Bespoke Digital Learning for OT and ICS

Regulations

• -UK HSE
• -Why secure technology
• -NCSC overview
• -Networking regulations

Concepts

• -Drivers of security

Risk

• -What is risk?
• -Risk terms
• -Assessment methods for risk

Defensive measures

• -Defence in depth and related concepts
• -Good behaviours of staff
• -Asset management and asset registers

Basics

• -Threat sources
• -Threat causes
• -Using vulnerability and threat information for good

Malicious actions

• -Possible outcomes
• -Overview of different access methods

Devices

• -Purdue model
• -Network interface controllers
• -Switches and switching
• -Routing and routers

Data flow control

• -OSI model
• -ICMP overview
• -ARP overview

Protective technology

• -Firewalls
• -Intrusion detection and prevention systems

Monitoring

• -Monitoring methods

Malicious activities

• -Network level attacks

Resilience

• -Hardware configurations
• -Roll-back and taking backups
• -Preparation, planning and exercising
• -Managing spares

Use of IT in OT

• -IT devices
• -IT comms and protocols
• -Industrial comms over ethernet
• -Misuse

Types

• -Hardware types
• -OS types

Access control

• -Physical security
• -Access accounts
• -Remote access

User access control

• -User authentication
• -Application user authentication
• -Local and group policies
• -Application user rights

Endpoint hardening

• -Software removal
• -Time sync
• -Hardware disabling and removal
• -PLC hardening
• -Active protection

Wireless comms in OT

• -WiFi
• -Bluetooth
• -HART
• -ISA100 / WiHART (802.14)

Patching and patch management

• -Drivers
• -Patch types
• -Change control
• -Patch sourcing and security
• -Patch installation

Malicious device prevention

• -Physical measures

System configuration management

• -Monitoring
• -Audits
• -Business continuity planning

Management of change

• -Third party management
• -Planning of work

Prepare

• -People and relationships
• -Policies and procedures
• -Support access
• -Business continuity planning
• -Assuring control actions

Identify

• -Initial triage - is this an incident?
• -Backups
• -Evidence gathering

Contain, eradicate, recover

• -Risk assessments and managing the spread
• -Removing malware and preventing access
• -Patching and updating
• -Verification and further protections
• -Offline analysis and asking for help

Lessons learned

• -Incident review