Section 1: ICS Cybersecurity Fundamentals
In part one, we will briefly recap the first edition of the book to outline what was covered and to point out the content that is still very relevant and that will be built upon in this second edition. The remainder of part one will be dedicated to discussions around a revised IDMZ architecture, resulting from many deployments, experience in the field, practice, and feedback. Part one will conclude with a deep dive into how to design for security, architecture that allows all the tools, techniques, and activities discussed in the rest of the book to be implemented effectively and easily.
This section comprises the following chapters:
- Chapter 1, Introduction and Recap of the First Edition
- Chapter 2, A Modern Look at the Industrial Control System Architecture
- Chapter 3, The Industrial Demilitarized Zone
- Chapter 4, Designing the ICS Architecture with Security in Mind
Chapter 1: Introduction and Recap of First Edition
Welcome to the second edition of Industrial Cybersecurity. Over the next 24 chapters, we will discuss the next logical steps after building a secure Industrial Control System (ICS) environment and defining a comprehensive set of policies, procedures, and standards, discussed in detail in the first edition.
We are going to start off this second edition with a brief recap of topics and material that were covered in the first edition of Industrial Cybersecurity. This has mainly been added to get you up to speed with the terminologies, technologies, and principles that are expanded upon throughout the rest of this book. The remainder of the book concentrates on security monitoring and verification of the ICS security posture and the various tools, techniques, and activities involved.
This chapter will be a review of the first edition of this book. We will go over all the topics and material that were covered in the first edition, which should give you a solid base for the topics covered in this book. The chapter will conclude with an explanation of what to expect in the rest of this second-edition book.
In this chapter, we'll cover the following topics:
- What is an ICS?
- Information Technology (IT) and Operational Technology (OT) convergence and the associated benefits and risks
- The comprehensive risk management process
- The Defense-in-Depth (DiD) model
- ICS security program development
Industrial Cybersecurity – second edition
The way I am positioning the first and second editions of Industrial Cybersecurity is with the first edition focusing on ICS cybersecurity fundamentals and ICS cybersecurity program design and implementation. The second edition should be a logical addition by taking these core concepts and expanding upon them with tools, techniques, and activities that are aimed at verifying, monitoring, checking, improving, and correcting the overall security posture of the ICS environment. Some topics we will be covering on this continued journey include the following:
- Architecture design with security in mind
- Active and passive security monitoring
- Industrial threat intelligence
- Visualizing, correlating, and alerting (Security Information and Event Management (SIEM))
- Incident response activities
- Security assessments (penetration testing, red/blue team exercises)
- Threat-hunting exercises
As mentioned earlier, this book will expand upon the topics of the first edition, so let's first recap on what we covered back in 2017.
Recap of the first edition
If you have not yet read the first edition of Industrial Cybersecurity, now would be the time to do so. It covers in detail how to get from zero to hero on implementing an industrial cybersecurity program, to define a secure ICS environment and network architecture that fits your organization's needs and requirements.
Reading the first edition is not a requirement though, as the first four chapters of this book will recap on relevant topics and get you on track to follow along and understand the material presented in this second edition.
Without further ado, let's start our journey with a recap of ICS (cybersecurity) principles and practices.
What is an ICS?
The traffic lights on your way to work if you go by car; the collision avoidance system if you take the train or metro; the delivery of electricity that powers the light you use to read this book; the processing and packaging that went into creating the jug of milk in your fridge or the coffee grind for that cup of Joe that fuels your day... What all these things have in common is the ICS driving the measurements, decisions, corrections, and other miscellaneous actions that result in the end products and services we take for granted each day.
Strictly speaking, an ICS is a collection of equipment, devices, and communication methods that, when combined for the foundational system, perform a specific task, deliver a service, or create a particular product. Figure 1.1 shows an ICS architecture, spanning the various layers of functionality as described in the Purdue model (explained in a later section).
ICS functions
The following screenshot shows a typical ICS architecture, following the Purdue model and stretched out across the industrial and enterprise networks of an organization. It will be used as an illustration for the following sections:
Figure 1.1 – Typical ICS architecture
Within the ICS architecture shown in the preceding screenshot, the following main types of devices within the three main sections of the architecture can typically be distinguished:
- The Enterprise Zone is predominantly IT space. Devices, systems, and equipment typically found here are computer-related, such as servers, workstations, and laptops, as well as mobile devices such as phones, tablets, handhelds, and others. These devices are connected together with various Ethernet equipment and media, including switches, wireless access points, routers, firewalls, and the cables that connect all of these devices (Category 6 (Cat6)/Cat6e media).
- The Industrial Demilitarized Zone (IDMZ) functions as a barrier between the Enterprise Zone and the Industrial Zone and is typically implemented as a collection of virtualization hardware, firewalls, and switches.
- In the Industrial Zone, we can find a variety of regular off-the-shelf IT equipment, along with proprietary and specialized hardware that is used to run the production process. In an upcoming section, ICS architecture, we will discuss some of the more common systems that can be found in the Industrial Zone.
The ultimate goal of an ICS is to create a product or run a process. This goal is achieved by implementing distinct functions within the ICS that, when combined, allow for control, visibility, and management of the production or process control. We will now look at typical functions found within an ICS.
The view function
The view function encompasses the ability to watch the current state of the automation system in real time. This data can be used by operators, supervisors, maintenance engineers, or other personnel to make business decisions or perform corrective actions. For example, when an operator sees that the temperature of boiler 1 is getting low, they might decide ...
