Ciprian Covas INDUSTRIAL CYBER SECURITY PROGRAM & SOLUTIONS FOREN 2016, Costinesti
|
|
- Blanche Ellis
- 6 years ago
- Views:
Transcription
1 Ciprian Covas INDUSTRIAL CYBER SECURITY PROGRAM & SOLUTIONS FOREN 2016, Costinesti
2 Agenda 1 Cyber Security - Today Cyber Security Security Profile Cyber Security - Solutions Honeywell Risk Manager Conclusions Open Discussion
3 Recent incidents and events German BSI (Federal Office for Information Security) reported in 2015: - Hackers manipulated and disrupted control systems at a steel mill in Germany - Blast furnace could not be properly shut down resulting massive damage! Blackout in Western-Ukraine on 23 Dec 2015: First Cyber-Attack to cause Power Outage - BlackEnergy backdoor + KillDisk component = Deletes Files/Events, Terminat Processes - Blinded" the dispatchers and wiped SCADA system hosts (servers and workstations) - Flooded the call centers to deny customers calling to report power out - Mitigation via staff who manned substations to manually re-close breakers to energize the system SYNful knock - Cisco router (1841, 2811, 3825) implants (firmware modification) - Creates backdoor into the system Hammertoss / BlackDragon - Spear phishing attack ( , Twitter, Github) - Espionage Pawnstorm - Adobe zero-day and Java zero day exploits used - Espionage Antivirus scan interrupts heart surgery
4 Focus: Up to But Not Including Corporate and 3 rd Party Networks 3 Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance Connections Firewall IT Cyber Security Level 3.5 DMZ Domain Controller ESF PHD Server Experion Server EAS Terminal Server Patch Mgmt Server Anti Virus Server 3 RD Party App Subsystem Interface eserver PHD Shadow Server Level 3 Router ESC ESF ACE Experion Server EST ESVT Optional HSRP Router Safety Manager Terminal Server Domain Controller Industrial Cyber Security Level 2 Qualified Cisco Switches Level 1
5 Presenter 4 Ciprian Covas Global Solution Manager for Cyber Security Managed Services Joined Honeywell in 2001 IT Manager between In Industrial Cyber Security since 2011
6 Leading Cyber Security Specialist for ICS Certified Cyber Security Professionals Global team Cyber Security Standard driven IEC (ISA 99), ANSSI, BSI, CPNI Embedded or Stand-alone 400+ Security assessments for Industrial Control Systems Cyber Security Services Numerous Partners Cyber labs 500+ Remediation Projects Multi Vendor Cyber Security Products 350+ Managed Security Networks
7 Honeywell ICS 6 Edmonton Bracknell Aberdeen Amsterdam Global setup to serve global organizations as well as local asset owners Vancouver Montreal Offenbach Bucharest Houston Atlanta Dubai Kuala Lumpur Santiago Perth SSC + HICS HICS Office Private LSS SSC HICS Resource(s) Industries served: Oil & gas Gas distribution Power Refineries Chemical Water treatment Pulp & paper Maritime
8 7 Honeywell s Industrial Cyber Security Lab Flexible model of a complete process control network up to the corporate network Honeywell Cyber Security solutions development and test bed Demonstration lab for customers Cyber security related academic programs Hands-on training Simulate cyber attacks Demonstrate Honeywell cyber security solutions
9 Driven by standards and regulations 8 IEC (Formerly ISA 99 & WIB) Industrial Automation Control Systems (IACS) Security Global standard for wide range of industry Honeywell ICS is active contributor to the development of the standard through ISA NERC CIP North American Power ANSSI, BSI, CPNI, MSB, INCIBE, etc. European guidelines, best practices and country-specific measures JRC & ENISA recommendations European Union NIST US technology standards (SP ) And others: ISO, API, OLF E.g. ISO 27000, API 1164, OLF 104 Local regulations
10 Agenda 9 Cyber Security - Today Cyber Security Profile Cyber Security Solutions Honeywell Risk Manager Conclusions Open Discussion
11 What is Cyber Security Profiling (CSP)? CSP is the security characterization of the ICS in a specific plant in terms of security objectives, as well as security properties. It defines the target protection characteristics and the actual implemented protection characteristics of an ICS or subsystem. 10 It provides a response to questions such as: To what extend must we protect the ICS? (Target) To what extend have we protected our ICS? (Actual) How can we reach the Target? (CSP Roadmap) Optional: How do we compare to other ICS? (Benchmark)
12 Typical security level 12 IEC Skills Motivation Means Resources SL4 Nation-state ICS Specific High Sophisticated (Campaign) Extended (multidisciplinary teams) SL3 Hacktivist, Terrorist ICS specific Moderate Sophisticated (Attack) Moderate (groups of hackers) SL2 Cyber crime, Hacker Generic Low Simple Low (Isolated individuals) SL1 Careless employee, contractor No attack skills Mistakes Nonintentional Employee, contractor
13 Cybersecurity Capability Maturity Model Levels 13
14 Cyber Security Profile 14 SL4 SL3 SL2 SL SL1 SL2 SL3 SL Refining process facilities 1401 Fertilizers 1102 O&G LNG terminals 1403 Petrochemicals 1103 O&G processing 1404 Plastics and fibers 1104 O&G production - on-shore 1405 Specialty chemicals 1105 O&G production - off-shore 1406 Biofuels 1108 O&G Marine - LNG IAS 1501 Alumina 1110 Gas To Liquid 1502 Aluminium 1112 Production - Coal bed M 1503 Base materials 1114 Pipeline - Liquid 1504 Cement 1115 Pipeline - Gas 1505 Coal & coal gasification 1201 Pulp 1506 Iron 1203 Paper 1509 Precious metals 1204 CWS 1510 Steel making 1303 Utility power 1508 Other SL1 SL2 SL3 SL4 MIL0 MIL1 MIL2 MIL3 Cyber Security strength is determined by the security design effectiveness (Security Level) and security operations effectiveness (Maturity Level) IEC standard provides the Security Level, Cobit or C2M2 toolkit provides the Maturity Level The Security Profile defines for each facility how to protect and how to organize Honeywell ICS has a complete portfolio and services to address each aspect of the profile (technical, non-technical); typically with SL2/SL3+ assessments Defines the Security Profile
15 Agenda 15 Cyber Security - Today Cyber Security Profile Cyber Security Solutions Honeywell Risk Manager Conclusions Open Discussion
