Incident Investigation Summary Report
No ratings yet
Incident Investigation Summary Report
3 pages
AI Cyber Risk Governance Strategy
No ratings yet
AI Cyber Risk Governance Strategy
16 pages
Enterprise Security Management Overview
No ratings yet
Enterprise Security Management Overview
4 pages
Arizona Data Classification Policy
No ratings yet
Arizona Data Classification Policy
9 pages
Cybersecurity Strategy and Standards Guide
100% (1)
Cybersecurity Strategy and Standards Guide
58 pages
Insurance Regulatory and Development Authority of Ndia: Ver - 1.0 April, 2023
No ratings yet
Insurance Regulatory and Development Authority of Ndia: Ver - 1.0 April, 2023
175 pages
Service Level Agreement Overview for OIT
No ratings yet
Service Level Agreement Overview for OIT
17 pages
Cloud Risk Assessment Tool Guide
No ratings yet
Cloud Risk Assessment Tool Guide
9 pages
NIST Risk Management Framework Overview
No ratings yet
NIST Risk Management Framework Overview
1 page
3 Month GRC Roadmap
No ratings yet
3 Month GRC Roadmap
1 page
DISA Review Questions and Answers Manual
No ratings yet
DISA Review Questions and Answers Manual
16 pages
The AI Adolescence Paradox
No ratings yet
The AI Adolescence Paradox
13 pages
AI Governance Executive Cheat Sheet
No ratings yet
AI Governance Executive Cheat Sheet
1 page
AI SYSTEMS CYBER DOCTRINE - Governance and Operational Control of Algorithmic Risk
No ratings yet
AI SYSTEMS CYBER DOCTRINE - Governance and Operational Control of Algorithmic Risk
49 pages
Digital Operational Resilience Act Guide
100% (1)
Digital Operational Resilience Act Guide
439 pages
Network Configuration Audit Checklist
No ratings yet
Network Configuration Audit Checklist
3 pages
Types of Privacy Consent Explained
No ratings yet
Types of Privacy Consent Explained
10 pages
Compliance Framework Overview and Examples
No ratings yet
Compliance Framework Overview and Examples
12 pages
Updated AI Governance Glossary
No ratings yet
Updated AI Governance Glossary
10 pages
401V - R01M00 - Trainee Guide - CISA - Final - PILOT
No ratings yet
401V - R01M00 - Trainee Guide - CISA - Final - PILOT
156 pages
401 Virtual Trainee Guide
No ratings yet
401 Virtual Trainee Guide
161 pages
Analyzing Online Platforms in Education
100% (2)
Analyzing Online Platforms in Education
7 pages
Understanding Computer RAM Types and Issues
No ratings yet
Understanding Computer RAM Types and Issues
22 pages
Mastering dbutils in Databricks
No ratings yet
Mastering dbutils in Databricks
21 pages
HCI Design Guidelines and Principles
No ratings yet
HCI Design Guidelines and Principles
41 pages
System Report for SiSoftware Sandra
No ratings yet
System Report for SiSoftware Sandra
4 pages
Kenya Land Surveyor Occupational Standard
No ratings yet
Kenya Land Surveyor Occupational Standard
95 pages
Koch Fractal Algorithm in C++
No ratings yet
Koch Fractal Algorithm in C++
4 pages
Sanaa Meharich: Tech Skills & Projects
No ratings yet
Sanaa Meharich: Tech Skills & Projects
1 page
Passport Automation System Overview
0% (1)
Passport Automation System Overview
22 pages
Radioss Time Step & Output Tools Guide
No ratings yet
Radioss Time Step & Output Tools Guide
78 pages
VBS Business Rule Creation Guide
No ratings yet
VBS Business Rule Creation Guide
4 pages
Cisco Nexus 9000 for AI Workloads
No ratings yet
Cisco Nexus 9000 for AI Workloads
17 pages
Hard Work vs. Smart Work Explained
No ratings yet
Hard Work vs. Smart Work Explained
7 pages
Image Compression Techniques Explained
No ratings yet
Image Compression Techniques Explained
3 pages
Grade 11 CAT Practical Assessment Guide
No ratings yet
Grade 11 CAT Practical Assessment Guide
35 pages
Building Effective Data Products
No ratings yet
Building Effective Data Products
2 pages
Basic
No ratings yet
Basic
170 pages
Chhattisgarh Laptop Bid Details 2025
No ratings yet
Chhattisgarh Laptop Bid Details 2025
9 pages
Python Basics: A Comprehensive Guide
No ratings yet
Python Basics: A Comprehensive Guide
65 pages
BCA Exam Results for Yashaswini J
No ratings yet
BCA Exam Results for Yashaswini J
2 pages
GV-Recording Server User Manual (RSV14-UM-A-EN)
No ratings yet
GV-Recording Server User Manual (RSV14-UM-A-EN)
157 pages
Cse Assignment 2
No ratings yet
Cse Assignment 2
11 pages
Software Licensing Reset Tool Guide
No ratings yet
Software Licensing Reset Tool Guide
53 pages
General
No ratings yet
General
5 pages
AMCAT CSE Syllabus Overview 2025
100% (1)
AMCAT CSE Syllabus Overview 2025
3 pages
Abseil C++ Library Build Configuration
No ratings yet
Abseil C++ Library Build Configuration
14 pages
Keypad Interface with PIC 16F877A
100% (1)
Keypad Interface with PIC 16F877A
6 pages
A World of Poetry For CXC PDF
33% (6)
A World of Poetry For CXC PDF
3 pages
SD WiFi Hub 021017
No ratings yet
SD WiFi Hub 021017
2 pages
Understanding JavaScript Engine and Runtime
No ratings yet
Understanding JavaScript Engine and Runtime
2 pages