3
Insights on IT risk | December 2011
In the ICS environment, the prioritization of security attributes is
reversed in comparison to corporate IT environment. Availability is
usually a key concern, while integrity and condentiality are
pushed aside in order to ensure easy and fast data ow between
critical components operating in real time. As a result, the approach
to securing ICS environments differs dramatically from the one
followed in corporate environments. Knowing that, penetration
tests should be customized to meet the reality of the ICS environment
so that conclusions and recommendations are valuable and realistic.
In most cases, penetration testing of ICS networks follows the same
basic steps as tests performed on traditional IT networks. However,
the manner in which the test is conducted must be tightly controlled,
with special attention given to concerns specic to an ICS environment.
The key to successful penetration testing within an ICS environment
is thorough communication and understanding between the ICS
support engineers and the penetration testers. ICS support engineers
should be given the opportunity to ask any questions concerning
the testing process, the methodology used, and the precautions taken
by the tester to maintain the operational integrity of production
systems. Penetration testers must have a clear understanding of
the implications of testing within an ICS environment. Any testing
activities that could potentially disrupt critical servers must be
excluded. Alternatives may be discussed between the ICS support
engineers and the penetration testers to determine whether the
alternative test is appropriate, but the health of the process as a
whole must take precedence over any testing objective.
Rules of engagement
Before the test begins, the rules of engagement should be clearly
dened and should include the expected outcome of testing. In addition:
• ICS support engineers should work with the testing team to
understand the team’s approach and what tools will be used during
the test. If automated or invasive tools are to be used, both teams
should understand the impact of the tools on the environment and,
if necessary, use special precautions to prevent adverse effects.
• The ICS team should identify the specic scope of the engagement
in terms of network ranges, hosts or applications to be included
in the test as well as those explicitly excluded from specic types
of testing or from the assessment altogether. Prior approval
should be received before testing systems that are hosted or
administered by third parties.
• Communication protocols should be established — in advance of
testing — that dene the means of escalating vulnerabilities identied
and any system availability issues observed by the testing team.
• All individuals performing the testing should provide contact
information to ICS support engineers in case testing must be
halted for any reason.
• ISC support engineers should provide regular briengs to system
operators throughout all evolutions of testing. This may include the
creation of additional procedures for operators to troubleshoot
anomalies with ICS support engineers who have an understanding
of the testing being conducted.
Penetration testing approach
剩余23页未读，继续阅读
weisec99
- 粉丝: 0
- 资源: 2
我的内容管理
展开
最新资源
- 解决本地连接丢失无法上网的问题
- BIOS报警声音解析：故障原因与解决方法
- 广义均值移动跟踪算法在视频目标跟踪中的应用研究
- C++Builder快捷键大全：高效编程的秘密武器
- 网页制作入门：常用代码详解
- TX2440A开发板网络远程监控系统移植教程：易搭建与通用解决方案
- WebLogic10虚拟内存配置详解与优化技巧
- C#网络编程深度解析：Socket基础与应用
- 掌握Struts1：Java MVC轻量级框架详解
- 20个必备CSS代码段提升Web开发效率
- CSS样式大全：字体、文本、列表样式详解
- Proteus元件库大全：从基础到高级组件
- 74HC08芯片：高速CMOS四输入与门详细资料
- C#获取当前路径的多种方法详解
- 修复MySQL乱码问题：设置字符集为GB2312
- C语言的诞生与演进：从汇编到系统编程的革命
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
