Initial commit - 611 cybersecurity skills across all subdomains

2026-08-02 00:57:42 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,87 @@
+# Standards Reference - OT Network Security Assessment
+
+## IEC 62443 (ISA/IEC 62443)
+
+### IEC 62443-1-1: Terminology, Concepts, and Models
+- Defines foundational concepts including zones, conduits, security levels, and the IACS reference architecture
+- Establishes the vocabulary used across all parts of the standard
+
+### IEC 62443-2-1: Security Management System Requirements
+- Requirements for an IACS security management system (SMS)
+- Covers risk assessment, security policies, organization, staff competence, and awareness
+
+### IEC 62443-3-2: Security Risk Assessment for System Design
+- Defines the process for partitioning an IACS into zones and conduits
+- Establishes Security Level targets (SL-T) for each zone based on risk assessment
+- Zone characteristics: assets, access points, communication channels, data flows
+- Conduit characteristics: connected zones, protocols, security countermeasures
+
+### IEC 62443-3-3: System Security Requirements and Security Levels
+- Foundational requirements (FR) mapped to security levels (SL 1-4):
+  - FR 1: Identification and Authentication Control (IAC)
+  - FR 2: Use Control (UC)
+  - FR 3: System Integrity (SI)
+  - FR 4: Data Confidentiality (DC)
+  - FR 5: Restricted Data Flow (RDF)
+  - FR 6: Timely Response to Events (TRE)
+  - FR 7: Resource Availability (RA)
+
+### Security Levels
+| Level | Description |
+|-------|-------------|
+| SL 1 | Protection against casual or coincidental violation |
+| SL 2 | Protection against intentional violation using simple means |
+| SL 3 | Protection against sophisticated attack with moderate resources |
+| SL 4 | Protection against state-sponsored attack with extensive resources |
+
+## NIST SP 800-82 Revision 3
+
+### Guide to Operational Technology (OT) Security
+- Published September 2023, replacing the ICS-focused Rev. 2
+- Expanded scope covers: ICS/SCADA, building automation, transportation, physical access control, physical environment monitoring
+- Provides OT overlay for NIST SP 800-53r5 security controls
+- Tailored security control baselines for low/moderate/high-impact OT systems
+
+### Key Sections for Network Assessment
+- Section 3: OT Overview and Architectures (Purdue Model reference)
+- Section 4: OT Risk Management
+- Section 5: OT Security Architecture (network segmentation, DMZ design)
+- Section 6: Applying Security Controls to OT (overlay guidance)
+
+### OT-Specific Control Tailoring
+- AC-4 (Information Flow Enforcement): Implement data diodes for unidirectional flows from Level 3 to Level 3.5
+- SC-7 (Boundary Protection): Industrial firewalls with protocol-aware deep packet inspection
+- AU-6 (Audit Record Review): Correlate OT network events with process alarms
+
+## NERC CIP Standards (Power Sector)
+
+### CIP-002-5.1a: BES Cyber System Categorization
+- Identify and categorize Bulk Electric System (BES) cyber systems as high, medium, or low impact
+
+### CIP-005-7: Electronic Security Perimeters
+- Define Electronic Security Perimeters (ESP) around BES cyber systems
+- Require Electronic Access Points (EAP) at all ESP boundaries
+- 2025 update requires MFA for remote access to medium and high-impact systems
+
+### CIP-007-6: System Security Management
+- Port and service management, security patch management
+- Malicious code prevention, security event monitoring
+- System access controls and authentication
+
+### CIP-010-4: Configuration Change Management and Vulnerability Assessments
+- Baseline configurations for BES cyber systems
+- Transient cyber asset and removable media management
+- Active vulnerability assessments at least every 15 months
+
+## Purdue Reference Model (ISA-95)
+
+### Level Architecture
+| Level | Name | Examples |
+|-------|------|----------|
+| Level 0 | Physical Process | Sensors, actuators, analyzers |
+| Level 1 | Basic Control | PLCs, RTUs, safety controllers |
+| Level 2 | Area Supervisory Control | HMI, engineering workstations, local historian |
+| Level 3 | Site Operations | OPC servers, site historian, MES |
+| Level 3.5 | DMZ | Data diodes, jump servers, patch servers |
+| Level 4 | Enterprise | ERP, email, corporate IT |
+| Level 5 | Internet/Cloud | Remote access, cloud services |
@@ -0,0 +1,119 @@
+# Workflows - OT Network Security Assessment
+
+## Assessment Lifecycle
+
+```
+Phase 1: Scoping          Phase 2: Discovery       Phase 3: Analysis
+-----------------+       +-----------------+      +-----------------+
+| Define scope    |       | Passive capture |      | Protocol review |