16 Our Solution Portfolio Backup and Recovery Incident Response Disaster Recovery Cyber Security Assessments Thread Risk Assessments Network & Wireless Assessments Audits and Design Reviews Secure Design and Optimization Zone & Conduit Separation 16 Risk Manager (in SOC) Continuous Monitoring Compliance & Reporting Industrial Security Information & Event Management (SIEM) Security Awareness Training Firewall, Next Gen FW Intrusion Prevention (IPS) Network Access Control Industrial Anti-Virus & Patching End Node Hardening Industrial Application Whitelisting Portable Media/Device/USB Security
17 The First Step to Security Is Understanding the Current Environment 17 Response & Recovery Situational Awareness Assessments & Audits TECHNOLOGY Architecture & Design Network Security Customer problems solved/needs addressed: Identifying and prioritizing the biggest risks Meeting industry/government regulations and guidelines Finding which systems and devices are the most exposed, and the most vulnerable Prioritizing cyber security efforts for the maximum return Endpoint Protection Honeywell Offerings: Risk Assessment Cyber Assessment (coincidental & intentional attacks using simple means) Risk/Thread Assessment (targeted attacks using sophisticated means) Validation Testing ICS White box / Tandem Audits, Compliance Assessments & Reports Wireless / Wired Network Assessment
18 Sources of vulnerability 18 An ICS has many sources of vulnerability: Infrastructure - Network - Computer platform - Computer operating system - Topology Application - Application components (e.g. database, middleware) - Authorization levels - Protocols used Embedded components - Field equipment (Transmitters, actuators) - Controllers, PLCs, safety controllers People - Plant personnel - Contractors Processes
19 Thoroughness Thoroughness The level of effort 19 RISK SL3 SL4 The strength of the attacker determines the tactics, technologies, and practices (TTP) used. SIMPLE GENERIC EXPLOIT SL1 COMPLEX ICS SPECIFIC EXPLOIT SL2 SL2 VULNERABLE, BUT EITHER UNKNOWN, NOT EXPOSED, OR INSUFFICIENT CAPABILITIES TO EXPLOIT SL3 Completeness SL4 Strong attackers have a very clear plan and objective The risk increases depending on the strength of the attacker The need for thoroughness and completeness increases when the strength of the attacker increases The need for very specific skills increases when the strength of the attacker increases SL1 Completeness
20 Security levels and security capabilities 20 SL1 58 capabilities SL2 87 capabilities SL3 118 capabilities SL4 128 capabilities Out of the box installations, plus antivirus, back-up Requires additions such as domain, deep packet inspection, device control Requires additions such as multi-factor authentication, IPS, SIEM, security monitoring, white listing Requires additions such as multi-factor authentication for all systems, biometrics, dual control
21 Technical controls 21 3 rd generation Firewall Next Generation Firewall Security Management Console Microsoft Workgroup Microsoft Active Directory Microsoft RADIUS Intrusion Prevention System Intel Security SIEM Cisco Access Point Cisco WLC Network Admittance Control Microsoft Windows Secure Access Portal RSA multifactor authentication Cisco Catalyst IOS Threat Intelligence Exchange (TIE) Antivirus black listing Endpoint protection white listing Endpoint protection device control Endpoint protection host IPS Honeywell Risk Manager Honeywell Experion Backup Recovery Honeywell Service Node AV update Honeywell Service Node Vaccine update Honeywell Service Node TI update Honeywell EPKS Secure Communications Honeywell EPKS Modbus firewall RO Modbus firewall RW OPC firewall DNP3 firewall Data Diode Bi-directional Data Diode Bluecoat USB protection Available capabilities for SL3+ security requirements
22 Once You ve Found the Gaps, Fill them 22 Response & Recovery Assessments & Audits TECHNOLOGY Architecture & Design Customer problems solved/needs addressed: How to use network design to promote strong security Implementing Zones & Conduits (per IEC 62443) to minimize the impact of an incident Situational Awareness Network Security Endpoint Protection Honeywell Offerings: Network Design & Optimization Services Wireless Design & Optimization Services Cyber Security Design Services Zones & Conduits Documentation of current architecture and security
23 Most Threats Come from the Network 23 Response & Recovery Assessments & Audits Architecture & Design Customer problems solved/needs addressed: How to make it harder for the bad guys to get in What to do if/when they do get in TECHNOLOGY Situational Awareness Endpoint Protection Network Security Honeywell Offerings: Network Design Services Firewall/NGFW Installation & Configuration IPS Installation & Configuration Data Diode Network Access Control Perimeter Security Management
24 Soft Systems Are Easy Targets 24 Response & Recovery Situational Awareness Assessments & Audits TECHNOLOGY Architecture & Design Network Security Customer problems solved/needs addressed: Identify which PCs and Servers are vulnerable to threats Determining if the proper access controls are in place (missing critical patches, AV is out-of-date, etc.) Endpoint Protection Honeywell Offerings: Endpoint Hardening Anti-Virus Installation & Configuration Application Whitelisting, Installation & Configuration
25 25 Endpoint Hardening USB Port Disable Whitelisting Reduce inadvertent cyber intrusions via memory stick Enhanced DSA Security Secure Communications Restrict access to all apps unless authorized via approved list Authentication with flexible account using least privilege Encrypted and authenticated communications
26 Awareness Is Critical 26 Response & Recovery Situational Awareness Assessments & Audits TECHNOLOGY Endpoint Protection Architecture & Design Network Security Customer problems solved/needs addressed: Staying diligent with limited security staff & resources Understanding what s happening, what s at risk, and why Identifying the early-warning signs to prevent incidents Knowing what to do if/when an incident does occur Honeywell Offerings: Risk Manager (further discussed in SOC section) Security Information and Event Management (SIEM) Continuous Monitoring Compliance & Reporting Security Awareness Training
