ICS Zoning Scenario

Resources from this project
Archived resources from this project

This collection of resources, from the Cybersecurity Education for Advanced Manufacturing Organizations project, is part of the Industrial Control System Zoning Scenario. This scenario is a cybersecurity training module designed to educate students on the importance and implementation of network zoning using the Purdue Model within industrial control systems (ICS) to enhance security. During the scenario, students will

Discuss the concept of network zoning using the Purdue Model.
Learn how to create network zones using segmentation.
Demonstrate how hackers can take advantage of improperly segmented networks and intercept communications.
Demonstrate how network segmentation restricts a hackers ability to intercept communications.

Collection Description:

This scenario includes a PowerPoint presentation, a lab overview, a lab, lab questions and answers, a list of best practices, and a list of related videos. The presentation provides background information on ICS security zoning using the Purdue Model, outlining the different network zones such as the Enterprise Security Zone, Industrial Demilitarized Zone, and Manufacturing Zone. The presentation discusses the objectives of network segmentation, including its role in enhancing security and preventing unauthorized access. The potential risks associated with improper network segmentation are also highlighted. PDF and PowerPoint versions are included.

The 4-page overview includes a summary, learning outcomes, a description of the systems used in the scenario, a general lab description, a diagram of setup and deploy, and a list of resources for more information. During the lab, students "... use common security tools to observe how a hacker connected to the same zone as an Industrial Control System (ICS) can easily view and/or modify data being transferred within the ICS." Students also "... implement network segmentation by moving the ICS and client system to a different network segment." Lastly, students "... observe that this prevents the hacker from observing or modifying any ICS traffic." PDF and Word versions are included.

The 15-page lab includes a scenario overview and lab steps. Some of the main steps of the lab include installing systems, logging and verifying connectivity, network configuration, capturing and viewing data, and analyzing captured data.

The 2-page lab form questions include questions about capturing and analyzing data transmitted in different zones of a network, understanding the significance of specific register values, and addressing network traffic capture and security configuration issues. A 4-page answer sheet is also included. Both resources include PDF and Word versions.

For orientation purposes the zoning-Overview.pdf is included as a separate attachment and offers a sample of the type of material included in this learning module.

Below is a list of the files contained within the .zip attachment. The size of each file is included in parenthesis.

zoning-ate (15 files, 11.3 MB)