CONCEPT DEVELOPMENT
Please do the research on the topic ( Advantech – WebAccess (SCADA) and complete the attached word file based on specific requirements. It is one of the vendor for industrial cyber security.
A key objective of any academic program is the refinement and reinforcement of strong communication skills. The same ability of a cyber security professional to compile information and present findings, observations, and recommendations in a clear, concise, and understandable manner is equally important. It is for these reasons that a requirement exists for the successful completion of this course to perform research and compile a technical paper centering on a specific automation vendor and their industrial solution offering.
The paper will focus on selecting a company and one of their industrial control system offerings. Solutions are often aligned to specific industry sectors and customer bases. These solutions should be understood to then look at vulnerabilities that have been disclosed targeting these systems. Equally important is the impact to the business operations of the end-user or asset owner should any of these vulnerabilities be exploiting – either intentionally or accidentally.
It is essential to evaluate the unmitigated risks associated with these vulnerabilities and develop a recommended list of actions that would help the asset owner in mitigating some of these risk in order to improve the operational integrity of their cyber-physical systems.
ASSIGNMENT 7 (W12)
TERM PAPER CONCEPT DEVELOPMENT (OUTLINE)
| Name | |
| Course Number | CSCI 497.1SW (Commerce) and 497.6SW (RELLIS) |
| Course Time | Monday: 1700 – 1930h |
| Semester | Fall 2021 |
| Submission | Assignment 7 |
| Due Date | November 22, 2021 |
| Instructor | Joel Langill |
| joel.langill@tamuc.edu | |
| Phone | +1 (920) 594-0321 |
| Office Hours | By Appointment (Moodle Message or Email) |
The assignment for this week consists of you completing the following:
· Ensure that you have selected a topic under the “Term Paper Topic Selection” activity under the Term Paper section of the course
· Review the “Term Paper Requirements” activity “Contents and Structure” chapter under the Term Paper section of the course
· Complete the outline as directed in this Assignment Submittal on the following pages
Please be sure and complete the cover page with your name as it appears on your university identification card, your corresponding email address, and whether you are attending the Commerce or RELLIS campus course prior to submission. Do not forget to submit your work when you have completed this assignment.
(Note: problems may to occur if using Google Chrome as a browser where it tries to open links in Google Docs. The “Docs PDF/PowerPoint Viewer (by Google)” extension must be disabled or removed.)
The term research paper and associated presentation should be logically divided into sections that follow sound research paper style and address each of the areas defined by the “Term Paper Requirements”. You are free to organization the paper and presentation as appropriate, however a template has been provided for both the paper and presentation to help start the initial paper structure.
This Assignment requires that you provide the high-level organization and key factual items that will form the basis of the paper. Please supply as indicated below. Information presented should be summarized and demonstrate that the foundation for completion of the paper by the required Due Date has been collected and is understood.
The topics presented in this Assignment are provided to assist in data collection, and do not necessarily need to be covered in the paper in their entirety.
Company Overview
Company Name:
Company Headquarters:
Major Geographical Regions Served:
System Name:
System First Released:
Sales Website URL:
Service and Support Website URL:
System Overview Brochure URL:
System Overview
Please attach a System Overview graphic (copy/paste from brochure):
Names and Functions of Key System Components:
Names of System Communication Networks:
What vendor-supplied security components are available?
Does the vendor offer any other systems as part of their portfolio? If so, please provide system names.
Communications and Protocols
Describe the primary protocols and methods used between the key system asset types. This must address communication to/from field-connected controllers, communication to/from human-machine interfaces, and communication to/from historical data repositories as a minimum.
Are any of these protocols proprietary? If so, please describe.
Industry Sectors using this System
Please provide the primary markets the system is targeted. You can either use U.S. defined Critical Infrastructure and Key Resources (CIKR), or Standard Industry Classification (SIC) for industry identification.
(hint: https://en.wikipedia.org/wiki/Standard_Industrial_Classification)
Vulnerabilities Disclosed for this System
Please provide any vulnerabilities that have been publicly disclosed that target the system under consideration. Include source, year, and disclosure reference identifier.
(hint: useful links are provided under the Week 9 Vulnerability and Exploit References provided on the Moodle LMS)
Were publicly available exploit packages made available that target the identified vulnerabilities?
(hint: useful links are provided under the Week 9 Vulnerability and Exploit References provided on the Moodle LMS)
Impact and Consequences to Industry Sectors Served (Risk Identification)
For the top 2-3 vulnerabilities discussed above, please provide a brief scenario (1-2 sentences) of how the successful exploitation of the vulnerability would impact the operating of the system and how it delivered its essential services to the industry it is deployed.
Mitigation (Risk Reduction)
Though NOT required for this Assignment, please be prepared in the term paper to discuss the vendor’s recommendations to mitigate the risk introduced from these vulnerabilities, and AT LEAST one compensating control that could be used to reduce risk in the absence of applying the vendor’s recommended corrective action. Attention should focus on minimizing the severity of the Consequence/Impact and not that of the vulnerability alone in isolation.
Do not forget to submit your work when you have completed this assignment.
CSCI 497 CSCI 497 F21 – Assignment 7
Fundamentals of Industrial Control System Cyber Security © 2012-2021 ICSCSI LLC
Fall 2021 Page 1 of 5