Introduction |
|
xxiii | |
|
Chapter 1 Industrial Control Systems |
|
|
1 | (42) |
|
|
2 | (1) |
|
Basic Process Control Systems |
|
|
3 | (2) |
|
Closed-Loop Control Systems |
|
|
5 | (1) |
|
Industrial Process Controllers |
|
|
6 | (14) |
|
Supervisory Control and Data Acquisition Systems |
|
|
20 | (1) |
|
|
21 | (2) |
|
|
23 | (2) |
|
OT/IT Network Integration |
|
|
25 | (3) |
|
Industrial Safety and Protection Systems |
|
|
28 | (1) |
|
Safety Instrument Systems |
|
|
29 | (10) |
|
|
39 | (2) |
|
|
41 | (2) |
|
Chapter 2 ICS Architecture |
|
|
43 | (100) |
|
|
44 | (1) |
|
Network Transmission Media |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
46 | (3) |
|
Industrial Network Media Standards |
|
|
49 | (3) |
|
|
52 | (1) |
|
External Network Communications |
|
|
53 | (2) |
|
Transmission Media Vulnerabilities |
|
|
55 | (1) |
|
Field Device Architecture |
|
|
56 | (2) |
|
|
58 | (4) |
|
|
62 | (1) |
|
|
63 | (8) |
|
Final Control Elements/Actuators |
|
|
71 | (2) |
|
|
73 | (3) |
|
|
76 | (3) |
|
Industrial Network Protocols |
|
|
79 | (1) |
|
Common Industrial Protocols |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
80 | (1) |
|
|
81 | (1) |
|
|
82 | (1) |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
83 | (1) |
|
Enterprise Network Protocols |
|
|
84 | (1) |
|
|
84 | (5) |
|
Dynamic Host Configuration Protocol |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
91 | (4) |
|
Chapter 3 Secure ICS Architecture |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
97 | (1) |
|
|
98 | (6) |
|
|
104 | (1) |
|
|
105 | (1) |
|
|
106 | (2) |
|
|
108 | (1) |
|
|
109 | (4) |
|
|
113 | (9) |
|
|
122 | (6) |
|
Controlling Intersegment Data Movement |
|
|
128 | (1) |
|
|
128 | (1) |
|
|
129 | (2) |
|
|
131 | (3) |
|
|
134 | (1) |
|
|
135 | (2) |
|
|
137 | (2) |
|
|
139 | (4) |
|
Chapter 4 ICS Module and Element Hardening |
|
|
143 | (62) |
|
|
145 | (1) |
|
Endpoint Security and Hardening |
|
|
145 | (1) |
|
User Workstation Hardening |
|
|
145 | (2) |
|
|
147 | (1) |
|
Additional Outer Perimeter Access Hardening |
|
|
148 | (6) |
|
|
154 | (1) |
|
|
155 | (1) |
|
|
156 | (4) |
|
Operating System Security Choices |
|
|
160 | (1) |
|
|
160 | (2) |
|
Hardening Operating Systems |
|
|
162 | (1) |
|
Common Operating System Security Tools |
|
|
162 | (7) |
|
|
169 | (3) |
|
Application Software Security |
|
|
172 | (1) |
|
|
172 | (1) |
|
|
173 | (1) |
|
Applying Software Updates and Patches |
|
|
174 | (1) |
|
|
174 | (1) |
|
|
175 | (2) |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
178 | (3) |
|
Anti-Malware: Sanitization |
|
|
181 | (1) |
|
|
182 | (2) |
|
|
184 | (5) |
|
|
189 | (1) |
|
|
189 | (2) |
|
|
191 | (2) |
|
|
193 | (1) |
|
Logical Server Access Control |
|
|
194 | (2) |
|
Hardening Network Connectivity Devices |
|
|
196 | (5) |
|
|
201 | (1) |
|
|
202 | (3) |
|
Chapter 5 Cybersecurity Essentials for ICS |
