Chapter 6: Passive Security Monitoring

In the previous chapter, we discussed security monitoring in general. We went over the most common ways we can perform security monitoring in our Industrial Control System (ICS) environment—namely, passive and active security monitoring. In this chapter, we are going to take a closer look at passive security monitoring. We will discuss what passively monitoring for security incidents entails, an look at common tools, techniques, activities, and procedures around passive monitoring of the industrial cybersecurity posture. This chapter includes exercises to help you set up a firewall, an ICS-oriented Intrusion Detection System (IDS) solution, and Security Onion. The combination of these three solutions allows holistic coverage of passive security monitoring and will be used throughout the rest of the book in other activities, such as threat-hunting exercises.

We will cover the following topics in this chapter:

• Passive security...