1484 lines
40 KiB
Markdown
1484 lines
40 KiB
Markdown
# Industrial Network Security Best Practices Guide
|
||
## Comprehensive Security for PLC and SCADA Systems
|
||
|
||
**Based on IEC 62443 Standards and Defense-in-Depth Principles**
|
||
|
||
---
|
||
|
||
## Table of Contents
|
||
|
||
1. [Introduction](#introduction)
|
||
2. [Security Frameworks and Standards](#security-frameworks-and-standards)
|
||
3. [Defense-in-Depth Strategy](#defense-in-depth-strategy)
|
||
4. [Network Segmentation (Zones and Conduits)](#network-segmentation)
|
||
5. [Siemens S7 PLC Specific Security](#siemens-s7-security)
|
||
6. [Implementation Checklist](#implementation-checklist)
|
||
7. [Security Assessment Procedures](#security-assessment)
|
||
8. [Ongoing Monitoring and Maintenance](#ongoing-monitoring)
|
||
9. [Incident Response](#incident-response)
|
||
10. [Compliance and Documentation](#compliance)
|
||
|
||
---
|
||
|
||
## 1. Introduction
|
||
|
||
### Why Industrial Network Security Matters
|
||
|
||
Industrial Control Systems (ICS) and Operational Technology (OT) environments face unique cybersecurity challenges:
|
||
|
||
- **Safety Critical**: Cyber attacks can cause physical harm, environmental damage, or loss of life
|
||
- **High Availability Requirements**: Production systems require 24/7 uptime
|
||
- **Long Lifecycles**: Equipment may operate for 20+ years with outdated software
|
||
- **Convergence of IT/OT**: Increasing connectivity exposes OT to IT-based threats
|
||
- **Targeted Attacks**: Nation-states and cybercriminals specifically target critical infrastructure
|
||
|
||
### Real-World Consequences
|
||
|
||
**Stuxnet (2010)**: Destroyed Iranian nuclear centrifuges via compromised Siemens S7 PLCs
|
||
**Ukraine Power Grid (2015)**: BlackEnergy malware caused blackouts affecting 230,000 people
|
||
**Triton/Trisis (2017)**: Targeted safety systems in petrochemical plant
|
||
**Colonial Pipeline (2021)**: Ransomware caused major fuel shortage in US
|
||
|
||
---
|
||
|
||
## 2. Security Frameworks and Standards
|
||
|
||
### IEC 62443 - The Gold Standard for Industrial Cybersecurity
|
||
|
||
IEC 62443 is the international standard specifically designed for Industrial Automation and Control Systems (IACS) security.
|
||
|
||
#### IEC 62443 Structure
|
||
|
||
The standard is divided into 4 main categories:
|
||
|
||
**1. General (IEC 62443-1-x)**
|
||
- Terminology, concepts, and models
|
||
- Foundation for the entire standard
|
||
- Defines security levels and zones
|
||
|
||
**2. Policies and Procedures (IEC 62443-2-x)**
|
||
- Cybersecurity management system requirements
|
||
- Risk assessment methodology
|
||
- Patch management and incident response
|
||
|
||
**3. System (IEC 62443-3-x)**
|
||
- System-level security requirements
|
||
- Network segmentation (zones and conduits)
|
||
- Security risk assessment for systems
|
||
|
||
**4. Component (IEC 62443-4-x)**
|
||
- Product development lifecycle requirements
|
||
- Component technical security requirements
|
||
- Secure coding and vulnerability management
|
||
|
||
#### Security Levels (SL) in IEC 62443
|
||
|
||
The standard defines 4 security levels based on threat capability:
|
||
|
||
| Security Level | Threat Type | Attacker Profile |
|
||
|----------------|-------------|------------------|
|
||
| **SL 0** | No special requirement | None |
|
||
| **SL 1** | Protection against casual or coincidental violation | Unskilled individual using simple means |
|
||
| **SL 2** | Protection against intentional violation using simple means | Skilled individual using simple means with low resources |
|
||
| **SL 3** | Protection against intentional violation using sophisticated means | Skilled individual with moderate resources and IACS-specific skills |
|
||
| **SL 4** | Protection against intentional violation using sophisticated means with extended resources | Highly skilled and motivated organization with extensive resources |
|
||
|
||
**Typical Target Levels:**
|
||
- Critical Infrastructure: SL 2-3
|
||
- High-Risk Facilities: SL 3-4
|
||
- Standard Industrial Plants: SL 1-2
|
||
|
||
### Other Relevant Standards
|
||
|
||
**NIST SP 800-82**: Guide to Industrial Control Systems (ICS) Security
|
||
**NIST Cybersecurity Framework (CSF)**: Identify, Protect, Detect, Respond, Recover
|
||
**ISO/IEC 27001**: Information Security Management Systems
|
||
**IEC 61511**: Safety Instrumented Systems (SIS) security
|
||
|
||
---
|
||
|
||
## 3. Defense-in-Depth Strategy
|
||
|
||
Defense-in-Depth applies **multiple layers of security controls** throughout the industrial network, ensuring that if one layer fails, others continue to provide protection.
