Like the traditional IT threat landscape, the ICS/OT landscape is changing dynamically, therefore this framework is evolving as well, the current revision is the second in line. By going through the control points of this framework we can ensure the identification of the non-compliant items in the environment and the security maturity of the organization. The evaluation of these enables the organization, to create an action plan to find the most pressing items regarding security and non-compliance risk and eliminate them.

The NIST 800-82 audit is highly recommended for organizations operating ICS/OT systems and devices, who want to achieve compliance (both in terms of frameworks and regulatory compliance) and/or want to know their cyber security and technological risks.

Crown Jewels Analysis

This analysis is an assessment from business and continuity perspective. It can identify the critical IT/OT assets which can halt the complete organization when they malfunction or stop, and by doing this, they can compromise the continuity for the whole organization.By doing a Crown Jewels Analysis, we first map the goals of the organizations and then identify the processes and procedures regarding these. For ICS/OT systems, the goals are usually in the CIA triad (Confidentiality, Integrity, Availability). While doing this, we also do a drilldown in the goals and processes, procedures, to identify all the ICS/OT related risks, organization-wide.

After mapping the dependencies, we enumerate the possible internal and external impacts on them and by doing this, we conclude an assessment score about all the elements of the infrastructure (like CVSS in IT), to identify the high and low risk parts. Because of this algorithmic scoring, we can concentrate on the implementation of security systems, where they are really needed. This method is suitable for mapping the processes, based on dependencies and due to this analysis, we can specify the non-compliant items and operational flaws.

Crown Jewels analysis is suggested for critical infrastructure and ICS/OT operators, who are mostly based on ICS systems and want to minimize the negative impacts of security-related and other unwanted events, by improving the defences of the critical components.

The industrial controls are ensuring compliance on the following fields:

• Hardware and Software (DCS, PLC, SCADA)
• ICS Networks
• Monitoring and detection

Besides the technical security, physical security is also in scope, as the requirements of relevant documentation. By complying to this framework, organizations can ensure the intactness of the CIA triad regarding their manufacturing processes and equipment, can easily identify and manage vulnerabilities and risks, and can also evade unforeseen events.

Compliance to IEC 62443 is suggested to organizations, who are working in the fields of manufacturing, implementation, engineering and control of ICS systems.

PCAP-based Risk Assessment

In this technical examination, we use a passive monitoring device to store and analyse the complete network traffic of a chosen network/ICS/OT segment. This enables the organization to describe the communication, devices, protocols within the designated segment via passive fingerprinting technology (without any active intervention), to assess the network-related risks.

The main scope of this assessment is the network, however in case of industrial protocols, like Modbus, Pcom, BACNet, we can assess further, as we can also store the values and data within the registers of devices operating on these protocols, hence creating a baseline and by doing this, we can detect anomalies.

At the end of this assessment, we create a report and a network map regarding the vulnerabilities of various network and ICS devices. This report also contains the risks and the remediation steps for these vulnerabilities.

By doing this vulnerability assessment, operators can gain valuable insight about the Security Posture of the Industrial Controllers and their surroundings, and can receive information about vulnerabilities, and their risks and remediations.

Red/Purple Teaming

Red Teaming is a simulation based on real-world scenarios, where the Red Team attacks the organisation’s defending Blue Team and infrastructure (usually Security/Operations), with tools usually used in cyberattacks.

This is different from traditional Vulnerability Assessment situations, as the Red Team can usually move freely within the boundaries of the exercise and have less constraints. This means, that seasoned ethical hackers can use all of the tools in their arsenal and they don’t have to consider the business continuity risks (therefore it’s best to create these exercises on a non-production training ground). The goal of this simulation is to bring them as close to real world attacks as possible.

In case of War Games, Black Cell’s Ethical Hackers stand in the red corner and the client’s Operations/Security team are in the blue.

This exercise is an excellent way to improve the organization’s human and technological defences and to create a complex assessment regarding the present state of previously mentioned defences for the management.

As per the above, the escalation of these events can be mitigated if the organization can properly identify and handle them, with the necessary priorities and care. If the organization lacks the capabilities for successful event handling, then it will escalate into an incident and immediate response will be necessary in order to lower the possible risks and damages.

In the process of incident handling by Black Cell, our Incident Response, Ethical Hacking and Forensics specialists are working hand-in-hand to investigate and triage of security events for our clients, and categorize them according to their severity to respond to the true positives immediately.

