sans

Back

@dragosinc

First takeaway. The #SANS Five ICS Cybersecurity Critical Controls

While I think I had come across them before it was helpful to get a quick overview.

Different many other approaches to #Cybersecurity, they don't start with a focus of prevention.

The 5 critical controls are

ICS-specific Incident Response Plan
Defensible Architecture
ICS Network Visibility and Monitoring
Secure Remote Access
Risk-based VulnerabilityManagement Program

ICS-specific Incident Response Plan

Identify the scenarios which apply to you according to your industry, setting, etc. Start with 2-3 high consequence Simulate the scenarios and test your incident response plans, identify and prioritize gaps.

Defensible Architecture

to enable humans to successfully defend your system. Asset management, isolation, segmentation based on risks identified in the scenarios above and to enable

ICS Network Visibility and Monitoring

Without this a root cause analysis is hard. And without identifying "the" root cause it's impossible to corrects problems (added benefit of identifying misconfigurations)

Secure Remote Access

Remote access is a reality in most OT systems.
A lot of incidents start by unsecure remote access, including the 3rd parties like suppliers and service providers. So getting this secured including MFA, is crucial.

Risk-based Vulnerability

Management Program

Patch everything isn't general possible in an OT setting. Instead of trying and failing focus on the vulnerabilities which increase the risks identified before.

Find more information at
https://www.sans.org/white-papers/five-ics-cybersecurity-critical-controls/
or
https://www.dragos.com/blog/the-sans-ics-five-critical-controls-a-practical-framework-for-ot-cybersecurity/

(Little shoutout to @dragosinc, while there is a registration form when downloading stuff from #Dragos, there is generally also a "skip" button to download without providing information. I love it)