Fortiphyd Logic

Subscribe to gain access to ALL of our courses and labs, over 55 hours of content and growing! Completing this "course" will auto-enroll you in all of our courses.

Create your own ICS security lab in VirtualBox with the open source GRFICS project to learn some of the key lessons of ICS security!

https://github.com/Fortiphyd/GRFICSv2

This course introduces the foundational principles of Cyber-Informed Engineering (CIE), a framework that integrates cybersecurity into the engineering and design of operational technology systems. Whether you're an engineer, operator, or technical manager, you’ll learn how to reduce the consequences of cyber events by building resilience into the systems themselves. Through a combination of lecture material and hands-on lab exercises, you'll explore real-world scenarios that bring each principle to life, helping you turn “What if?” into “Even if.”

After this course, participants will be able to:

• Define the 12 principles of CIE and how they contribute to a more resilient infrastructure
• Identify opportunities to reduce cyber risk through engineering controls
• Recommend CIE strategies for specific situations

Disclaimer - This course references materials developed under contract for the U.S. Department of Energy by the Idaho National Laboratory and the National Renewable Energy Laboratory. All rights to these materials remain with their respective owners. This course is not affiliated with or endorsed by the U.S. Department of Energy or any of its contractors.

(Lab) Take on the role of an attacker in the DMZ network of a power plant, learning how to exploit the common vulnerabilities there and pivot deeper into the ICS network. After completing this chapter, users will be able to:

• Use basic Linux commands and tools (whoami, pwd, ls, mkdir, nano, cd, mv, cp, rm, man)
• Run basic network scans with nmap
• Understand the function of historians in ICS networks
• Test for SQL injection vulnerabilities
• Perform man-in-the-middle (MITM) attacks using ARP spoofing
• Explore ICS protocols using Wireshark
• Run password cracking tools against remote access protocols (SSH)
• Check for weak passwords by running a cracking tool against password files

(Lab) Using lessons learned from successfully attacking the power plant in Chapters 1 and 2, learn how to harden and secure ICS assets using various endpoint defenses. After completing this chapter, users will be able to:

• Validate operator inputs on HMIs
• Add safety checks to PLC programs
• Scan for malware using Yara
• Investigate Windows event logs, and set up audit policies 
• Use the Windows powershell command line (ps, select-string, netstat)
• Use intermediate level Linux commands (ps, grep, netstat)
• Investigate Linux logs
• Write basic Linux host firewall rules

(Lab) In this advanced level module, take a deep dive into the Modbus traffic of a simulated chemical plant to understand how to attack and harden one of the most common ICS protocols in use. After completing this chapter you will be able to

• Run advanced nmap scripts to enumerate Modbus devices
• Use Python Scapy scripts to perform detailed Modbus device enumeration
• Scan and scrape data from a Modbus server
• Send Modbus commands to control a process
• Fuzz Modbus servers to check for vulnerabilities
• Write IDS rules to detect suspicious Modbus activity
• Set up a basic Modbus honeypot to study attacker behavior 

(Lab) In this advanced level module, get hands on experience with the BACnet protocol in a simulated server room cooling system to understand how to attack and harden one of the most common building automation system (BAS) protocols in use. After completing this chapter you will be able to

• Explore building automation systems in Shodan
• Run nmap scripts to enumerate BACnet devices
• Set up a rogue BACnet master to read process data and send commands
• Fuzz BACnet servers to check for vulnerabilities
• Write Suricata/Snort content rules to detect suspicious BACnet activity
• Set up a basic BACnet honeypot to study attacker behavior

After completing this module, users will be able to:

• Understand the key concepts of computer networking and cryptography
• Describe common networking and network security devices and when to use them
• Identify common protocols on ICS networks and when to use them

After completing this module, users will be able to:

• Operate basic HMIs
• Explore simple historians for process data
• Identify common vulnerabilities in Purdue Level 2/3 devices
• Recommend strategies for securing Level 2/3 devices

After completing this module users will be able to:

• Understand common wireless protocols used in ICS
• Identify vulnerabilities in wireless communication
• Recommend more secure deployments of wireless communication

After completing this module users will be able to:

• Build a patch management program suitable for ICS networks
• Prioritize ICS patches
• Understand how to implement application whitelisting for ICS devices
• Perform basic Linux and Windows system hardening and configuration management

After this course, users will be able to:

• Develop a basic incident response plan for their facility
• Plan and conduct a tabletop exercise

(Lab) So much attention is paid to securing industrial control systems at various levels in the network, but what can controls engineers do to help secure the PLCs that are actually translating digital commands into physical actions?

In this 4-part series learn how the "Top 20 Secure PLC Coding Practices" provides PLC programmers with the first ever industry guidelines for adding basic security to the PLC programming itself. Practice the various guidelines in simulated ICS networks including power generation, power distribution, and building automation networks.

Part 3 of the 4-part series covers:

• Practice 3: Leave operational logic in the PLC
• Practice 20: Trap false negatives and false positives for critical alerts
• Practice 8: Validate HMI input variables at the PLC level
• Practice 6: Validate timers and counters

https://plc-security.com/