Table Of ContentIndustrial
Cybersecurity
Second Edition
Efficiently monitor the cybersecurity posture of your
ICS environment
Pascal Ackerman
BIRMINGHAM—MUMBAI
Industrial Cybersecurity
Second Edition
Copyright © 2021 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or
transmitted in any form or by any means, without the prior written permission of the publisher,
except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the
information presented. However, the information contained in this book is sold without warranty,
either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors,
will be held liable for any damages caused or alleged to have been caused directly or indirectly by
this book.
Packt Publishing has endeavored to provide trademark information about all of the companies
and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing
cannot guarantee the accuracy of this information.
Group Product Manager: Vijin Boricha
Publishing Product Manager: Preet Ahuja
Senior Editor: Rahul D'souza
Content Development Editor: Romy Dias
Technical Editor: Nithik Cheruvakodan
Copy Editor: Safis Editing
Project Coordinator: Shagun Saini
Proofreader: Safis Editing
Indexer: Rekha Nair
Production Designer: Alishon Mendonca
First published: October 2017
Second edition: September 2021
Production reference: 1010921
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
ISBN: 978-1-80020-209-2
www.packt.com
Contributors
About the author
Pascal Ackerman is a seasoned industrial security professional with a degree in electrical
engineering and over 20 years of experience in industrial network design and support,
information and network security, risk assessments, pentesting, threat hunting, and
forensics. After almost two decades of hands-on, in-the-field, and consulting experience,
he joined ThreatGEN in 2019 and is currently employed as managing director of threat
services and research. His passion lies in analyzing new and existing threats to ICS
environments and he fights cyber adversaries both from his home base and while traveling
the world with his family as a digital nomad.
Pascal wrote the previous edition of this book and has been a reviewer and technical
consultant of many security books.
I want to thank my wonderful wife and loving daughters, for helping,
supporting, and encouraging me throughout the process of writing this
book.
Additionally, I'd like to thank the ICS security community for helping me
during the many hours of research. Many of you have helped me, directly or
indirectly, by pointing me in the right direction, writing an article or related
book, or just being there for me when I needed to bounce ideas off you.
About the reviewers
Syed M. Belal is a cybersecurity director, principal consultant, and strategist with over
14 years of experience in information technology (IT), operational technology (OT),
and industrial control systems (ICS) applications with a focus on networking and
cybersecurity. Currently, as the director of OT Cybersecurity Consulting, he is responsible
for its strategy and growth globally. He helps critical infrastructures protect assets from
internal and external threats and align strategy by designing successful and cost-effective
solutions.
He holds a BS in electrical engineering and an MBA in business strategy. He holds a
multitude of industry certifications, including CISSP, CISA, and CISM.
First, thanks to the Almighty for His guidance. I'd like to thank my wife,
Rabea, and our three children, Zaeem, Zaafirah, and Zakariyya, for
their daily support and patience. To my parents, relatives, friends, and
colleagues, thank you for guiding and supporting me. I'd also like to thank
Packt Publishing for the opportunity to review this wonderful book.
As the technical lead for ManTech International Corp., Ron Nemes is responsible for
leading all technical and operational aspects of delivering ICS cybersecurity assessment
and consulting solutions to multiple clients. He performs ICS critical infrastructure risk
assessments around the world across various functions, including power and building
automation. A seasoned cybersecurity professional, he is an expert in bridging business
and technical needs to achieve client success. He brings extensive experience in designing,
implementing, and assessing network infrastructure and security for the Department of
Defense, civilian, and commercial environments. He also holds the CISSP, GICSP, GPEN,
and GRID certifications.