+| Safety limits   | ----> | Asset inventory | ---> | Zone evaluation |
+| Authorization   |       | Traffic mapping |      | Firewall audit  |
+-----------------+       +-----------------+      +-----------------+
+                                                          |
+Phase 6: Verify           Phase 5: Remediate       Phase 4: Report
+-----------------+       +-----------------+      +-----------------+
+| Validate fixes  |       | Segmentation    |      | Risk scoring    |
+| Re-assessment   | <---- | FW rule changes | <--- | Finding detail  |
+| Compliance map  |       | Protocol harden |      | Prioritization  |
+-----------------+       +-----------------+      +-----------------+
+```
+
+## Phase 1: Scoping and Authorization
+
+### Inputs
+- Facility type and industry vertical
+- Regulatory requirements (NERC CIP, IEC 62443, NIST CSF)
+- Existing network diagrams and asset inventories
+- Maintenance window schedules
+
+### Activities
+1. Meet with operations, engineering, and IT security teams
+2. Define Purdue levels in scope and safety-critical exclusions
+3. Obtain written authorization specifying permitted assessment activities
+4. Identify SPAN/TAP points for passive monitoring deployment
+5. Review prior assessment reports and known issues
+
+### Outputs
+- Signed Rules of Engagement document
+- Assessment scope matrix (Purdue levels vs. activity types)
+- SPAN/TAP deployment plan
+- Emergency contact list and escalation procedures
+
+## Phase 2: Passive Network Discovery
+
+### Inputs
+- SPAN port access on OT network switches
+- Assessment scope document
+
+### Activities
+1. Deploy passive monitoring sensors on SPAN ports at each Purdue level boundary
+2. Capture network traffic for minimum 2 weeks to observe full operational cycle
+3. Build asset inventory from observed traffic (MAC, IP, protocols, firmware versions)
+4. Map all communication flows with source, destination, protocol, and frequency
+5. Identify industrial protocols in use (Modbus, DNP3, OPC UA, EtherNet/IP, S7comm)
+6. Detect unauthorized devices and rogue connections
+
+### Activities - Wireless Assessment
+1. Scan for wireless access points in OT areas using spectrum analyzer
+2. Identify wireless industrial protocols (WirelessHART, ISA100.11a, Zigbee)
+3. Check for unauthorized Wi-Fi networks bridging IT and OT
+
+### Outputs
+- Complete asset inventory with Purdue level classification
+- Network communication flow map
+- Protocol distribution analysis
+- Unauthorized device/connection list
+
+## Phase 3: Analysis and Evaluation
+
+### Inputs
+- Asset inventory and traffic capture data
+- Firewall rule exports
+- Network architecture diagrams
+
+### Activities
+1. Evaluate zone architecture against IEC 62443-3-2 requirements
+2. Analyze firewall rules for overly permissive or prohibited conduits
+3. Assess industrial protocol security (authentication, encryption, access controls)
+4. Review remote access architecture and authentication mechanisms
+5. Evaluate patch levels of HMI, engineering workstations, and servers
+6. Check for known vulnerabilities in discovered OT firmware versions
+7. Assess physical security of network equipment in field locations
+
+### Outputs
+- Finding list with severity ratings
+- Gap analysis against applicable standards
+- Risk matrix mapping findings to operational/safety impact
+
+## Phase 4: Reporting
+
+### Report Structure
+1. Executive Summary (1 page)
+2. Scope and Methodology
+3. Asset Inventory Summary
+4. Network Architecture Assessment
+5. Detailed Findings (Critical/High/Medium/Low)
+6. Compliance Gap Analysis
+7. Remediation Roadmap with Prioritization
+8. Appendices (asset inventory, network diagrams, tool output)
+
+## Phase 5: Remediation Support
+
+### Priority Order
+1. **Immediate**: Block unauthorized cross-zone paths (enterprise to field devices)
+2. **30-day**: Implement DMZ between corporate IT and OT operations
+3. **60-day**: Deploy industrial protocol-aware firewalls between zones
+4. **90-day**: Harden remote access with MFA and jump servers
+5. **6-month**: Full zone/conduit segmentation per IEC 62443 design
+
+## Risk Scoring for OT Environments
+
+OT risk scoring must account for safety impact beyond traditional CIA triad:
+
+| Factor | Weight | Description |
+|--------|--------|-------------|
+| Safety Impact | 30% | Potential for physical harm to personnel or public |
+| Operational Impact | 25% | Production disruption or equipment damage |
+| Environmental Impact | 15% | Release of hazardous materials |
+| Financial Impact | 15% | Direct costs and regulatory penalties |
+| Reputational Impact | 15% | Public trust and regulatory scrutiny |