-: Mitigating vulnerabilities.
So, we've talked about a lot of specialized systems here,
especially in the ICS and SCADA world.
And so, the question is,
how do you start mitigating some of these vulnerabilities?
Well, the go-to guide for this is going to be
the NIST Special Publication 800-82.
Now, again, this is a good read
if you happen to work in a manufacturing environment
or someplace that uses ICS and SCADA.
Now, you don't have to read this entire guide
yourself because I'm going to give you
the four key controls for mitigating
vulnerabilities in specialized systems.
And this is really what you need to know for the exam.
But again, if you're working in an environment
that is automation and manufacturing
and you have ICS SCADA systems,
this entire guide is a great read
for you in the real world.
Now, the first thing we want to talk about
is how you can establish administrative control
over operational technology networks.
The best way to do this is by recruiting staff
who have expertise with these things.
Because, as I said, these are not your normal IT networks.
I am really knowledgeable when it comes to IT networks,
but I am not really knowledgeable when it comes
to ICS and SCADA networks in the OT realm,
I've done a little bit of work with them,
but just enough to be dangerous.
So, you wouldn't want to hire me for that.
Instead, you want to find people who know
what they're talking about when it comes
to OT. OT is a different beast.
And so, you want to make sure you get somebody
who understands SCADA and ICS and PLCs
and FPGAs and all the stuff we've been talking
about the last couple of lessons.
These are specialists and they're worth
the money to have on staff, especially
if you're running a big manufacturing plant.
The second big tip,
you want to make sure you're implementing
the minimum network links
by disabling any unnecessary links,
services, and protocols.
Essentially, when you have
an operational technology network,
you want to eliminate it
from all of the rest of the networks,
as much as possible.
We want to cut those links,
we want to disable services.
So, if I have a manufacturing plant,
I should have two networks, my corporate network,
the IT network, and the plant network, the OT network.
If there's any connection between those two,
it should be very minimal
and should be heavily monitored.
The third thing we want to talk about
is how we can develop and test
a patch management program for operational
technology networks.
Again, these OT networks are different
than our information technology networks.
You can't just go ahead and use your Microsoft SCCM servers.
That's not going to work for you.
So, you want to make sure you understand
what options you have
and how you're going to do a patch management program.
Remember, these are things unlike PLCs,
they have firmware that needs to be upgraded sometimes,
that's going to require maintenance windows,
that's going to require downtime.
You need to have a process
of how you're going to do this.
And that's why it's important to develop
and test your patch management program.
And then, the fourth thing we need to think about
is how we're going to perform regular audits
of logical and physical access
to these different systems
so that we can detect possible
vulnerabilities and intrusions.
Now, this isn't going to be as easy
as hooking up Nessus to the network and doing a scan.
You're going to have to have specialists
who know what they're looking
for when they're scanning these areas.
Also, a big word of warning here.
Your enumeration tools and vulnerability scanners,
they can cause a lot of problems
on operational technology networks.
Generally, if you're trying to do scanning
of an operational technology network,
you are not going to be doing active scanning.
Instead, you're going to hook up something like Wireshark.
You're going to do packet capture,
and then, using that passive analysis
of that network traffic,
you'll be able to identify those devices
to do your enumeration,
or you'll be able to use that passive analysis
to start figuring out what vulnerabilities
you may have inside your network.