This is the presentation I made at CornCON II: The Wrath OF Corn. The intent of this presentation is to put more tools in your toolbox to help protect Industrial Control Systems, SCADA or Distributed Control Systems from threats and vulnerabilities.
This slideshow was presented February 2, 2016 and developed for the Iowa Infragard team and discusses the Importance of Security Cyber-Physical Control systems, Elements of a control system, the manufacturing supply chain and consequences of cyber attacks in industrial environments. Please feel free to reach out with questions or comments.
Kevin Wheeler, Founder and Managing Director, InfoDefense
Securing Industrial Control Systems
Our nation’s critical infrastructure is controlled by SCADA and other industrial control technologies. Water utilities, petroleum refineries, oil pipelines, food processors, manufacturers and power companies all use SCADA systems to control and monitor operations. The vast majority of these industrial control systems have been in place for decades with few, if any, enhancements to effectively protect against today’s advanced threats. As a result, industrial control system vulnerabilities are currently a major concern.
Legacy SCADA systems can be secured using many of the same best practices that are used to protect the enterprise. This presentation provides an overview of SCADA threats as well as practical solutions for protecting industrial control systems.
NIST releases SP 800-160 Multi-discplinary approach to cybersecurityDavid Sweigert
This document provides guidance for applying systems security engineering principles and practices to the development of secure systems. It discusses integrating security considerations into each stage of the system development life cycle based on the International Organization for Standardization/International Electrotechnical Commission/Institute of Electrical and Electronics Engineers 15288 standard for systems and software engineering. The purpose is to address security issues from stakeholders' protection needs and requirements perspectives using established engineering processes to ensure those needs are adequately addressed throughout the system life cycle.
This document provides an overview of Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS), including fundamentals, evolution over time, vulnerabilities, security frameworks, good practices, and resources. It defines SCADA/ICS, describes how they have become more interconnected, lists vulnerabilities like outdated systems and remote access, outlines security standards like NIST and NERC, recommends practices like segmentation and patching, and provides example frameworks and resources.
ICS (Industrial Control System) Cybersecurity TrainingTonex
ICS Cybersecurity training is intended for security professionals and control system designs in order to give them propelled cybersecurity aptitudes and learning in order to ensure the Industrial Control System (ICS) and keep their mechanical task condition secure against digital dangers.
Audience:
Control engineers, integrators and architects
System administrators, engineers
Information Technology (IT) professionals
Security Consultants
Managers who are responsible for ICS
Researchers and analysts working on ICS security
Vendors, Executives and managers
Information technology professionals, security engineers, security analysts, policy analysts
Investors and contractors
Technicians, operators, and maintenance personnel
Price: $3,999.00 Length: 4 Days
Training Objectives:
Understand fundamentals of Industrial Control Systems (ICS)
Recognize the security architecture for ICS
Identify different kinds of vulnerabilities in ICS network, remote devices, software, or control servers
Learn about active defense and incident response for ICS
Learn the essentials for NERC Critical Infrastructure Protection (CIP)
Understand policies and procedures for NERC critical infrastructure protection (CIP)
List strategies for NERC CIP version 5/6
Apply risk management techniques to ICS
Describe ICS Active Defense and Incident Response
Describe techniques for defending against the new ICS threat matrix
Assess and audit risks for ICS
Apply IEC standard to network and system security of ICS
Implement the ICS security program step by step
Protect the ICS network from vulnerabilities
Understand different types of servers in ICS and protect them against attacks
Apply security standards to SCADA systems based on NIST SP 800-82
Detect different types of attacks to SCADA systems
Tackle all the security challenges related to ICS cybersecurity
Training Outline:
ICS Cybersecurity training course consists of the following lessons, which can be revised and tailored to the client’s need:
Fundamentals of Industrial Control Systems (ICS)
ICS Security Architecture
Common ICS Vulnerabilities
ICS Threat Intelligence
NERC Critical Infrastructure Protection (CIP)
Risk Management and Risk Assessment
ICS Auditing and Assessment
IEC 62443: Network and System Security for ICS
Implementation of ICS Security Program Development
ICS Incident Response
Network Protection for ICS
ICS Server Protection
SCADA Security Policies and Standards
Detection of Cyber Attacks on SCADA Systems
Our instructors at Tonex will assist you with mastering every one of the ICS Cybersecurity plan strategies by presenting the hazard administration framework, chance evaluation methods, episode reaction, constant monitoring, SCADA security change, and network security approaches for ICS.
ICS Cyber security Training
https://www.tonex.com/training-courses/ics-cybersecurity-training/
Industrial Control Security USA Sacramento California Oct 13/14James Nesbitt
This document provides information about the Industrial Control Cybersecurity conference to be held on October 13-14, 2015 in Sacramento, California. The conference will address key topics such as vulnerability detection and mitigation in critical infrastructure sectors like energy, oil, gas, electric and water. It will feature presentations from industry and government leaders as well as cybersecurity experts. The goal is to enhance public-private collaboration and information sharing to improve security of national infrastructure systems.
Top 20 Security Controls for a More Secure InfrastructureInfosec
The CIS® (Center for Internet Security, Inc.®) Controls offer 20 proven, globally recognized best practices for securing your IT systems and data against the most pervasive attacks. Join Tony Sager, CIS Senior Vice President and Chief Evangelist, to learn:
- Origin and purpose of the CIS Controls
- How to prioritize implementation
- How to make the CIS Controls a foundational part of your security program, and improve your enterprise defenses, operations, compliance and security awareness
Watch the full webinar: https://www2.infosecinstitute.com/l/12882/2018-12-06/bcbc68
Jonathan Pollet and Mark Heard of Red Tiger Security at S4x15 OTDay.
The NIST Cybersecurity Framework (CSF) has been out for a year now, and some owner/operators have begun to use it to help create an ICS cyber security program. The Red Tiger Security team discusses what the CSF is and there experience in using it with real world clients.
This slideshow was presented February 2, 2016 and developed for the Iowa Infragard team and discusses the Importance of Security Cyber-Physical Control systems, Elements of a control system, the manufacturing supply chain and consequences of cyber attacks in industrial environments. Please feel free to reach out with questions or comments.
Kevin Wheeler, Founder and Managing Director, InfoDefense
Securing Industrial Control Systems
Our nation’s critical infrastructure is controlled by SCADA and other industrial control technologies. Water utilities, petroleum refineries, oil pipelines, food processors, manufacturers and power companies all use SCADA systems to control and monitor operations. The vast majority of these industrial control systems have been in place for decades with few, if any, enhancements to effectively protect against today’s advanced threats. As a result, industrial control system vulnerabilities are currently a major concern.
Legacy SCADA systems can be secured using many of the same best practices that are used to protect the enterprise. This presentation provides an overview of SCADA threats as well as practical solutions for protecting industrial control systems.
NIST releases SP 800-160 Multi-discplinary approach to cybersecurityDavid Sweigert
This document provides guidance for applying systems security engineering principles and practices to the development of secure systems. It discusses integrating security considerations into each stage of the system development life cycle based on the International Organization for Standardization/International Electrotechnical Commission/Institute of Electrical and Electronics Engineers 15288 standard for systems and software engineering. The purpose is to address security issues from stakeholders' protection needs and requirements perspectives using established engineering processes to ensure those needs are adequately addressed throughout the system life cycle.
This document provides an overview of Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS), including fundamentals, evolution over time, vulnerabilities, security frameworks, good practices, and resources. It defines SCADA/ICS, describes how they have become more interconnected, lists vulnerabilities like outdated systems and remote access, outlines security standards like NIST and NERC, recommends practices like segmentation and patching, and provides example frameworks and resources.
ICS (Industrial Control System) Cybersecurity TrainingTonex
ICS Cybersecurity training is intended for security professionals and control system designs in order to give them propelled cybersecurity aptitudes and learning in order to ensure the Industrial Control System (ICS) and keep their mechanical task condition secure against digital dangers.