27 We Have a Problem 27 Response & Recovery Assessments & Audits Architecture & Design Customer problems solved/needs addressed: What do you do when an incident occurs? How do you recover? How do you regain safety and reliability? TECHNOLOGY Situational Awareness Network Security Endpoint Protection Honeywell Offerings: Backup & Restore Services (Security) Incident Response Services 24 x 7
28 Honeywell Security Service Center (HSSC) 28 Amsterdam Houston Amsterdam Bucharest Houston
29 Managed Industrial Cyber Security Services 29 Patch and Anti-Virus Automation Security and Performance Monitoring Activity and Trend Reporting Advanced Monitoring and Co- Management Secure Access Tested and qualified patches for operating systems & DCS software Tested and qualified antimalware signature file updates Comprehensive system health & cybersecurity monitoring 24x7 alerting against predefined thresholds Monthly or quarterly compliance & performance reports Identifying critical issues and chronic problem areas Honeywell Industrial Cyber Security Risk Manager Firewalls, Intrusion Prevention Systems, etc. Highly secure remote access solution Encrypted, two factor authentication Complete auditing: reporting & video playback Monitoring, Reporting and Honeywell Expert Support
30 What is monitored Performance Analyzers for 550+ Critical parameters 30
31 Get updates Collect monitoring data Get updates Send data Managed Industrial Cyber Security Services 31 Industrial Site Internet Security Service Center Level 4 Corporate Proxy Server Level 3.5 eserver Terminal Server Relay Node Isolates ICS/PCN Ensures no direct communication between L3 and L4 Communication Server Application Servers Level 3 Restricts unauthorized ICS/PCN nodes from sending or receiving data Database Servers Service Node Anti malware Patch Management Monitoring Secure access Level 2 EST/ESF 3 rd Party Historian Domain Controller SSL Encrypted communication Connects to Honeywell Security Service Center ONLY! ACE EST/ ESF Experion Servers Domain Controller Level 1
32 32 CYBER SECURITY RISK MANAGER
33 Industrial Cyber Security Risk Manager 33 Real time, continuous visibility, understanding and decision support Proactively identifies cyber security vulnerabilities and threats, and quantifies and prioritizes risks Easy-to-use Interface No need to be a cyber security expert First of its Kind for Industrial Environments Real time assessment and continuous monitoring for improved situational awareness Multi automation vendor support Low impact technology won t disrupt operations Proactively Monitor, Measure, and Manage Cyber Security Risk
34 Built-in Expert Advice for Fast Risk Mitigation Possible Cause Recommended Actions Potential Impact
35 Honeywell Risk Manager 35 Risk Appetite The amount and type of risk an organization is willing to accept in pursuit of its business objectives Risk Tolerance The specific maximum risk that an organization is willing to take regarding each relevant risk Trends reflect risk appetite and risk tolerance for that particular site
36 36
37 Agenda 37 Cyber Security - Today Cyber Security Profile Cyber Security Solutions Honeywell Risk Manager Conclusions Open Discussion
38 Industry-Leading Industrial Cyber Security 38 Industrial Cyber Security Experts Global team of certified Industrial Cyber Security experts 100% dedicated to Industrial Cyber Security Experts in process control cyber security Leaders in security standards ISA99 / IEC62443 / NIST Proven Experience 10+ years industrial cyber security 1,000+ successful industrial cyber projects 300+ managed industrial cyber security sites Proprietary cyber security methodologies and tools Investment and Innovation Largest R&D investment in industrial cyber security Partnerships with leading cyber security vendors Industry first Risk Manager First to obtain ISASecure security for ICS product State of art Industrial Cyber Security Solutions Lab Refining & Minerals, Petrochemical Oil & Gas Chemicals Power Generation Metals & Mining Pulp & Paper 38 Proven Industrial Cyber Security Solution Provider
39 This is what we do: 39 Open Discussion
40 40 BACKUP SLIDES
41 References 41 Steel mill incident Antivirus halts medical device: Black Dragon: ergy_sector.pdf Ukraine incident: Synful Knock: Hammertoss:
42 Secure Remote Access 42 Highly Secure - Individual accounts must be added to site and authorized for specific devices - Two-factor authentication required to access gateway - Request for access must be submitted and approved for each session - Screen sharing allows monitoring of all activity - Access can be disabled at any time - Alerts can be sent for all sessions starts and stops Exceptional Audit Capabilities Comprehensive, detailed reporting of all activity Audits logs stored in two isolated locations Video recording and playback available
43 Patch and Antivirus Automation Anti-Virus Automation 43 Common for Antivirus and Patch updates Automated, secure transfer of update files Honeywell tested and qualified on equivalent release Maintains integrity of files through Secure Connection s encrypted file transfer Avoids file modification risk via transfers by or portable media Antivirus automation: McAfee or Symantec Provides a local source of current, qualified signature files for installation Central management reduces manual, administrative work Reduces delays required to obtain current files and patches Optional Services include: on-site Server & PC installations (in coordination with Honeywell Field Service Engineer) checks to assure latest signatures are installed configuration of automated, staggered signature deployment. Prevent Exploits, Infections and Application Malfunction