|
||
|
||
### Core Principles
|
||
|
||
1. **Layered Security**: No single point of failure
|
||
2. **Diversity**: Use different types of security controls
|
||
3. **Fail-Safe Design**: Systems fail to a secure state
|
||
4. **Least Privilege**: Minimum access necessary
|
||
5. **Separation of Duties**: No single person has complete control
|
||
|
||
### The Seven Layers of Defense
|
||
|
||
```
|
||
Layer 7: Policies, Procedures & Awareness
|
||
↓
|
||
Layer 6: Physical Security
|
||
↓
|
||
Layer 5: Perimeter Security (Firewalls, DMZ)
|
||
↓
|
||
Layer 4: Network Security (Segmentation, VLANs, IDS)
|
||
↓
|
||
Layer 3: Host Security (Hardening, Antivirus, Patching)
|
||
↓
|
||
Layer 2: Application Security (Authentication, Encryption)
|
||
↓
|
||
Layer 1: Data Security (Encryption, Backup, Integrity)
|
||
```
|
||
|
||
### Implementation Strategy
|
||
|
||
**Physical Layer:**
|
||
- Locked server rooms and control cabinets
|
||
- Access control systems (badge readers)
|
||
- CCTV monitoring
|
||
- Tamper-evident seals on critical equipment
|
||
|
||
**Network Layer:**
|
||
- Firewalls between zones
|
||
- Network segmentation (VLANs)
|
||
- Intrusion Detection Systems (IDS)
|
||
- Data diodes for one-way communication
|
||
|
||
**System Layer:**
|
||
- Operating system hardening
|
||
- Disable unnecessary services
|
||
- Application whitelisting
|
||
- Regular security updates and patches
|
||
|
||
**Application Layer:**
|
||
- Strong authentication (passwords, 2FA)
|
||
- Role-based access control (RBAC)
|
||
- Secure coding practices
|
||
- Input validation
|
||
|
||
**Data Layer:**
|
||
- Encryption at rest and in transit
|
||
- Regular backups (3-2-1 rule)
|
||
- Data integrity checks
|
||
- Secure data destruction
|
||
|
||
**People Layer:**
|
||
- Security awareness training
|
||
- Background checks for critical roles
|
||
- Documented security policies
|
||
- Incident response procedures
|
||
|
||
---
|
||
|
||
## 4. Network Segmentation (Zones and Conduits)
|
||
|
||
### The Purdue Model
|
||
|
||
The Purdue Enterprise Reference Architecture (PERA) is the foundation for ICS network segmentation:
|
||
|
||
```
|
||
Level 5: Enterprise Network (ERP, Email, Internet)
|
||
↓ DMZ / Firewall
|
||
Level 4: Business Planning & Logistics (MES, Historian)
|
||
↓ DMZ / Firewall
|
||
Level 3: Operations Management (SCADA, HMI)
|
||
↓ Industrial Firewall
|
||
Level 2: Area Supervisory Control (PLC, DCS)
|
||
↓ Industrial Switch
|
||
Level 1: Basic Control (PLC, RTU, Field Devices)
|
||
↓ Field Network
|
||
Level 0: Process (Sensors, Actuators, Motors)
|
||
```
|
||
|
||
### Zones and Conduits (IEC 62443-3-2)
|
||
|
||
**Zone**: A grouping of logical or physical assets that share common security requirements
|
||
**Conduit**: A logical grouping of communication channels connecting two or more zones
|
||
|
||
#### Example Zone Structure
|
||
|
||
**Zone 1: Enterprise Network**
|
||
- Business systems (ERP, email, file servers)
|
||
- Internet connectivity
|
||
- Office workstations
|
||
|
||
**Zone 2: DMZ (Demilitarized Zone)**
|
||
- Historian servers
|
||
- Data diodes
|
||
- Application servers accessible from both enterprise and control
|
||
|
||
**Zone 3: Control Network (Level 3)**
|
||
- SCADA servers
|
||
- HMI workstations
|
||
- Engineering workstations
|
||
|
||
**Zone 4: Process Control Network (Level 2)**
|
||
- PLCs (Siemens S7-1200/1500)
|
||
- DCS controllers
|
||
- Safety systems (SIS)
|
||
|
||
**Zone 5: Field Device Network (Level 1-0)**
|
||
- I/O modules
|
||
- Remote I/O
|
||
- Sensors and actuators
|
||
|
||
#### Conduit Security Requirements
|
||
|
||
Each conduit between zones must implement appropriate security controls:
|
||
|
||
| Conduit | Source Zone | Dest Zone | Security Requirements |
|
||
|---------|-------------|-----------|----------------------|
|
||
| C1 | Enterprise | DMZ | Corporate Firewall, VPN, Authentication |
|
||
| C2 | DMZ | Control Network | Industrial Firewall, Unidirectional Gateway |
|
||
| C3 | Control Network | Process Network | Industrial Switch with ACLs, Port Security |
|
||
| C4 | Process Network | Field Devices | Encrypted protocols (if supported), Physical isolation |
|
||
|
||
### Network Segmentation Best Practices
|
||
|
||
1. **Air-Gap Critical Systems**: Physically separate safety-critical systems
|
||
2. **Use Industrial Firewalls**: Commercial IT firewalls are not sufficient
|
||
3. **Implement Data Diodes**: For one-way data transfer from OT to IT
|
||
4. **VLANs for Logical Separation**: When physical separation isn't possible
|
||
5. **Limit Communication Paths**: Only allow necessary connections
|
||
6. **Monitor All Boundaries**: IDS/IPS at each zone boundary
|
||
|
||
---
|
||
|
||
## 5. Siemens S7 PLC Specific Security
|
||
|
||
### S7-1200/1500 Security Features
|
||
|
||
#### 1. Access Protection (Password Protection)
|
||
|
||
**Protection Levels:**
|
||
- **No Protection**: Full read/write access
|
||
- **Write Protection**: Read-only access without password
|
||
- **Read/Write Protection**: Password required for all access
|
||
- **Complete Protection + Integrity**: Strongest protection including know-how protection
|
||
|
||
**Configuration in TIA Portal:**
|
||
```
|
||
1. Open PLC properties
|
||
2. Go to "Protection & Security"
|
||
3. Set "Protection level"
|
||
4. Enter strong password (min. 8 characters)
|
||
5. Enable "Copy protection" for intellectual property
|
||
```
|
||
|
||
**Best Practice**: Use Read/Write Protection or Complete Protection for production PLCs
|
||
|
||
#### 2. IP Access Control Lists (ACLs)
|
||
|
||
Restrict which devices can communicate with the PLC by IP address.
|
||
|
||
**Configuration:**
|
||
```
|
||
1. PLC Properties → Protection & Security → Connection mechanisms
|
||
2. Enable "Permit access only for the following IP addresses/subnets"
|
||
3. Add authorized IPs:
|
||
- Engineering station: 192.168.10.50/32
|
||
- HMI: 192.168.10.60/32
|
||
- SCADA server: 192.168.10.70/32
|
||
4. Deny all other connections
|
||
```
|
||
|
||
#### 3. Communication Encryption
|
||
|
||
**CP 1543-1 Communication Processor:**
|
||
- Built-in VPN functionality (IPsec)
|
||
- Integrated firewall
|
||
- Supports encrypted S7 communication
|
||
|
||
**Configuration Steps:**
|
||
1. Install CP 1543-1 module in PLC
|
||
2. Configure VPN tunnel in TIA Portal
|
||
3. Set up IPsec parameters (AES-256 encryption)
|
||