Various compliance frameworks (like ISO 27001, PCI DSS, IBTV and other regulations) can require a detailed and precise Security Event and Incident handling plan. Our solution experts can help our clients in the creation of the proper incident handling processes, procedures and regulations and they can also help keep them up-to-date and well-exercised.

Digital Forensics

After an incident (like Malware Infection, Breaches or Data Leaks) our Forensics experts can help investigate regarding the following important questions:

• What happened exactly?
• Who did it (Insider/Outsider)?
• When did it happen?
• How did it happen?
• Which devices/systems were affected?
• Which accounts were affected?

During a forensics investigation, Black Cell’s experts collect and store all the evidence regarding the incidents in a forensically sound way and then assess and evaluate them, in search for the answers for the above questions.

To speed up the investigation, log files (Firewall, IDS/IPS, AD, DLP, etc.) from the incident are loaded into the SOC division’s Forensics SIEM system. Of course, forensics is not just about logs, we also collect and analyse various artefacts from the environment, like MFT, Prefetch and shadow files, Memory Images, Registry and others.

During the forensics examination, we also evaluate the perimeter and endpoint security devices, to gain insight about the possible misconfigurations, anomalies and vulnerabilities.

The purpose of these information is not just to support the various, human decision-making positions (like leadership, security operations, incident handlers), but to also support security appliances (like perimeter firewalls, IDPS systems, Email filters, SIEM systems). The CTI system creates machine-readable feeds from various sources, by processing, analysing and concluding them; it assigns them various indicators (IoCs) and translates them into a common CTI feed protocol (CybOX, STIX, TAXI, etc.) to make them available for the various security appliances.

Security Operations Centre (ICS/OT SOC)

The SOC is the backbone of an organization’s cybersecurity. They work around the clock and their main tasks are the prevention and reconnaissance of IT Security Incidents and if they happen, the handling. The SOC is also a proactive department, continuously researching new ways to handle threats and to evaluate the various IT Security processes of the organization in order to prevent incidents.

Black Cell’s managed SOC can meet the requirements of the small and medium sized enterprises. With this complex platform, these businesses can enjoy a holistic, layered defence, which can help ensure the safety of the enterprise around the clock, both to our national and international customers.

Our CERT (Computer Emergency Response Team) team has been certified by the Carnegie Mellon University.

Black Cell’s incident handling team contains experts from four different departments of IT Security, to ensure that every shift can handle the most complex incidents.

These departments are:

• Ethical Hacking/Offensive Security
• Defensive Security/Log analytics
• Threat Hunting
• Cyber Threat Intelligence

Besides IT Security, our network engineers and product support colleagues are also available to help.

The foundation of SOC are the Playbooks and Use Cases, which are unique to the field of ICS/OT. Our Playbooks and Use Case are based on the industry standard MITRE ATT&CK for Industrial Control Systems matrix and international best practices, therefore we can ensure our industry-specialized SOC can be both operationally and functionally effective.

For example, in case of the Modus protocol, Protocol Enforcement can configure the available function codes, and the read/write capabilities for registers. This capability is especially useful when the organization needs to achieve the least privilege principal on its network.

As these devices are specially made for industrial usage, their configuration is easier for OT operators, than the usual IT security devices’.

Due to the business continuity requirements, these firewalls mount a native “bypass” function, which is especially useful when testing. When the appliance is in testing/bypass mode, it lets through all the traffic and just testing its ruleset, which enables the OT personnel to check the firewall rules before actually enabling them.

MOXA OT Security

Moxa Secures Your OT Networks With OT-IT Integrated Security

With an ongoing commitment to ensuring reliable connectivity for industrial environments, Moxa has enhanced its network security portfolio with Industrial Cybersecurity Solution to mitigate cyber threats against industrial networks.

Industrial Cybersecurity Solution

• Security management
• Network segmentation
• Industrial next-generation firewall
• Industrial IPS/IDS
• Whitelisting Control

Moxa’s industrial IPS (Intrusion Prevention System) features our OT-centric Deep Packet Inspection technology, enhances IT network security visibility, and ultimately helps mitigate risks and protect industrial networks from security threats. Deep Packet Inspection can identify multiple industrial protocols and allow or block specific functions, such as read or write access. Based on the identified protocol, the industrial IPS can then prevent any unauthorized protocols or functions. This way, you can be more confident that the traffic on your industrial networks is trusted and non-malicious. In addition, Moxa’s industrial IPS provides virtual patching of vulnerabilities for operating systems, application software, and industrial equipment such as PLCs. By effectively integrating OT and IT technologies, Moxa’s industrial IPS safeguards your critical assets from the latest cybersecurity threats.