44 Patch and Antivirus Automation Patch Automation 44 Common for Antivirus and Patch updates Automated, secure transfer of update files Honeywell tested and qualified on equivalent release Maintains integrity of files through Secure Connection s encrypted file transfer Avoids file modification risk via transfers by or portable media Patch Automation: Microsoft WSUS and Experion Provides a local source of current, qualified patches for installation Reduces delays required to obtain current files and patches Optional Services include: On-site installation of patches (in coordination with Honeywell Field Service Engineer) Checks to assure latest patches are installed Local group device assignment of WSUS if requested Prevent Exploits, Infections and Application Malfunction
45 Security and Performance Monitoring 45 Continuous Monitoring - Agentless monitoring solution for system, network and security performance and health - Tested to ensure no impact on systems - Automated monitoring of critical ICS, network, Windows TM and security parameters - Intelligent analysis based on Honeywell engineering & expertise Alerts / Situational Awareness - 24/7 automated, proactive alerting for all monitored devices - Equipment and device specific thresholds - Managed Security Service Center automatically generates an alert or SMS text to site specified contact - Alert messages may include attached troubleshooting techniques
46 ICS Continuous Monitoring: Making the Case 46 Continuous Monitoring ensures Industrial Control System (ICS) reliability - Detection of availability & performance issues to prevent serious degradation In the context of Cybersecurity: - Which ICS Cyber Security controls (technical and non-technical) need to be in place for ICS Continuous Monitoring? - Where does ICS Continuous Monitoring belong in the CyberSecurity Profile? This section: - introduces the Cyber Security Profile and its underlying principles - places Continuous Industrial Cyber Risk Readiness in the overall Cyber Security Profile context - proves why Continuous Monitoring is in the heart of detecting cybersecurity anomalies & events which is vital to respond/recover - explains why Continuous Monitoring is an essential performance evaluation principle which increases cybersecurity maturity
47 Key Item to Monitor 47 Network Activity Logs Attack Signatures, ACL Rules, Utilization Spikes System Audit Logs Unauthorized Access, Disabling Controls, Configuration Changes System Availability/Performance Application Health, CPU Utilization, Hardware Errors Administrative Changes GPO Modifications, Group Additions, Enabling USB Devices Software Update Compliance Aging for Virus Signatures, Security Patches, Software Updates Virus Infections
Mark Littlejohn June 23, 2016 DON T GO IT ALONE. Achieving Cyber Security using Managed Services
Mark Littlejohn June 23, 2016 DON T GO IT ALONE Achieving Cyber Security using Managed Services Speaker: Mark Littlejohn 1 Mark is an industrial technology professional with over 30 years of experience
More informationKonstantin Rogalas CYBER SECURITY PROGRAM & SOLUTIONS
Konstantin Rogalas 19.11.2015 CYBER SECURITY PROGRAM & SOLUTIONS Focus: Up to But Not Including Corporate and 3 rd Party Networks 1 Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance Connections
More informationINDUSTRIAL CYBER SECURITY
Rudrajit Roy 20 October 2016 INDUSTRIAL CYBER SECURITY A Comprehensive Approach Agenda 1 Global Industrial Cyber Security Journey Industry Best Practices Honeywell Industrial Cyber Security Who we are,
More informationHONEYWELL INDUSTRIAL CYBER SECURITY
Ammar Alzaher 2017 HONEYWELL INDUSTRIAL CYBER SECURITY www.becybersecure.com Agenda Introductions Why Honeywell Solutions Overview Managed Services Cyber Security Lab Risk Manager Secure Media Exchange
More informationMark Littlejohn June Improving ICS Cyber Security Consistency Using Managed Security Services
Mark Littlejohn June 2018 Improving ICS Cyber Security Consistency Using Managed Security Services 1 Common Cyber Concerns: Typical Attack Vectors* Brought in by employees, contractors, security guards,
More informationMike Spear, Ops Leader Greg Maciel, Cyber Director INDUSTRIAL CYBER SECURITY PROGRAMS
Mike Spear, Ops Leader Greg Maciel, Cyber Director INDUSTRIAL CYBER SECURITY PROGRAMS Can You Answer These Questions? 1 What s my company s exposure to the latest industrial cyber threat? Are my plants
More informationSafdar Akhtar, Cyber Director Sema Tutucu, Ops Leader 27 September CYBER SECURITY PROGRAM: Policies to Controls
Safdar Akhtar, Cyber Director Sema Tutucu, Ops Leader 27 September 2017 CYBER SECURITY PROGRAM: Policies to Controls Can You Answer These Questions? 1 What s my company s exposure to the latest industrial
More informationABB Ability Cyber Security Services Protection against cyber threats takes ability
ABB Ability Cyber Security Services Protection against cyber threats takes ability In today s business environment, cyber security is critical for ensuring reliability of automation and control systems.
More informationIndustrial Security - Protecting productivity. Industrial Security in Pharmaanlagen
- Protecting productivity Industrial Security in Pharmaanlagen siemens.com/industrialsecurity Security Trends Globally we are seeing more network connections than ever before Trends Impacting Security
More informationIndustry Best Practices for Securing Critical Infrastructure
Industry Best Practices for Securing Critical Infrastructure Cyber Security and Critical Infrastructure AGENDA - Difference between IT and OT - Real World Examples of Cyber Attacks Across the IT/OT Boundary
More informationProtecting productivity with Industrial Security Services
Protecting productivity with Industrial Security Services Identify vulnerabilities and threats at an early stage. Take proactive measures. Achieve optimal long-term plant protection. usa.siemens.com/industrialsecurityservices
More informationFunctional. Safety and. Cyber Security. Pete Brown Safety & Security Officer PI-UK
Functional Safety and Cyber Security Pete Brown Safety & Security Officer PI-UK Setting the Scene 2 Functional Safety requires Security Consider just Cyber Security for FS Therefore Industrial Control
More informationPresenter Jakob Drescher. Industry. Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks.
