Detect - Revision history

Jlawrence at 18:07, 31 October 2024

2024-10-31T18:07:07Z

← Older revision		Revision as of 18:07, 31 October 2024
Line 1:		Line 1:
	~~Detection Summary~~
	Real-time detection involves utilizing detection tools to inform users of potential network anomalies that might indicate cyber security events. Real-time detection is meant to be a means to aid system operators in preventing a cyber event before it causes loss of equipment and safety. Real-time detection typically involves: utilizing monitoring and alerting tools to collect network data and events aggregating and processing events displaying events and potential vulnerabilities and notifying system users and operators of events		Real-time detection involves utilizing detection tools to inform users of potential network anomalies that might indicate cyber security events. Real-time detection is meant to be a means to aid system operators in preventing a cyber event before it causes loss of equipment and safety. Real-time detection typically involves: utilizing monitoring and alerting tools to collect network data and events aggregating and processing events displaying events and potential vulnerabilities and notifying system users and operators of events

Jlawrence at 18:06, 31 October 2024

2024-10-31T18:06:44Z

← Older revision		Revision as of 18:06, 31 October 2024
Line 6:		Line 6:
	*Network Scanning		*Network Scanning
	*Security Information and Event Management		*Security Information and Event Management

			[[File:Detection_Capabilities_Matrix.png]]

	==Real-Time Detection==		==Real-Time Detection==

Jlawrence: /* Security Information and Event Management */

2024-10-30T19:37:26Z

Security Information and Event Management

← Older revision		Revision as of 19:37, 30 October 2024
Line 60:		Line 60:
	*Integration of IT and OT. Many tools are expanding to ingest data from a multitude of network monitoring tools and logging services to create a centralized place to evaluate vulnerabilities and network anomalies.		*Integration of IT and OT. Many tools are expanding to ingest data from a multitude of network monitoring tools and logging services to create a centralized place to evaluate vulnerabilities and network anomalies.
	*Organizations are establishing consolidated SIEM solutions between IT and OT. OT dedicated SIEMs are commonly deployed, often in a dedicated Security Operations Center (SOC).		*Organizations are establishing consolidated SIEM solutions between IT and OT. OT dedicated SIEMs are commonly deployed, often in a dedicated Security Operations Center (SOC).

			'''Relevant EPRI and industry Resources'''
			* [https://www.epri.com/research/programs/112046/results/3002014367 Security Event Monitoring Guideline: Generation Cyber Security]
			* [https://www.epri.com/research/programs/112046/results/3002014784 Security Status Monitoring: Generation Cyber Security - Computer Based Technology Transfer]
			* [https://www.epri.com/research/programs/112046/results/3002019701 Program on Technology Innovation: Integrated Security Operations Center and Monitoring and Diagnostics Digital Data Integration for Advanced Cyber-Physical Detection Capability—A Roadmap for the Energy Sector]
			*CIP-005-5 R1.1-R1.4, Identifying and Monitoring ESPs
			*CIP-005-5 R1.5, Detecting and Documenting Malicious Communications
			*CIP-007-6 R3, Malicious Code Prevention
			*CIP-007-6 R4, Security Event Monitoring
			*CIP-008-5 R2.3, Log Retention for Reportable Security Incidents
			*CIP-010-2 R1 and R2, Configuration Management
			*CIP-010-2 R3.1 and R3.2, Active Vulnerability Scanning
			*CIP-011-2 R1, Cyber System Information Protection

Jlawrence: /* Network Scanning */

2024-10-30T19:36:07Z

Network Scanning

← Older revision		Revision as of 19:36, 30 October 2024
Line 40:		Line 40:
	*Active Scanning: Active scanning tends to be more invasive as it actively sends packets to devices and can disrupt operations or cause device failures. Active scanning provides information for devices that can communicate across the scanning network range.		*Active Scanning: Active scanning tends to be more invasive as it actively sends packets to devices and can disrupt operations or cause device failures. Active scanning provides information for devices that can communicate across the scanning network range.
	*Scanning software continues to converge both IT and OT by providing more comprehensive views of system devices, vulnerabilities, and potential behavior anomalies.		*Scanning software continues to converge both IT and OT by providing more comprehensive views of system devices, vulnerabilities, and potential behavior anomalies.