Audience:
Control engineers, integrators and architects
System administrators, engineers
Information Technology (IT) professionals
Security Consultants
Managers who are responsible for ICS
Researchers and analysts working on ICS security
Vendors, Executives and managers
Information technology professionals, security engineers, security analysts, policy analysts
Investors and contractors
Technicians, operators, and maintenance personnel
Price: $3,999.00 Length: 4 Days
Training Objectives:
Understand fundamentals of Industrial Control Systems (ICS)
Recognize the security architecture for ICS
Identify different kinds of vulnerabilities in ICS network, remote devices, software, or control servers
Learn about active defense and incident response for ICS
Learn the essentials for NERC Critical Infrastructure Protection (CIP)
Understand policies and procedures for NERC critical infrastructure protection (CIP)
List strategies for NERC CIP version 5/6
Apply risk management techniques to ICS
Describe ICS Active Defense and Incident Response
Describe techniques for defending against the new ICS threat matrix
Assess and audit risks for ICS
Apply IEC standard to network and system security of ICS
Implement the ICS security program step by step
Protect the ICS network from vulnerabilities
Understand different types of servers in ICS and protect them against attacks
Apply security standards to SCADA systems based on NIST SP 800-82
Detect different types of attacks to SCADA systems
Tackle all the security challenges related to ICS cybersecurity
Training Outline:
ICS Cybersecurity training course consists of the following lessons, which can be revised and tailored to the client’s need:
Fundamentals of Industrial Control Systems (ICS)
ICS Security Architecture
Common ICS Vulnerabilities
ICS Threat Intelligence
NERC Critical Infrastructure Protection (CIP)
Risk Management and Risk Assessment
ICS Auditing and Assessment
IEC 62443: Network and System Security for ICS
Implementation of ICS Security Program Development
ICS Incident Response
Network Protection for ICS
ICS Server Protection
SCADA Security Policies and Standards
Detection of Cyber Attacks on SCADA Systems
Our instructors at Tonex will assist you with mastering every one of the ICS Cybersecurity plan strategies by presenting the hazard administration framework, chance evaluation methods, episode reaction, constant monitoring, SCADA security change, and network security approaches for ICS.
ICS Cyber security Training
https://www.tonex.com/training-courses/ics-cybersecurity-training/
Industrial Control Security USA Sacramento California Oct 13/14James Nesbitt
This document provides information about the Industrial Control Cybersecurity conference to be held on October 13-14, 2015 in Sacramento, California. The conference will address key topics such as vulnerability detection and mitigation in critical infrastructure sectors like energy, oil, gas, electric and water. It will feature presentations from industry and government leaders as well as cybersecurity experts. The goal is to enhance public-private collaboration and information sharing to improve security of national infrastructure systems.
Top 20 Security Controls for a More Secure InfrastructureInfosec
The CIS® (Center for Internet Security, Inc.®) Controls offer 20 proven, globally recognized best practices for securing your IT systems and data against the most pervasive attacks. Join Tony Sager, CIS Senior Vice President and Chief Evangelist, to learn:
- Origin and purpose of the CIS Controls
- How to prioritize implementation
- How to make the CIS Controls a foundational part of your security program, and improve your enterprise defenses, operations, compliance and security awareness
Watch the full webinar: https://www2.infosecinstitute.com/l/12882/2018-12-06/bcbc68
Jonathan Pollet and Mark Heard of Red Tiger Security at S4x15 OTDay.
The NIST Cybersecurity Framework (CSF) has been out for a year now, and some owner/operators have begun to use it to help create an ICS cyber security program. The Red Tiger Security team discusses what the CSF is and there experience in using it with real world clients.
Presented at ISACA's EuroCACS 2015 (Copenhaguen).
Understand the impact of Industrial Control Systems (ICS) on the security ecosystem.
Expand the knowledge on SCADA systems and how cyberattacks can have physical consequences, bridging the cyber and physical worlds.
The document discusses the SANS Top 20 Critical Security Controls and how QualysGuard supports them. It provides an overview of the controls and their goals of effectively securing systems. It then describes how QualysGuard's Vulnerability Management, Policy Compliance, and Web Application Scanning modules support specific controls through features like continuous scanning, configuration auditing, vulnerability assessments, and automated remediation workflows.
Practical steps for assessing tablet & mobile device securityEnclaveSecurity
This document discusses practical steps for assessing the security of tablet and mobile devices. It begins by noting that organizations are increasingly using mobile devices but security controls have not kept pace. It then evaluates security controls like encryption, malware protection and authentication that are available or not for different mobile platforms. The document also stresses the importance of centralized management and governance policies for mobile devices. It provides resources for further learning about mobile security best practices.
The document discusses whether patching control systems is an effective security practice given the challenges of securing industrial control systems. It makes three key points:
1. Patching insecure-by-design devices provides minimal risk reduction since attackers can achieve their goals by exploiting legitimate system features rather than vulnerabilities.
2. Most industrial control systems operate within an insecure-by-design zone, so patching may not prevent attacks since attackers do not need to exploit systems to cause damage.
3. Many control system components have low impact even if compromised, so patching provides little benefit given the effort. Prioritizing patching for systems directly accessible from untrusted networks is recommended over broadly patching everything.
Cyber & Process Attack Scenarios for ICSJim Gilsinn
Presented at the OPC Foundation's "The Information Revolution 2014" in Redmond, WA August 5-6, 2014
This presentation discusses the modes and methodologies an attacker may use against an industrial control system in order to create a complex process attack. The presentation then discusses some specific examples, both real and hypothetical. The presentation finishes with a description of some common ways in which an organization could defend itself against these types of attacks.
This document summarizes a presentation on cyber security in real-time systems. It discusses threats to industrial control systems and SCADA systems, and the differences between traditional IT and industrial control system cultures. It provides examples of attacks on industrial control systems and poor monitoring of SCADA systems. It suggests that security operations centers may provide common ground between IT and ICS. Finally, it discusses recent media reports relating to hacking of rail signaling systems and aircraft systems.
Industrial Control Cyber Security Europe 2015 James Nesbitt
The Industrial Control Cybersecurity conference consists of presentations and debate from some of the energy industry’s leading end users from Operational and IT backgrounds, Government influencers, leading cybersecurity authorities and some of the world’s most influential solution providers.
Key topics of discussion will pivot on convergence of operational and information technology transformation, design, implementation, integration and risks associated with enterprise facing architecture.
Further review includes the development of policy, operational and cultural considerations, maturity models, public and private information sharing and the adoption of cybersecurity controls.
2015 will provide further insight into how industry can further develop organisational priorities, effective methodologies, benchmark return on investment for cybersecurity procurement, supplier relationships and how to effectively deploy defense in-depth strategies.
We will introduce discussion on the latest attacks and hear from those who are responsible for identifying them. The conference will further address penetration testing, the art of detection and threat monitoring, incident response and recovery.
The document discusses the implementation of a Cyber Security Operations Center (CSOC) for the Port of Los Angeles. Key points:
- The Port of Los Angeles is a critical national infrastructure that handles a large volume of cargo annually.
- A CSOC was implemented with $2.2 million in funding to address issues like an understaffed security team, lack of threat intelligence, and minimal incident response capabilities.
- The CSOC included tools for threat detection/prevention, security analytics, incident management, and a new facility with a video wall and analytics dashboards. Standard operating procedures and an organizational structure with different security roles were also defined.
Are existing compliance requirements sufficient to prevent data breaches? This session will provide a technical assessment of the 2019 Capital One data breach, illustrating the technical modus operandi of the attack and identify related compliance requirements based on the NIST Cybersecurity Framework. Attendees will learn the unexpected impact of corporate culture on overall cyber security posture.
This talk was presented at RSA Conference 2021 (Session RMG-T15) on May 18, 2021.
Original paper available for download at SSRN: Novaes Neto, Nelson and Madnick, Stuart E. and Moraes G. de Paula, Anchises and Malara Borges, Natasha, A Case Study of the Capital One Data Breach (28/04/2020). https://ssrn.com/abstract=3570138
Achieving Visible Security at Scale with the NIST Cybersecurity FrameworkKevin Fealey
In 2011, Marc Andreessen said "software is eating the world." Today, that statement is truer than ever. Businesses in every industry - from retail, to energy, to financial - are essentially software companies, with millions of lines of custom source code being written and managed in-house. Additionally, advances in the Software Development Life Cycle (SDLC) and the emergence of DevOps have allowed some organizations to deploy new code from development to production dozens of time each day. Traditional approaches to securing such large quantities of code, especially at the speed of current development, have proven to be ineffective, as is evident by recent public data breaches of both public and private sector organizations; as well as the resulting legislation, like Presidential Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity. The only way for cybersecurity teams to keep up with their development counterparts is to automate, but where should they start?
The NIST Cybersecurity Framework provides guidance for organizations interested in establishing or improving a cybersecurity program. Today, a security automation plan is a crucial aspect of any cybersecurity program.
This talk will describe how the NIST Cybersecurity Framework can be used to establish and implement a plan for integrating security-automation activities into any security program. We'll describe the latest trends in security-automation and DevOps, including how to automatically identify security-best practices being followed, and anti-patterns that indicate a potential risk. Attendees will learn how to consolidate this data in a centralized dashboard of their choosing, and how such information can be automatically distributed to stakeholders throughout their organization.
In the coming years, with the growth of Internet of Things (IoT) and Cloud, organizations will become more and more reliant on custom software. Cybersecurity teams who fail to begin automating soon will only continue to fall further behind and put their organizations at greater risk. The NIST Cybersecurity Framework provides the foundation for such teams to establish their roadmap to security, and this talk will build on that foundation to highlight some potential paths.
The document provides a historical timeline of building automation and security from 2004 to 2020. It discusses key events like the founding of BACnet International in 1995 and the BACnet Secure Connect standard released in 2019. The document also discusses challenges around cybersecurity threats, costs, and governance for both IT and operational technology systems. It advocates for collaboration across functions and companies to improve cybersecurity and provides examples of efforts by organizations like BACnet International and Cimetrics to accelerate implementation of secure standards and solutions.
