POWER June 2015 - 42

CYBERSECURITY
Network Security Monitoring (NSM) Resources
■ Cliff Stoll, The Cuckoo's Egg: Tracking a
Spy Through the Maze of Computer Espionage
(1989)
■ One-hour PBS NOVA Special (1990) based
on Cliff Stoll's experience: https://www.
youtube.com/watch?v=EcKxaq1FTac
■ Todd Heberlein et al., A Network Security
Monitor (1990): seclab.cs.ucdavis.edu/
papers/pdfs/th-gd-90.pdf
in 1988. This article shows that these same
tools and techniques can be applied to defending
ICS.
NSM needs two components to be successful:
at least one person with a questioning
attitude and the right tools for that person
to collect and analyze the data while keeping
a lookout for attacks. Collecting logs and
data, detecting anomalies, and performing
analysis on the anomalies (hunting for evil)
is the NSM cycle. This is the daily job of the
security analyst-to be on constant watch
for strange things on a network that may be
a breach. The goal is to make the time between
the breach occurring and detection of
■ Richard Bejtlich, The Practice of Network
Security Monitoring (2013): nostarch.
com/nsm
■ Chris Sanders & Jason Smith, Applied
Network Security Monitoring (2013):
appliednsm.com
■ The NSM Wiki: nsmwiki.org
■ The open source Linux distribution for
NSM, Security Onion: securityonion.net
the breach as short as possible.
For instance, when I was a new employee
at Mandiant, I was issued a new laptop and
was allowed to download programs I needed
downloaded was and if I intended to install it.
I was blown away at how fast they responded!
If the downloaded tool had been malware,
they would have started their response very
quickly. Often, organizations don't know
they have been breached for many months or,
in some cases, years.
What is important to know about NSM
is that it uses passive collection, not active
scanning of the ICS network, which we know
can cause serious consequences. Active scanning
uses software to probe the network to
find devices, open ports, and even vulnerabilities.
If not done properly, active scanning
can cause control system devices to malfunction.
Passive collection is monitoring traffic
on Ethernet and serial networks, which will
not affect control system devices.
Last year, 245 cyber incidents were reported
for ICS owners, 79 of which were in the
energy sector.
to do my job. I downloaded a free Modbus
tool; two minutes later I received an email
from our SOC analyst asking what the file I
To passively monitor a network for
NSM, you need at least one network sensor
and a way to get a copy of the network
Promoting The Safe, Efficient, And Economic Use
Of Sub-Bituminous Coal By Generating Companies.
Experience Three World-Class User Group Meetings:
PRB Coal Users' Group
Annual Meeting
April 18-21, 2016
New Orleans, LA
www.prbcoals.com
Asian SBC Users' Group
Conference
October 12-15, 2015
Bangkok, Thailand
www.asiansbcusers.com
Philippine Coal Plant Users'
Group Technical Forums
Oct 8-9, 2015
Manila, Philippines
www.pcpug.org
Become a Member Today!
Gain access to user guidelines and best practices, e-media educational tools, archives to 14+ years
of annual meeting presentations, targeted networking opportunities with generating companies and
leading service providers, and connect on member forums.
Gain even more benefits by becoming an
Industry or Generating Company Sponsor
For more information contact: prb@tradefairgroup.com, 713-343-1879
Contact: Christy Coleman, ccoleman@accessintel.com, 713-343-1873
25689
42
www.powermag.com
POWER | June 2015

https://www http://www.youtube.com/watch?v=EcKxaq1FTac http://www.appliednsm.com http://www.nsmwiki.org http://seclab.cs.ucdavis.edu/ http://www.securityonion.net http://www.prbcoals.com http://www.asiansbcusers.com http://www.pcpug.org http://www.powermag.com

POWER June 2015

Table of Contents for the Digital Edition of POWER June 2015