Chapter 7: Active Security Monitoring

In the previous chapter, we looked at ways to passively be on the lookout for security incidents and risk development in our ICS environment. Even though being passive (sniffing, monitoring, event scrutinizing) is still the preferred way to detect security-related events and information, what follows is a discussion on how to use more involved methods to detect these events. If performed properly, active security monitoring techniques can be used effectively and without disrupting production, with the added benefit that active security monitoring tends to uncover more and more detailed security and risk-related data from our production network and connected systems.

In this chapter, we will look at the tools, techniques, activities, and procedures surrounding actively monitoring the industrial cybersecurity posture. We will discuss the thought process behind the techniques and tools, and then gain some hands-on experience with a couple of exercises...