Master ICS/OT Cybersecurity: Fundamental to Advanced-Part 2

Explore core cryptography concepts, including cryptosystems, confidentiality, integrity, authentication, authorization, and non-repudiation, along with symmetric and asymmetric methods and PKI in hands-on activities.

Asymmetric cryptography uses public and private keys to encrypt and decrypt data, enabling authentication and non-repudiation while aiding secure key distribution with algorithms like RSA, ECDSA, and Diffie-Hellman.

Explore hash functions for data integrity, including hash algorithms, message digest, and hmac, to detect unauthorized modifications and verify data origin authentication without encryption.

Practice decoding ciphers with cyberchef in a linux lab, using base64, hex dump, and gunzip, then RC4 with a passphrase and x86 machine-code disassembly.

Learn to extract inputs from a log, identify timestamps, and convert unix timestamps in seconds to UTC format using CyberChef recipes and the bake button.

Apply the magic operation to detect input data properties and generate decoding recipes, revealing a base 58 encoded message decoded by a cipher recipe and clarifying entropy and file types.

Demonstrates pbkdf2, a password based key derivation function used with RSA public key cryptography; adjust key size, iterations, and salt to influence the derived output.

Engineers use OpenSSL to generate private keys and certificates, enabling secure, authenticated communication between power plant and substation controllers in the Cyberland use case.

Learn to verify software integrity and authenticity by hashing downloaded files with sha-256 (and md5 if available), comparing against provided hashes, and confirming matches via a simple terminal command.

Assess the functional differences among control and process industrial networks, supervisory, and business networks, detailing real-time operation, reliability, bandwidth, latency, serial and Ethernet communications, and protocol types.

Apply a latency-aware approach to industrial control network segmentation by using an l3 switch to reduce hops and enable inter-vlan routing, improving latency and stability.

Explore physical and logical network segmentation, including VLANs, IPS, proxies, and ACLs, contrasted with air gapping, data diodes, firewalls, switches, and Faraday cages.

Explore a reference architecture for a control network, detailing level zero to four, firewalls, and secure segmentation between trusted and untrusted zones, remote access, and IoT gateways.

Analyze a Siemens reference architecture with three machines, ring and wireless networks, and an IoT MQTT broker. It showcases layered segmentation, DMZ, redundant firewalls, and comprehensive security controls.

Identify manufacturing impact levels across low, moderate, and high, detailing injury, financial loss, environmental release, and public image; support risk assessment and guide security controls by product and industry.

Focus on the preparation phase, the most important part of incident response, detailing health and safety briefings, certifications, permits, access controls, PPE, and planning to establish roles and external access.

Identify whether a log, event, alert, or suspicious activity qualifies as an incident using certifying criteria in the identification phase, then validate with reviews, interviews, IOCs, and impact.

Remove malicious code after containment by using malware tools, patching vulnerabilities, and restoring data, while validating eradication effectiveness in operational technology environments with legacy systems.

Review and update the incident response plan after resolution to capture lessons learned. Conduct root cause analysis and assess response effectiveness, using tabletop exercises to spot quick wins and shortfalls.

Develop a contingency planning process based on nest 834, detailing seven steps from policy to maintenance, including bcp, bia, mtd, risk assessment, backup solutions, and testing.

Conduct a business impact analysis to map mission-critical functions and interdependencies, classify their criticality, assess risks and max tolerable downtime, and set recovery priorities.

the disaster recovery plan minimizes losses and restores mission critical technology after a catastrophic incident, defining rpo, rto, and mtd and guiding data recovery and testing.