![](https://csdnimg.cn/release/download_crawler_static/4827955/bg5.jpg)
3
Insights on IT risk | December 2011
In the ICS environment, the prioritization of security attributes is
reversed in comparison to corporate IT environment. Availability is
usually a key concern, while integrity and condentiality are
pushed aside in order to ensure easy and fast data ow between
critical components operating in real time. As a result, the approach
to securing ICS environments differs dramatically from the one
followed in corporate environments. Knowing that, penetration
tests should be customized to meet the reality of the ICS environment
so that conclusions and recommendations are valuable and realistic.
In most cases, penetration testing of ICS networks follows the same
basic steps as tests performed on traditional IT networks. However,
the manner in which the test is conducted must be tightly controlled,
with special attention given to concerns specic to an ICS environment.
The key to successful penetration testing within an ICS environment
is thorough communication and understanding between the ICS
support engineers and the penetration testers. ICS support engineers
should be given the opportunity to ask any questions concerning
the testing process, the methodology used, and the precautions taken
by the tester to maintain the operational integrity of production
systems. Penetration testers must have a clear understanding of
the implications of testing within an ICS environment. Any testing
activities that could potentially disrupt critical servers must be
excluded. Alternatives may be discussed between the ICS support
engineers and the penetration testers to determine whether the
alternative test is appropriate, but the health of the process as a
whole must take precedence over any testing objective.
Rules of engagement
Before the test begins, the rules of engagement should be clearly
dened and should include the expected outcome of testing. In addition:
• ICS support engineers should work with the testing team to
understand the team’s approach and what tools will be used during
the test. If automated or invasive tools are to be used, both teams
should understand the impact of the tools on the environment and,
if necessary, use special precautions to prevent adverse effects.
• The ICS team should identify the specic scope of the engagement
in terms of network ranges, hosts or applications to be included
in the test as well as those explicitly excluded from specic types
of testing or from the assessment altogether. Prior approval
should be received before testing systems that are hosted or
administered by third parties.
• Communication protocols should be established — in advance of
testing — that dene the means of escalating vulnerabilities identied
and any system availability issues observed by the testing team.
• All individuals performing the testing should provide contact
information to ICS support engineers in case testing must be
halted for any reason.
• ISC support engineers should provide regular briengs to system
operators throughout all evolutions of testing. This may include the
creation of additional procedures for operators to troubleshoot
anomalies with ICS support engineers who have an understanding
of the testing being conducted.
Penetration testing approach