|
|
205 | (66) |
|
|
207 | (1) |
|
|
208 | (1) |
|
Confidentiality, Integrity, and Availability |
|
|
208 | (1) |
|
Availability in ICS Networks |
|
|
209 | (1) |
|
|
210 | (1) |
|
Principle of Least Privilege |
|
|
211 | (1) |
|
|
211 | (1) |
|
Vulnerability and Threat Identification |
|
|
212 | (1) |
|
|
213 | (1) |
|
|
213 | (1) |
|
|
214 | (2) |
|
|
216 | (1) |
|
Events, Incidents, and Attacks |
|
|
217 | (1) |
|
|
217 | (13) |
|
|
230 | (1) |
|
|
230 | (1) |
|
|
231 | (1) |
|
|
232 | (1) |
|
|
233 | (1) |
|
|
233 | (1) |
|
|
234 | (17) |
|
|
251 | (9) |
|
|
260 | (2) |
|
|
262 | (2) |
|
|
264 | (1) |
|
Public Key Infrastructure |
|
|
264 | (2) |
|
|
266 | (1) |
|
|
267 | (1) |
|
|
268 | (1) |
|
|
268 | (3) |
|
Chapter 6 Physical Security |
|
|
271 | (44) |
|
|
272 | (1) |
|
|
273 | (1) |
|
|
274 | (2) |
|
Physical Security Controls |
|
|
276 | (2) |
|
|
278 | (8) |
|
Remote Access Monitoring and Automated Access Control Systems |
|
|
286 | (3) |
|
Intrusion Detection and Reporting Systems |
|
|
289 | (1) |
|
|
290 | (5) |
|
Video Surveillance Systems |
|
|
295 | (2) |
|
|
297 | (1) |
|
|
297 | (1) |
|
|
298 | (8) |
|
Physical Security for ICS |
|
|
306 | (1) |
|
Industrial Processes/Generating Facilities |
|
|
307 | (1) |
|
Control Center/Company Offices |
|
|
307 | (2) |
|
|
309 | (2) |
|
|
311 | (1) |
|
|
312 | (3) |
|
Chapter 7 Access Management |
|
|
315 | (32) |
|
|
316 | (1) |
|
|
317 | (1) |
|
|
317 | (1) |
|
Discretionary Access Control |
|
|
318 | (1) |
|
Role-Based Access Control |
|
|
318 | (1) |
|
Rule-Based Access Control |
|
|
319 | (1) |
|
Attribute-Based Access Control |
|
|
319 | (1) |
|
Context-Based Access Control |
|
|
320 | (1) |
|
Key Security Components within Access Controls |
|
|
320 | (1) |
|
|
321 | (1) |
|
|
321 | (3) |
|
|
324 | (2) |
|
Application Runtime and Execution Control |
|
|
326 | (1) |
|
|
326 | (2) |
|
Establishing User and Group Accounts |
|
|
328 | (2) |
|
|
330 | (1) |
|
Network Authentication Options |
|
|
331 | (1) |
|
Establishing Resource Controls |
|
|
332 | (2) |
|
|
334 | (2) |
|
Remote ICS Access Control |
|
|
336 | (4) |
|
Access Control for Cloud Systems |
|
|
340 | (3) |
|
|
343 | (1) |
|
|
344 | (3) |
|
Chapter 8 ICS Security Governance and Risk Management |
|
|
347 | (26) |
|
|
348 | (1) |
|
Security Policies and Procedure Development |
|
|
348 | (1) |
|
|
349 | (1) |
|
Exceptions and Exemptions |
|
|
350 | (1) |
|
|
351 | (5) |
|
|
356 | (1) |
|
|
357 | (1) |
|
|
358 | (1) |
|
|
359 | (3) |
|
Risk Identification Vulnerability Assessment |
|
|
362 | (1) |
|
|
363 | (1) |
|
|
364 | (2) |
|
|
366 | (1) |
|
|
367 | (2) |
|
|
369 | (1) |
|
|
370 | (3) |
|
Chapter 9 ICS Security Assessments |
|
|
373 | (32) |
|
|
374 | (1) |
|
|
374 | (2) |
|
|
376 | (1) |
|
|
376 | (1) |
|
|
377 | (5) |
|
Communication Robustness Testing |
|
|
382 | (1) |
|
|
382 | (2) |