4. Configure firewall rules
|
||
|
||
#### 4. Firmware Updates and Patch Management
|
||
|
||
**Check Current Firmware:**
|
||
```
|
||
TIA Portal → Online & Diagnostics → Device Information → Firmware Version
|
||
```
|
||
|
||
**Update Process:**
|
||
1. Download firmware from Siemens Support Portal
|
||
2. Verify firmware signature
|
||
3. Test in non-production environment first
|
||
4. Schedule maintenance window
|
||
5. Backup PLC program before updating
|
||
6. Update via TIA Portal → Online Tools → Firmware Update
|
||
|
||
**Subscribe to Siemens ProductCERT:**
|
||
- URL: https://www.siemens.com/cert
|
||
- Receive security advisories for vulnerabilities
|
||
- CSAF format for automated processing
|
||
|
||
#### 5. Disable Unused Services
|
||
|
||
**Services to Disable (if not needed):**
|
||
- Web Server (HTTP/HTTPS)
|
||
- FTP Server
|
||
- SNMP
|
||
- Modbus TCP (if using only S7 communication)
|
||
- OPC UA (if not required)
|
||
|
||
**Configuration:**
|
||
```
|
||
Device Properties → System and Clock Memory → Web server
|
||
□ Enable web server (uncheck if not needed)
|
||
```
|
||
|
||
#### 6. Secure Physical Access
|
||
|
||
**S7-1500 Front Flap Lock:**
|
||
- Prevents unauthorized access to:
|
||
- SIMATIC memory card
|
||
- Mode selector
|
||
- Display and buttons
|
||
|
||
**Configuration:**
|
||
1. Insert locking latch into front flap
|
||
2. Physical key required to open
|
||
3. Document key location in security procedures
|
||
|
||
#### 7. Network Services Security
|
||
|
||
**Default Ports Used by S7-1200/1500:**
|
||
| Port | Protocol | Service | Security Action |
|
||
|------|----------|---------|----------------|
|
||
| 102 | TCP | S7 Communication | Firewall, ACLs |
|
||
| 80 | TCP | HTTP Web Server | Disable or use HTTPS only |
|
||
| 443 | TCP | HTTPS Web Server | Enable with certificates |
|
||
| 161 | UDP | SNMP | Disable if not needed |
|
||
| 20000 | TCP | PN DCP | Limit to local segment |
|
||
|
||
**Firewall Rules Example (iptables):**
|
||
```bash
|
||
# Allow S7 communication only from authorized IPs
|
||
iptables -A INPUT -p tcp --dport 102 -s 192.168.10.50 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 102 -s 192.168.10.60 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 102 -j DROP
|
||
|
||
# Block web server from external access
|
||
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 80 -j DROP
|
||
```
|
||
|
||
### Common S7 Vulnerabilities and Mitigations
|
||
|
||
#### CVE-2016-9159: Credential Disclosure
|
||
**Affected**: S7-300, S7-400 (older firmware)
|
||
**Risk**: Password can be extracted via network access to port 102
|
||
**Mitigation**:
|
||
1. Update to latest firmware
|
||
2. Implement network segmentation
|
||
3. Use CP modules with firewall
|
||
4. Monitor port 102 access
|
||
|
||
#### CVE-2019-13945: Denial of Service
|
||
**Affected**: S7-1200, S7-1500 (certain firmware versions)
|
||
**Risk**: Specially crafted packets can crash PLC
|
||
**Mitigation**:
|
||
1. Update firmware to latest version
|
||
2. Implement IDS to detect malformed packets
|
||
3. Firewall rules to filter suspicious traffic
|
||
|
||
#### Lack of Native Authentication
|
||
**Issue**: S7 protocol doesn't require authentication by default
|
||
**Mitigation**:
|
||
1. Use IP Access Control Lists
|
||
2. Network segmentation
|
||
3. VPN for remote access
|
||
4. Consider CP modules with VPN/firewall
|
||
|
||
---
|
||
|
||
## 6. Implementation Checklist
|
||
|
||
### Phase 1: Assessment and Planning (Weeks 1-4)
|
||
|
||
#### Week 1: Asset Inventory
|
||
- [ ] Document all PLCs (model, firmware version, location)
|
||
- [ ] Map network topology (create network diagrams)
|
||
- [ ] Identify all communication paths
|
||
- [ ] List all access points (local and remote)
|
||
- [ ] Document current security measures
|
||
|
||
**Tools:**
|
||
- Nmap for network discovery
|
||
- Siemens SINEC NMS for asset management
|
||
- Network documentation software (Visio, Lucidchart)
|
||
|
||
#### Week 2: Risk Assessment
|
||
- [ ] Identify critical assets and processes
|
||
- [ ] Evaluate potential threats (insider, external, accidental)
|
||
- [ ] Assess current vulnerabilities
|
||
- [ ] Determine Security Level targets (SL-T) per IEC 62443
|
||
- [ ] Prioritize risks (high/medium/low)
|
||
|
||
**Risk Assessment Matrix:**
|
||
```
|
||
Impact vs. Likelihood:
|
||
Low Medium High
|
||
High | Med | High | Critical
|
||
Medium | Low | Med | High
|
||
Low | Low | Low | Med
|
||
```
|
||
|
||
#### Week 3: Gap Analysis
|
||
- [ ] Compare current state to IEC 62443 requirements
|
||
- [ ] Identify missing security controls
|
||
- [ ] Document technical debt
|
||
- [ ] Estimate remediation effort and cost
|
||
- [ ] Create prioritized remediation plan
|
||
|
||
#### Week 4: Policy and Procedure Development
|
||
- [ ] Write/update cybersecurity policy
|
||
- [ ] Define roles and responsibilities
|
||
- [ ] Create access control procedures
|
||
- [ ] Develop incident response plan
|
||
- [ ] Establish change management process
|
||
|
||
### Phase 2: Quick Wins (Weeks 5-8)
|
||
|
||
#### Immediate Actions (No Downtime Required)
|
||
- [ ] Enable PLC password protection (all PLCs)
|
||
- [ ] Configure IP Access Control Lists
|
||
- [ ] Disable unused PLC services
|
||
- [ ] Change all default passwords
|
||
- [ ] Enable logging on network devices
|
||
- [ ] Document all changes
|
||
|
||
#### Low-Risk Improvements
|
||
- [ ] Install antivirus on HMI/SCADA systems
|
||
- [ ] Enable Windows Firewall on operator stations
|
||
- [ ] Implement USB device controls
|
||
- [ ] Create baseline configurations for all systems
|
||
- [ ] Set up centralized log collection
|
||
|
||
### Phase 3: Network Segmentation (Weeks 9-16)
|
||
|
||
#### Design Phase
|
||
- [ ] Design zone and conduit architecture
|
||
- [ ] Plan VLAN structure
|
||
- [ ] Select firewall/switch hardware
|
||
- [ ] Create detailed implementation plan
|
||
- [ ] Schedule maintenance windows
|
||
|
||
#### Implementation Phase
|
||
- [ ] Install firewalls between zones
|
||
- [ ] Configure VLANs on switches
|
||
- [ ] Set up firewall rules (whitelist approach)
|
||
- [ ] Install IDS/IPS sensors
|
||
- [ ] Test all communication paths
|
||
- [ ] Document new architecture
|
||
|
||
**Firewall Rule Template:**
|
||
```
|
||
Source Zone: Level 3 (SCADA)
|
||
Dest Zone: Level 2 (PLCs)
|
||
Protocol: TCP
|
||
Port: 102
|
||
Action: ALLOW
|