• Ultra-compact industrial security box with IPS/IDS
• Granular policy enforcement with whitelisting control
• LAN Bypass design to prevent a single point of failure and traffic overloading
• Bump-in-the-wire installation without impacting the network

Onboard Security Chip

The hardware-based secure element cannot be read out. It is used to secure all processes and to encrypt your passwords and data.

Active Session Warning

Use an onboard DO to enable a local audible or visual alarm and notify local staff of an active remote session on the unit.

Unique Password

Each hardware device that leaves the factory has its own unique password.

Signed Firmware

The Secure Boot concept ensures that the router only boots with signed and trusted firmware.

Support SIMPLY.connect

Setting up a new router has never been easier. SIMPLY.connect enables you to make a guided connection in three steps: Log in, scan, done. No more complex configuration.

Waterfall ICS/OT Data Diode

The Waterfall data diode works the same was as an ordinary diode, therefore it lets the data flow one way, but not the other.

It’s capable of network segregation written in the NIST SP-800-53 framework and compliant with the highest security standards – this is done by isolating the ICS/OT networks from the less secure IT/production networks and still providing unidirectional, secure and monitored data flow.

As traditional networks and TCP/IP communication is bi-directional, the data diode is not just a hardware element, but also contains software to enable 2-way protocols on a one-way channel.

It creates a hardware based, optical, one-way (just RX or just TX) connection between segments, and due to this, it cannot be altered or avoided by any means.

Unlike traditional firewalls, which direct traffic based on software, hardware based unidirectional channels can’t be tampered by miscreants, as the laws of physic are applicable to all of us.

As this is a special segregation on the OSI layers 1-2, therefore this system works different than the usual security gateways. This can be a drawback, as some services will not work on it as intended, therefore thorough testing is required (in case the organisation wants to use traditional security measures), although, this device is usually used in unorthodox situations, so this drawback is often more like a perk.

The service support is limited, but the data diode can enable the most frequently used applications:

File Transfer (SMB, FTP, SFTP, NFS, CIFS, etc.)
• HTTPS/HTTPS mirroring
• Database mirroring or streaming
• Printing
• Email
• Virus Protection
• Patches and updates
• Remote monitoring
• Other, special protocols (pl. ICS/OT, modbus, historian, SIMATIC/S7Comm, Omron FINS, WinCC, etc.)

You see the highest priority vulnerabilities as well as threats and anomalous behavior, enabling you to respond faster, ensuring high reliability and security.

Guardian reduces OT risks for the largest critical infrastructure, energy, manufacturing, mining, transportation, building automation and other OT sites around the world.

As there is need of data input regarding ICS/OT devices, it’s important to clean and remove any malicious code from this input. The OPSWAT Metadefender is made for this purpose, with up to 20 virus scanning engines. The scanning is made on-premises and can also be air-gapped to ensure a data leak free environment.

Zero-day and other APT threats are usually undetectable by classic, signature-based virus scanning engines, therefore the OPSWAT Metadefender Content Disarm and Reconstruction (CDR) first unpacks the files and then removes the possibly dangerous elements (eg.: DDE, macro, metadata, scripts, etc.) and then recreates the files, without the possible malicious items.

The OPSWAT Metadefender KIOSK is a data input and medium verifier terminal. This terminal lies at the perimeter of the ICS/OT network and helps sanitize the input data automatically. With this, the users can upload the data into the KIOSK, it will check it automatically (both virus and CDR-wise) and will automatically forward it into the proper shares of the closed network. The OT op1erators can then use the clean files.

As this solution is independent from the organization’s own IT infrastructure, the connected operators can’t reach anything within the boundaries of said networks – just the devices connected to the EWON firewall. As this is a proper firewall, therefore its rules can control which devices are available and to whom. Web-based interfaces (HMI, SCADA) can be also rendered natively in the cloud, without any need for an application.

By logging in into the Talk2M, operators can also reach other web and remote access services of the devices connected to the EWON gateway, and there is also a mobile application to reach these devices, therefore operators can reach the devices from anywhere, at any time.

The device is also capable of port forwarding and NATing between the production and industrial network.