Protecting Infrastructure from Cyber AttacksMaurice Dawson
The Department of Homeland Security (DHS) has become more concerned with cyber attacks on infrastructure such as supervisory control and data acquisition (SCADA) systems. An attack in Iran has proven that the landscape of cyber warfare is continually evolving. As the SCADA systems are the systems that autonomously monitor and adjust switching among other processes within critical infrastructures such as nuclear plants, and power grids DHS has become concerned about these systems as they are unmanned frequently and remotely accessed. A vulnerability such as remote access could allow anyone to take control of assets to critical infrastructure remotely. There has been increasing mandates, and directives to ensure any system deployed meets stringent requirements. As the Stuxnet worm has become a reality, future attacks could be malicious code directly targeting specific locations of critical infrastructure. This paper will address methods to protect infrastructure from cyber attacks using a hybrid of certification & accreditation (C&A) processes and information assurance (IA) controls.
Introduction to NIST Cybersecurity FrameworkTuan Phan
This document provides an introduction to the NIST Cybersecurity Framework. It discusses the goals and key parts of the Framework, including the Framework Core with its functions, categories and subcategories. It also covers the Framework Profile and Implementation Tiers. The document then demonstrates how Trusted Integration's software maps to the Framework and can be used to assess an organization's cybersecurity activities.
For what reason would it be advisable for you to pick TONEX for your SCADA Security Training?
SCADA Security Training course gives progressed SCADA specialized outline of the developing patterns, propelled applications, activities, administration and security. We have Providing SCADA and Automation and Security Training and counseling for more than 15 years with 20+ man-long periods of improvement encounter.
SCADA Security Training course covers all parts of Industrial Control System (ICS) security for a few kinds of control frameworks including: Supervisory Control and Data Acquisition (SCADA) frameworks, Distributed Control Systems (DCS) and Other control framework arrangements, for example, slide mounted Programmable Logic Controllers (PLC).
#Some of the highlights of the SCADA Security Training:
Understand concepts behind Industrial Control Systems (ICS) and SCADA Security
Learn about DCS, SCADA and Industrial Control Systems technology, Infrastructure, instrumentation, HMI and Data Historians
SCADA and ICS Characteristics, Threats and Vulnerabilities
SCADA and ICS Security Program Development and Deployment
SCADA Network Architecture
SCADA Security Controls
Learn Passive and Active Techniques
Explore the impact of Wireless communications on SCADA System Security Testing
Explore SCADA System Security Testing with Active Techniques
Understand SCADA vulnerabilities and different techniques behind exploiting SCADA Systems
Understand how SCADA defense techniques and procedures work
Identify the weak links and challenges in SCADA cybersecurity
Review the available solutions and standards for secure SCADA architectures
Examine the state of policies on data privacy and Internet security and their impact on SCADA
Define a “To Do” list of action items to secure the SCADA systems
ICS/SCADA Security Essentials Essentials for NERC Critical Infrastructure Protection
ICS Active Defense and Incident Response
Assessing and Exploiting SCADA and Control Systems
Critical Infrastructure and Control System Cybersecurity
SCADA Security Management
#Learn more about the following aspects of SCADA, ICS and DCS Security:
Understanding Control System Vulnerabilities
Understanding and Identifying SCADA and ICS Vulnerabilities
SCADA, Industrial Control System (ICS) and Distributed Control Systems (DCS) Exploitation
Securing and Protecting Industrial Control Systems (ICS)
ICS, DCS and PLC Penetration Testing, Exploiting and Vulnerability Assessments
Hacking SCADA using Nmap, Nessus and Metasploit
Hacking Remote Web Servers
SCADA SQL Injection Attack
Learn more about SCADA security training
SCADA Security Training
https://www.tonex.com/training-courses/scada-security-training/
Cybersecurity Metrics: Reporting to BoDPranav Shah
The document discusses a cybersecurity metrics report for a company's board of directors. It summarizes the cyber threat landscape, digital assets at risk, the company's response to cyber risks, and a cyber risk scorecard. Key metrics include the company's BitSight security rating, number of security incidents, audit findings, and progress toward cybersecurity goals.
Ivanti's own healthcare vertical expert will interview an IT leader from William Osler Health System about the unique service management challenges facing healthcare providers today and share the latest on Ivanti Neurons for Healthcare.
Джан Демирел (Турция). Текущий статус регулирования промышленной кибербезопас...Kaspersky
Джан Демирел, Глава команды сервисов по индустриальной кибербезопасности в Cyberwise, в своем докладе рассказывает о текущем статусе регулирования промышленной кибербезопасности в Турции в свете геополитики и стратегии.
Dragos’ Year in Review 2018 report provides insights and lessons learned from our team’s first-hand experience hunting and responding to industrial control systems (ICS) adversaries throughout the year, so we can offer recommendations for stronger defenses for industrial organizations and help drive change in the ICS cybersecurity community.
Challenges and Solution to Mitigate the cyber-attack on Critical Infrastruct...Abhishek Goel
SCADA systems control some of the most vital infrastructure in industrial and energy sectors, from oil and gas pipelines to nuclear facilities to water treatment plants.
Critical infrastructure is defined as the physical and IT assets, networks and services that if disrupted or destroyed would have a serious impact on the health, security, or economic wellbeing of citizens and the efficient functioning of a country’s government.
Cyber Risk Management in 2017: Challenges & RecommendationsUlf Mattsson
Ulf Mattsson presented on cyber risk management challenges and recommendations in 2017. He discussed trends like the increasing involvement of boards in cybersecurity oversight. Mattsson also covered topics such as talking to boards about cyber risk, data security blind spots within organizations, and how the Payment Card Industry Data Security Standard is evolving to incorporate concepts like data discovery and integrating security into the development process. He emphasized the importance of generating security metrics and adopting a DevSecOps approach to strengthen an organization's security posture and compliance.
[CONFidence 2016] Gaweł Mikołajczyk - Making sense out of the Security Operat...PROIDEA
As the SOC Manager with Cisco Active Threat Analytics (ATA), Gawel is responsible for building, growing and operating Cisco Managed Security Services SOC in Krakow, Poland and Tokyo, Japan.
Before that, Gawel spent half a decade in various Architect and Consulting Security roles at Cisco. He holds numerous industry certificates, including CCIE #24987, CISSP-ISSAP, CISA, C|EH and SFCE. Gawel is a frequent speaker at IT events, such as Cisco Live! Europe/Australia, PLNOG, EuroNOG, Security B-Sides, CONFidence, Cisco Connect, Cisco Expo and Cisco Forum.
Before Gawel has joined Cisco, he was a UNIX System Administrator and a Systems Engineer with one of the leading system integrators in Poland. He was also a Cisco Networking Academy Instructor. Gawel graduated from Warsaw University of Technology with degree in Telecommunications.
Presented at ISACA's EuroCACS 2015 (Copenhaguen).
Understand the impact of Industrial Control Systems (ICS) on the security ecosystem.
Expand the knowledge on SCADA systems and how cyberattacks can have physical consequences, bridging the cyber and physical worlds.
The document discusses the SANS Top 20 Critical Security Controls and how QualysGuard supports them. It provides an overview of the controls and their goals of effectively securing systems. It then describes how QualysGuard's Vulnerability Management, Policy Compliance, and Web Application Scanning modules support specific controls through features like continuous scanning, configuration auditing, vulnerability assessments, and automated remediation workflows.
Practical steps for assessing tablet & mobile device securityEnclaveSecurity
This document discusses practical steps for assessing the security of tablet and mobile devices. It begins by noting that organizations are increasingly using mobile devices but security controls have not kept pace. It then evaluates security controls like encryption, malware protection and authentication that are available or not for different mobile platforms. The document also stresses the importance of centralized management and governance policies for mobile devices. It provides resources for further learning about mobile security best practices.
The document discusses whether patching control systems is an effective security practice given the challenges of securing industrial control systems. It makes three key points:
1. Patching insecure-by-design devices provides minimal risk reduction since attackers can achieve their goals by exploiting legitimate system features rather than vulnerabilities.
2. Most industrial control systems operate within an insecure-by-design zone, so patching may not prevent attacks since attackers do not need to exploit systems to cause damage.
3. Many control system components have low impact even if compromised, so patching provides little benefit given the effort. Prioritizing patching for systems directly accessible from untrusted networks is recommended over broadly patching everything.
Cyber & Process Attack Scenarios for ICSJim Gilsinn
Presented at the OPC Foundation's "The Information Revolution 2014" in Redmond, WA August 5-6, 2014
This presentation discusses the modes and methodologies an attacker may use against an industrial control system in order to create a complex process attack. The presentation then discusses some specific examples, both real and hypothetical. The presentation finishes with a description of some common ways in which an organization could defend itself against these types of attacks.