||
Log: Yes
|
||
```
|
||
|
||
### Phase 4: Advanced Security Controls (Weeks 17-24)
|
||
|
||
#### System Hardening
|
||
- [ ] Harden all Windows systems (CIS benchmarks)
|
||
- [ ] Implement application whitelisting
|
||
- [ ] Deploy endpoint protection
|
||
- [ ] Configure secure logging (SIEM)
|
||
- [ ] Enable file integrity monitoring
|
||
|
||
#### Access Control
|
||
- [ ] Implement multi-factor authentication (MFA)
|
||
- [ ] Deploy jump servers for remote access
|
||
- [ ] Configure VPN with strong encryption
|
||
- [ ] Establish privileged access management (PAM)
|
||
- [ ] Create audit trails for all access
|
||
|
||
#### Monitoring and Detection
|
||
- [ ] Deploy network monitoring (IDS/IPS)
|
||
- [ ] Configure SIEM alerts
|
||
- [ ] Establish baseline behavior
|
||
- [ ] Create detection use cases
|
||
- [ ] Set up automated alerting
|
||
|
||
### Phase 5: Testing and Validation (Weeks 25-28)
|
||
|
||
#### Security Testing
|
||
- [ ] Vulnerability scanning (authenticated scans only)
|
||
- [ ] Penetration testing (with extreme caution)
|
||
- [ ] Firewall rule testing
|
||
- [ ] Incident response tabletop exercise
|
||
- [ ] Disaster recovery test
|
||
- [ ] User awareness testing (phishing simulation)
|
||
|
||
**IMPORTANT**: Never perform aggressive testing on production OT systems
|
||
|
||
#### Validation Checklist
|
||
- [ ] All PLCs have password protection
|
||
- [ ] IP ACLs configured on all PLCs
|
||
- [ ] Unnecessary services disabled
|
||
- [ ] Firewalls between all zones
|
||
- [ ] Remote access requires VPN + MFA
|
||
- [ ] All systems logging to SIEM
|
||
- [ ] Backup and recovery tested
|
||
- [ ] Incident response plan tested
|
||
|
||
### Phase 6: Continuous Improvement (Ongoing)
|
||
|
||
#### Monthly Tasks
|
||
- [ ] Review firewall logs
|
||
- [ ] Check for firmware updates
|
||
- [ ] Review access logs
|
||
- [ ] Update asset inventory
|
||
- [ ] Security awareness training reminder
|
||
|
||
#### Quarterly Tasks
|
||
- [ ] Vulnerability assessment
|
||
- [ ] Review and update policies
|
||
- [ ] Access rights review (recertification)
|
||
- [ ] Test backups
|
||
- [ ] Review IDS/IPS alerts
|
||
|
||
#### Annual Tasks
|
||
- [ ] Full security audit
|
||
- [ ] Penetration test (controlled environment)
|
||
- [ ] Update risk assessment
|
||
- [ ] Incident response drill
|
||
- [ ] Review and update BCP/DR plans
|
||
- [ ] Security awareness training (full program)
|
||
|
||
---
|
||
|
||
## 7. Security Assessment Procedures
|
||
|
||
### Pre-Assessment Preparation
|
||
|
||
#### Safety First
|
||
**CRITICAL**: OT security assessments can disrupt operations or cause safety issues.
|
||
|
||
**Before Any Assessment:**
|
||
1. Obtain written approval from operations manager
|
||
2. Schedule during planned maintenance window
|
||
3. Have control system engineers on-site
|
||
4. Test all procedures in non-production environment first
|
||
5. Prepare rollback plan
|
||
6. Brief safety personnel
|
||
|
||
### Assessment Levels
|
||
|
||
#### Level 1: Passive Assessment (No Risk)
|
||
**Activities:**
|
||
- Document review
|
||
- Architecture review
|
||
- Policy and procedure review
|
||
- Interviews with staff
|
||
- Review of logs and reports
|
||
|
||
**Tools**: None (manual review)
|
||
|
||
#### Level 2: Network Monitoring (Minimal Risk)
|
||
**Activities:**
|
||
- Passive network traffic capture
|
||
- Protocol analysis
|
||
- Device discovery (passive)
|
||
- Baseline establishment
|
||
|
||
**Tools**:
|
||
- Wireshark
|
||
- Nozomi Networks
|
||
- Claroty
|
||
- Dragos Platform
|
||
|
||
#### Level 3: Active Scanning (Low Risk)
|
||
**Activities:**
|
||
- Network discovery (active)
|
||
- Service enumeration
|
||
- OS fingerprinting
|
||
- Credential validation
|
||
|
||
**Tools** (use with caution):
|
||
- Nmap (with rate limiting)
|
||
- Siemens SINEC NMS
|
||
- Tenable.sc (ICS profile)
|
||
|
||
**Configuration Example (Safe Nmap Scan):**
|
||
```bash
|
||
# Safe, slow scan for S7 PLCs
|
||
nmap -sT -T1 --max-rate 10 -p 102 --script s7-info 192.168.10.0/24
|
||
|
||
# Explanation:
|
||
# -sT: TCP connect scan (not SYN scan)
|
||
# -T1: Slowest timing template
|
||
# --max-rate 10: Max 10 packets/second
|
||
# -p 102: Only S7 port
|
||
# --script s7-info: Siemens-specific enumeration
|
||
```
|
||
|
||
#### Level 4: Vulnerability Scanning (Medium Risk)
|
||
**Activities:**
|
||
- Authenticated vulnerability scans
|
||
- Configuration compliance checks
|
||
- Missing patch identification
|
||
|
||
**Tools**:
|
||
- Tenable.sc with ICS plugin
|
||
- Rapid7 Nexpose
|
||
- Qualys VM
|
||
|
||
**CRITICAL Requirements:**
|
||
1. Test in lab environment first
|
||
2. Use ICS-specific scan profiles
|
||
3. Schedule during maintenance window
|
||
4. Have control engineers present
|
||
5. Start with single device
|
||
6. Monitor PLC scan time and CPU load
|
||
|
||
#### Level 5: Penetration Testing (High Risk)
|
||
**ONLY in isolated test environment or with extreme caution**
|
||
|
||
**Activities:**
|
||
- Exploit validation
|
||
- Privilege escalation
|
||
- Lateral movement testing
|
||
- Data exfiltration simulation
|
||
|
||
**Requirements:**
|
||
- Dedicated test network
|
||
- Replica of production environment
|
||
- Experienced ICS penetration testers
|
||
- 24/7 on-site support
|
||
- Detailed test plan approved by all stakeholders
|
||
|
||
### Step-by-Step Security Assessment
|
||
|
||
#### Step 1: Information Gathering (Passive)
|
||
|
||
**Objective**: Understand the environment without touching systems
|
||
|
||
**Tasks:**
|
||
1. Review network diagrams
|
||
2. Document all PLCs and versions
|
||
3. Identify communication protocols
|
||
4. Map data flows
|
||
5. Review existing security controls
|
||
6. Identify critical assets
|
||
|
||
**Deliverable**: Asset inventory and network map
|
||
|
||
#### Step 2: Vulnerability Identification
|
||
|
||
**2a. Configuration Review**
|
||
```bash
|
||
# Check for common misconfigurations
|
||
|
||
# PLC Password Protection
|
||
✓ Is password protection enabled?
|
||
✓ Password meets complexity requirements? (min 8 chars)
|
||
✓ Password documented in secure location?
|
||
|
||
# Network Access
|
||
✓ Are IP ACLs configured?
|
||
✓ Is web server disabled (if not needed)?
|
||
✓ Are unused protocols disabled?
|
||
|
||
# Firmware
|
||
✓ Firmware version documented?
|
||
✓ Firmware up to date?
|
||
✓ Update process documented?
