Security of industrial control systemsSyllabus

Subject code

İF-2216y

Credits

5

Student workload

90

Semester

Autumn semester

Academic year

4

Subject type

Mandatory

Form of education

Full-time

Language of instruction

Azerbaijani

In-class hours

a) 30 saat - mühazirə b) 15 saat - seminar c) 15 saat - laboratoriya

Out-of-class hours

a) 50 saat - TSİ b) 40 saat - MRTSİ

The subject involves the formation of theoretical knowledge and practical skills in industrial management systems and cyber security of critical infrastructures. within the scope of the subject, the differences between IT and OT environments, the architecture of industrial control systems and the working principles of basic industrial technologies such as scada, plc, dcs, rtu, HMI are studied. students are introduced to the features and security risks of modbus, dnp3, ICCP and other industrial communication protocols. methods of identifying, analyzing and eliminating vulnerabilities, cyber threats and risks in critical infrastructures are reviewed. it also examines the adaptation of appropriate cybersecurity measures applied in the IT environment to OT systems and approaches to ensuring security in the industrial environment. the subject is aimed at forming the skills of students to analyze cyber security events that have occurred in industrial systems, identify the root causes and choose appropriate protective measures.

• lecture
• laboratory work
• seminar
• presentations
• interactive discussion
• problem-based learning

1. 1

   CLO 1: Must know the differences between IT and OT environments, the protocols and operation of OT systems.

2. 2

   CLO 2: Must be able to identify gaps/weaknesses related to systems in critical infrastructures and learn how to eliminate them.

3. 3

   CLO 3: Must be familiar with systems such as plc, dcs, rtu, hmi, AVR in critical infrastructures.

4. 4

   CLO 4: Must be able to identify potential cyber threats and perform risk analysis on critical infrastructures.

5. 5

   CLO 5: Must know how to apply appropriate cyber security steps applied in an IT environment to an OT environment.

6. 6

   CLO 6: Must be able to analyze events related to critical infrastructures and know how to apply appropriate steps to find the root cause.

1. 1.
   An overview of industrial management systems (mis).Lecture

   Within the framework of the subject, the concept, purpose and role of the industrial management systems (is) in the operation of critical infrastructures are studied. the main components and systems involved in the management of industrial processes, their functions and their interaction are reviewed. the main differences between IT and OT environments in terms of architecture, operational goals, security priorities and management characteristics are explained. a systematic comparison of IT and OT environments is also carried out and the unique characteristics of industrial systems are investigated.

2. 2.
   General architecture of SISLecture

   Within the subject, the general architecture and basic structural levels of industrial management systems are studied. based on the purdue model, the layers of the industrial network, the systems and devices located in these layers, and the interactions between them are explained. key design considerations and operational requirements considered when designing a SIS architecture are reviewed. also, the location of the main industrial facilities within the architecture, working principles and characteristics are investigated.

3. 3.
   Comprehensive risk managementLecture

   Within the framework of the topic, the process of complex risk management in industrial management systems and its main stages are studied. the principles of identifying information and operational assets, determining their importance and criticality are explained. system architecture, functions, components, and operating environment characterization are reviewed. also, issues of risk analysis that can affect the system through the identification of potential threats and threat modeling are investigated.

4. 4.
   Modern architecture of SISLecture

   Within the subject, modern architectural approaches of industrial management systems and their security features are studied. the interaction of various systems, network levels and security mechanisms is considered in the modern SIS environment. the principles of the defense in depth (did) security model based on multi-level defense and its application in industrial systems are explained. it also explores the role of deploying various security controls at several levels of defense and forming a unified security architecture.

5. 5.
   Sis environment equipmentLecture

   In the framework of the topic, the main equipment used in the construction of the industrial management systems (sis) environment and their functions are studied. the working principles of basic industrial devices such as plc, rtu, dcs, hmi, industrial servers, sensors and actuators are reviewed. the role of these equipments in monitoring, management and automation of industrial processes is explained. interactions between different SIS equipment and their integration in a single industrial management environment are also investigated.

6. 6.
   Security considerations for virtual environmentsLecture

   Within the framework of the subject, the application of virtualization technologies in the environment of industrial management systems (sis) and their security features are studied. the use of virtual machines, hypervisors and virtual networks in industrial systems and the opportunities they create are reviewed. the main security risks and vulnerabilities that may arise in virtualized SIS environments are explained. it also examines key defenses for virtual resource isolation, access control, configuration protection, and security.

7. 7.
   Industrial demilitarized zone (idmz)Lecture

   Within the topic, the concept, purpose and role of the industrial demilitarized zone (idmz) in ensuring security between IT and OT networks are studied. the location of the IDMZ in the industrial network architecture and its function in limiting direct communication between networks is explained. the main stages of the IDMZ design process, the principles of defining security zones and data flows are reviewed. also, the main security controls applied in the IDMZ environment and the organization of secure data exchange are examined.

