Cyberstudy
PDF p.265 In progress

Hardening Specialized Devices

Open PDF at p.265 22 flashcards

Summary

PDF p.265

Specialized devices like Industrial Control Systems (ICS), SCADA systems, embedded systems, Real-Time Operating Systems (RTOS), and Internet of Things (IoT) devices require tailored hardening strategies to protect against cybersecurity threats. These strategies include regular updates, disabling unnecessary services, limiting network access, and using secure credentials.

In plain words

Supplementary — not from your PDF

ICS, SCADA, embedded, RTOS and IoT devices need tailored hardening. General steps: update where possible, disable unused services, limit network access (firewalls, IDS/IPS, TLS/SSH), use strong credentials and RBAC, and audit regularly. ICS/SCADA especially need segmentation and data diodes (unidirectional gateways that let data flow out but nothing in). Embedded and RTOS devices need secure design, secure boot and tamper protection. Standards such as IEC 62443, Common Criteria and ISO 27001 guide the work.

Detailed explanation

PDF p.265
  • General Hardening Strategies
    • System Updates: Regularly update systems to patch vulnerabilities.
    • Disable Unnecessary Services: Reduce attack surface by disabling services not in use.
    • Limit Network Access: Use firewalls, IDS/IPS, and transport encryption protocols (TLS, SSH).
    • Secure Credentials: Implement strong authentication and role-based access controls.
    • Security Audits and Penetration Tests: Identify and remediate vulnerabilities.

Hardening ICS/SCADA

  • Network Segmentation: Isolate ICS/SCADA systems from wider networks.
  • Authentication and Authorization: Implement robust processes to limit access.
  • Unidirectional Gateways (Data Diodes): Ensure data flows only outward to protect from inbound attacks.
  • Physical and Cyber Threat Protection: Prevent environmental disasters and utility failures.

Hardening Embedded and RTOS

  • Secure Design: Incorporate security from the start with secure coding practices and minimal design.
  • Secure Boot Mechanisms: Ensure only trusted software runs on the device.
  • Physical Tamper-Proofing: Protect devices from physical tampering.
  • Comprehensive Security Testing: Regularly test for vulnerabilities.

Security Standards and Certifications

  • Standards: Provide guidelines and best practices (e.g., Common Criteria, IEC 62443, MISRA-C, CERT Secure Coding Standards).
  • Certifications: Demonstrate compliance with security standards (e.g., ISO 27001, IEC 61508).
  • Framework: Establish a common language and criteria for evaluating security.

Important terms

taken from the text above
System Updates
Regularly update systems to patch vulnerabilities.
Disable Unnecessary Services
Reduce attack surface by disabling services not in use.
Limit Network Access
Use firewalls, IDS/IPS, and transport encryption protocols (TLS, SSH).
Secure Credentials
Implement strong authentication and role-based access controls.
Security Audits and Penetration Tests
Identify and remediate vulnerabilities.
Network Segmentation
Isolate ICS/SCADA systems from wider networks.
Authentication and Authorization
Implement robust processes to limit access.
Unidirectional Gateways (Data Diodes)
Ensure data flows only outward to protect from inbound attacks.
Physical and Cyber Threat Protection
Prevent environmental disasters and utility failures.
Secure Design
Incorporate security from the start with secure coding practices and minimal design.
Secure Boot Mechanisms
Ensure only trusted software runs on the device.
Physical Tamper-Proofing
Protect devices from physical tampering.
Comprehensive Security Testing
Regularly test for vulnerabilities.
Certifications
Demonstrate compliance with security standards (e.g., ISO 27001, IEC 61508).
Framework
Establish a common language and criteria for evaluating security.
ICS Industrial Control Systems RTOS Real-Time Operating Systems IoT Internet of Things

Examples & real-world scenarios

Supplementary — not from your PDF
  • A data diode sending plant telemetry to the office network with no path back.
  • Secure boot on an embedded controller.
  • An IEC 62443 assessment of an industrial network.

Scenario

Engineers want to view plant data from the office but must not expose the control network. A unidirectional gateway (data diode) pushes data out while physically preventing inbound traffic.

Common mistakes

Supplementary — not from your PDF
  • Applying IT patching schedules to ICS without testing. Availability and safety come first.
  • Connecting ICS devices directly to corporate or Internet networks.

Practical skills

Supplementary — not from your PDF
  • Recommend hardening steps for an IoT or ICS device.

What I should remember

Key Points PDF p.265
  • General Hardening
    • Updates and Patches: Regularly update systems.
    • Disable Services: Turn off unnecessary services.
    • Network Security: Use firewalls, IDS/IPS, and encryption.
    • Secure Credentials: Implement strong authentication.
    • Audits and Tests: Conduct regular security audits and penetration tests.
  • ICS/SCADA
    • Segmentation: Isolate systems from wider networks.
    • Data Diodes: Ensure unidirectional data flow.
    • Threat Protection: Prevent cyber and physical threats.
  • Embedded and RTOS
    • Secure Design: Use secure coding and minimal design.
    • Secure Boot: Ensure trusted software runs.
    • Tamper-Proofing: Protect against physical tampering.
    • Security Testing: Regularly test for vulnerabilities.
  • Standards and Certifications
    • Guidelines: Follow security standards.
    • Compliance: Obtain relevant certifications.
    • Framework: Use a common language for security evaluation.