|
||
```
|
||
|
||
**2b. Network Vulnerability Scan**
|
||
```bash
|
||
# Use Nmap safely for S7 PLCs
|
||
nmap -sT -T1 -p 102,80,443,161 --max-rate 5 192.168.10.100
|
||
|
||
# Check results for:
|
||
# - Open ports (should only be 102 if others disabled)
|
||
# - Service versions
|
||
# - Banner information
|
||
```
|
||
|
||
**2c. Known Vulnerability Check**
|
||
- Check Siemens ProductCERT advisories
|
||
- Compare firmware version to CVE database
|
||
- Review CISA ICS-CERT advisories
|
||
|
||
#### Step 3: Risk Evaluation
|
||
|
||
**Risk Scoring:**
|
||
```
|
||
Risk = Likelihood × Impact × Exploitability
|
||
|
||
Likelihood (1-5):
|
||
1 = Very unlikely
|
||
3 = Possible
|
||
5 = Very likely
|
||
|
||
Impact (1-5):
|
||
1 = Minimal
|
||
3 = Moderate (production delay)
|
||
5 = Critical (safety hazard)
|
||
|
||
Exploitability (1-5):
|
||
1 = Very difficult (requires insider access)
|
||
3 = Moderate (requires some skill)
|
||
5 = Easy (public exploit available)
|
||
```
|
||
|
||
**Example:**
|
||
- Finding: PLC has no password protection
|
||
- Likelihood: 4 (network accessible)
|
||
- Impact: 5 (controls safety system)
|
||
- Exploitability: 5 (trivial to access)
|
||
- Risk Score: 4 × 5 × 5 = 100 (CRITICAL)
|
||
|
||
#### Step 4: Reporting
|
||
|
||
**Report Structure:**
|
||
1. Executive Summary
|
||
2. Scope and Methodology
|
||
3. Asset Inventory
|
||
4. Findings (organized by severity)
|
||
5. Risk Assessment
|
||
6. Recommendations (prioritized)
|
||
7. Remediation Plan
|
||
|
||
**Finding Template:**
|
||
```
|
||
FINDING ID: VUL-001
|
||
SEVERITY: Critical
|
||
TITLE: PLC Password Protection Disabled
|
||
DESCRIPTION: S7-1200 at 192.168.10.100 has no password protection
|
||
IMPACT: Unauthorized user can read/modify PLC program, causing safety hazard
|
||
LIKELIHOOD: High (network accessible from control network)
|
||
EXPLOITABILITY: High (no authentication required)
|
||
AFFECTED SYSTEMS: PLC-REACTOR-01 (192.168.10.100)
|
||
RECOMMENDATION: Enable Read/Write Protection with strong password
|
||
EFFORT: Low (15 minutes per PLC)
|
||
PRIORITY: 1 (Critical - remediate within 24 hours)
|
||
```
|
||
|
||
---
|
||
|
||
## 8. Ongoing Monitoring and Maintenance
|
||
|
||
### Continuous Monitoring Strategy
|
||
|
||
#### What to Monitor
|
||
|
||
**Network Level:**
|
||
- Firewall rule violations
|
||
- Unauthorized connection attempts
|
||
- Protocol anomalies
|
||
- Bandwidth utilization
|
||
- New devices on network
|
||
|
||
**System Level:**
|
||
- Login attempts (successful and failed)
|
||
- Configuration changes
|
||
- Firmware updates
|
||
- Service start/stop
|
||
- Antivirus alerts
|
||
|
||
**Application Level:**
|
||
- PLC mode changes (RUN/STOP)
|
||
- Program uploads/downloads
|
||
- Recipe changes
|
||
- Setpoint modifications
|
||
- Alarm patterns
|
||
|
||
**Physical Level:**
|
||
- Door access events
|
||
- CCTV events
|
||
- Environmental sensors (temperature, humidity)
|
||
|
||
### Monitoring Tools
|
||
|
||
#### Network IDS/IPS for OT
|
||
|
||
**Commercial Solutions:**
|
||
- Nozomi Networks Guardian
|
||
- Claroty
|
||
- Dragos Platform
|
||
- Fortinet FortiGate (OT-specific)
|
||
- Cisco Cyber Vision
|
||
|
||
**Open Source:**
|
||
- Snort (with OT rules)
|
||
- Suricata (with ICS signatures)
|
||
- Zeek (formerly Bro) with S7Comm analyzer
|
||
|
||
#### SIEM Integration
|
||
|
||
**Popular SIEM Solutions:**
|
||
- Splunk (with ICS apps)
|
||
- IBM QRadar
|
||
- ArcSight
|
||
- LogRhythm
|
||
|
||
**Key Log Sources:**
|
||
1. Firewall logs
|
||
2. IDS/IPS alerts
|
||
3. Windows Event Logs (HMI, Engineering stations)
|
||
4. PLC audit logs (if available)
|
||
5. Switch logs (MAC address changes, port security)
|
||
6. VPN access logs
|
||
7. Physical access control logs
|
||
|
||
### Alert Configuration
|
||
|
||
#### Critical Alerts (Immediate Response)
|
||
|
||
```
|
||
1. PLC Program Download
|
||
- Trigger: S7 WRITE command to program blocks
|
||
- Action: Page on-call engineer, log event
|
||
|
||
2. PLC Mode Change (RUN → STOP)
|
||
- Trigger: PLC state change
|
||
- Action: Alert operations, investigate
|
||
|
||
3. Unauthorized IP Connection
|
||
- Trigger: Connection from IP not in whitelist
|
||
- Action: Block IP, alert security team
|
||
|
||
4. Multiple Failed Login Attempts
|
||
- Trigger: 3 failed logins within 5 minutes
|
||
- Action: Lock account, alert security
|
||
|
||
5. New Device on Control Network
|
||
- Trigger: New MAC address detected
|
||
- Action: Alert network admin, investigate
|
||
```
|
||
|
||
#### Warning Alerts (Review Within 24h)
|
||
|
||
```
|
||
1. Configuration Change
|
||
2. Firmware Update
|
||
3. New user account created
|
||
4. Privilege escalation
|
||
5. Anomalous protocol usage
|
||
```
|
||
|
||
### Patch Management
|
||
|
||
#### Siemens S7 Patch Process
|
||
|
||
**1. Monitor for Updates**
|
||
- Subscribe to Siemens ProductCERT: https://www.siemens.com/cert
|
||
- Check TIA Portal updates monthly
|
||
- Review security advisories
|
||
|
||
**2. Evaluate Patches**
|
||
```
|
||
For each patch, assess:
|
||
- Severity: Critical / High / Medium / Low
|
||
- Applicability: Does it affect our systems?
|
||
- Impact: Will it affect production?
|
||
- Prerequisites: Required firmware version?
|
||
- Testing: Can we test in lab first?