This document summarizes a presentation on cyber security in real-time systems. It discusses threats to industrial control systems and SCADA systems, and the differences between traditional IT and industrial control system cultures. It provides examples of attacks on industrial control systems and poor monitoring of SCADA systems. It suggests that security operations centers may provide common ground between IT and ICS. Finally, it discusses recent media reports relating to hacking of rail signaling systems and aircraft systems.
Industrial Control Cyber Security Europe 2015 James Nesbitt
The Industrial Control Cybersecurity conference consists of presentations and debate from some of the energy industry’s leading end users from Operational and IT backgrounds, Government influencers, leading cybersecurity authorities and some of the world’s most influential solution providers.
Key topics of discussion will pivot on convergence of operational and information technology transformation, design, implementation, integration and risks associated with enterprise facing architecture.
Further review includes the development of policy, operational and cultural considerations, maturity models, public and private information sharing and the adoption of cybersecurity controls.
2015 will provide further insight into how industry can further develop organisational priorities, effective methodologies, benchmark return on investment for cybersecurity procurement, supplier relationships and how to effectively deploy defense in-depth strategies.
We will introduce discussion on the latest attacks and hear from those who are responsible for identifying them. The conference will further address penetration testing, the art of detection and threat monitoring, incident response and recovery.
The document discusses the implementation of a Cyber Security Operations Center (CSOC) for the Port of Los Angeles. Key points:
- The Port of Los Angeles is a critical national infrastructure that handles a large volume of cargo annually.
- A CSOC was implemented with $2.2 million in funding to address issues like an understaffed security team, lack of threat intelligence, and minimal incident response capabilities.
- The CSOC included tools for threat detection/prevention, security analytics, incident management, and a new facility with a video wall and analytics dashboards. Standard operating procedures and an organizational structure with different security roles were also defined.
Are existing compliance requirements sufficient to prevent data breaches? This session will provide a technical assessment of the 2019 Capital One data breach, illustrating the technical modus operandi of the attack and identify related compliance requirements based on the NIST Cybersecurity Framework. Attendees will learn the unexpected impact of corporate culture on overall cyber security posture.
This talk was presented at RSA Conference 2021 (Session RMG-T15) on May 18, 2021.
Original paper available for download at SSRN: Novaes Neto, Nelson and Madnick, Stuart E. and Moraes G. de Paula, Anchises and Malara Borges, Natasha, A Case Study of the Capital One Data Breach (28/04/2020). https://ssrn.com/abstract=3570138
Achieving Visible Security at Scale with the NIST Cybersecurity FrameworkKevin Fealey
In 2011, Marc Andreessen said "software is eating the world." Today, that statement is truer than ever. Businesses in every industry - from retail, to energy, to financial - are essentially software companies, with millions of lines of custom source code being written and managed in-house. Additionally, advances in the Software Development Life Cycle (SDLC) and the emergence of DevOps have allowed some organizations to deploy new code from development to production dozens of time each day. Traditional approaches to securing such large quantities of code, especially at the speed of current development, have proven to be ineffective, as is evident by recent public data breaches of both public and private sector organizations; as well as the resulting legislation, like Presidential Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity. The only way for cybersecurity teams to keep up with their development counterparts is to automate, but where should they start?
The NIST Cybersecurity Framework provides guidance for organizations interested in establishing or improving a cybersecurity program. Today, a security automation plan is a crucial aspect of any cybersecurity program.
This talk will describe how the NIST Cybersecurity Framework can be used to establish and implement a plan for integrating security-automation activities into any security program. We'll describe the latest trends in security-automation and DevOps, including how to automatically identify security-best practices being followed, and anti-patterns that indicate a potential risk. Attendees will learn how to consolidate this data in a centralized dashboard of their choosing, and how such information can be automatically distributed to stakeholders throughout their organization.
In the coming years, with the growth of Internet of Things (IoT) and Cloud, organizations will become more and more reliant on custom software. Cybersecurity teams who fail to begin automating soon will only continue to fall further behind and put their organizations at greater risk. The NIST Cybersecurity Framework provides the foundation for such teams to establish their roadmap to security, and this talk will build on that foundation to highlight some potential paths.
The document provides a historical timeline of building automation and security from 2004 to 2020. It discusses key events like the founding of BACnet International in 1995 and the BACnet Secure Connect standard released in 2019. The document also discusses challenges around cybersecurity threats, costs, and governance for both IT and operational technology systems. It advocates for collaboration across functions and companies to improve cybersecurity and provides examples of efforts by organizations like BACnet International and Cimetrics to accelerate implementation of secure standards and solutions.
Protecting Infrastructure from Cyber AttacksMaurice Dawson
The Department of Homeland Security (DHS) has become more concerned with cyber attacks on infrastructure such as supervisory control and data acquisition (SCADA) systems. An attack in Iran has proven that the landscape of cyber warfare is continually evolving. As the SCADA systems are the systems that autonomously monitor and adjust switching among other processes within critical infrastructures such as nuclear plants, and power grids DHS has become concerned about these systems as they are unmanned frequently and remotely accessed. A vulnerability such as remote access could allow anyone to take control of assets to critical infrastructure remotely. There has been increasing mandates, and directives to ensure any system deployed meets stringent requirements. As the Stuxnet worm has become a reality, future attacks could be malicious code directly targeting specific locations of critical infrastructure. This paper will address methods to protect infrastructure from cyber attacks using a hybrid of certification & accreditation (C&A) processes and information assurance (IA) controls.
Introduction to NIST Cybersecurity FrameworkTuan Phan
This document provides an introduction to the NIST Cybersecurity Framework. It discusses the goals and key parts of the Framework, including the Framework Core with its functions, categories and subcategories. It also covers the Framework Profile and Implementation Tiers. The document then demonstrates how Trusted Integration's software maps to the Framework and can be used to assess an organization's cybersecurity activities.
For what reason would it be advisable for you to pick TONEX for your SCADA Security Training?
SCADA Security Training course gives progressed SCADA specialized outline of the developing patterns, propelled applications, activities, administration and security. We have Providing SCADA and Automation and Security Training and counseling for more than 15 years with 20+ man-long periods of improvement encounter.
SCADA Security Training course covers all parts of Industrial Control System (ICS) security for a few kinds of control frameworks including: Supervisory Control and Data Acquisition (SCADA) frameworks, Distributed Control Systems (DCS) and Other control framework arrangements, for example, slide mounted Programmable Logic Controllers (PLC).
#Some of the highlights of the SCADA Security Training:
Understand concepts behind Industrial Control Systems (ICS) and SCADA Security
Learn about DCS, SCADA and Industrial Control Systems technology, Infrastructure, instrumentation, HMI and Data Historians
SCADA and ICS Characteristics, Threats and Vulnerabilities
SCADA and ICS Security Program Development and Deployment
SCADA Network Architecture
SCADA Security Controls
Learn Passive and Active Techniques
Explore the impact of Wireless communications on SCADA System Security Testing
Explore SCADA System Security Testing with Active Techniques
Understand SCADA vulnerabilities and different techniques behind exploiting SCADA Systems
Understand how SCADA defense techniques and procedures work
Identify the weak links and challenges in SCADA cybersecurity
Review the available solutions and standards for secure SCADA architectures
Examine the state of policies on data privacy and Internet security and their impact on SCADA
Define a “To Do” list of action items to secure the SCADA systems
ICS/SCADA Security Essentials Essentials for NERC Critical Infrastructure Protection
ICS Active Defense and Incident Response
Assessing and Exploiting SCADA and Control Systems
Critical Infrastructure and Control System Cybersecurity
SCADA Security Management
#Learn more about the following aspects of SCADA, ICS and DCS Security:
Understanding Control System Vulnerabilities
Understanding and Identifying SCADA and ICS Vulnerabilities
SCADA, Industrial Control System (ICS) and Distributed Control Systems (DCS) Exploitation
Securing and Protecting Industrial Control Systems (ICS)
ICS, DCS and PLC Penetration Testing, Exploiting and Vulnerability Assessments
Hacking SCADA using Nmap, Nessus and Metasploit
Hacking Remote Web Servers
SCADA SQL Injection Attack
Learn more about SCADA security training
SCADA Security Training
https://www.tonex.com/training-courses/scada-security-training/
Cybersecurity Metrics: Reporting to BoDPranav Shah
The document discusses a cybersecurity metrics report for a company's board of directors. It summarizes the cyber threat landscape, digital assets at risk, the company's response to cyber risks, and a cyber risk scorecard. Key metrics include the company's BitSight security rating, number of security incidents, audit findings, and progress toward cybersecurity goals.
Ivanti's own healthcare vertical expert will interview an IT leader from William Osler Health System about the unique service management challenges facing healthcare providers today and share the latest on Ivanti Neurons for Healthcare.
Джан Демирел (Турция). Текущий статус регулирования промышленной кибербезопас...Kaspersky
Джан Демирел, Глава команды сервисов по индустриальной кибербезопасности в Cyberwise, в своем докладе рассказывает о текущем статусе регулирования промышленной кибербезопасности в Турции в свете геополитики и стратегии.
