ICS613: ICS Penetration Testing and Assessments™

Overview

The objective of Section 1 is to outline the differences between a penetration test within a corporate network and a control network. Students with experiences in corporate penetration tests will need to be introduced to Operational Technology (OT), how they are used in processes, and the consequences of their actions. Students with experiences in OT will need to be introduced to the different types of penetration tests, the tools used for these assessments, and the consequences of their actions. These objectives will be achieved by covering the concepts and reinforcing them using labs where standard tools cause a physical failure within a process. The day will also be used to introduce students to the virtual machines with ICS tools, virtual systems, and tools and to ensure access to lab resources.

Overview

Section 2 will introduce the student to an assessment methodology that follows the ICS Attack Kill Chain. Students will be informed about the considerations for scoping a penetration test for a control network, including the expectations and limitations they will encounter. This will be reinforced using a lab that will leverage penetration testing tools and process that will highlight environment specific considerations when performing various tasks and what can happen to a process when appropriate precautions are not taken. Students will then be exposed to physical security considerations because of their importance as a primary control in most organizations. Techniques for bypassing physical controls will be discussed.

Students will learn how attackers gain digital access to key personnel workstations and gather information about the control process, learning to mimic this behavior in a lab to find and compile documents and credentials and leverage these credentials to pivot into the control network. Students will then perform safe system and service enumeration activities to collect information about the control network. Finally, students will learn how to use scripts to enumerate information from a management server using an industrial protocol and identify how to attack a processor/field device using another industrial protocol. The day will finish by outlining penetration testing reporting and ICS-specific mitigation considerations.

Overview

As a cyber defender working in industrial control systems (ICS) environments, it is imperative to understand that these systems are composed of many computer systems, network components, and field devices, each running various operating systems and real-time operating systems. Therefore, to effectively assess the cybersecurity posture of these systems, you must have a solid foundation in these operating systems and how to approach them to identify vulnerabilities systematically.

Developing ICS operating systems expertise requires system knowledge and hands-on experience through lab exercises. By gaining this knowledge and experience, you can better prepare yourself and your team to conduct assessments beyond surface-level vulnerabilities and uncover adversary attack surfaces at deeper system layers. In addition, you will learn the foundation of assessing controllers, devise Real-Time Operating Systems, and develop simple tests and procedures to validate controller Certifications.

By taking a systematic approach and building a solid understanding of ICS operating systems, you can improve your ability to assess the security of these critical systems and help ensure their resilience in the face of cyber threats against Industrial Control System networks, systems, and devices.

Overview

Many ICS Cyber Teams have a solid foundation in cyber essentials. However, they sometimes need more opportunities to expand their Industrial Cyber knowledge and tradecraft at the OT network level by interacting with live field devices and distributed control systems.

It is critical to learn and use a set of safety-based tactics, techniques, and procedures (TTPs) that prioritize the protection of life, equipment, and the underlying process when conducting cybersecurity assessments, penetration tests, red team/blue teaming, and hunting operations within industrial control systems networks.

It is essential to engage in hands-on training that focuses on real-world scenarios and includes exposure to existing distributed control systems, DCS networking, field devices, and actual “plug-in” conditions that limit the use of traditional cyber tools.

Overview

The final day of the course will continue to highlight live DCS system components and appropriate assessment approaches and methodologies. The content and hands on labs will provide an excellent foundation for conducting cyber engagements on these systems, including using DCS-specific vendor tools, adversary exploit techniques, Atomic Red Team assessment tradecraft, and the more traditional penetration testing techniques.

The industry is rapidly evolving to move beyond simple Pen tests and vulnerability assessments of individual devices and instead toward conducting assessments on offline deployed systems and eventually to live systems. It is, therefore, critical that ICS cyber teams build their knowledge and expertise in a way that allows them to assess these complex systems safely and effectively while ensuring the protection of critical infrastructure and the people who depend on it.