Cybersecurity of industrial systems IEC-62443

INTRODUCTION AND SECURITY STANDARDS

• Introduction with key concepts and differences between IT and OT environments
• Threat overview and industrial cybersecurity risk analysis
• Introduction to IEC 62443 methodology and risk assessment
• Practical workshops on the definition of a SuC (System under consideration) and risk assessment according to IEC 62443
• Key concepts of IEC 62443 (zones, conduits and risk analysis methodologies)
• Defense-in-depth and the different layers of security (organizational, physical, perimeter)
• Demonstration: access system security, using Mifare technology as an example

NETWORK SECURITY AND CRYPTOLOGY

• System security and basic network security principles
• Demonstration of a brute-force attack on a WPA2 network
• Introduction to cryptology: presentation of key concepts (symmetric and asymmetric encryption, hash, salt and pepper)
• Demonstration of how to exploit a vulnerability in precompiled Python files containing secrets

PRODUCT SECURITY AND SECURE ARCHITECTURE

• Secure Software Lifecycle (SDLC) and best practices for secure software development
• Host and application security
• Demonstration of vulnerabilities affecting poorly protected USB ports with personnel unaware of attacks from seemingly innocuous devices.
• Demonstration of a replay attack using exploits on a bulletin board.
• Data security
• Practical workshops on detailed risk assessment, risk estimation and definition of security levels according to IEC 62443.
• Methods for identifying and dealing with vulnerabilities
• Presentation of best practices for designing a robust and secure architecture

Detailed programm

DAY 1 

INTRODUCTION

• Introducing SERMA

CYBERSECURITY IN THE INDUSTRIAL WORLD

• Understanding cybersecurity in an industrial context
• Threats and attack methodologies
• IT / OT divergence and convergence

ISA/IEC 62443 STANDARD

• Understanding the concepts of the standard
• Risk assessment process
• Initial assessment of detailed risks
• Risk acceptance and comparison

WORKSHOPS

• WS1 – Define the system under consideration
• WS2 – Perform initial risk assessment
• WS3 – Partition Zones and Conduits

DAY 2

ISA/IEC 62443 STANDARD

• Detailed risk assessment process

DEFENSE IN DEPTH

• Systems – Physical security
• Systems – Perimeter security
• Systems – Internal network security

DEMONSTRATION

• Classic Mifare case
• Brute force WPA2 attack and ARP spoofing
• Crypto: poorly implemented encryption

CRYPTOGRAPHY

• Symmetric and asymmetric
• Certificate and PKI (Public Key Infrastructure)
• Hash function with salt and pepper

WORKSHOPS

• WS4 – Detailed risk assessment (1/2) – Threat scenarios

DAY 3

ISA/IEC 62443 STANDARD

• Secure product development lifecycle
• Fundamental requirements

DEFENSE IN DEPTH

• Product – Host security
• Product – Application security
• Product – Data security

DEMONSTRATION

• Rubber Ducky – USB attack
• Radio frequency – Replay attack

WORKSHOPS

• WS5 – Detailed risk assessment (2/2) – Risk estimation
• WS6 – Definition of security levels
• WS7 – Specification of cybersecurity requirements

VULNERABILITY DETAILS

• MCS, CVE & CVSS

No industrial safety experience required. However, knowledge of industrial systems and some notions of IT, electronics and embedded software are desirable.

• A PC / MAC with Teams installed and unrestricted access to the Internet.

If remote :

• Stable Internet access via Ethernet or Wi-Fi with a decent bandwidth (1.2 Mb/s minimum downstream is recommended).

This course is aimed at people interested in the design aspects of industrial architecture. Electronics enthusiasts and professionals, as well as IT security professionals (developers, architects, integrators, hardware designers, project managers).

Expert in industrial cybersecurity.

• Projected PowerPoint presentation
• Interactive web platform (Klaxoon)
• Practical attack/defense scenario on a connected mini-factory

Assessments at the beginning and end of the course, quizzes, etc.

A training certificate complying with the provisions of Article L.6353-1 paragraph 2 is issued to the trainee.

5 working days before the start of the course (if OPCO funding).

2023 :

Satisfaction rate : 81%

Number of sessions : 2

Number of trainees : 11