Dragos’ Year in Review 2018 report provides insights and lessons learned from our team’s first-hand experience hunting and responding to industrial control systems (ICS) adversaries throughout the year, so we can offer recommendations for stronger defenses for industrial organizations and help drive change in the ICS cybersecurity community.
Challenges and Solution to Mitigate the cyber-attack on Critical Infrastruct...Abhishek Goel
SCADA systems control some of the most vital infrastructure in industrial and energy sectors, from oil and gas pipelines to nuclear facilities to water treatment plants.
Critical infrastructure is defined as the physical and IT assets, networks and services that if disrupted or destroyed would have a serious impact on the health, security, or economic wellbeing of citizens and the efficient functioning of a country’s government.
Cyber Risk Management in 2017: Challenges & RecommendationsUlf Mattsson
Ulf Mattsson presented on cyber risk management challenges and recommendations in 2017. He discussed trends like the increasing involvement of boards in cybersecurity oversight. Mattsson also covered topics such as talking to boards about cyber risk, data security blind spots within organizations, and how the Payment Card Industry Data Security Standard is evolving to incorporate concepts like data discovery and integrating security into the development process. He emphasized the importance of generating security metrics and adopting a DevSecOps approach to strengthen an organization's security posture and compliance.
[CONFidence 2016] Gaweł Mikołajczyk - Making sense out of the Security Operat...PROIDEA
As the SOC Manager with Cisco Active Threat Analytics (ATA), Gawel is responsible for building, growing and operating Cisco Managed Security Services SOC in Krakow, Poland and Tokyo, Japan.
Before that, Gawel spent half a decade in various Architect and Consulting Security roles at Cisco. He holds numerous industry certificates, including CCIE #24987, CISSP-ISSAP, CISA, C|EH and SFCE. Gawel is a frequent speaker at IT events, such as Cisco Live! Europe/Australia, PLNOG, EuroNOG, Security B-Sides, CONFidence, Cisco Connect, Cisco Expo and Cisco Forum.
Before Gawel has joined Cisco, he was a UNIX System Administrator and a Systems Engineer with one of the leading system integrators in Poland. He was also a Cisco Networking Academy Instructor. Gawel graduated from Warsaw University of Technology with degree in Telecommunications.
Want to learn about the latest NIST Cybersecurity Framework (CSF) 2.0?
We've just uploaded a recording of our 2-hour training workshop organized by the ISC2 El Djazair Chapter and delivered by cybersecurity instructor Bachir Benyammi.
In this workshop, you'll gain insights on:
- NIST CSF 2.0 components (Core, Tiers, and Profiles)
- Implementing the framework for your specific needs
- Improving your organization's cybersecurity posture
- Assessing your cybersecurity maturity
- Examples of assessment tools
Watch the full workshop on our YouTube channel: https://lnkd.in/dXEbp8QM
DevSecOps aims to integrate security practices into DevOps workflows to deliver value faster and safer. It addresses challenges like keeping security practices aligned with continuous delivery models and empowered DevOps teams. DevSecOps incorporates security checks and tools into development pipelines to find and fix issues early. This helps prevent breaches like the 2017 Equifax hack, which exploited a known vulnerability. DevSecOps promotes a culture of collaboration, shared responsibility, and proactive security monitoring throughout the software development lifecycle.
PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadkówPROIDEA
Sesja o doświadczeniach profesjonalnego zespołu SOC (Security Operations Center) w oparciu o przykłady z życia wzięte. Od anatomii ataków do rekomendacji jak można się skutecznie bronić.
CISCO SECURITY INTELLIGENCE OPERATIONS SIOHappy Sad
Cisco Security Intelligence Operations (SIO) provides threat intelligence and reputation-based security across Cisco security products through three main components: Cisco SensorBase for global threat data collection, the Threat Operations Center for analysis and rule/signature development, and dynamic updates of security rules/data to Cisco devices. SIO collects data from over 700,000 Cisco security devices and other sources to develop reputation scores and rules that power features like global correlation and reputation-based filtering across Cisco firewalls, IPS, email and web security products.
The document describes how Cisco collaborated with other security companies to identify and shut down a major Angler exploit kit operation that was targeting 90,000 victims per day and generating tens of millions of dollars annually through ransomware attacks. By working with the hosting provider Limestone Networks, Cisco was able to determine that most of the Angler traffic was coming from a small number of Limestone and Hetzner servers, and helped get those servers taken offline to cripple the ransomware campaign. The success highlights the importance of industry collaboration to combat sophisticated cybercriminal operations.
Adversaries and defenders are both developing technologies
and tactics that are growing in sophistication. For their part,
bad actors are building strong back-end infrastructures
with which to launch and support their campaigns. Online
criminals are refining their techniques for extracting money
from victims and for evading detection even as they continue
to steal data and intellectual property.
The Cisco 2016 Annual Security Report highlights several major developments in cybersecurity:
1) Cisco helped sideline the largest Angler exploit kit operation in the US that was targeting 90,000 victims per day and generating tens of millions annually for threat actors.
2) Cisco and Level 3 Threat Research Labs significantly weakened one of the largest DDoS botnets ever observed called SSHPsychos (Group 93).
3) Malicious browser extensions are a major source of data leakage, affecting over 85% of organizations studied.
Como cybercriminals cada vez mais ataques a sua estratégia de risco cibernético está sob o microscópio. Com o Cisco 2016 Annual Security Report, que analisa os avanços da indústria de segurança e dos criminosos, veja como seus empresas avaliam a preparação para a segurança em suas organizações e obtêm idéias sobre onde fortalecer suas defesas. Seja um profissional de Segurança da informação faça o curso de analista de Redes e segurança http://www.trainning.com.br/curso_mcse_ccna_ceh_itil_vmware/?v=Slide
As cybercriminals increasingly profit from brazen attacks, your cyber-risk strategy is under the microscope. With the Cisco 2016 Annual Security Report, which analyzes advances by security industry and criminals, see how your peers assess security preparedness in their organizations and gain insights into where to strengthen your defenses.
Industrial Control Security USA Sacramento California Oct 6/7James Nesbitt
Industrial Control Cybersecurity USA October 6th and 7th
Sacramento California USA
Identify, protect, detect, respond and recover.
All stakeholders have a new responsibility in ensuring the safety, reliability and stability of our Critical National Infrastructure. Public and Private partnerships are paramount and information sharing on an international level a priority. We will be addressing key areas of vulnerability, threat detection, mitigation, and planning for the Energy and Water Sector.
The document discusses product security and how it relates to application security, infrastructure security, and security operations for a specific product or system. It argues that applying DevOps methodologies to traditional application security practices can help make security part of everyday work for developers and operations teams. This will help change an organization's security culture to focus on designing security into products from the start.
This document discusses cybersecurity frameworks and provides an overview of the most popular frameworks. It begins by defining frameworks, regulations, standards and guidelines. Some of the main benefits of frameworks mentioned are providing a comprehensive security baseline, enabling measurement and benchmarking, and demonstrating maturity. Twelve of the most popular frameworks are then listed and described briefly. The document outlines different types of frameworks and provides tips for choosing an appropriate framework based on mandatory requirements, country practices, industry usage, certification needs, organization size and maturity. It also discusses mappings between frameworks and attributes of information security controls.
For Public_ Cybersecurity_ Frameworks, Fundamentals, and Foundations 2023.pdfJustinBrown267905
The document provides an overview of cybersecurity frameworks, fundamentals, and foundations. It discusses common cybersecurity terms like frameworks, controls, and standards. It also examines drivers for cybersecurity like laws, compliance, audits and data privacy. Key areas covered include asset inventory, risk assessment, threat modeling, security controls, frameworks like NIST CSF, and the importance of people/human factors. The document aims to help organizations strengthen their cybersecurity posture and navigation the complex landscape of improving security.
Architecture centric support for security orchestration and automationChadni Islam
The presentation was prepared for the University of Adelaide School of Computer Science Research Seminar Series. See the slides to know
- what is security orchestration?
- what are the key challenges in this domain?
- how software architecture can play a role in improving the design decision of security orchestration and automation platform?
This document discusses various types of security assessments, including technical security testing, security process assessments, and security audits. It provides details on vulnerability assessments, network penetration testing, web application penetration testing, and source code analysis. It also discusses security process reviews and the differences between security assessments and security audits.
Similar to Securing Industrial Control Systems - CornCON II: The Wrath Of Corn (20)
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!SOFTTECHHUB
As the digital landscape continually evolves, operating systems play a critical role in shaping user experiences and productivity. The launch of Nitrux Linux 3.5.0 marks a significant milestone, offering a robust alternative to traditional systems such as Windows 11. This article delves into the essence of Nitrux Linux 3.5.0, exploring its unique features, advantages, and how it stands as a compelling choice for both casual users and tech enthusiasts.