			'''Relevant EPRI and Industry Resources'''
			* [https://www.epri.com/research/programs/112046/results/3002014369 Control System Protocols and Security Scanning: Guideline on Cyber Security Scanning for Generation Plant Control Systems]
			* [https://www.epri.com/research/programs/112046/results/3002014786 Guideline on Cyber Security Scanning for Generation Plant Control Systems Computer Based Technology Transfer]
			* [https://www.epri.com/research/programs/112046/results/3002021178 Industrial Control System Network Visibility Tool Use Cases]
			*CIP-005 R1.5, Electronic Security Perimeter
			*CIP-007 R3.1, Malicious Software Prevention
			*CIP-010 R2.1, Configuration Monitoring (High Impact BES Cyber Systems Only)
			*CIP-010 R3.1, Vulnerability Assessments

	==Security Information and Event Management==		==Security Information and Event Management==

Jlawrence: /* Real-Time Detection */

2024-10-30T19:33:07Z

Real-Time Detection

← Older revision		Revision as of 19:33, 30 October 2024
Line 19:		Line 19:
	*Common endpoint and network detection methods are well-established in OT systems.		*Common endpoint and network detection methods are well-established in OT systems.
	*Cloud-based detection and third-party information-sharing tools were not prevalent in recent utility surveys.		*Cloud-based detection and third-party information-sharing tools were not prevalent in recent utility surveys.

			'''Relevant EPRI Resources'''
			* [https://www.epri.com/research/programs/112046/results/3002011543 Real-Time Detection in Power Generation: Overview of Current State of Technology]
			* [https://www.epri.com/research/programs/112046/results/3002018751 Automated Asset Discovery Performance Testing of Generation Sector Protocol Passive Network Traffic Capture Files]
			* [https://www.epri.com/research/programs/112046/results/3002020292 Digital Twins – A Promising Technology for Data-Centric Cyber Security]
			* [https://www.epri.com/research/programs/112046/results/3002015258 Distributed Control Systems, Automation Technologies, and Embedded Security: Generation Cybersecurity]
			* [https://www.epri.com/research/programs/112046/results/3002021178 Industrial Control System Network Visibility Tool Use Cases]
			* [https://www.epri.com/research/programs/112046/results/3002019701 Program on Technology Innovation: Integrated Security Operations Center and Monitoring and Diagnostics Digital Data Integration for Advanced Cyber-Physical Detection Capability—A Roadmap for the Energy Sector]

	==Network Scanning==		==Network Scanning==

Jlawrence: /* Security Information and Event Management */

2024-10-30T13:43:27Z

Security Information and Event Management

← Older revision		Revision as of 13:43, 30 October 2024
Line 35:		Line 35:
	==Security Information and Event Management==		==Security Information and Event Management==
	Security information and event management (SIEM) becomes increasingly important as power generation operation technology becomes more digital and produces more alert information. SIEM solutions provide a means of identifying security events and enable near real-time detection capabilities across multiple environments. SIEM tools analyze aggregated security logs, system logs, and application logs from assets, which are then categorized into security events.		Security information and event management (SIEM) becomes increasingly important as power generation operation technology becomes more digital and produces more alert information. SIEM solutions provide a means of identifying security events and enable near real-time detection capabilities across multiple environments. SIEM tools analyze aggregated security logs, system logs, and application logs from assets, which are then categorized into security events.

	'''Challenges''' with security information and event management in power generation facilities include:		'''Challenges''' with security information and event management in power generation facilities include:
	*Configuration and tuning is complex. Recent EPRI surveys indicate that many organizations receive and evaluate hundreds to thousands of false positives daily.		*Configuration and tuning is complex. Recent EPRI surveys indicate that many organizations receive and evaluate hundreds to thousands of false positives daily.

Jlawrence: /* Security Information and Event Management */

2024-10-30T13:42:44Z

Security Information and Event Management

← Older revision		Revision as of 13:42, 30 October 2024
Line 34:		Line 34:

	==Security Information and Event Management==		==Security Information and Event Management==
	*Security information and event management (SIEM) becomes increasingly important as power generation operation technology becomes more digital and produces more alert information. SIEM solutions provide a means of identifying security events and enable near real-time detection capabilities across multiple environments. SIEM tools analyze aggregated security logs, system logs, and application logs from assets, which are then categorized into security events.		Security information and event management (SIEM) becomes increasingly important as power generation operation technology becomes more digital and produces more alert information. SIEM solutions provide a means of identifying security events and enable near real-time detection capabilities across multiple environments. SIEM tools analyze aggregated security logs, system logs, and application logs from assets, which are then categorized into security events.
	'''Challenges''' with security information and event management in power generation facilities include:		'''Challenges''' with security information and event management in power generation facilities include:
	*Configuration and tuning is complex. Recent EPRI surveys indicate that many organizations receive and evaluate hundreds to thousands of false positives daily.		*Configuration and tuning is complex. Recent EPRI surveys indicate that many organizations receive and evaluate hundreds to thousands of false positives daily.