Presenter Jakob Drescher Industry Cyber Security 1 Cyber Security? Measures used to protect assets against computer threats. Covers both intentional and unintentional attacks. Malware or network traffic
More informationT22 - Industrial Control System Security
T22 - Industrial Control System Security PUBLIC Copyright 2017 Rockwell Automation, Inc. All Rights Reserved. 1 Holistic Approach A secure application depends on multiple layers of protection and industrial
More informationIndustrial Cyber Security. ICS SHIELD Top-down security for multi-vendor OT assets
Industrial Cyber Security ICS SHIELD Top-down security for multi-vendor OT assets OT SECURITY NEED Industrial organizations are increasingly integrating their OT and IT infrastructures. The huge benefits
More informationK12 Cybersecurity Roadmap
K12 Cybersecurity Roadmap Introduction Jason Brown, CISSP Chief Information Security Officer Merit Network, Inc jbrown@merit.edu @jasonbrown17 https://linkedin.com/in/jasonbrown17 2 Agenda 3 Why Use the
More informationIEC A cybersecurity standard approaching the Rail IoT
IEC 62443 A cybersecurity standard approaching the Rail IoT siemens.com/communications-for-transportation Today s Siemens company structure focusing on several businesses Siemens AG Power and Gas (PG)
More informationDigital Wind Cyber Security from GE Renewable Energy
Digital Wind Cyber Security from GE Renewable Energy BUSINESS CHALLENGES The impact of a cyber attack to power generation operations has the potential to be catastrophic to the renewables industry as well
More informationIndustrial Defender ASM. for Automation Systems Management
Industrial Defender ASM for Automation Systems Management INDUSTRIAL DEFENDER ASM FOR AUTOMATION SYSTEMS MANAGEMENT Industrial Defender ASM is a management platform designed to address the overlapping
More informationDefense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
More informationDesigning and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
More informationCyber security - why and how
Cyber security - why and how Frankfurt, 14 June 2018 ACHEMA Cyber Attack Continuum Prevent, Detect and Respond Pierre Paterni Rockwell Automation, Connected Services EMEA Business Development Manager PUBLIC
More informationTHE TRIPWIRE NERC SOLUTION SUITE
CONFIDENCE: SECURED BUSINESS INTELLIGENCE SOLUTION BRIEF THE TRIPWIRE NERC SOLUTION SUITE A TAILORED SUITE OF PRODUCTS AND SERVICES TO AUTOMATE NERC CIP COMPLIANCE u u We ve been able to stay focused on
More informationCyber Security for Process Control Systems ABB's view
Kaspersky ICS Cybersecurity 2017, 2017-09-28 Cyber Security for Process Control Systems ABB's view Tomas Lindström, Cyber Security Manager, ABB Control Technologies Agenda Cyber security for process control
More informationCYBERVANTAGE MANAGED SECURITY SERVICES
Industrial Cyber Security CYBERVANTAGE MANAGED SECURITY SERVICES 24/7 Expertise to Reduce Operational Downtime and Lower Cyber Risk Honeywell provided the cyber security knowledge base required to protect
More informationCYBERVANTAGE TM SECURITY CONSULTING SERVICES
Industrial Cyber Security CYBERVANTAGE TM SECURITY CONSULTING SERVICES Where Innovation Meets Implementation to Drive Industrial Cyber Security Excellence Innovation and Implementation: Industrial Cyber
More informationДОБРО ПОЖАЛОВАТЬ SIEMENS AG ENERGY MANAGEMENT
ДОБРО ПОЖАЛОВАТЬ SIEMENS AG ENERGY MANAGEMENT ENERGY AUTOMATION - SMART GRID Restricted Siemens AG 20XX All rights reserved. siemens.com/answers Frederic Buchi, Energy Management Division, Siemens AG Cyber
More informationWhy Should You Care About Control System Cybersecurity. Tim Conway ICS.SANS.ORG
Why Should You Care About Control System Cybersecurity Tim Conway ICS.SANS.ORG Events Example #1 Dec 23, 2015 Cyber attacks impacting Ukrainian Power Grid Targeted, synchronized, & multi faceted Three
More informationCyber Security Solutions Mitigating risk and enhancing plant reliability
P OW E R G E N E R AT I O N Cyber Security Solutions Mitigating risk and enhancing plant reliability 2 CYBER SECURITY SOLUTIONS MITIGATING RISK AND ENHANCING PLANT RELIABILITY Providing a roadmap to achieve
More informationNERC CIP VERSION 6 BACKGROUND COMPLIANCE HIGHLIGHTS
NERC CIP VERSION 6 COMPLIANCE BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements
More informationSecuring Industrial Control Systems
L OCKHEED MARTIN Whitepaper Securing Industrial Control Systems The Basics Abstract Critical infrastructure industries such as electrical power, oil and gas, chemical, and transportation face a daunting
More informationlocuz.com SOC Services
locuz.com SOC Services 1 Locuz IT Security Lifecycle services combine people, processes and technologies to provide secure access to business applications, over any network and from any device. Our security
More informationWhat It Takes to be a CISO in 2017
What It Takes to be a CISO in 2017 Doug Copley Deputy CISO Sr. Security & Privacy Strategist February 2017 IMAGINE You re the CISO In Bangladesh Of a bank On a Friday when you re closed You realize 6 huge
More informationCyber security for digital substations. IEC Europe Conference 2017
Cyber security for digital substations IEC 61850 Europe Conference 2017 Unrestricted Siemens 2017 siemens.com/gridsecurity Substation Digitalization process From security via simplicity 1st generation:
More informationCyber Security of Industrial Control Systems (ICSs)
Cyber Security of Industrial Control Systems (ICSs) February 23, 2016 Joe Weiss PE, CISM, CRISC, ISA Fellow Managing Partner Applied Control Solutions, LLC (408) 253-7934 joe.weiss@realtimeacs.com Applied
More informationIndustrial Security Getting Started
Industrial Security Getting Started Unrestricted Siemens A/S siemens.com/industrial-security Agenda 09:00 - Getting started. The Framework 10:00 - Coffee break 10:15 - Patch Management, Asset and Network
More informationSecuring Plant Operation The Important Steps
Stevens Point, WI Securing Plant Operation The Important Steps September 24, 2012 Slide 1 Purpose of this Presentation During this presentation, we will introduce the subject of securing your control system
More informationLifecycle Solutions & Services. Managed Industrial Cyber Security Services
Lifecycle Solutions & Services Managed Industrial Cyber Security Services Around the world, industrial firms and critical infrastructure operators partner with Honeywell to address the unique requirements
More informationEnterprise Cybersecurity Best Practices Part Number MAN Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
More informationService. Sentry Cyber Security Gain protection against sophisticated and persistent security threats through our layered cyber defense solution
Service SM Sentry Cyber Security Gain protection against sophisticated and persistent security threats through our layered cyber defense solution Product Protecting sensitive data is critical to being
More informationSecurity analysis and assessment of threats in European signalling systems?
