Introduction to Penetration Testing and Vulnerability Assessments (PTVA) for Industrial Control Systems/ Operating Technologies (ICS/OT)
In Industrial Plant and Industrial Control System (ICS) environment, the growing connectivity among industrial computing Systems (PLC, DCS, ESD, SCADA), the increasing extensibility of systems, and the unbridled growth of the size and complexity of systems have made software security a bigger problem now than in the past. In addition, it is an operational imperative to properly protect an organization's information assets by following a comprehensive and structured approach to protect against risks that an organization may face. In an attempt to solve the security problem and comply with the mandated security regulations, security experts have developed various security assurance methods, including proof of correctness, layered design, software engineering environments, Penetration Testing and Vulnerability Assessments (PTVA).
PTVA is a comprehensive method to test the complete, integrated, operational and reliable computer base consisting of hardware, software and people. The process involves an active analysis of the system for any potential vulnerabilities, including poor or improper system configuration, hardware and software flaws, and operational weaknesses in the process or technical countermeasures. A key criterion for achieving this objective is that each organization should have at least some Penetrations Testing and Vulnerability Assessment tools. Experienced instrumentation control team and team of IT professionals, can collectively select PTVA tools combined with skills and expertise gained from various Industrial sectors such as Oil/Gas production, Power Generations, Power distribution, Water and Waste Water Treatment, pharmaceutical, etc.
WHY PTVA...
The main purpose of PTVA is to identify security vulnerabilities within a controlled environment so that they can be removed before unauthorized users exploit them. IT system professionals use penetration testing to address issues associated with assessing vulnerabilities, with a focus on high-severity vulnerabilities. Penetration testing is a valuable assurance assessment tool that benefits both business and its operations.
PTVA in an ICS/OT environment should occur in a controlled environment to avoid process/product disruptions. Subject matter experts who have knowledge of ICS and IT should work on these critical tasks and activities.
WHAT IS INVOLVED IN PENETRATION TESTING...
Two aspects should be considered in determining the scope and goals of penetration testing: the test strategies and the types of tests used.
PENETRATION TESTING STRATEGIES...
Depending on the quantity of information the tester has, there are three penetration testing strategies: Black Box, White Box and Grey Box. Based on the specific objectives to be attained, there are two penetration testing strategies that include external and internal testing.
PENETRATION TESTING TYPES...
There are three areas that should be tested in penetration testing: the physical structure of the system, the logical structure of the system, and the response or workflow of the system. These three fields define the scope and types of penetration tests, namely network, application and social engineering.
To receive latest update on ICS/OT cyber security, pls click here