|
||
```
|
||
|
||
**3. Test in Non-Production**
|
||
- Apply patch to lab PLC
|
||
- Run full functional tests
|
||
- Monitor for 48 hours
|
||
- Document any issues
|
||
|
||
**4. Schedule Production Update**
|
||
- Coordinate with operations
|
||
- Schedule maintenance window
|
||
- Prepare rollback plan
|
||
- Notify all stakeholders
|
||
|
||
**5. Apply and Verify**
|
||
```
|
||
Pre-Update:
|
||
- Backup PLC program
|
||
- Document current firmware version
|
||
- Take screenshot of diagnostics
|
||
|
||
Update:
|
||
- Apply firmware update
|
||
- Verify version number
|
||
- Run functional tests
|
||
|
||
Post-Update:
|
||
- Monitor for 24 hours
|
||
- Document completion
|
||
- Update asset inventory
|
||
```
|
||
|
||
**6. Document**
|
||
- Update change log
|
||
- Record in CMDB
|
||
- Update network diagram if needed
|
||
|
||
#### Patch Priority Matrix
|
||
|
||
| Severity | Affected Systems | Priority | Timeline |
|
||
|----------|-----------------|----------|----------|
|
||
| Critical | Safety Systems | P1 | 7 days |
|
||
| Critical | Production Systems | P2 | 30 days |
|
||
| High | Safety Systems | P2 | 30 days |
|
||
| High | Production Systems | P3 | 90 days |
|
||
| Medium | Any | P4 | Next maintenance window |
|
||
| Low | Any | P5 | Annual review |
|
||
|
||
### Backup and Recovery
|
||
|
||
#### PLC Backup Strategy
|
||
|
||
**What to Backup:**
|
||
- PLC program (complete project)
|
||
- Configuration (IP address, parameters)
|
||
- Firmware version (document for reinstall)
|
||
- Hardware configuration
|
||
- Documentation (I/O lists, functional specs)
|
||
|
||
**Backup Frequency:**
|
||
- After any program change (immediate)
|
||
- Weekly (automated if possible)
|
||
- Before firmware updates
|
||
- Before major maintenance
|
||
|
||
**Backup Storage:**
|
||
- Primary: Network location (secured)
|
||
- Secondary: External hard drive (offline)
|
||
- Tertiary: Off-site (cloud or remote facility)
|
||
- Follow 3-2-1 rule: 3 copies, 2 media types, 1 off-site
|
||
|
||
**TIA Portal Backup Process:**
|
||
```
|
||
1. Open project in TIA Portal
|
||
2. Project → Archive...
|
||
3. Select "Create archive with all files"
|
||
4. Name with date: "PLC_REACTOR_2026-02-16.zap"
|
||
5. Save to secure network location
|
||
6. Verify archive integrity
|
||
7. Document in backup log
|
||
```
|
||
|
||
**Recovery Testing:**
|
||
- Test recovery quarterly
|
||
- Document recovery time objective (RTO)
|
||
- Practice in lab environment
|
||
- Train multiple personnel on recovery
|
||
|
||
---
|
||
|
||
## 9. Incident Response
|
||
|
||
### Incident Response Plan
|
||
|
||
#### Phase 1: Preparation
|
||
|
||
**Pre-Incident Checklist:**
|
||
- [ ] Incident response team identified (roles assigned)
|
||
- [ ] Contact list maintained (on-call rotation)
|
||
- [ ] Communication plan established
|
||
- [ ] Forensic tools prepared
|
||
- [ ] Backup systems verified
|
||
- [ ] Tabletop exercises conducted (annually)
|
||
|
||
**IR Team Roles:**
|
||
- **Incident Commander**: Overall response coordination
|
||
- **Operations Lead**: Production continuity
|
||
- **Safety Lead**: Safety assessment and procedures
|
||
- **Technical Lead**: System investigation and remediation
|
||
- **Communications Lead**: Internal and external communications
|
||
- **Legal/Compliance**: Regulatory requirements
|
||
|
||
#### Phase 2: Detection and Analysis
|
||
|
||
**Detection Methods:**
|
||
1. SIEM alerts
|
||
2. IDS/IPS alarms
|
||
3. Operator reports
|
||
4. Anomaly detection
|
||
5. External notification (vendor, CERT)
|
||
|
||
**Initial Response (First 15 minutes):**
|
||
```
|
||
1. Alert incident commander
|
||
2. Assess safety impact
|
||
3. Isolate affected systems (if safe to do so)
|
||
4. Preserve evidence
|
||
5. Begin documentation
|
||
```
|
||
|
||
**Incident Classification:**
|
||
|
||
| Severity | Definition | Response Time | Escalation |
|
||
|----------|-----------|---------------|------------|
|
||
| **Critical** | Safety impact or major production loss | Immediate | Executive team, authorities |
|
||
| **High** | Production impact but no safety concern | Within 1 hour | Management, legal |
|
||
| **Medium** | Limited impact, contained | Within 4 hours | IR team only |
|
||
| **Low** | No operational impact | Next business day | Technical team |
|
||
|
||
#### Phase 3: Containment
|
||
|
||
**Short-Term Containment:**
|
||
- Isolate affected network segment
|
||
- Disconnect from external networks
|
||
- Change credentials
|
||
- Block malicious IPs
|
||
- Switch to backup systems (if available)
|
||
|
||
**Long-Term Containment:**
|
||
- Rebuild compromised systems
|
||
- Implement additional controls
|
||
- Enhanced monitoring
|
||
- Forensic analysis
|
||
|
||
**Containment Decision Matrix:**
|
||
|
||
For PLC Compromise:
|
||
```
|
||
Question 1: Is safety at risk?
|
||
→ YES: Immediately switch to manual control / shutdown
|
||
→ NO: Proceed to Q2
|
||
|
||
Question 2: Is production at risk?
|
||
→ YES: Isolate PLC, switch to backup if available
|
||
→ NO: Proceed to Q3
|
||
|
||
Question 3: Can we contain without interruption?
|
||
→ YES: Isolate network segment, monitor
|
||
→ NO: Schedule emergency maintenance
|
||
```
|
||
|
||
#### Phase 4: Eradication
|
||
|
||
**Steps:**
|
||
1. Identify root cause
|
||
2. Remove malware/backdoors
|
||
3. Close vulnerability
|
||
4. Patch systems
|
||
5. Validate removal
|
||
6. Restore from clean backup
|
||
|
||
**For Compromised PLC:**
|
||
```
|
||
1. Disconnect PLC from network
|
||
2. Clear PLC memory (factory reset if needed)
|
||
3. Update firmware to latest version
|
||
4. Restore program from verified clean backup
|
||
5. Change all passwords
|
||
6. Reconfigure IP ACLs
|
||
7. Validate against known-good configuration
|
||
8. Test offline before reconnecting
|
||
```
|
||
|
||
#### Phase 5: Recovery
|
||
|
||
**Recovery Checklist:**
|
||
- [ ] Affected systems rebuilt/restored
|
||
- [ ] Security controls verified
|
||
- [ ] Monitoring enhanced
|
||
- [ ] Credentials rotated
|
||
- [ ] Communications to stakeholders
|
||
- [ ] Operations returned to normal
|
||
- [ ] Increased monitoring period (48-72 hours)