Security analysis and assessment of threats in European signalling systems? New Challenges in Railway Operations Dr. Thomas Störtkuhl, Dr. Kai Wollenweber TÜV SÜD Rail Copenhagen, 20 November 2014 Slide
More informationSOLUTIONS BRIEF GOGO AIRBORNE SECURITY SUMMARY 2017 Q3 RELEASE
SOLUTIONS BRIEF GOGO AIRBORNE SECURITY SUMMARY 2017 Q3 RELEASE SECURE AIRBORNE CONNECTIVITY: OVERVIEW Gogo Business Aviation realizes the ever-pressing need to be vigilant in staying ahead of potential
More informationLindström Tomas Cyber security from ABB System 800xA PA-SE-XA
Lindström Tomas 2013-09-02 Cyber security from ABB System 800xA PA-SE-XA-015963 Cyber Security solutions from ABB Agenda Cyber Security in ABB: general view, activities, organization How we work with Cyber
More informationPROTECTING MANUFACTURING and UTILITIES Industrial Control Systems
PROTECTING MANUFACTURING and UTILITIES Industrial Control Systems Mati Epstein Global Sales Lead, Critical Infrastructure and ICS [Internal Use] for Check Point employees 1 Industrial Control Systems (ICS)/SCADA
More informationSecurity Monitoring. Managed Vulnerability Services. Managed Endpoint Protection. Platform. Platform Managed Endpoint Detection and Response
Security Operations Flexible and Scalable Solutions to Improve Your Security Capabilities Security threats continue to rise each year and are increasing in sophistication and malicious intent. Unfortunately,
More informationNW NATURAL CYBER SECURITY 2016.JUNE.16
NW NATURAL CYBER SECURITY 2016.JUNE.16 ADOPTED CYBER SECURITY FRAMEWORKS CYBER SECURITY TESTING SCADA TRANSPORT SECURITY AID AGREEMENTS CONCLUSION QUESTIONS ADOPTED CYBER SECURITY FRAMEWORKS THE FOLLOWING
More informationContinuous protection to reduce risk and maintain production availability
Industry Services Continuous protection to reduce risk and maintain production availability Managed Security Service Answers for industry. Managing your industrial cyber security risk requires world-leading
More informationSneak Peak at CIS Critical Security Controls V 7 Release Date: March Presented by Kelli Tarala Principal Consultant Enclave Security
Sneak Peak at CIS Critical Security Controls V 7 Release Date: March 2018 2017 Presented by Kelli Tarala Principal Consultant Enclave Security 2 Standards and Frameworks 3 Information Assurance Frameworks
More informationIC32E - Pre-Instructional Survey
Name: Date: 1. What is the primary function of a firewall? a. Block all internet traffic b. Detect network intrusions c. Filter network traffic d. Authenticate users 2. A system that monitors traffic into
More informationDEVELOP YOUR TAILORED CYBERSECURITY ROADMAP
ARINC cybersecurity solutions DEVELOP YOUR TAILORED CYBERSECURITY ROADMAP Getting started is as simple as assessing your baseline THE RIGHT CYBERSECURITY SOLUTIONS FOR YOUR UNIQUE NEEDS Comprehensive threat
More informationIndegy. Industrial Cyber Security. ISA New Orleans Section. Applying the NIST Framework February 6, 2018
Indegy Industrial Cyber Security ISA New Orleans Section Applying the NIST Framework February 6, 2018 Agenda 1. Introductions 2. Indegy Background 3. NIST Background and History with ICS 4. What is the
More informationCyber Resilience Solution for Smart Buildings
Cyber Resilience Solution for Smart Buildings Integrated IT/OT Security Oren Aspir, Cyberbit, CTO 2017 by CYBERBIT 2017 by CYBERBIT Proprietary CYBERBIT Proprietary Buildings getting smarter IT systems
More informationCYBERSECURITY RISK LOWERING CHECKLIST
CYBERSECURITY RISK LOWERING CHECKLIST The risks from cybersecurity attacks, whether external or internal, continue to grow. Leaders must make thoughtful and informed decisions as to the level of risk they
More informationChanging face of endpoint security
Changing face of endpoint security S A N T H O S H S R I N I V A S A N C I S S P, C I S M, C R I S C, C E H, C I S A, G S L C, C G E I T D I R E C T O R S H A R E D S E R V I C E S, H C L T E C H N O L
More informationABB Process Automation, September 2014
ABB Process Automation, September 2014 ABB Process Automation Services Services that add life to your products, systems and processes September 26, 2014 Slide 1 1 ABB Process Automation Services A proven
More informationCybersecurity Training
Standards Certification Education & Training Publishing Conferences & Exhibits Cybersecurity Training Safeguarding industrial automation and control systems www.isa.org/cybetrn Expert-led training with
More informationISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002
ISO 27002 COMPLIANCE GUIDE How Rapid7 Can Help You Achieve Compliance with ISO 27002 A CONTENTS Introduction 2 Detailed Controls Mapping 3 About Rapid7 8 rapid7.com ISO 27002 Compliance Guide 1 INTRODUCTION
More informationICS Security Monitoring
ICS Security Monitoring INFRASTRUCTURE MINING & METALS NUCLEAR, SECURITY & ENVIRONMENTAL OIL, GAS & CHEMICALS Moses Schwartz Security Engineer Computer Incident Response Team Bechtel Corporation State
More informationLESSONS LEARNED IN SMART GRID CYBER SECURITY
LESSONS LEARNED IN SMART GRID CYBER SECURITY Lynda McGhie CISSP, CISM, CGEIT Quanta Technology Executive Advisor Smart Grid Cyber Security and Critical Infrastructure Protection lmcghie@quanta-technology.com
More informationDATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE EXECUTIVE SUMMARY ALIGNING CYBERSECURITY WITH RISK The agility and cost efficiencies
More informationThe SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
More informationHow can I use ISA/IEC (Formally ISA 99) to minimize risk? Standards Certification Education & Training Publishing Conferences & Exhibits
