40 lines
8.8 KiB
Org Mode
40 lines
8.8 KiB
Org Mode
:PROPERTIES:
|
|
:ID: f14796e1-9962-4a0f-a104-ef3c296d60b7
|
|
:END:
|
|
|
|
#+title: ot-ics-security-ramp/curriculum
|
|
#+filetags: :project: :knowledge: :cybersecurity: :curriculum:
|
|
|
|
Curriculum tracking for [[ot-ics-security-ramp]] — self-assessment, methodology, and deep-dive progress. See [[ot-ics-security-ramp/glossary]] for the running quiz-ready term glossary and [[ot-ics-security-ramp/reading-list]] for standout resources worth keeping/sharing.
|
|
|
|
** Key Context
|
|
- Startup secures networks of utility companies — this is OT/ICS/critical-infrastructure security, not general enterprise security.
|
|
- Trigger: interview process surfaced that Aner didn't know "RAT" or "C2" despite solid underlying concept knowledge (8200 SDR, Gita WiFi/Bluetooth security research) — a terminology/lingo gap, not a concept gap.
|
|
- Daily RSS reading habit already established (Krebs, SANS ISC, CISA Advisories, etc.).
|
|
|
|
** Self-Assessment Results (2026-09-29)
|
|
Full results and corrected misconceptions (IOC/IOA swap, Kerberoasting) logged in [[ot-ics-security-ramp/glossary]]. Biggest blanks going in: APT, TTP, living-off-the-land, exfiltration, most of the defensive stack (EDR/XDR/SIEM/SOAR/NDR/etc.), cloud security beyond self-taught k8s, IR/forensics entirely, frameworks/compliance entirely, vendor landscape partial only.
|
|
|
|
** Methodology (decided 2026-09-29)
|
|
Hybrid approach, not one-size-fits-all:
|
|
- Conceptually rich + currently blank domains (OT/ICS fundamentals, IR/forensics, frameworks/compliance, defensive stack) → conversational deep-dive, one section at a time, discuss before moving on.
|
|
- Pure vocabulary/naming gaps (vendor landscape, acronym expansion, APT/TTP-style terms) → quick reference pass, no deep discussion needed.
|
|
- Priority reorder given the utility-company detail: OT/ICS fundamentals first, ahead of generic defensive-stack coverage.
|
|
- **Standing workflow preference: auto-update [[ot-ics-security-ramp/glossary]] and [[ot-ics-security-ramp/reading-list]] with every new term/resource covered, without asking first or narrating "I'll add this" — just do it.**
|
|
|
|
** OT/ICS Deep-Dive Progress (started 2026-09-29)
|
|
Covered so far (full definitions in [[ot-ics-security-ramp/glossary]]): IT-vs-OT / AIC triad; Purdue Model levels 0-5 + Level 3.5 DMZ; ICS protocols (Modbus, DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA); canonical attack case studies (Stuxnet, Ukraine grid/Industroyer, TRITON/SIS, Metcalf sniper attack); OT vendor landscape (Dragos/Claroty/Nozomi "big three" plus Tenable.ot, MS Defender for IoT, Forescout, Armis, vendor-native); 2026 threat landscape from the Dragos Year in Review (KAMACITE/SYLVANITE/BAUXITE, MSP/GIS as supply-chain targets — see [[ot-ics-security-ramp/reading-list]]); NERC CIP compliance (NERC/FERC/BES scope, electric-only vs water/gas, CIP-002/005/007/008/010/013/014); OT/ICS hands-on lab tools (pymodbus, opendnp3, OpenPLC, GRFICS, Conpot, T-Pot, MiniCPS, ScadaBR).
|
|
Not yet covered: IR/forensics (queued), general frameworks/compliance beyond NERC CIP (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms (EDR/XDR/SIEM/SOAR/NDR/NGFW/IDS/IPS/DLP/ZTNA), cloud security beyond k8s (CSPM/CWPP/CIEM).
|
|
|
|
** Protocol Deep-Dive Session (2026-10-06)
|
|
Completed the priority-redirect protocol session: SNMP (new — manager/agent, MIB/OID, GET/SET/TRAP, v1/v2c plaintext community strings vs. SNMPv3); Modbus (deeper — function codes, four data tables, Modbus Security/TLS retrofit, FrostyGoop case study); DNP3 (deeper — object-based types, unsolicited reporting, DNP3-SA HMAC challenge-response mechanics, Aggressive Mode replay flaw per Cremers et al.); GOOSE (deeper — pub-sub over raw Ethernet L2/multicast MAC, stNum/sqNum and how Industroyer forged them, SCD engineering files, IEC 62351-6, PRP/HSR, process-bus/station-bus segmentation risk); IEC 104 (deeper — ASDU/Information Object typing, port 2404, regional dominance vs. DNP3, IEC 62351-3/5); OPC-UA (deeper — object-oriented address space, X.509/Security Policies, horizontal cross-vendor-interop origin vs. vertical IT/cloud bridging vs. emerging field-level/TSN use). New terms (compensating controls, brownfield/greenfield, MES, etc.) and all new reading resources logged to [[ot-ics-security-ramp/glossary]] and [[ot-ics-security-ramp/reading-list]] as covered, per standing convention. Produced [[ot-ics-security-ramp/protocol-comparison]] as a standalone side-by-side reference across transport, data model, security posture, Purdue level, and known attacks.