|
||
|
||
#### Phase 6: Post-Incident Activities
|
||
|
||
**Lessons Learned Meeting (within 2 weeks):**
|
||
1. Timeline review
|
||
2. What went well?
|
||
3. What could be improved?
|
||
4. Action items (assign owners and due dates)
|
||
|
||
**Incident Report Contents:**
|
||
1. Executive summary
|
||
2. Incident timeline
|
||
3. Root cause analysis
|
||
4. Impact assessment (financial, operational, safety)
|
||
5. Response actions taken
|
||
6. Lessons learned
|
||
7. Recommendations
|
||
8. Action plan
|
||
|
||
**Follow-Up Actions:**
|
||
- Update incident response plan
|
||
- Update detection rules
|
||
- Implement preventive controls
|
||
- Training for staff
|
||
- Share findings (anonymized) with industry
|
||
|
||
### Reporting Requirements
|
||
|
||
#### Internal Reporting
|
||
- Immediate: Safety/operations management
|
||
- Within 24h: Executive team
|
||
- Within 1 week: Complete incident report
|
||
|
||
#### External Reporting
|
||
|
||
**Regulatory (if applicable):**
|
||
- NERC CIP (electric sector): Within 1 hour for critical incidents
|
||
- TSA (pipelines/rail): Within 24 hours
|
||
- EPA (water): Within requirements
|
||
- OSHA (safety incident): Within 8 hours for fatality/hospitalization
|
||
|
||
**Industry Sharing:**
|
||
- ICS-CERT (CISA): Voluntary but recommended
|
||
- Information Sharing and Analysis Centers (ISACs)
|
||
- Local law enforcement (if criminal)
|
||
|
||
---
|
||
|
||
## 10. Compliance and Documentation
|
||
|
||
### Documentation Requirements
|
||
|
||
#### Security Documentation Repository
|
||
|
||
**1. Policies and Standards**
|
||
- Information Security Policy
|
||
- Acceptable Use Policy
|
||
- Password Policy
|
||
- Change Management Policy
|
||
- Incident Response Policy
|
||
- Access Control Policy
|
||
|
||
**2. Procedures**
|
||
- System Hardening Procedures
|
||
- Backup and Recovery Procedures
|
||
- Patch Management Procedures
|
||
- User Access Provisioning/Deprovisioning
|
||
- Vendor Access Procedures
|
||
- Incident Response Procedures
|
||
|
||
**3. Technical Documentation**
|
||
- Network Architecture Diagrams
|
||
- Asset Inventory (with security controls)
|
||
- Firewall Configurations and Rule Sets
|
||
- PLC Configurations (baseline)
|
||
- System Baseline Configurations
|
||
- Data Flow Diagrams
|
||
|
||
**4. Risk Management**
|
||
- Risk Assessment Results
|
||
- Risk Register (tracking all identified risks)
|
||
- Risk Treatment Plans
|
||
- Security Control Matrices
|
||
- Compliance Gap Analysis
|
||
|
||
**5. Operations**
|
||
- Change Logs
|
||
- Incident Logs
|
||
- Access Logs Reviews
|
||
- Audit Reports
|
||
- Test Results (vulnerability scans, penetration tests)
|
||
- Training Records
|
||
|
||
### Audit and Compliance
|
||
|
||
#### Internal Audits
|
||
|
||
**Quarterly Audit Checklist:**
|
||
|
||
**Access Control:**
|
||
- [ ] User access reviews completed
|
||
- [ ] Privileged access reviewed
|
||
- [ ] Terminated user accounts disabled
|
||
- [ ] Password policy compliance
|
||
- [ ] MFA enabled for remote access
|
||
|
||
**Change Management:**
|
||
- [ ] All changes documented in change log
|
||
- [ ] Changes approved before implementation
|
||
- [ ] Testing performed per requirements
|
||
- [ ] Rollback plans documented
|
||
|
||
**Patch Management:**
|
||
- [ ] Patch inventory current
|
||
- [ ] Critical patches applied per timeline
|
||
- [ ] Patch testing documented
|
||
- [ ] Exceptions documented and approved
|
||
|
||
**Backup/Recovery:**
|
||
- [ ] Backups performed per schedule
|
||
- [ ] Backup integrity verified
|
||
- [ ] Recovery test performed (quarterly)
|
||
- [ ] Off-site backup verified
|
||
|
||
**Security Controls:**
|
||
- [ ] Antivirus definitions current
|
||
- [ ] Firewall rules reviewed
|
||
- [ ] IDS/IPS signatures updated
|
||
- [ ] Log collection verified
|
||
- [ ] Physical security controls verified
|
||
|
||
**Training and Awareness:**
|
||
- [ ] Annual security training completed
|
||
- [ ] Phishing simulations performed
|
||
- [ ] Incident response training conducted
|
||
- [ ] New employee orientation completed
|
||
|
||
#### External Audits
|
||
|
||
**Preparation:**
|
||
1. Gather all required documentation
|
||
2. Review previous audit findings
|
||
3. Verify all action items completed
|
||
4. Conduct pre-audit self-assessment
|
||
5. Assign audit coordinator
|
||
|
||
**Common Audit Frameworks:**
|
||
- IEC 62443 (ISASecure certification)
|
||
- NERC CIP (electric sector)
|
||
- NIST CSF
|
||
- ISO 27001
|
||
- SOC 2 Type II
|
||
|
||
**Audit Evidence Examples:**
|
||
- Screenshots of configurations
|
||
- Log excerpts
|
||
- Access control lists
|
||
- Change management tickets
|
||
- Training completion records
|
||
- Incident response logs
|
||
|
||
### Regulatory Compliance
|
||
|
||
#### Industry-Specific Requirements
|
||
|
||
**Critical Manufacturing:**
|
||
- CISA guidelines
|
||
- State-specific requirements
|
||
|
||
**Electric Sector:**
|
||
- NERC CIP (Critical Infrastructure Protection)
|
||
- FERC regulations
|
||
|
||
**Water/Wastewater:**
|
||
- EPA regulations
|
||
- America's Water Infrastructure Act (AWIA)
|
||
|
||
**Chemical:**
|
||
- CFATS (Chemical Facility Anti-Terrorism Standards)
|
||
- Process Safety Management (PSM)
|
||
|
||
**Oil and Gas:**
|
||
- TSA pipeline security
|
||
- API standards
|
||
|
||
---
|
||
|
||
## Appendices
|
||
|
||
### Appendix A: Useful Commands and Scripts
|
||
|
||
#### Network Discovery (Safe for OT)
|
||
```bash
|
||
# Passive network monitoring
|
||
tcpdump -i eth0 -w capture.pcap 'port 102'
|
||
|
||
# Safe Nmap scan for S7 PLCs
|
||
nmap -sT -T1 --max-rate 5 -p 102 --script s7-info <IP_RANGE>
|
||
|
||
# Check specific PLC
|
||
nmap -sT -p 102,80,443 192.168.10.100
|
||
```
|
||
|
||
#### Firewall Rule Examples
|
||
|
||
**IPTables (Linux):**
|
||
```bash
|
||
# Allow S7 communication from HMI only
|
||
iptables -A FORWARD -s 192.168.10.50 -d 192.168.10.100 -p tcp --dport 102 -j ACCEPT
|
||
iptables -A FORWARD -d 192.168.10.100 -p tcp --dport 102 -j LOG --log-prefix "BLOCKED_S7: "
|
||
iptables -A FORWARD -d 192.168.10.100 -p tcp --dport 102 -j DROP