How can I use ISA/IEC- 62443 (Formally ISA 99) to minimize risk? Standards Certification Education & Training Publishing Conferences & Exhibits What is ISA 62443? A series of ISA standards that addresses
More informationExpanding Cyber Security Management for Critical Infrastructure
Expanding Cyber Security Management for Critical Infrastructure ISSE Wednesday 15 th November 17, Brussels Dr Andrew Hutchison, Telekom Security andrew.hutchison@t-systems.com OVERVIEW Attack Surface expands
More informationINCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Malware Outbreak
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
More informationFuture Challenges and Changes in Industrial Cybersecurity. Sid Snitkin VP Cybersecurity Services ARC Advisory Group
Future Challenges and Changes in Industrial Cybersecurity Sid Snitkin VP Cybersecurity Services ARC Advisory Group Srsnitkin@ARCweb.com Agenda Industrial Cybersecurity Today Scope, Assumptions and Strategies
More informationWho Goes There? Access Control in Water/Wastewater Siemens AG All Rights Reserved. siemens.com/ruggedcom
WEAT Webinar Who Goes There? Access Control in Water/Wastewater Siemens AG 2018. siemens.com/ruggedcom ACCESS CONTROL WEBINAR TABLE OF CONTENTS TOPIC Why Access Control? Risks If Not Used Factors of Authentication
More informationCyber Security Solutions for Industrial Controls
Cyber Security Solutions for Industrial Controls bhge.com OVERVIEW In a complex world of ever-changing technologies, Baker Hughes, a GE company realizes the importance of having an experienced partner
More informationCourse overview. CompTIA Security+ Certification (Exam SY0-501) Study Guide (G635eng v107)
Overview This course is intended for those wishing to qualify with CompTIA Security+. CompTIA's Security+ Certification is a foundation-level certificate designed for IT administrators with 2 years' experience
More informationTABLE OF CONTENTS. Section Description Page
GPA Cybersecurity TABLE OF CONTENTS Section Description Page 1. Cybersecurity... 1 2. Standards... 1 3. Guides... 2 4. Minimum Hardware/Software Requirements For Secure Network Services... 3 4.1. High-Level
More informationPlant Security Services Protecting productivity in the digital era October
Plant Security Services Protecting productivity in the digital era October2017 Restricted www.siemens.com/plant-security-services Internet of (hacked) Things Page 2 Use case - No OT cybersecurity company
More informationEnsuring Your Plant is Secure Tim Johnson, Cyber Security Consultant
Ensuring Your Plant is Secure Tim Johnson, Cyber Security Consultant 1 The Foxboro Evo TM Process Automation System Addressing the needs across your operation today and tomorrow. 2 Industrial Control Systems
More informationFFIEC Cyber Security Assessment Tool. Overview and Key Considerations
FFIEC Cyber Security Assessment Tool Overview and Key Considerations Overview of FFIEC Cybersecurity Assessment Tool Agenda Overview of assessment tool Review inherent risk profile categories Review domain
More informationPROTECTION FOR WORKSTATIONS, SERVERS, AND TERMINAL DEVICES ENDPOINT SECURITY NETWORK SECURITY I ENDPOINT SECURITY I DATA SECURITY
PROTECTION FOR WORKSTATIONS, SERVERS, AND TERMINAL DEVICES ENDPOINT SECURITY NETWORK SECURITY I ENDPOINT SECURITY I DATA SECURITY OUR MISSION Make the digital world a sustainable and trustworthy environment
More informationHow do you track devices that have been approved for use? Are you automatically alerted if an unapproved device connects to the network?
Cybersecurity Due Diligence Checklist Control # Control Name Risks Questions for IT 1 Make an Benign Case: Employees Inventory of using unapproved Authorized devices without Devices appropriate security
More informationCyber Criminal Methods & Prevention Techniques. By
Cyber Criminal Methods & Prevention Techniques By Larry.Boettger@Berbee.com Meeting Agenda Trends Attacker Motives and Methods Areas of Concern Typical Assessment Findings ISO-17799 & NIST Typical Remediation
More informationCYBER SECURITY. formerly Wick Hill DOCUMENT* PRESENTED BY I nuvias.com/cybersecurity I
DOCUMENT* PRESENTED BY CYBER SECURITY formerly Wick Hill * Nuvias and the Nuvias logo are trademarks of Nuvias Group. Registered in the UK and other countries. Other logo, brand and product names are trademarks
More informationDefense in Depth Security in the Enterprise
Defense in Depth Security in the Enterprise Mike Mulville SAIC Cyber Chief Technology Officer MulvilleM@saic.com Agenda The enterprise challenge - threat; vectors; and risk Traditional data protection
More informationISE North America Leadership Summit and Awards
ISE North America Leadership Summit and Awards November 6-7, 2013 Presentation Title: Presenter: Presenter Title: Company Name: Embracing Cyber Security for Top-to-Bottom Results Larry Wilson Chief Information
More informationCybersecurity Roadmap: Global Healthcare Security Architecture
SESSION ID: TECH-W02F Cybersecurity Roadmap: Global Healthcare Security Architecture Nick H. Yoo Chief Security Architect Disclosure No affiliation to any vendor products No vendor endorsements Products
More informationMethods for Reducing Cybersecurity Vulnerabilities of Power Substations Using Multi-Vendor Smart Devices in a Smart Grid Environment
S&L Logo Methods for Reducing Cybersecurity Vulnerabilities of Power Substations Using Multi-Vendor Smart Devices in a Smart Grid Environment Date: October 24, 2017 Authors/Presenters: J. Matt Cole, PE
More informationTHE EFFECTIVE APPROACH TO CYBER SECURITY VALIDATION BREACH & ATTACK SIMULATION
