Global ICS Vendor Cyber security "best practie"

[Shlomi_Feldman]

Schneider Electric recommend their customers the following best practices to secure their industrial networks

• Locate control and safety system networks and remote devices behind firewalls, and
    isolate them from the business network.
• Physical controls should be in place so that no unauthorized person would have access
    to the ICS and safety controllers, peripheral equipment or the ICS and safety networks.
• All controllers should reside in locked cabinets and never be left in the “Program” mode.
• All programming software should be kept in locked cabinets and should never be
   connected to any network other than the network for the devices that it is intended.
• All methods of mobile data exchange with the isolated network such as CDs, USB
   drives, etc. should be scanned before use in the terminals or any node connected to
   these networks.
• Laptops that have connected to any other network besides the intended network should
   never be allowed to connect to the safety or control networks without proper sanitation.
• Minimize network exposure for all control system devices and/or systems, and ensure
   that they are not accessible from the Internet.
• When remote access is required, use secure methods, such as Virtual Private Networks
   (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the
  most current version available. Also recognize that VPN is only as secure as the
 connected devices.

we can notice immediately that above the physical security solutions, the vendor recommend the use of Firewall for segmentation, threat detection and VPN for remote connectivity. that proves once again how our core solutions are more than relevant to improve cyber-security in OT networks. 

[_Val_]

@Shlomi_Feldman are you planning any white paper with this info?

[Shlomi_Feldman]

Hi

I don't think so of writing special whitepaper about it.

as most of the issues appear in the current whitepaper, I think we will just modify the current paper

[Shlomi_Feldman]

In my initial post I shared with you mitigation "best practice" by Schneider Electric.
In the following link https://ics-cert.us-cert.gov/advisories/ICSA-19-113-01 You may find details and recommendation from Rockwell Automation another global OT vendor. you will immediately notice the similarity between the vendors recommendation and how it correlates with our security solutions for the ICS/OT networks