Unformatted Attachment Preview
PureLand Cyber Secrity Assessment
1/1/2014
Assessor: Luke Reissman
Disclaimer
This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not
provide any warranties of any kind regarding any information contained within. In no event shall the United States
Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect,
special or consequential damages and including damages based on any negligence of the United States Government or
its contractors or subcontractors, arising out of, resulting from, or in any way connected with this report, whether or not
based upon warranty, contract, tort, or otherwise, whether or not injury was sustained from, or arose out of the results of,
or reliance upon the report.
The DHS does not endorse any commercial product or service, including the subject of the assessment or evaluation in
this report. Any reference to specific commercial products, processes, or services by trademark, manufacturer, or
otherwise, does not constitute or imply its endorsement, recommendation, or favoring by DHS.
The display of the DHS official seal or other DHS visual identities on this report shall not be interpreted to provide the
recipient organization authorization to use the official seal, insignia or other visual identities of the Department of
Homeland Security. The DHS seal, insignia, or other visual identities shall not be used in any manner to imply
endorsement of any commercial product or activity by DHS or the United States Government. Use of the DHS seal
without proper authorization violates federal law (e.g., 18 U.S.C. §§ 506, 701, 1017), and is against DHS’s policies
governing usage of the seal.
The report is prepared and intended for internal use by the organization that made the request. The contents of this
report may be subject to government or private intellectual property rights. To request distribution of this report outside
the organization for which it was prepared, contact the CSET® Program Office. The contents of this report may be
reproduced or incorporated into other reports, but may not be modified without the prior express written permission of the
CSET® Program Office.
PureLand Cyber Secrity
Assessment
Page 2
Advisory
CSET is only one component of the overall cyber security picture and should be complemented with a robust cyber security program
within the organization. A self-assessment with CSET cannot reveal all types of security weaknesses, and should not be the sole
means of determining an organization’s security posture.
The tool will not provide an architectural analysis of the network or a detailed network hardware/software configuration review. It is not a
risk analysis tool so it will not generate a complex risk assessment. CSET is not intended as a substitute for in depth analysis of control
system vulnerabilities as performed by trained professionals. Periodic onsite reviews and inspections must still be conducted using a
holistic approach including facility walk downs, interviews, and observation and examination of facility practices. Consideration should
also be given to additional steps including scanning, penetration testing, and exercises on surrogate, training, or non-production
systems, or systems where failures, unexpected faults, or other unexpected results will not compromise production or safety.
CSET assessments cannot be completed effectively by any one individual. A cross-functional team consisting of representatives from
operational, maintenance, information technology, business, and security areas is essential. The representatives must be subject
matter experts with significant expertise in their respective areas. No one individual has the span of responsibility or knowledge to
effectively answer all the questions.
Data and reports generated by the tool should be managed securely and marked, stored, and distributed in a manner appropriate to
their sensitivity.
PureLand Cyber Secrity
Assessment
Page 3
TABLE OF CONTENTS
Table Of Contents .................................................................................................................. 4
Assessment Information ......................................................................................................... 5
Description Of Assessment .................................................................................................... 6
Executive Summary ............................................................................................................... 6
Standards Compliance .......................................................................................................... 7
Network Diagram ................................................................................................................... 8
Ranked Subject Areas ........................................................................................................... 9
PureLand Cyber Secrity
Assessment
Page 4
ASSESSMENT INFORMATION
Assessment Name:
PureLand Cyber Secrity Assessment
Assessment Date, (MM/DD/YYYY):
1/1/2014
Facility Name:
PureLand Wastewater Treatment Plant
City or Site Name:
Kalamazoo
State, Province or Region:
MI
Principal Assessor Name:
Luke Reissman
Assessor E-mail:
luke.x.reissman@wilmu.edu
Assessor Telephone:
302-555-1212
Additional Notes and Comments:
Contact(s):
PureLand Cyber Secrity
Assessment
Page 5
DESCRIPTION OF ASSESSMENT
Ficticious Cyber Security Self Evaluation
EXECUTIVE SUMMARY
Cyber terrorism is a real and growing threat. Standards and guides have been developed, vetted, and widely accepted to assist with
protection from cyber attacks. The Cyber Security Evaluation Tool (CSET) includes a selectable array of these standards for a tailored
assessment of cyber vulnerabilities. Once the standards were selected and the resulting question sets answered, the CSET created a
compliance summary, compiled variance statistics, ranked top areas of concern, and generated security recommendations.
PureLand Cyber Secrity
Assessment
Page 6
STANDARDS COMPLIANCE
PureLand Cyber Secrity
Assessment
Page 7
NETWORK DIAGRAM
PureLand Cyber Secrity
Assessment
Page 8
RANKED SUBJECT AREAS
This chart shows subject areas needing the most attention. Each bar represents the labeled subject area’s weighted contribution so
that the combined total always equals 100%. The weighted contribution includes the importance of both the question and the subject
area, as well as the percentage of missed questions in that subject area.
PureLand Cyber Secrity
Assessment
Page 9
PureLand Cyber Secrity
Assessment
Page 10
PureLand Wastewater Current State Description
Objective
This assignment requires the student to assess the current state of Cyber Security for PureLand
Wastewater. This assessment can be used as part of the project to develop and present a Cyber
Security Improvement Plan.
Quality of assessment
Student should strive to ensure the Current State provides a clear and concise description of the
security status for PureLand based on the document titled, Site Summary Report PureLand
Wastewater.doc on Blackboard in the PureLand Case Study section.
Instructions for assignment
1. Read the PureLand Cyber Security Case Study document to understand the premise of this
assignment. In summary, you are a consultant hired by PureLand Wastewater to improve
their CyberSecurity due to new CFATS regulations from the US Department of Homeland
Security.
2. Write 1-2 pages on your opinion of the current state of security within their company.
Highlight the areas where they are strong or weak. Consider using a SWOT analysis if you
have learned that technique, but it’s not required.
3. Submit your document to Blackboard before the due date on the assignment.
Advanced Persistent Threat Impacts
SEC 6080 Week-3 Research activity
Objective
Examine the potential impact of Advance Persistent Threats and Cyber War on Industrial Control
Systems
Instructions for assignment
1. Define what an Advanced Persistent Threat(APT) is.
2. How might an APT be used in a Cyber War to inflict damage on Industrial Control Systems?
3. Provide an example of an APT being used to cause damage to an Industrial Control System