Industrial Network Security · 2nd Edition by Teumim, David J. -- Read -- Imperial Library of Trantor

Index

Title Page Copyright Acknowledgments Table of Contents Preface Chapter 1.0 Industrial Network Security

1.1 What Are Industrial Networks? 1.2 What Is Industrial Network Security? 1.3 The Big Picture: Critical Infrastructure Protection 1.4 The Challenge: “Open and Secure” 1.5 Who’s Working on What? 1.6 Federal Regulatory Authority References

Chapter 2.0 A Security Backgrounder

2.1 Physical, Cyber, and Personnel Security 2.2 Risk Assessment and IT Cybersecurity 2.3 Risk Assessment for the Plant 2.4 Who’s Responsible for Industrial Network Security? 2.5 Tips for Making the Business Case to Upper Management 2.6 Making the Business Case with Data References

Chapter 3.0 COTS and Connectivity

3.1 Use of COTS and Open Systems 3.2 Connectivity 3.3 What You Get that You Didn’t Bargain For References

Chapter 4.0 Cybersecurity in a Nutshell

4.1 Security Is a Process 4.2 Basic Principles and Definitions 4.3 Basic Principles: Identification, Authentication, and Authorization 4.4 More Cyber Attack Case Histories 4.5 Risk Assessment and Risk Management Revisited 4.6 Cyber Threats 4.7 Vulnerabilities 4.8 A Common COTS Vulnerability: The Buffer Overflow 4.9 Attacker Tools and Techniques 4.10 Anatomy of the Slammer Worm 4.11 Who’s Guarding Whom? References

Chapter 5.0 Countermeasures

5.1 Balancing the Risk Equation with Countermeasures 5.2 The Effect of Countermeasure Use 5.3 Creating an Industrial Network Cyber Defense

Chapter 6.0 Cyberdefense Part I — Design and Planning

6.1 Defense in Layers 6.2 Access Control 6.3 Principle of Least Privilege 6.4 Network Separation References

Chapter 7.0 Cyberdefense Part II — Technology

7.1 Guidance from ISA99 TR1 7.2 Firewalls and Boundary Protection 7.3 Intrusion Detection 7.4 Virus Control 7.5 Encryption Technologies 7.6 Virtual Private Networks (VPNs) 7.7 Authentication and Authorization Technologies References

Chapter 8.0 Cyberdefense Part III — People, Policies, and Security Assurance

8.1 Management Actions and Responsibility 8.2 Writing Effective Security Documentation 8.3 Awareness and Training 8.4 Industrial Network Security Assurance Program: Security Checklists 8.5 Security Assurance: Audits 8.6 Adding in Physical Security 8.7 Adding in Personnel Security References

Chapter 9.0 New Topics in Industrial Network Security

Chapter 10.0 Defending Industrial Networks—Case Histories

10.1 A Large Chemical Company 10.2 Another Company’s Story—Procter & Gamble

Appendix A – Acronyms About the Author