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...Neo4j
Leonard Jayamohan, Partner & Generative AI Lead, Deloitte
This keynote will reveal how Deloitte leverages Neo4j’s graph power for groundbreaking digital twin solutions, achieving a staggering 100x performance boost. Discover the essential role knowledge graphs play in successful generative AI implementations. Plus, get an exclusive look at an innovative Neo4j + Generative AI solution Deloitte is developing in-house.
Essentials of Automations: The Art of Triggers and Actions in FMESafe Software
In this second installment of our Essentials of Automations webinar series, we’ll explore the landscape of triggers and actions, guiding you through the nuances of authoring and adapting workspaces for seamless automations. Gain an understanding of the full spectrum of triggers and actions available in FME, empowering you to enhance your workspaces for efficient automation.
We’ll kick things off by showcasing the most commonly used event-based triggers, introducing you to various automation workflows like manual triggers, schedules, directory watchers, and more. Plus, see how these elements play out in real scenarios.
Whether you’re tweaking your current setup or building from the ground up, this session will arm you with the tools and insights needed to transform your FME usage into a powerhouse of productivity. Join us to discover effective strategies that simplify complex processes, enhancing your productivity and transforming your data management practices with FME. Let’s turn complexity into clarity and make your workspaces work wonders!
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024Neo4j
Neha Bajwa, Vice President of Product Marketing, Neo4j
Join us as we explore breakthrough innovations enabled by interconnected data and AI. Discover firsthand how organizations use relationships in data to uncover contextual insights and solve our most pressing challenges – from optimizing supply chains, detecting fraud, and improving customer experiences to accelerating drug discoveries.
How to Get CNIC Information System with Paksim Ga.pptxdanishmna97
Pakdata Cf is a groundbreaking system designed to streamline and facilitate access to CNIC information. This innovative platform leverages advanced technology to provide users with efficient and secure access to their CNIC details.
In the rapidly evolving landscape of technologies, XML continues to play a vital role in structuring, storing, and transporting data across diverse systems. The recent advancements in artificial intelligence (AI) present new methodologies for enhancing XML development workflows, introducing efficiency, automation, and intelligent capabilities. This presentation will outline the scope and perspective of utilizing AI in XML development. The potential benefits and the possible pitfalls will be highlighted, providing a balanced view of the subject.
We will explore the capabilities of AI in understanding XML markup languages and autonomously creating structured XML content. Additionally, we will examine the capacity of AI to enrich plain text with appropriate XML markup. Practical examples and methodological guidelines will be provided to elucidate how AI can be effectively prompted to interpret and generate accurate XML markup.
Further emphasis will be placed on the role of AI in developing XSLT, or schemas such as XSD and Schematron. We will address the techniques and strategies adopted to create prompts for generating code, explaining code, or refactoring the code, and the results achieved.
The discussion will extend to how AI can be used to transform XML content. In particular, the focus will be on the use of AI XPath extension functions in XSLT, Schematron, Schematron Quick Fixes, or for XML content refactoring.
The presentation aims to deliver a comprehensive overview of AI usage in XML development, providing attendees with the necessary knowledge to make informed decisions. Whether you’re at the early stages of adopting AI or considering integrating it in advanced XML development, this presentation will cover all levels of expertise.
By highlighting the potential advantages and challenges of integrating AI with XML development tools and languages, the presentation seeks to inspire thoughtful conversation around the future of XML development. We’ll not only delve into the technical aspects of AI-powered XML development but also discuss practical implications and possible future directions.
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AIVladimir Iglovikov, Ph.D.
Presented by Vladimir Iglovikov:
- https://www.linkedin.com/in/iglovikov/
- https://x.com/viglovikov
- https://www.instagram.com/ternaus/
This presentation delves into the journey of Albumentations.ai, a highly successful open-source library for data augmentation.
Created out of a necessity for superior performance in Kaggle competitions, Albumentations has grown to become a widely used tool among data scientists and machine learning practitioners.
This case study covers various aspects, including:
People: The contributors and community that have supported Albumentations.
Metrics: The success indicators such as downloads, daily active users, GitHub stars, and financial contributions.
Challenges: The hurdles in monetizing open-source projects and measuring user engagement.
Development Practices: Best practices for creating, maintaining, and scaling open-source libraries, including code hygiene, CI/CD, and fast iteration.
Community Building: Strategies for making adoption easy, iterating quickly, and fostering a vibrant, engaged community.
Marketing: Both online and offline marketing tactics, focusing on real, impactful interactions and collaborations.
Mental Health: Maintaining balance and not feeling pressured by user demands.
Key insights include the importance of automation, making the adoption process seamless, and leveraging offline interactions for marketing. The presentation also emphasizes the need for continuous small improvements and building a friendly, inclusive community that contributes to the project's growth.
Vladimir Iglovikov brings his extensive experience as a Kaggle Grandmaster, ex-Staff ML Engineer at Lyft, sharing valuable lessons and practical advice for anyone looking to enhance the adoption of their open-source projects.
Explore more about Albumentations and join the community at:
GitHub: https://github.com/albumentations-team/albumentations
Website: https://albumentations.ai/
LinkedIn: https://www.linkedin.com/company/100504475
Twitter: https://x.com/albumentations
Cosa hanno in comune un mattoncino Lego e la backdoor XZ?Speck&Tech
ABSTRACT: A prima vista, un mattoncino Lego e la backdoor XZ potrebbero avere in comune il fatto di essere entrambi blocchi di costruzione, o dipendenze di progetti creativi e software. La realtà è che un mattoncino Lego e il caso della backdoor XZ hanno molto di più di tutto ciò in comune.
Partecipate alla presentazione per immergervi in una storia di interoperabilità, standard e formati aperti, per poi discutere del ruolo importante che i contributori hanno in una comunità open source sostenibile.
BIO: Sostenitrice del software libero e dei formati standard e aperti. È stata un membro attivo dei progetti Fedora e openSUSE e ha co-fondato l'Associazione LibreItalia dove è stata coinvolta in diversi eventi, migrazioni e formazione relativi a LibreOffice. In precedenza ha lavorato a migrazioni e corsi di formazione su LibreOffice per diverse amministrazioni pubbliche e privati. Da gennaio 2020 lavora in SUSE come Software Release Engineer per Uyuni e SUSE Manager e quando non segue la sua passione per i computer e per Geeko coltiva la sua curiosità per l'astronomia (da cui deriva il suo nickname deneb_alpha).
In his public lecture, Christian Timmerer provides insights into the fascinating history of video streaming, starting from its humble beginnings before YouTube to the groundbreaking technologies that now dominate platforms like Netflix and ORF ON. Timmerer also presents provocative contributions of his own that have significantly influenced the industry. He concludes by looking at future challenges and invites the audience to join in a discussion.
A tale of scale & speed: How the US Navy is enabling software delivery from l...sonjaschweigert1
Rapid and secure feature delivery is a goal across every application team and every branch of the DoD. The Navy’s DevSecOps platform, Party Barge, has achieved:
- Reduction in onboarding time from 5 weeks to 1 day
- Improved developer experience and productivity through actionable findings and reduction of false positives
- Maintenance of superior security standards and inherent policy enforcement with Authorization to Operate (ATO)
Development teams can ship efficiently and ensure applications are cyber ready for Navy Authorizing Officials (AOs). In this webinar, Sigma Defense and Anchore will give attendees a look behind the scenes and demo secure pipeline automation and security artifacts that speed up application ATO and time to production.
We will cover:
- How to remove silos in DevSecOps
- How to build efficient development pipeline roles and component templates
- How to deliver security artifacts that matter for ATO’s (SBOMs, vulnerability reports, and policy evidence)
- How to streamline operations with automated policy checks on container images
Generative AI Deep Dive: Advancing from Proof of Concept to ProductionAggregage
Join Maher Hanafi, VP of Engineering at Betterworks, in this new session where he'll share a practical framework to transform Gen AI prototypes into impactful products! He'll delve into the complexities of data collection and management, model selection and optimization, and ensuring security, scalability, and responsible use.
Climate Impact of Software Testing at Nordic Testing DaysKari Kakkonen
My slides at Nordic Testing Days 6.6.2024
Climate impact / sustainability of software testing discussed on the talk. ICT and testing must carry their part of global responsibility to help with the climat warming. We can minimize the carbon footprint but we can also have a carbon handprint, a positive impact on the climate. Quality characteristics can be added with sustainability, and then measured continuously. Test environments can be used less, and in smaller scale and on demand. Test techniques can be used in optimizing or minimizing number of tests. Test automation can be used to speed up testing.
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Albert Hoitingh
In this session I delve into the encryption technology used in Microsoft 365 and Microsoft Purview. Including the concepts of Customer Key and Double Key Encryption.
Pushing the limits of ePRTC: 100ns holdover for 100 daysAdtran
At WSTS 2024, Alon Stern explored the topic of parametric holdover and explained how recent research findings can be implemented in real-world PNT networks to achieve 100 nanoseconds of accuracy for up to 100 days.
