Some months ago doing a research for a job assignment, I ended up in scadahacker.com which is an ICS specific cyber security blog. Among the books the blog recommends is Industrial Network Security, I did not think about it twice and bought it. I was not familiar enough with the area to understand it, so this book introduced me to some foundational areas if you are keen to develop a career in this niche of cyber security or you are working closely to ICS/OT.
This book is mainly addressed to professionals currently maintaining OT ( operational technologies) and who are tasked with securing these technologies. For the Security professional, the book will introduce a good foundation to understand the architecture and how to assess and secure it but the book’s main audience is undoubtedly the ICS/OT professional.
Most of the book focuses around cyber security so a professional already in the field will not get much out of these chapters, however, there are some but not many chapters dedicated to ICS/OT.
I really enjoyed the chapters dedicated to introduce Industrial Control Systems and Operations, ICS network design and architecture and especially ICS risk assessments which was my main interest and how I ended up in scadahacker. The rest of the book focuses around cyber security and these chapters were very tedious for someone who already works in the field.
What surprised me from this book?
Many of these environments were designed and implemented many many decades ago, and many of them have gone and they are still going through the digital transformation so IP and Ethernet protocols, among others, are key to understand how to secure their communications. The level of detail of these sections are comparable to books often found in the computer engineering discipline. It has been 20 years since the last time I had to understand how Ethernet, a layer two protocol, works including its variations such as CSMA/CD ( Carrier Sense Multiple Access with Collision Detection) and CSMA/CA ( Carries Sense Multiple Access with Collision Avoidance). If you are a professional with a computer engineering background from the late 90’s, I bet you are not up for the reading, but if you are in the ICS/OT industry trying to understand how to secure these environments, it is definitively the kind of material you need to know and understand.
Would I buy this book again?
Absolutely, while it was not a pleasant experience because it is a book full of technicalities, protocols and low level technology, the book helped me to understand the challenges to secure ICS/OT. It extended my basic knowledge in this area allowing me to expand my research and get deeper into other areas such as security and risk assessments for ICS/OT. For the industrial professional looking to understand the increasing digitization and how to secure their daily environments, it is a must read.