|
|
|
|
** OPC UA Protocol Mechanics Session (2026-10-12)
|
|
Condensed pass through the Claroty Team82 10-part OPC UA attack-surface deep dive (see [[ot-ics-security-ramp/reading-list]]), followed by conversational deep-dive on protocol mechanics: full session lifecycle (HEL/ACK → OPN/SecureChannel asymmetric bootstrap → CreateSession/ActivateSession identity layer → Read/Write/Browse/Subscribe → CLO teardown); SecureChannel-vs-Session decoupling and why it matters (renewal without losing session state); GetEndpoints as unauthenticated-by-design discovery and why that's not a secrecy boundary; UserName/Password token encryption mechanics and exactly how/why it degrades to plaintext in practice; Subscription/MonitoredItem pub-sub-style efficiency layer vs. the separate OPC UA PubSub transport profile; Alarms & Conditions model (ConditionType state machine, EventMonitoredItem, ConditionRefresh) as the realistic shape of something like a HighLevelAlarm; Node/AddressSpace meta-model (8 NodeClasses, References) as mandatory grammar vs. vendor-proprietary or Companion-Spec vocabulary, with a worked Pump/Tank example; same Pump/Tank example re-modeled in Modbus/Modbus-TCP to contrast self-describing address space against flat typeless register tables + external register-map documentation. Also covered vulnerability-class vocabulary from the reading (chunk flooding, zip-slip, WerFault abuse, Pwn2Own ICS) and clarified OPC UA client/server roles don't map 1:1 to Purdue levels — it's a chained relay (PLC→SCADA→MES→ERP), each hop its own independent client-server pair. New terms and the reading-list entry status logged to [[ot-ics-security-ramp/glossary]] and [[ot-ics-security-ramp/reading-list]] per standing convention; also added a missing ERP glossary entry.
|
|
|
|
** IR/Forensics Deep-Dive Session (2026-10-12)
|
|
First full pass through IR/forensics, structured as 7 sections, conversational deep-dive with discussion between each: (1) IR lifecycle — NIST SP 800-61 vs. SANS PICERL; (2) Detection & Analysis — SIEM/EDR/IDS-IPS, triage, scoping, and the OT wrinkle that EDR-style endpoint agents can't run on PLCs/RTUs, pushing OT detection toward passive network monitoring; (3) Containment — short/long-term, isolate-vs-monitor-in-place, DNS sinkholing, and the OT-specific constraint that touching a live process needs joint sign-off with plant operations/safety (TRITON/TRISIS as the case where the SIS itself was the target); (4) Digital forensics fundamentals — chain of custody, forensic imaging/write-blockers, RFC 3227 order of volatility, live vs. dead-box; (5) Memory & disk forensics — acquisition mechanics (WinPmem/LiME/avml, hypervisor-level snapshotting, why modern hardening like HVCI/VBS and Lockdown LSM blocks live acquisition and why real IR relies on pre-positioned signed tooling), Volatility, timeline/MACB analysis, file carving, slack space, persistence artifacts — plus a hands-on exercise reading /proc/kcore on the live machine and decoding its ELF64 header (e_type=ET_CORE, e_phoff/e_phnum pointing to the real PT_LOAD segments inside the sparse ~128TiB address space); (6) Network forensics — PCAP vs. NetFlow/IPFIX tradeoff, Zeek as the practical middle ground, beaconing/DGA/DNS-tunneling, JA3/JA3S + SNI as the answer to TLS opacity, and why OT network forensics is actually richer than IT's (unencrypted ICS protocols give full semantic visibility in plaintext); (7) OT-specific forensics gaps — PLCs as forensic dead ends (no audit log) vs. the engineering workstation as where real evidence lives, control-logic verification via vendor Upload functions (S7comm/CIP) as the realistic way to extract a PLC's running program, the Stuxnet PLC-rootkit caveat that defeats naive upload-and-compare, Historian data as the physical-process timeline substitute, SCD file integrity as a distinct attack target, and anti-forensics in OT (corrected mid-session: the Dec-2025 Poland CHP partition-table wipe was remote/digital, not physical — physical anti-forensics is a separate, real but distinct OT consideration). All terms logged to [[ot-ics-security-ramp/glossary]] under a new "IR / Forensics" section; also added a missing standalone-callout note for RTU (already defined, bundled with PLC) and a missing ERP entry.
|
|
|
|
** Status
|
|
IR/forensics first pass complete (2026-10-12). Next up per original queue: frameworks/compliance (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms, cloud security beyond k8s.
|