Sudheer Mechineni, Head of Application Frameworks, Standard Chartered Bank
Discover how Standard Chartered Bank harnessed the power of Neo4j to transform complex data access challenges into a dynamic, scalable graph database solution. This keynote will cover their journey from initial adoption to deploying a fully automated, enterprise-grade causal cluster, highlighting key strategies for modelling organisational changes and ensuring robust disaster recovery. Learn how these innovations have not only enhanced Standard Chartered Bank’s data infrastructure but also positioned them as pioneers in the banking sector’s adoption of graph technology.
Dr. Sean Tan, Head of Data Science, Changi Airport Group
Discover how Changi Airport Group (CAG) leverages graph technologies and generative AI to revolutionize their search capabilities. This session delves into the unique search needs of CAG’s diverse passengers and customers, showcasing how graph data structures enhance the accuracy and relevance of AI-generated search results, mitigating the risk of “hallucinations” and improving the overall customer journey.
3. In brief
► Nordic and US-based steel company with a global reach
► Leading producer of Advanced High Strength Steels
► About 17,300 employees in 50 countries
► Steel production facilities in Sweden, Finland and the US
► Annual steel production capacity of 8.8 million tons
► Listed on multiple public exchanges
100% Recyclable Products – 97% recycled raw materials,
saving 600,000 tires per year, production results in 66% less
CO2 emissions, recycle over 1 Million gallons of water a
year. Aiming for a CO2 free process Iowa facility makes steel
using 40% wind power.
3
4. 17,300 employees in over 50 countries
Nordic
Main production sites
in Sweden, Finland and US –
SSAB production sites
Sales coverage
4
5. Disclaimer
The views expressed in this presentation
are those of the author and do not
necessarily reflect the views of SSAB, IEEE
or the Quad Cities Cyber Security Alliance.
This presentation is “TLP: White” and may
be distributed, shared, remixed and reused
without restriction.
5
6. Good to have a goal
Your primary responsibility is to prevent
compromise.
You need to preserve the safety and reliability of
the physical process and not the system itself.
Adequately protect systems
ICS system failure can result in:
◦ Loss of life
◦ Loss of revenue
◦ Loss of equipment
◦ Environmental damage
◦ Loss of service
6
7. Basics
Know your network
Know your hosts
Know your enemy
Know what your enemy knows
Protection is key but detection is a must
Apply principals of least privilege
Apply defense in depth
Use what you have
7
8. You are not alone!
Quad Cities Cyber Security Alliance
https://www.facebook.com/groups/QCCyber/
US-CERT & ICS-CERT
www.us-cert.gov – ics-cert.us-cert.gov
877-776-7585
NIST - www.nist.gov
SCADAHACKER - https://scadahacker.com
C3 voluntary program –
https://www.us-cert.gov/ccubedvp
DHS – AIS and CISCP - cyberadvisor@hq.dhs.gov
https://www.dhs.gov/topic/cybersecurity-information-sharing
https://www.us-cert.gov/ais
https://www.dhs.gov/ciscp
InfraGard - www.infragard.org
FIRST.org and Information Sharing and Analysis Centers (ISACs)
National Strategy for Securing Control Systems
https://ics-cert.us-cert.gov/sites/default/files/documents/Strategy%20for%20Securing%20Control%20Systems.pdf
9. Network and Share
InfraGard - www.infragard.org
American Society for Industrial Security - www.asisonline.org
National Cybersecurity Partnership
HSIN –
dhs.gov/homeland-security-information-network-hsin
Professional Relationships
LinkedIn Groups - Industrial Control System Cyber Security
(ICS-CS) - linkedin.com/topic/industrial-control-systems-
security
Local Organizations
◦ Quad Cities Cyber Security Alliance
◦ IEEE
◦ ISACA
11. What is it?
Standard expression of current state
Standard way to express who you want to
be when you grow up.
Identify and prioritize opportunities to
improve
Measure Progress
Drives communication to teams and
management
11
13. Identify
Asset Management
Identify and Categorize Risks
Identify Stakeholder Communities
Identify the correct Controls for your risks
Secure Network Interconnections
Identify Special Protocols
Perform Risk Assessments
Perform Protocol Analysis
Strategies
Indicators of Compromise
13
14. ICS-CERT will train you – For FREE
What is available?
https://ics-cert.us-cert.gov/Training-Available-Through-ICS-CERT
Operational Security (OPSEC) for Control Systems (100W) - 1 hour
Cybersecurity for Industrial Control Systems (210W) - 15 hours
The 210W courses are:
210W-01 Differences in Deployments of Industrial Control Systems (ICS)
210W-02 Influence of Common Information Technology (IT) Components on ICS
210W-03 Common ICS Components
210W-04 Cybersecurity within IT and ICS Domains
210W-05 Cybersecurity Risk
210W-06 Current Trends - Threats
210W-07 Current Trends - Vulnerabilities
210W-08 Determining the Impact of a Cybersecurity Incident
210W-09 Attack Methodologies in IT and ICS
210W-10 Mapping IT Defense-in-Depth Security Solutions to ICS
ICS- CERT Virtual Training Portal
https://ics-cert-training.inl.gov
15. TEEX will also train you for free
What is available?
AWR138 Network Assurance
AWR139 Digital Forensics Basics
AWR168 Cyber Law and White Collar Crime
AWR169 Cyber Incident Analysis and Response
AWR173 Information Security Basics
AWR174 Cyber Ethics
AWR175 Information Security for Everyone
AWR176 Disaster Recovery for Information Systems
AWR177 Information Risk Management
AWR178 Secure Software
ICS- CERT Virtual Training Portal
https://teex.org/Pages/Program.aspx?catID=199
Source:
https://teex.org/Pages/default.aspx
16. FEMA will also train you for free
What is available?
Setup a free FEMA Student ID
https://cdp.dhs.gov/FEMASID
FEMA Continuity of Operations Workshop
https://www.fema.gov/continuity-operations-workshops
Incident Command System (ICS) training
Critical Infrastructure Support
National Infrastructure Plan
Protecting Critical Infrastructure Against Insider Threats
17. You get millions of dollars of research for free
What is available?
NIST Computer Security Resource Center
SP800-82 ICS Security
Developing a Risk Program
Secure Architecture
ICS Security Controls
ICS-CERT Defense-in-depth recommended practices
18. Start a project
If you don’t start somewhere
– you’re gonna go nowhere. –
Bob Marley
Build a risk based program
Know what your protecting
Segment in trust boundaries
Develop ICS relevant policies
Build a 60 second elevator
pitch and Always Be Closing
20. Know your stakeholders
Legal Team
Safety Team
ICS Engineers
Procurement Teams
Sr. Management Teams
Human Resources
Inside and Outside Sales
Quality
Research and Development
21. Many hands make light work
Don’t try and do it all yourself.
Divide work by stakeholder teams.
Ensure stakeholder teams understand their roles.
22. Work top down
Start at the TOP!
Have the top ask their managers
for support.
Work with those managers to
ask them for support.
Keep pushing to the bottom.
23. Cyber Resilience Review
Self Assessment - Simple PDF Questionnaire
Built before NIST CSF / Has been
Build on top of CERT-Resilience Management Model (RMM)
Measure your maturity in:
1 Asset Management
2 Controls Management
3 Configuration and Change Management
4 Vulnerability Management
5 Incident Management
6 Service Continuity Management
7 Risk Management
8 External Dependencies Management
9 Training and Awareness
10 Situational Awareness
Source:
https://www.us-cert.gov/ccubedvp/assessments
28. Cyber Security Evaluation Tool (CSET)
DHS Cyber Security Evaluation Tool
Systematic
Disciplined
Repeatable
Version 8 launches September 13 for download
Supports 35 Industry Accepted Cybersecurity Standards
Supporting general environments as well as Chemical, Oil, Gas,
Electrical, Nuclear, and other models available.