Table of Contents
Preface
Section 1: ICS Cybersecurity Fundamentals
1
Introduction and Recap of First Edition
Industrial Cybersecurity – Example attack on the Slumbertown
second edition 4 papermill 25
Recap of the first edition 5 The comprehensive risk management
process 27
What is an ICS? 5
The DiD model 30
ICS functions 6
ICS security program development 32
ICS architecture 10
Takeaway from the first edition 34
The Purdue model for ICSes 16
Summary 36
IT and OT convergence and the
associated benefits and risks 21
2
A Modern Look at the Industrial Control System Architecture
Why proper architecture matters 38 The hardware that's used to build the
ICS environment 52
Industrial control system
architecture overview 38 ICS environment and architecture
management 59
The Enterprise Zone 40
The Industrial Demilitarized Zone 44 Summary 60
The Industrial Zone 45
vi Table of Contents
3
The Industrial Demilitarized Zone
The IDMZ 61 IDMZ firewalls 70
Fundamental concept 63 IDMZ switches 71
IDMZ design process 63 IDMZ broker services 73
Design changes due to an expanding The Industrial Zone – Level 3 Site
ICS environment 68 Operations 74
What makes up an IDMZ design? 69 Example IDMZ broker-service
solutions 78
The Enterprise Zone 69
Summary 92
4
Designing the ICS Architecture with Security in Mind
Typical industrial network mind 104
architecture designs 94
Security monitoring 111
Evolution from standalone islands of
Network choke points 112
automation 94
Logging and alerting 117
Designing for security 104
Summary 117
Network architecture with security in
Section 2: Industrial Cybersecurity –
Security Monitoring
5
Introduction to Security Monitoring
Security incidents 122 Event logs 128
Passive security monitoring 124
Putting it all together –
Active security monitoring 124 introducing SIEM systems 131
Threat-hunting exercises 125 Summary 132
Security monitoring data
collection methods 125
Network packet capturing 126
Table of Contents vii
6
Passive Security Monitoring
Technical requirements 134 configuring Security Onion 151
Passive security monitoring Deploying the Security Onion VM 152
explained 134 Configuring Security Onion 162
Network packet sniffing 135 Deploying Wazuh agents 165
Collection and correlation of event logs 137
Exercise 2 – Setting up and a
Host-based agents 139
configuring a pfSense firewall 171
Security Information and Event Deploying a pfSense VM 172
Management – SIEM 140 Configuring pfSense 177
What is a SIEM solution? 140
Exercise 3 – Setting up,
How does a SIEM solution work? 140
configuring, and using
Common passive security Forescout's eyeInsight (formerly
monitoring tools 141 known as SilentDefense) 182
NSM 142 Deploying the SilentDefense sensor
and Command Center VMs 182
IDS 145
Configuration of the SilentDefense
Event log collection and correlation 149
setup 188
Setting up and configuring Example usages of the SilentDefense
Security Onion 150 setup 197
Exercise 1 – Setting up and
Summary 216
7
Active Security Monitoring
Technical requirements 218 Dangers of scanning in the ICS
environment 226
Understanding active security
monitoring 218 Nmap 227
Assets scan 229
Network scanning 219
Interrogating Windows machines 245
Endpoint inspection with host-based
Exploring Modbus 257
agents 222
Getting EtherNet/IP information 263
Manual endpoint inspection/verification2 25
Scanning Siemens S7 (iso-tsap) 269
Exercise 1 – Scanning network- Manual vulnerability verification 270
connected devices 226 Scanning for vulnerabilities 272
viii Table of Contents
Exercise 2 – Manually inspecting information 286
an industrial computer 286 Configured users 293
Pulling Windows-based host
Summary 295
8
Industrial Threat Intelligence
Technical requirements 298 External/third-party free and paid-for
feeds 304
Threat intelligence explained 298
Using threat information in Creating threat intelligence
industrial environments 300 data out
Acquiring threat information 302 of threat information 307
Your own incidents and threat hunting Exercise – Adding an AlienVault
efforts 303 OTX threat feed to Security
Vendor reports 303 Onion 307
Your own honeypots 303 Summary 312
Peers and sharing communities 304
9
Visualizing, Correlating, and Alerting
Technical requirements 314 SilentDefense alerts to Security
Holistic cybersecurity Onion syslog 341
monitoring 315 Exercise 5 – Creating a pfSense
firewall event dashboard in
Network traffic monitoring 316
Kibana 349
Network intrusion monitoring 317
Host-based security monitoring 318 Exercise 6 – Creating a breach
detection dashboard in Kibana 359
Exercise 1 – Using Wazuh to add
NIDS alerts 360
Sysmon logging 319
Zeek notices 366
Exercise 2 – Using Wazuh to add
Zeek Intel logs 369
PowerShell Script Block Logging 327
Suspicious process and file creation 370
Exercise 3 – Adding a Snort IDS
Suspicious PowerShell commands 373
to pfSense 331
Suspicious egress connections 377
Exercise 4 – Sending Suspicious ingress connections 379
Table of Contents ix
Failed user login attempts 380 SilentDefense alerts 385
New user creation and changes to user Finishing up the dashboard 386
accounts 382
Summary 390
Downloaded files 384
Section 3: Industrial Cybersecurity – Threat
Hunting
10
Threat Hunting
What is threat hunting? 394 Network services event logs 409
Threat hunting in ICS SIEM 409
environments 396 Network packet captures 410
Research, lookups, and comparison
What is needed to perform
resources 410
threat hunting exercises? 397
Network traffic logs 397 Threat hunting is about
Endpoint OS and application event logs 398 uncovering threats 411
Making modifications to PLC, HMI, and Correlating events and alerts
other control systems and equipment 408 for threat hunting purposes 412
Tracking new and changed devices on
Summary 412
the (industrial) network 408
11
Threat Hunt Scenario 1 – Malware Beaconing
Forming the malware beaconing behavior 417
beaconing threat hunting Using RITA to detect beaconing
hypothesis 414 behavior 428
Detection of beaconing
Investigating/forensics of
behavior in the ICS environment4 15
suspicious endpoints 435
Malware beaconing explained 415
Finding the suspicious computer 439
Data exfiltration 416
Find the beaconing process – netstat 440
Legitimate application beaconing 416
Upload executable to VirusTotal 454
Using Security Onion to detect
Rudimentary inspection of the