Jlawrence at 13:41, 30 October 2024

2024-10-30T13:41:54Z

← Older revision		Revision as of 13:41, 30 October 2024
Line 32:		Line 32:
	*Active Scanning: Active scanning tends to be more invasive as it actively sends packets to devices and can disrupt operations or cause device failures. Active scanning provides information for devices that can communicate across the scanning network range.		*Active Scanning: Active scanning tends to be more invasive as it actively sends packets to devices and can disrupt operations or cause device failures. Active scanning provides information for devices that can communicate across the scanning network range.
	*Scanning software continues to converge both IT and OT by providing more comprehensive views of system devices, vulnerabilities, and potential behavior anomalies.		*Scanning software continues to converge both IT and OT by providing more comprehensive views of system devices, vulnerabilities, and potential behavior anomalies.

			==Security Information and Event Management==
			*Security information and event management (SIEM) becomes increasingly important as power generation operation technology becomes more digital and produces more alert information. SIEM solutions provide a means of identifying security events and enable near real-time detection capabilities across multiple environments. SIEM tools analyze aggregated security logs, system logs, and application logs from assets, which are then categorized into security events.
			'''Challenges''' with security information and event management in power generation facilities include:
			*Configuration and tuning is complex. Recent EPRI surveys indicate that many organizations receive and evaluate hundreds to thousands of false positives daily.
			*As more IoT/IT/OT devices are incorporated into power systems, the data that is ingested by SIEM tools will increase in complexity and quantity. Data duplication further challenges tool deployment.

			'''Current SIEM key practices''' include:
			*Integration of IT and OT. Many tools are expanding to ingest data from a multitude of network monitoring tools and logging services to create a centralized place to evaluate vulnerabilities and network anomalies.
			*Organizations are establishing consolidated SIEM solutions between IT and OT. OT dedicated SIEMs are commonly deployed, often in a dedicated Security Operations Center (SOC).

Jlawrence at 13:38, 30 October 2024

2024-10-30T13:38:09Z

← Older revision		Revision as of 13:38, 30 October 2024
Line 19:		Line 19:
	*Common endpoint and network detection methods are well-established in OT systems.		*Common endpoint and network detection methods are well-established in OT systems.
	*Cloud-based detection and third-party information-sharing tools were not prevalent in recent utility surveys.		*Cloud-based detection and third-party information-sharing tools were not prevalent in recent utility surveys.

			==Network Scanning==
			Scanning is critical to the generation plant cyber security strategy as it indicates network changes and software vulnerabilities. It can also identify gaps in hardening and segmentation.

			'''Challenges''' with network scanning in power generation facilities include:
			*Concerns about impacting operations limit active use scanning in OT networks.
			*Scanning must be configured and implemented carefully in OT networks to ensure operations are not negatively impacted. This is typically performed during a maintenance or outage period.

			'''Current scanning key practices''' include:
			*Scanning tools utilize one or more of the following types of scanning: network discovery, host discovery, unauthorized or abnormal network activity, and vulnerabilities
			*Passive Scanning: Passive scanning monitors network traffic by sniffing network traffic as it goes by and is less invasive than active scanning. Passive scanning only provides information for devices that do communicate through the monitoring point. Monitoring points are typically network TAPS or SPAN ports.
			*Active Scanning: Active scanning tends to be more invasive as it actively sends packets to devices and can disrupt operations or cause device failures. Active scanning provides information for devices that can communicate across the scanning network range.
			*Scanning software continues to converge both IT and OT by providing more comprehensive views of system devices, vulnerabilities, and potential behavior anomalies.

Jlawrence at 13:36, 30 October 2024

2024-10-30T13:36:05Z

← Older revision		Revision as of 13:36, 30 October 2024
Line 2:		Line 2:
	Real-time detection involves utilizing detection tools to inform users of potential network anomalies that might indicate cyber security events. Real-time detection is meant to be a means to aid system operators in preventing a cyber event before it causes loss of equipment and safety. Real-time detection typically involves: utilizing monitoring and alerting tools to collect network data and events aggregating and processing events displaying events and potential vulnerabilities and notifying system users and operators of events		Real-time detection involves utilizing detection tools to inform users of potential network anomalies that might indicate cyber security events. Real-time detection is meant to be a means to aid system operators in preventing a cyber event before it causes loss of equipment and safety. Real-time detection typically involves: utilizing monitoring and alerting tools to collect network data and events aggregating and processing events displaying events and potential vulnerabilities and notifying system users and operators of events

	'''Key detection topics'' include:		'''Key detection topics''' include:
	*Real-Time Detection		*Real-Time Detection
	*Network Scanning		*Network Scanning