Key Questions and Universal Questions
SP800-53, SP800-171, SP800-82
Wizard Based Assurance Level Calculator
Import and Export for Visio Drawings
Reports in PDF or DOCX:
Executive Summary, Site Summary, Detail Report, Security Plan
Source:
https://teex.org/Pages/default.aspx
29. Control System Architecture Analysis
Design Architecture Review (DAR)
2 to 3 day review of Network Architecture
On site by DHS staff ( iNL)
Meet with Information Technology and Operational Technology Teams
Review Vendor Support
Review Cyber Security Controls
Review Asset Inventory
ICS Network Architecture
Review Protective and Detective Controls
Review Device Configuration
Physical Security of Critical Assets
Source:
https://ics-cert.us-cert.gov/Assessments
32. Control System Architecture Analysis
Network Architecture Verification and
Validation
Review Protocol Hierarchy – Data flows and organization of network
Review Netflow device-to-device communication
Review traffic attempting to traverse boundaries
Baseline of network traffic
Validates that the network is clean and clear of known threats
Source:
https://ics-cert.us-cert.gov/Assessments
33. Infrastructure Visualization Platform
Supports Critical Infrastructure and Emergency Responders
DHS scans the environment and provides you with several copies
including viewpoints of Hostile Targets and Civil Response
Helps First responder teams help you during a Cyber Physical Event
Source:
https://www.dhs.gov/infrastructure-visualization-platform
34. Open Source Tools
YARA - plusvic.github.io/yara/
Yara Rules – ICS-CERT or http://yararules.com/
Wireshark - https://www.wireshark.org/
Moonsols Memory Toolkit - DumpIT –
www.moonsols.com
Laura Chapell on YouTube
“Introduction to Wireshark Course WTC01 & WTC02”
Grass Marlin -
https://github.com/iadgov/GRASSMARLIN
Google Dorking
Shodan – shodan.io
Windows Built-In Tools
35. Windows Built-In Tools
> tasklist /svc - List all services running on a host
> Netstat –noa – List all ports with associated task number
◦ date /t > %1
◦ time /t >> %1
◦ whoami >> %1
◦ systeminfo >> %1
◦ ipconfig /all >> %1
◦ arp -a >> %1
◦ netstat -b >> %1
◦ schtasks >> %1
◦ doskey /h >> %1
36. Technology and Innovation
New Products are coming to market from security companies that
understand ICS and Scada Protocols. Not just for TCP anymore:
Modebus
Profinet
BACNet
S7
OPC
…and more…
ICS Vendors are catching up
Traditional Vendors are branching out….
38. Sample Questions
[Procurement] Are appropriate agreements finalized before access is
granted, including for third parties and contractors?
[Code Protection] Are malicious code protection mechanisms used at
system entry and exit points and at workstations, servers, or mobile
computing devices?
[Media Control] Is the capability for automatic execution of
code on removable media disabled?
[Physical Security] Is entry to the facility controlled by physical
access devices and/or guards?
[Awareness Training] Is basic security awareness training
provided to all system users before authorizing access
Editor's Notes
Q. How many people are here at CornCON for the first time?
30 years technical experience, 27 years IT Experience,
Information Security Manager, IT for SSAB Americas
Founding member of the Quad Cities Cybersecurity Alliance
Experience in Electronics, Field Service, ISP Webmaster and Internet Services, and Enterprise Communications.
Founding Quad Cities Cybersecurity Alliance, member IEEE and the Chicago Infragard Chapter
Certified by FEMA, HP, CompTIA, Microsoft, and others
Previous positions as Project Manager, Server Management, Critical Infrastructure Management and IT Operations Management.
Q. Who do we have in the room?
Manufacturing?
Energy?
Nuclear?
Power?
Brewing or other scientific?
Automated Indicator Sharing
Cyber Information Sharing and Collaboration Program
Q. Who is an alliance member?
Q. Any C-Cubed Members?
Q. Anyone using the NIST CSF?
It’s a little simplistic but a good start. Up to 30% of organizations are already using CSF in some manner
Powerful Crosswalks available.
Identify protect and detect are right on. Respond and recover is a little lackluster in an ICS environment.
If you are trying to protect a process and not information once the genie is out of the bottle well, its over.
Q. Anyone here with a FEMA Training ID?
All Control systems are software and all software can be hacked!
Create a business case for an ICS Security Program, prioritize your potential costs, and estimate damage scenarios.
How many could be hospitalized? How many could be killed, what is the potential for capital investment loss, what is the potential for an environmental cleanup need?
Know your brushes from your diamonds. If you try and protect your toothbrushes and your diamonds you will lose less toothbrushes and more diamonds.
Use a risk based approach – know hat you are protecting - your threats vulnerabilities likelihood and impact – only you can know these things in your context.
Before Video:
Reflecting on this story will help you to understand why SSAB and myself both care deeply about protecting industrial control systems.
This is a news story from 2014 that talks about another steel company from Germany. Just to be clear this is not an SSAB facility.
After Video:
The steel company depicted in this video lost the ability to control their furnaces, and eventually this lead to a runaway condition that resulted in the loss of property. In this case it was just property. Industrial controls control physical processes and so the consequences of a breach are often much higher than in traditional IT systems.
Q. What other stakeholder groups might we see?
This slide contains video content with audio –
ICS-CERT maintains a little known but powerful tool called the Cybersecurity Evaluation Toolkit.
If you are interested in Cybersecurity it is likely you would benefit from CSET.
CSET offers a Wizard based approach to setting security assurance levels, Flexible standards, Network diagraming tools, an Extensive Resource Library good for anyone interested in cyber and custom reporting tools.
The analysis screen provides you with a way to measure your security posture against selected standards and uses charts to provide a visual display of your data and at the same time allows for comparisons across categories, questions, and subject areas.
The analysis screen will also allow you to drill down on specific data from a given chart for more information.
The charts presented are fixed and dependent on your evaluation mode.
Selecting the CSF evaluation mode will result in a different set of charts than the question or framework modes.
One of the fundamental decisions you must make when performing an evaluation is to select a Security Assurance level. Sometimes you know based on a standard what level you need to conform to, but others may not have a clue where to start to determine what assurance level is best.
CSET offers several ways to make this decision.
Using CSET – setting an assurance level
Manually Set – Low, Moderate, High or Very High for each of CIA
Questions based YES or NO answers questions using FIPS and NIST standards as guidance.
Consequence based approach uses a series of sliders to indicate a number of people or dollar from each category.
An assurance level set to low will result in questions later that are less demanding than would result from a moderate, high or very high assurance level.
See in SP800-82 – Zones establish a trust boundary and in over 200 incidents each year ICS-CERT finds boundary protection to be a key finding.
Big flat networks are bad – they expose you – don’t build them.
The following zones segment information architecture into five basic functions:
External Zone is the area of connectivity to the Internet, communication with peer, and remote facilities. It is the point of connectivity that is usually considered untrusted. For industrial control systems, the external zone has the least amount of priority and the highest variety of risks.
Corporate Zone is the area of connectivity for corporate communications. E-mail servers, DNS servers, and IT business system infrastructure components are typical resources in this zone. A wide variety of risks exist in this zone because of the amount of systems and connectivity to the External Zone. However, because of the maturity of the security posture and redundancy of systems, the Corporate Zone’s precedence can be considered to be at a lower priority than other zones, but much higher than the External Zone.
Manufacturing/Data Zone is the area of connectivity where a vast majority of monitoring and control takes place. It is a critical area for continuity and management of a control network. Operational support and engineering management devices are located in this zone along side spedial servers called data historians that log events. The Manufacturing Zone is central in the operation of both the end devices and the business requirements of the Corporate Zone, and the priority of this area is considered to be high. Risks are associated with direct connectivity to the External Zone and the Corporate Zone.
Control Zone is the area of connectivity to devices such as Programmable Logic Controllers (PLCs), HMIs, and basic input/output devices such as actuators and sensors. The priority of this zone is very high as this is the area where the functions of the devices affect the physical end devices. In a modern control network, these devices will have support for TCP/IP and other common protocols.
Safety Zone usually has the highest priority because these devices have the ability to automatically control the safety level of an end device (such as Safety Instrument Systems). Typically, the risk is lower in this zone as these devices are only connected to the end devices but recently many of these devices have started to offer functionality for TCP/IP connectivity for the purposes of remote monitoring and redundancy support.
The following zones segment information architecture into five basic functions:
External Zone is the area of connectivity to the Internet, communication with peer, and remote facilities. It is the point of connectivity that is usually considered untrusted. For industrial control systems, the external zone has the least amount of priority and the highest variety of risks.
Corporate Zone is the area of connectivity for corporate communications. E-mail servers, DNS servers, and IT business system infrastructure components are typical resources in this zone. A wide variety of risks exist in this zone because of the amount of systems and connectivity to the External Zone. However, because of the maturity of the security posture and redundancy of systems, the Corporate Zone’s precedence can be considered to be at a lower priority than other zones, but much higher than the External Zone.
Manufacturing/Data Zone is the area of connectivity where a vast majority of monitoring and control takes place. It is a critical area for continuity and management of a control network. Operational support and engineering management devices are located in this zone along side spedial servers called data historians that log events. The Manufacturing Zone is central in the operation of both the end devices and the business requirements of the Corporate Zone, and the priority of this area is considered to be high. Risks are associated with direct connectivity to the External Zone and the Corporate Zone.
Control Zone is the area of connectivity to devices such as Programmable Logic Controllers (PLCs), HMIs, and basic input/output devices such as actuators and sensors. The priority of this zone is very high as this is the area where the functions of the devices affect the physical end devices. In a modern control network, these devices will have support for TCP/IP and other common protocols.
Safety Zone usually has the highest priority because these devices have the ability to automatically control the safety level of an end device (such as Safety Instrument Systems). Typically, the risk is lower in this zone as these devices are only connected to the end devices but recently many of these devices have started to offer functionality for TCP/IP connectivity for the purposes of remote monitoring and redundancy support.
Look at functionality – correctness - reliability usability
You can do a light version of this yourself – but not the analytics. These are performed by running the data through Security Onion and Bro Scripts