Industrial Cybersecurity

• Security incidents
• Passive security monitoring
• Active security monitoring
• Threat-hunting exercises
• Security monitoring data collection methods
• Putting it all together – introducing SIEM systems
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• Technical requirements
• Passive security monitoring explained
• Security Information and Event Management – SIEM
• Common passive security monitoring tools
• Setting up and configuring Security Onion
• Exercise 1 – Setting up and configuring Security Onion
• Exercise 2 – Setting up and configuring a pfSense firewall
• Exercise 3 – Setting up, configuring, and ...9;s eyeInsight (formerly known as SilentDefense)
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• Technical requirements
• Understanding active security monitoring
• Exercise 1 – Scanning network-connected devices
• Exercise 2 – Manually inspecting an industrial computer
• Summary

7 Laboratorio en vivo in this lesson — see the labs panel →

• Technical requirements
• Threat intelligence explained
• Using threat information in industrial environments
• Acquiring threat information
• Creating threat intelligence data out of threat information
• Exercise – Adding an AlienVault OTX threat feed to Security Onion
• Summary

• Technical requirements
• Holistic cybersecurity monitoring
• Exercise 1 – Using Wazuh to add Sysmon logging
• Exercise 2 – Using Wazuh to add PowerShell Script Block Logging
• Exercise 3 – Adding a Snort IDS to pfSense
• Exercise 4 – Sending SilentDefense alerts to Security Onion syslog
• Exercise 5 – Creating a pfSense firewall event dashboard in Kibana
• Exercise 6 – Creating a breach detection dashboard in Kibana
• Summary

2 Laboratorio en vivo in this lesson — see the labs panel →

• What is threat hunting?
• Threat hunting in ICS environments
• What is needed to perform threat hunting exercises?
• Threat hunting is about uncovering threats
• Correlating events and alerts for threat hunting purposes
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• Forming the malware beaconing threat hunting hypothesis
• Detection of beaconing behavior in the ICS environment
• Investigating/forensics of suspicious endpoints
• Using indicators of compromise to uncover additional suspect systems
• Summary

• Technical requirements
• Forming the malicious or unwanted applications threat hunting hypothesis
• Detection of malicious or unwanted applications in the ICS environment
• Investigation and forensics of suspicious endpoints
• Using discovered indicators of compromise to search the environment for additional suspect systems
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• Forming the suspicious external connections threat hunting hypothesis
• Ingress network connections
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• Understanding the types of cybersecurity assessments
• Risk assessments
• Red team exercises
• Blue team exercises
• Penetration testing
• How do ICS/OT security assessments differ from IT?
• Summary

2 Laboratorio en vivo in this lesson — see the labs panel →

• Understanding the attack stages and ultimate objectives of ICS cyber attacks
• Risk assessments
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• Red Team versus Blue Team versus pentesting
• Red Team/Blue Team example exercise, attacking Company Z
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• Practical view of penetration testing
• Why are ICS environments easy targets for attackers?
• Typical risks to an ICS environment
• Modeling pentests around the ICS Kill Chain
• Pentesting results allow us to prioritize cybersecurity efforts
• Pentesting industrial environments requires caution
• Exercise – performing an ICS-centric penetration test
• Summary

1 Laboratorio en vivo in this lesson — see the labs panel →

• What is an incident?
• What is incident response?
• Incident response processes
• Incident response procedures
• Example incident report form
• Summary

2 Laboratorio en vivo in this lesson — see the labs panel →

• Discussing the lab architecture
• Details about the enterprise environment lab setup
• Details about the industrial environment – lab setup
• How to simulate (Chinese) attackers
• Discussing the role of lab firewalls
• How to install the malware for the lab environment
• Configuring packet capturing for passive security tools
• Summary