Frequently Asked Questions

An Industrial Control System (ICS) is a collection of devices that measure and control a specific process. This is accomplished by a combination of Information Technology (IT) devise and Operational Technology (OT) devices. In this context, IT devices refers to devices that can be found a traditional IT environment, for example: routers, network switches, servers, and workstations; these devices can be virtual or physical. As for OT, this refers to devises that control and or monitor the process under discussion. For example: Valves, Remote Terminal Units (RTUs), differential pressure transmitters, Programmable Logic Controllers (PLCs); most of these devices are physical. The system is sometimes called a Supervisory Control and Data Acquisition (SCADA) system or Distributed Control System (DCS).

Critical infrastructure is considered sectors whose assets, systems, and networks, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety. For additional information see: https://www.cisa.gov/critical-infrastructure-sectors.

1. It improves an organization’s ability to manage cyber threat intelligence (CTI) by providing a way to consistently map and share adversary behavior between organizations.
2. It can help assess and improve security monitoring, detection, and hunt strategies, including prioritizing valuable data sources [ADD REFERENCE] and guiding OT hunt methodologies .
3. It can help organizations identify risks and develop appropriate mitigations, especially through the development of Failure Scenarios that model how known TTPs could cause an operational hazard.

Tactics, techniques, and procedures (TTP) are the “why” and “how” of an attack. An example of breaking down TTPs can be found in ATT&CK® for Industrial Control Systems.

An “air-gapped” system is a system that is not connected to any other system and no external data enters or leaves. Due to the changing nature of the industry, it is difficult to truly “air-gap” an ICS system. For example:

• If there is a need for production data in locations outside of the facility (e.g., control center) or there are industry verticals where data is required to be communicated (e.g., power plant production data is required to be dent to the Regional Transmission Organization/Independent System Operator) or
• In the case where a system does not have any connections out an outside system, and there is still a need to exchange data (e.g., capture data, change configuration/setting, software updates, etc.). In these cases, a transient device (e.g., laptop) or removable media (e.g., flash drive, external hard drive) are used to manipulate the system/data.

• When IIOT devices are placed in remote areas, security features are turned off as they have a high drain on device battery or
• Configuring an IIOT device with a direct internet connection, which can circumvent existing security controls (e.g., firewall).

<Sure…I think AWS has an OT cloud setup…I know it coming, but I am not aware of anyone implementing ICS in the cloud. To be honest, I am personally not comfortable with the risks>