ICS,OT and IT Notes

Question 1

Purdue Model Levels

Answer 1

4/5 - Enterprise, 3.5 - ICS DMZ, 3 - SCADA Operations, 2 - Control System area (HMI), 1- Controllers, PLCs, RTU, 0 - Physical Processes, Sensors, Switches, Relays, Pumps , Valves.

Question 2

PLC (Programmable Logic Computer)

Answer 2

Connects the physical hardware to the real world, and runs logic code to read state or change the state of the engineering process.

Question 3

Data Historian

Answer 3

contains data on the industrial control system environment (Changes and trends over time). Targeted for exfiltration of sensitive info.

Question 4

Engineering Workstation

Answer 4

EW has access to software to program and change PLCs and other field devices. targeted to get access to the code for PLCs and change the processes.

Question 5

HMI (Human Machine Interface)

Answer 5

Visual interface between the physical process and the operators.

Question 6

IT Email System (Not ICS)

Answer 6

used to pivot towards data historian. Typically shares a trust relationship with data historians.

Question 7

What are the 5 Critical ICS Assets

Answer 7

PLC, Data Historian, Engineering Workstation, HMI, and IT Email System

Question 8

How to defend critical assets

Answer 8

Network Segmentation, Network Monitoring (IDS), Engineering Tasks (Check logic and RUN mode for field devices)

Question 9

Network Security Monitoring Devices

Answer 9

Switches & Firewalls

Question 10

PLC Protection

Answer 10

Put devices in “RUN” mode to prevent remote access changes. Check the hash of the project files for critical PLCs. Change Management at the PLC level.

Question 11

Data Historian Protection

Answer 11

Any data coming into data historian monitoring, exfiltration from data historian monitoring, Separate AD and domain environment from IT AD, & no trust relationships

Question 12

Engineering Workstation Protection

Answer 12

Network monitoring, Data exfiltration (USB removable media), and network-specific commands from the device (Ports and remote access ports).

Question 13

HMI Protection

Answer 13

Monitor network-specific traffic from HMI, Changes to the HMI, application logs, or alarm logs, Jump box in DMZ

Question 14

IT Email System Protection

Answer 14

Sandboxing for URL, Attachments, etc. IT Security and awareness of ICS, IT security provides data to ICS security.

Question 15

Asset Inventory