BREACH & ATTACK SIMULATION THE EFFECTIVE APPROACH TO CYBER SECURITY VALIDATION Cymulate s cyber simulation platform allows you to test your security assumptions, identify possible security gaps and receive
More informationCYBERBIT P r o t e c t i n g a n e w D i m e n s i o n
CYBERBIT P r o t e c t i n g a n e w D i m e n s i o n CYBETBIT in a Nutshell A leader in the development and integration of Cyber Security Solutions A main provider of Cyber Security solutions for the
More informationBest Practices in Securing a Multicloud World
Best Practices in Securing a Multicloud World Actions to take now to protect data, applications, and workloads We live in a multicloud world. A world where a multitude of offerings from Cloud Service Providers
More informationCyberArk Solutions for Secured Remote Interactive Access. Addressing NERC Remote Access Guidance Industry Advisory
CyberArk Solutions for Secured Remote Interactive Access Addressing NERC Remote Access Guidance Industry Advisory Table of Contents The Challenges of Securing Remote Access 3 Using CyberArk s Privileged
More informationBest Practices in ICS Security for System Operators
Best Practices in ICS Security for System Operators Introduction Industrial automation and control systems have become increasingly connected to internal and external networks. This exposure has resulted
More informationSecurity by Default: Enabling Transformation Through Cyber Resilience
Security by Default: Enabling Transformation Through Cyber Resilience FIVE Steps TO Better Security Hygiene Solution Guide Introduction Government is undergoing a transformation. The global economic condition,
More informationSECURE SYSTEMS, NETWORKS AND DEVICES SAFEGUARDING CRITICAL INFRASTRUCTURE OPERATIONS
SECURE SYSTEMS, NETWORKS AND DEVICES SAFEGUARDING CRITICAL INFRASTRUCTURE OPERATIONS PROTECT YOUR DAILY OPERATIONS FROM BEING COMPROMISED In today s data-driven society, connectivity comes with a cost.
More informationGladiator Incident Alert
Gladiator Incident Alert Allen Eaves Sabastian Fazzino FINANCIAL PERFORMANCE RETAIL DELIVERY IMAGING PAYMENT SOLUTIONS INFORMATION SECURITY & RISK MANAGEMENT ONLINE & MOBILE 1 2016 Jack Henry & Associates,
More informationSECURING THE SUPPLY CHAIN
SECURING THE SUPPLY CHAIN BY Jerome Farquharson, CISSP, Donald Dustin Williams, PE, AND Courtney Buser The advance of smart grids, smart devices and increasingly interconnected systems provides exceptional
More informationGDPR Update and ENISA guidelines
GDPR Update and ENISA guidelines 2016 [Type text] There are two topics that should be uppermost in every CISO's mind, how to address the growing demand for Unified Communications (UC) and how to ensure
More informationIndustrial Security Co-Sourcing: Shifting from CapEx to OpEx Presented by Vinicius Strey Manufacturing in America 03/22-23/2017
Industrial Security Co-Sourcing: Shifting from CapEx to OpEx Presented by Vinicius Strey Manufacturing in America 03/22-23/2017 Unrestricted Siemens 2017 usa.siemens.com/mia Table of contents Industrial
More informationReinvent Your 2013 Security Management Strategy
Reinvent Your 2013 Security Management Strategy Laurent Boutet 18 septembre 2013 Phone:+33 6 25 34 12 01 Email:laurent.boutet@skyboxsecurity.com www.skyboxsecurity.com What are Your Key Objectives for
More informationNIST Revision 2: Guide to Industrial Control Systems (ICS) Security
NIST 800-82 Revision 2: Guide to Industrial Control Systems (ICS) Security How CyberArk can help meet the unique security requirements of Industrial Control Systems Table of Contents Executive Summary
More informationProtection Levels, Holistic Approach. ISA-99 WG 3 TG 3 Protection Levels
Protection Levels, Holistic Approach Security is about technology, processes and people Policies and procedures Functional security measures Competency A holistic security protection concept has to include
More informationAddressing Cyber Threats in Power Generation and Distribution
Addressing Cyber Threats in Power Generation and Distribution VEO, Asko Tuomela o Bachelor of Science in Electrical Power Engineering o Over 6 years experience in power projects, PLCs and supervision systems
More informationRIPE RIPE-17. Table of Contents. The Langner Group. Washington Hamburg Munich
RIPE RIPE-17 Table of Contents The Langner Group Washington Hamburg Munich RIPE Operations Technology Management Plan (MP-17) 0.1 Purpose... 4 0.2 Process Overview... 4 0.3 Implementation Scope... 5 0.4
More informationIT SECURITY RISK ANALYSIS FOR MEANINGFUL USE STAGE I
Standards Sections Checklist Section Security Management Process 164.308(a)(1) Information Security Program Risk Analysis (R) Assigned Security Responsibility 164.308(a)(2) Information Security Program
More informationSymantec Security Monitoring Services
24x7 real-time security monitoring and protection Protect corporate assets from malicious global threat activity before it impacts your network. Partnering with Symantec skilled and experienced analysts
More informationGerhard Brndt, ABB AG, BU Power Generation Cyber Security and Compliance in Increasingly Distributed and Aging Power Generation Infrastructures
Gerhard Brndt, ABB AG, BU Power Generation Cyber Security and Compliance in Increasingly Distributed and Aging Power Generation Infrastructures ABB Group June 20, 2012 Slide 1 Situation of today The potential
More informationProcess System Security. Process System Security
Roel C. Mulder Business Consultant Emerson Process Management Sophistication of hacker tools, May 2006, Slide 2 Risk Assessment A system risk assessment is required to determine security level Security
More information