|
|
384 | (1) |
|
|
385 | (7) |
|
|
392 | (1) |
|
|
392 | (1) |
|
Network Enumeration/Port Scanning |
|
|
393 | (2) |
|
|
395 | (1) |
|
|
395 | (6) |
|
|
401 | (1) |
|
|
402 | (3) |
|
Chapter 10 ICS Security Monitoring and Incident Response |
|
|
405 | (48) |
|
|
407 | (1) |
|
|
408 | (1) |
|
|
408 | (1) |
|
Establishing a Security Baseline |
|
|
409 | (2) |
|
Change Management Documentation |
|
|
411 | (1) |
|
Configuration Change Management |
|
|
412 | (2) |
|
Controlling Patch Distribution and Installation for Systems |
|
|
414 | (5) |
|
|
419 | (1) |
|
|
420 | (1) |
|
|
421 | (2) |
|
|
423 | (1) |
|
|
424 | (1) |
|
|
425 | (8) |
|
|
433 | (1) |
|
The Incident Response Lifecycle |
|
|
434 | (1) |
|
|
435 | (7) |
|
|
442 | (3) |
|
|
445 | (1) |
|
|
446 | (3) |
|
|
449 | (1) |
|
|
450 | (3) |
|
Chapter 11 Disaster Recovery and Business Continuity |
|
|
453 | (28) |
|
|
454 | (1) |
|
Business Continuity Plans |
|
|
455 | (1) |
|
|
455 | (4) |
|
Local Virtualized Storage |
|
|
459 | (3) |
|
System Backup and Restoration |
|
|
462 | (1) |
|
|
463 | (3) |
|
|
466 | (1) |
|
|
467 | (1) |
|
|
467 | (2) |
|
|
469 | (1) |
|
|
470 | (2) |
|
Documenting the Disaster Recovery Plan |
|
|
472 | (1) |
|
The Disaster Response/Recovery Team |
|
|
473 | (2) |
|
|
475 | (2) |
|
|
477 | (1) |
|
|
478 | (3) |
|
Appendix A GICSP Objective Map |
|
|
481 | (6) |
|
ICS410.1 ICS: Global Industrial Cybersecurity Professional (GICSP) Objectives |
|
|
482 | (1) |
|
|
482 | (1) |
|
ICS410.2: Architecture and Field Devices |
|
|
483 | (1) |
|
ICS410.3: Communications and Protocols |
|
|
484 | (1) |
|
ICS410.4: Supervisory Systems |
|
|
485 | (1) |
|
ICS410.5: Security Governance |
|
|
485 | (2) |
|
|
487 | (46) |
|
Appendix C Standards and References |
|
|
533 | (6) |
|
|
536 | (3) |
|
Appendix D Review and Exam Question Answers |
|
|
539 | (32) |
|
Chapter 1 Industrial Control Systems |
|
|
540 | (2) |
|
|
540 | (1) |
|
|
541 | (1) |
|
Chapter 2 ICS Architecture |
|
|
542 | (3) |
|
|
542 | (2) |
|
|
544 | (1) |
|
Chapter 3 Secure ICS Architecture |
|
|
545 | (3) |
|
|
545 | (2) |
|
|
547 | (1) |
|
Chapter 4 ICS Modules and Element Hardening |
|
|
548 | (3) |
|
|
548 | (2) |
|
|
550 | (1) |
|
Chapter 5 Cybersecurity Essentials for ICS |
|
|
551 | (3) |
|
|
551 | (2) |
|
|
553 | (1) |
|
Chapter 6 Physical Security |
|
|
554 | (2) |
|
|
554 | (2) |
|
|
556 | (1) |
|
Chapter 7 Access Management |
|
|
556 | (3) |
|
|
556 | (2) |
|
|
558 | (1) |
|
Chapter 8 ICS Security Governance and Risk Management |
|
|
559 | (2) |
|
|
559 | (1) |
|
|
560 | (1) |
|
Chapter 9 ICS Security Assessments |
|
|
561 | (3) |
|
|
561 | (2) |
|
|
563 | (1) |
|
Chapter 10 ICS Security Monitoring and Incident Response |
|
|
564 | (3) |
|
|
564 | (1) |
|
|
565 | (2) |
|
Chapter 11 Disaster Recovery and Business Continuity |
|
|
567 | (4) |
|
|
567 | (1) |
|
|
568 | (3) |
Index |
|
571 | |