|
||
|
||
# Block all traffic between IT and OT zones except via DMZ
|
||
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.10.0/24 -j DROP
|
||
```
|
||
|
||
**Cisco ASA:**
|
||
```
|
||
! Allow S7 from SCADA to PLC network
|
||
access-list SCADA_TO_PLC extended permit tcp object SCADA_NETWORK object PLC_NETWORK eq 102
|
||
access-list SCADA_TO_PLC extended deny ip any any log
|
||
|
||
! Apply to interface
|
||
access-group SCADA_TO_PLC in interface inside
|
||
```
|
||
|
||
### Appendix B: Security Assessment Template
|
||
|
||
```markdown
|
||
# Security Assessment Report
|
||
|
||
## Executive Summary
|
||
- Assessment Date: _______________
|
||
- Scope: _________________________
|
||
- Overall Risk Rating: ____________
|
||
|
||
## Findings Summary
|
||
- Critical: ___
|
||
- High: ___
|
||
- Medium: ___
|
||
- Low: ___
|
||
|
||
## Top 5 Risks
|
||
1. [Finding ID] [Title] - [Risk Score]
|
||
2. [Finding ID] [Title] - [Risk Score]
|
||
3. [Finding ID] [Title] - [Risk Score]
|
||
4. [Finding ID] [Title] - [Risk Score]
|
||
5. [Finding ID] [Title] - [Risk Score]
|
||
|
||
## Detailed Findings
|
||
|
||
### Finding 1: [Title]
|
||
- **Severity**: Critical/High/Medium/Low
|
||
- **Risk Score**: ___
|
||
- **Affected Systems**: ___
|
||
- **Description**: ___
|
||
- **Impact**: ___
|
||
- **Recommendation**: ___
|
||
- **Priority**: ___
|
||
- **Estimated Effort**: ___
|
||
|
||
[Repeat for each finding]
|
||
|
||
## Remediation Plan
|
||
[Prioritized list of remediation actions with timeline]
|
||
```
|
||
|
||
### Appendix C: Emergency Contact List Template
|
||
|
||
```
|
||
INCIDENT RESPONSE TEAM
|
||
|
||
Incident Commander:
|
||
Name: _______________
|
||
Phone: _______________
|
||
Email: _______________
|
||
|
||
Operations Lead:
|
||
Name: _______________
|
||
Phone: _______________
|
||
Email: _______________
|
||
|
||
Technical Lead:
|
||
Name: _______________
|
||
Phone: _______________
|
||
Email: _______________
|
||
|
||
Safety Lead:
|
||
Name: _______________
|
||
Phone: _______________
|
||
Email: _______________
|
||
|
||
EXTERNAL CONTACTS
|
||
|
||
Siemens Support: 1-800-XXX-XXXX
|
||
Local FBI Cyber: _______________
|
||
CISA (ICS-CERT): 888-282-0870 / ics-cert@cisa.dhs.gov
|
||
Local Law Enforcement: 911
|
||
```
|
||
|
||
### Appendix D: Training Resources
|
||
|
||
**Free Training:**
|
||
- CISA ICS Training: https://www.cisa.gov/ics-training-catalog
|
||
- SANS ICS Security: https://www.sans.org/cyber-security-courses/ics-scada-cyber-security/
|
||
- Siemens Learning Portal: https://support.industry.siemens.com/tf/ww/en/
|
||
|
||
**Certifications:**
|
||
- GICSP (Global Industrial Cyber Security Professional) - SANS
|
||
- GRID (Response and Industrial Defense) - SANS
|
||
- Certified ICS Security Specialist - Various providers
|
||
|
||
**Industry Organizations:**
|
||
- ICS-CERT (CISA)
|
||
- SANS ICS
|
||
- ISA (International Society of Automation)
|
||
- ISAGCA (ISA Global Cybersecurity Alliance)
|
||
|
||
### Appendix E: Vendor Security Questionnaire
|
||
|
||
Use this when evaluating control system vendors or integrators:
|
||
|
||
```
|
||
1. Do you follow IEC 62443 development lifecycle?
|
||
2. Do you have ISASecure certification for your products?
|
||
3. How do you handle vulnerability disclosure?
|
||
4. What is your patch release timeline for critical vulnerabilities?
|
||
5. Do you provide security advisories?
|
||
6. Are default passwords required to be changed?
|
||
7. Do you support encrypted communications?
|
||
8. Do you provide security hardening guides?
|
||
9. What logging and auditing capabilities exist?
|
||
10. Do you require/offer security training for your products?
|
||
```
|
||
|
||
---
|
||
|
||
## Quick Reference Card
|
||
|
||
### Daily Security Checks (5 minutes)
|
||
1. Review critical SIEM alerts
|
||
2. Check firewall logs for violations
|
||
3. Verify backup completion
|
||
|
||
### Weekly Security Tasks (30 minutes)
|
||
1. Review all SIEM alerts
|
||
2. Check for Siemens security advisories
|
||
3. Review access logs
|
||
4. Update asset inventory (if changes)
|
||
|
||
### Monthly Security Tasks (2-4 hours)
|
||
1. User access review/recertification
|
||
2. Review and update firewall rules
|
||
3. Vulnerability scan (safe profile)
|
||
4. Security awareness reminder
|
||
5. Review incident log
|
||
|
||
### Quarterly Security Tasks (1-2 days)
|
||
1. Full vulnerability assessment
|
||
2. Test backup/recovery
|
||
3. Review and update policies
|
||
4. Physical security inspection
|
||
5. Internal audit
|
||
6. Tabletop exercise
|
||
|
||
### Annual Security Tasks (1-2 weeks)
|
||
1. Full security audit
|
||
2. Penetration testing (test environment)
|
||
3. Risk assessment update
|
||
4. All policies and procedures review
|
||
5. Disaster recovery test
|
||
6. Security training (all staff)
|
||
7. Contract/vendor reviews
|
||
|
||
---
|
||
|
||
## Glossary
|
||
|
||
**ACL (Access Control List)**: List of permissions attached to an object
|
||
**DMZ (Demilitarized Zone)**: Network segment that sits between internal and external networks
|
||
**ICS (Industrial Control System)**: Generic term for control systems including SCADA, DCS, PLC
|
||
**IDS (Intrusion Detection System)**: Monitors network traffic for suspicious activity
|
||
**IPS (Intrusion Prevention System)**: IDS that can also block threats
|
||
**OT (Operational Technology)**: Hardware and software controlling physical processes
|
||
**PLC (Programmable Logic Controller)**: Digital computer for automation
|
||
**SCADA (Supervisory Control and Data Acquisition)**: System for remote monitoring and control
|
||
**SIEM (Security Information and Event Management)**: Centralized logging and analysis
|
||
**SL (Security Level)**: IEC 62443 measure of protection against threats
|
||
**VPN (Virtual Private Network)**: Encrypted connection over public network
|
||
|
||
---
|
||
|
||
**Document Version**: 1.0
|
||
**Last Updated**: February 16, 2026
|
||
**Based On**: IEC 62443, NIST SP 800-82, CISA Guidelines
|
||
**Intended Audience**: Control System Engineers, ICS Security Professionals, Plant Managers
|