Instructor: Mitigating vulnerabilities. 2 2
So we've talked about a lot 3 3
of specialized systems here especially 4 4
in the ICS and SCADA world. 5 5
And so the question is 6 6
how do you start mitigating some 7 7
of these vulnerabilities? 8 8
Well, the go-to guide for this is going to 9 9
be the "NIST Special Publication 800-82". 10 10
Now, again, this is a good read if you happen 11 11
to work in a manufacturing environment 12 12
or someplace that uses ICS and SCADA. 13 13
Now, you don't have to read 14 14
this entire guide yourself 15 15
because I'm going to give you the four key controls 16 16
for mitigating vulnerabilities 17 17
in specialized systems and this is really 18 18
what you need to know for the exam. 19 19
But again, if you're working in an environment 20 20
that is automation and manufacturing 21 21
and you have ICS SCADA systems, 22 22
this entire guide is a great read for you 23 23
in the real world. 24 24
Now, the first thing we want to talk about is 25 25
how you can establish administrative control 26 26
over Operational Technology networks. 27 27
The best way to do this is by recruiting staff 28 28
who have expertise with these things. 29 29
Because as I said, 30 30
these are not your normal IT networks. 31 31
I am really knowledgeable 32 32
when it comes to IT networks 33 33
but I am not really knowledgeable when it comes 34 34
to ICS and SCADA networks in the OT realm. 35 35
I've done a little bit of work with them 36 36
but just enough to be dangerous. 37 37
So you wouldn't want to hire me for that. 38 38
Instead, you want to find people who know 39 39
what they're talking about 40 40
When it comes to OT. 41 41
OT is a different beast and so you want to 42 42
make sure you get somebody 43 43
who understands SCADA and ICS and PLCs 44 44
and FPGAs and all the stuff we've been talking 45 45
about in the last couple lessons. 46 46
These are specialists and they're worth the money 47 47
to have on staff especially, 48 48
if you're running a big manufacturing plant. 49 49
The second big tip, you want to make 50 50
sure you're implementing the minimum network links 51 51
by disabling any unnecessary linkS, 52 52
services and protocols. 53 53
Essentially, when you have an Operational Technology network 54 54
you want to eliminate it from all of the rest 55 55
of the networks as much as possible. 56 56
We want to cut those links, 57 57
we want to disable services. 58 58
So if I have a manufacturing plant, 59 59
I should have two networks. 60 60
My corporate network, the IT network, 61 61
and the plant network, the OT network. 62 62
If there's any connection between those two, 63 63
it should be very minimal 64 64
and it should be heavily monitored. 65 65
The third thing we want to talk about is 66 66
how we can develop 67 67
and test a patch management program 68 68
for Operational Technology networks. 69 69
Again, these OT networks are different 70 70
than our information technology networks. 71 71
You can't just go ahead 72 72
and use your Microsoft SCCM servers. 73 73
That's not going to work for you. 74 74
So you want to make sure you understand 75 75
what options you have and how you're going to 76 76
do a patch management program. 77 77
Remember, these are things unlike PLCs, 78 78
they have firmware that needs 79 79
to be upgraded sometimes. 80 80
That's going to require maintenance windows, 81 81
that's going to require downtime. 82 82
You need to have a process 83 83
of how you're going to do this 84 84
and that's why it's important to develop 85 85
and test your patch management program. 86 86
And then the fourth thing we need to think 87 87
about is how we're going to perform regular audits 88 88
of logical and physical access 89 89
to these different systems so that we can detect 90 90
possible vulnerabilities and intrusions. 91 91
Now, this isn't going to be as easy 92 92
as hooking up Nessus to the network 93 93
and doing a scan. 94 94
You're going to have to have specialists 95 95
who know what they're looking for 96 96
when they're scanning these areas. 97 97
Also, big word of warning here, 98 98
your enumeration tools 99 99
and vulnerabilities scanners, 100 100
they can cause a lot of problems 101 101
on Operational Technology networks. 102 102
Generally, if you're trying to do scanning 103 103
of an Operational Technology network, 104 104
you are not going to be doing active scanning. 105 105
Instead, you're going to hook up something 106 106
like Wire Shark, you're going to do packet capture 107 107
and then using that passive analysis 108 108
of that network traffic, you'll be able 109 109
to identify those devices to do your enumeration 110 110
or you'll be able to use that passive analysis 111 111
to start figuring out 112 112
what vulnerabilities you may have 113 113
inside your network.