CySA+
  • CySA+ CS0-002 Exam Objectives
  • Threat Intelligence Cycle
  • Intelligence Sources
  • Security Intelligence Sharing
  • Threat Classification and Threat Actors
  • Threat Research and Indicators of Compromise
  • Attack Frameworks and The Cyber Kill Chain
  • Defining Threat Modeling and Threat Hunting
  • Vulnerability Identification and Validation
  • Vulnerability Scan Results and CVSS Scores
  • Nmap and Enumeration
  • Security Controls
  • Defense in Depth Security Baselines
  • Security Trend Analysis
  • Remediation Issues
  • Asset, Change, and Configuration Management
  • Software Development Lifecycle & Development Models
  • Software Assessment and Code Review
  • Mitigating Attack Types Part 1
  • Mitigating Attack Types Part 2
  • Mitigating Attack Types Part 3
  • Password Cracking and Hashing
  • Privilege Escalation & Man-in-the-Middle
  • Network Based IoCs
  • Host Based IoCs
  • Network Architecture and Segmentation
  • Network Traffic, Packet, and Protocol Analysis
  • Pentesting and Active Defense
  • Firewalls
  • URL Analysis & DNS in Malware
  • Network Access Control and Port Security
  • Identity and Access Management (IAM)
  • Web Application Scanners
  • SSL/TLS Digital Certificate Management
  • Mobile Threats
  • Email Threats and Mitigation
  • Data Loss Prevention (DLP)
  • Endpoint Security and Behavior Analysis
  • Hardware Assurance
  • Blackholes and Sinkholes
  • IoT, Embedded Systems & ICS/SCADA Threats
  • Log Analysis & Continuous Security Monitoring
  • SIEM and Event Correlation
  • Malware Analysis
  • Cloud Models and Service Threats
  • Cloud Automation and Other Cloud Threats
  • VDI, Containers, and Microservices
  • CI/CD, IaC, DevOps
  • AI and Machine Learning
  • Digital Forensics
  • Technical Controls for Securing Data
  • Non-Technical Controls for Securing Data
  • Security Policies and Procedures
  • Continuity Planning and Risk Assessment
  • Incident Response Phases and Communication
Powered by GitBook
On this page

IoT, Embedded Systems & ICS/SCADA Threats

  • Limited hardware.

  • Designed without security best practices.

  • No admin interfaces.

  • Embedded OS

    • Computers designed for a single function

    • Static systems

    • SoC – System on a chip

    • RToS – Real-Time Operating System

    • FPGA – Field programmable gate arrays

  • Building Automation Systems (BAS)

    • Enterprise-level “smart home”

    • Security overlooked

    • PAC – Physical Access Control

  • Vehicles and Drones

    • From entertainment systems to self driving cars

    • ECU – Electronic Control Unit

    • CAN – Controller Area Network (Bus)

    • OBD interface

  • Industrial Control Systems (ICS)

    • Automating control machinery, managing critical infrastructure: power, health, nuclear, communications, water, etc

    • ICS vs DCS (Distributed Control System)

    • PLCs connected by Fieldbus or Ethernet

  • Supervisory Control and Data Acquisition (SCADA)

    • A SCADA system controls large scan ISCes, with multiples sites

    • Separate network, air gapped

    • Security?

      • No updates

      • Monitor all links

      • Web Apps

      • Legacy PC operating systems

      • Physical security: USB, CD-ROMs

      • Dedicated SCADA security systems & data diodes

  • Modbus

    • ICS protocol

    • Updates configurations on PLCs

PreviousBlackholes and SinkholesNextLog Analysis & Continuous Security Monitoring

Last updated 2 years ago