8. 8.
   Secure SIS architectureLecture

   Within the framework of the topic, the principles of building the network architecture of industrial management systems, taking into account security requirements, are studied. in the SIS environment, the division of networks into zones and security levels, the limitation of inter-system connections and the management of data flows are explained. the role of network segmentation, multi-level defense, and minimal access principles in shaping a secure architecture is reviewed. also, issues of ensuring compatibility between operational continuity and security requirements of industrial systems are investigated.

9. 9.
   Analysis of cyber security issues in SISLecture

   Within the framework of the topic, the main cyber security problems existing in industrial management systems and their causes are studied. the unique characteristics of SIS environments, such as long-lived equipment, outdated technologies, limited upgradeability, and high availability requirements, are considered. sənaye sistemlərinə xas zəifliklər, kiber təhdidlər və onların əməliyyat proseslərinə mümkün təsirləri izah edilir. it also examines the operational and technological limitations that must be considered when implementing security measures in the SIS environment.

10. 10.
    Təhlükəsizlik zonaları arasında təhlükəsiz qarşılıqlı əlaqənin müəyyən və idarə edilməsiLecture

    Within the framework of the topic, the principles of determining and safely managing the interaction between different security zones in industrial management systems are studied. approaches to defining cross-zone data flows, limiting authorized connections, and applying security controls are reviewed. methods of gathering and centralizing monitoring data from various sources for tracking security incidents are explained. also, the use of collected data for security assessment of inter-zone connections and detection of potential threats is investigated.

11. 11.
    Passive security monitoringLecture

    Within the scope of the topic, the purpose, principles and application methods of passive safety monitoring in industrial management systems are studied. processes for collecting, centralizing, and correlating event logs from various system and network sources are reviewed. the role of host-based agents in monitoring system activity and obtaining security information is explained. it also examines the application of SIEM systems in security event analysis, correlation and detection of potential threats.

12. 12.
    Ics-də zərərli proqramların aşkarlanması və analiziSeminar

    Sənaye idarəetmə sistemlərində zərərli proqramların aşkarlanması üsulları, sistemlərin yoluxmasına səbəb olan amillər və zərərli proqramların ICS mühitlərinə potensial təsirləri araşdırılır. zərərli proqramların ilkin analizi, davranış göstəricilərinin müəyyənləşdirilməsi və təhlükəsizlik hadisələrinin araşdırılması prinsipləri öyrənilir.

    • • ftn1: azərbaycan tarixinin dövrlərinin əsas mahiyyəti izah edilir.
    • • ftn3: tələbələrin bu və ya digər məsələlərlə bağlı obyektiv mövqeyini formalaşmasına nail olunur.
    • • ftn2: azərbaycan tarixi üzrə bəzi mübahisəli məsələlərə aydınlıq gətirilir.
    • • ftn4: tələbələrin ən azından minimum məlumat əldə etməsi, mövzular ətrafında öz fikrinin formalaşmasının səviyyəsi yoxlanılır.
    • • ftn5: tələbələrə qədim tariximizin müasir dövrlə uzlaşdırılması vərdişləri aşılanır.
13. 13.
    Industrial cyber security – threat huntingLecture

    Within the framework of the topic, the purpose, basic principles and application approaches of threat hunting in the environment of industrial management systems are studied. the process of proactively searching for hidden and persistent threats that can evade existing security controls in a SIS environment is explained. techniques for identifying potential threats based on network traffic, system and event logs, abnormal behavior, and other security data are reviewed. it also examines the issues of safely implementing the threat hunting process, taking into account the operational characteristics of the industrial environment.

14. 14.
    Different types of cyber security assessmentLecture

    Within the framework of the topic, the main approaches and assessment types used for assessing the state of cyber security in industrial management systems are studied. the stages of the cyber kill chain relevant to the SIS environment and the analysis of attack activities by these stages are reviewed. security incident detection, analysis, localization, elimination and systems recovery processes are explained. it also examines the use of the results of cyber security assessments in incident management and prevention of future attacks.

1. Brooks, charles j., and philip a. craig jr. practical industrial cybersecurity: ics, industry 4.0, and iiot. john wiley & sons, 2022.
2. Ackerman, pascal. industrial cybersecurity: efficiently monitor the cybersecurity posture of your ICS environment. packt publishing ltd, 2021.
3. Smith, paul. pentesting industrial control systems: an ethical hacker's guide to analyzing, compromising, mitigating, and securing industrial processes. packt publishing ltd, 2021.
4. Imamverdiyev, yadigar n. "analysis OF CYBERSECURITY PROBLEMS IN PROCESS CONTROL systems." problems of information technology (2021): 16-29.