Please enable JavaScript.
Coggle requires JavaScript to display documents.
⚙️ 6️⃣ NCA ECC DOMAIN 6 — INDUSTRIAL CONTROL SYSTEMS (ICS) CYBERSECURITY -…
⚙️ 6️⃣ NCA ECC DOMAIN 6 — INDUSTRIAL CONTROL SYSTEMS (ICS) CYBERSECURITY
6.1️⃣ ICS Cybersecurity Governance 🏛️
6.1.1 ICS Security Strategy 📜
Define OT security objectives
Protect critical processes
Establish cybersecurity policies
Align with business requirements
6.1.2 ICS Security Roles 👥
OT Security Manager
Control System Engineer
Network Engineer
SOC Analyst
Incident Response Team
6.1.3 Risk Management ⚠️
Identify OT assets
Identify threats
Assess vulnerabilities
Calculate risk
Apply security controls
6.1.4 Compliance Requirements 📋
NCA ECC
IEC 62443
NIST SP 800-82
ISO 27001
6.2️⃣ ICS Asset Management 🏭
6.2.1 OT Asset Identification 🔎
PLC (Programmable Logic Controller)
RTU (Remote Terminal Unit)
HMI (Human Machine Interface)
SCADA Servers
Engineering Workstations
Industrial Network Devices
6.2.2 Asset Inventory 📋
Device Information
Firmware Version
IP Address
Communication Protocol
Business Criticality
6.2.3 Asset Monitoring 👁️
Unauthorized Device Detection
Configuration Changes
Firmware Changes
Network Behavior Monitoring
6.3️⃣ ICS Network Security 🌐
6.3.1 IT/OT Network Segmentation 🔒
Corporate IT Network
|
|
Firewall
|
|
DMZ Zone
|
|
OT Network
|
|
PLC / SCADA
6.3.2 Industrial Firewalls 🔥
Access Control Rules
Protocol Filtering
Traffic Inspection
Logging
6.3.3 Secure Remote Access 🔐
VPN
MFA
Jump Servers
Session Monitoring
6.3.4 Network Monitoring 📡
IDS/IPS
Network Sensors
Packet Capture
Protocol Analysis
6.4️⃣ Industrial Protocol Security 🔌
6.4.1 Modbus Security
Modbus TCP
Register Monitoring
Unauthorized Commands Detection
Traffic Analysis
6.4.2 Siemens S7 Security
PLC Communication
S7 Protocol Monitoring
Engineering Access Control
6.4.3 OPC-UA Security
Authentication
Encryption
Certificates
Secure Communication
6.4.4 DNP3 Security
SCADA Communication
Authentication
Secure Telemetry
6.4.5 Protocol Monitoring Tools 🧰
Wireshark
Zeek
Suricata
Nozomi Networks
6.5️⃣ ICS Access Control 🔑
User Authentication
Unique Accounts
Strong Passwords
MFA
Privileged Access Management
Administrator Control
Engineering Account Control
Session Recording
Remote Access Security
Vendor Access
Temporary Access
Approval Process
Physical Security 🏢
Control Rooms
PLC Cabinets
Server Rooms
6.6️⃣ ICS Vulnerability Management 🔍
Vulnerability Identification
Firmware Analysis
Configuration Review
Security Assessment
Vulnerability Scanning Tools
Nessus
OpenVAS
Tenable.ot
Claroty
Patch Management
Test Before Deployment
Maintenance Windows
Change Control
Risk Mitigation
Network Isolation
Firewall Rules
Compensating Controls
6.7️⃣ ICS Monitoring & Detection 🚨
Security Monitoring
SIEM Integration
OT Logs
Network Events
Threat Detection
Unauthorized Commands
Abnormal Traffic
Malware Activity
Configuration Changes
MITRE ATT&CK for ICS 🎯
Initial Access
Discovery
Lateral Movement
Inhibit Response Function
Impair Process Control
Impact
Detection Tools
ELK SIEM
OSSEC/Wazuh
Zeek
Suricata
6.8️⃣ ICS Incident Response 🚨
Preparation
IR Plan
Asset Documentation
Backup Configuration
Detection
Alarm Analysis
Network Investigation
Log Analysis
Containment
Isolate Device
Block Communication
Protect Safety Systems
Recovery
Restore Operations
Validate PLC Logic
Monitor Systems
Lessons Learned
Root Cause Analysis
Update Controls
Improve Security
🎯 NCA ECC DOMAIN 6 IMPLEMENTATION ROADMAP
1️⃣ Discover OT Assets 🏭
2️⃣ Map Industrial Network 🌐
3️⃣ Segment IT and OT 🔒
4️⃣ Monitor Industrial Traffic 📡
5️⃣ Detect Cyber Threats 🚨
6️⃣ Respond Safely ⚙️
7️⃣ Continuously Improve Security 🔄