IC33M Flashcards
Module 1
Identify and document the scope of the IACS under assessment
Specify, gather or generate the cybersecurity information required to perform the assessment
Identify or discover cybersecurity vunerabilities inherent in the IACS products in the IACS products or system design
Intrepret the results of a process HAzard Analysis (PHA)
Organise and facilitate a cybersecurity risk assessment for an IACS
Identify and evaluate realistic threat senarios
Identify and access the effectiveness of existing countermeasures
Identify gaps in existing policies, precudures and standards
Evaluate the cost, complexity and effectiviness of new countermeasures in order to make meaningfull recommendations.
Establish and document security zones and conduits
Develop a cybersecurity requirements specification
What is the security lifecycle?
- Assess
- Design & Implement
- Maintain
The security lifecycle is a continuous process needed to minimize risks.
Cyber Risk Response
Design the risk out
One form of mitigation is to change the design of the system so that the risk is removed
Cyber Risk Response
Reduce the risk
Risks can be decreased to an acceptable level through the implementation of countermeasures that reduce the likelihood or the consequences of an attack
Cyber Risk Response
Transfer or share the risk
It may be possible to establish some sort of insurance or agreement that transfers some or all of the risk to a third entity
Cyber Risk Response
Eliminate redundant or ineffective controls
A good risk assessment process will identify these types of controls that need to be addressed
Cyber Risk Response
Accept the risk
There is always an option to accept the risk, to see it as the cost of doing business
Why conduct Cybersecurity Vulnerability Assessments?
It defines, identifies , and classifies the security vulnerabilities in an industrial control system and its related network infrastructure.
Critical step in evaluating cyber risk
Evaluates the IACS design, implementation, configuration, operation and management
Determines the adequacy of the security measures and identifies security deficiencies
What are the types of Cybersecurity Vulnerability assessments? (4)
- High Level (Gap Assessment) - Least invasive
- Passive
- Active
- Penetration Test - Most invasive
Benefits of CSET
A repeatable and systematic approach for assessing an organization’s cyber security posture
Evaluation and comparison of existing industry standards and regulations
Facilities discussion and input from subject matter experts throughout the organization
Identifies potential vulnerabilities in the control system design and security policies
Offers guidelines for IACS cybersecurity solutions and mitigations
Cyber Security Management System
Policy, Procedures Training, and Procedures
- IC33M - High-level cyber risk Assessment
- IC33M - Allocation of IACS assets to security zones or conduits
- IC33M - Detailed cyber risk assessment
- IC34M - Cybersecurity requirements specification
- IC34M - Design and engineering of cyber security countermeasures
6.
Define the scope of a cyber security assessment
Scope determines the parameters of what is included in the assessment and how it is performed
- Identify requirements
- Specify devices
- Select collection method
- Document
What are the elements of a good project plan?
- What is the goal of the project, and what does the organization hope to achieve.
- Clearly define the scope of the project, and what are the parameters, including what is not included in the scope, this helps keep resources focused.
- What is the project budget, and what resources are required.
- Identify all stakeholders and their interest in the
Module 3 - After completing this module, you will be able to:
- Identify or discover cybersecurity vulnerabilities inherent in the IACS products or system design
- Organize and facilitate a cybersecurity risk assessment for an IACS
How to conduct an IAC vulnerability assessment:
- Pre-assessment
- Kick-off meeting
- Walkthrough
- Passive data collection
- Network Scanning (Active)
- Vulnerability Scanning (Active)
- Analysis
- Reporting
