Summary

In this chapter, we proved our hypothesis that suspicious external connections are going into the industrial zone. We landed at this conclusion by observing the interactions with industrial equipment from all connections into the industrial zone that were discovered over a 7-day period. We eliminated the legitimate connections by finding anomalies associated with a suspicious connection and investigated the suspicious system on the enterprise network to find the smoking gun, which came from the discovery of a connection into the enterprise system from a Chinese IP address out on the internet.

This concludes the Threat Hunting part of this book. The next chapter will be the first chapter of Section 4, Industrial Cybersecurity Assessment. That first chapter gives an introduction to the various assessment types that can help us to verify the effectiveness and correctness of our security program.