Course Outline
Module 1: OT Cybersecurity Fundamentals and Cisco Cyber Vision Introduction
- An Overview of ICS/OT and Industrial IoT architectures
- Identifying common threats, vulnerabilities, and attack surfaces in OT/ICS environments
- OT concepts, terms, and daily operational challenges
- Understanding convergence challenges (IT/OT integration)
- Key components and elements of Cisco Cyber Vision architecture
- Introducing Cisco Cyber Vision UI (navigation and main functionalities overview)
Module 2: Cisco Cyber Vision Deployment and Implementation
- Deployment methodologies (Centralized, Distributed Sensor deployment approaches)
- Detailed review of sensor types, functionalities, and appropriate deployment scenarios
- Installation and provisioning Cisco Cyber Vision Center
- Installation and configuration of Cisco Cyber Vision sensors
- Performing initial data capturing and validating sensor communications
Module 3: Cisco Cyber Vision Operational Management
- Familiarization with advanced GUI features and customizations (Dashboards, Views, Panels)
- Event Management: Monitoring events, alerts, and audits for cyber incidents and anomalies
- Understanding the use and management of monitor mode
- Baselining facilities and managing change detection
- Intrusion Detection System (IDS) integration, configuration, and management using SNORT
- Advanced Vulnerability Management within Cisco Cyber Vision usage
- Active Discovery methodology and best practices
- Administration of the Cisco Cyber Vision ecosystem (licensing, user management, RBAC, LDAP
Module 4: Cisco Cyber Vision Integration with Cisco Catalyst Center
- Integration Architecture Overview
- Use Cases for Integration
- Configuration Workflow
- Operational Verification
Module 5: Cisco Cyber Vision Integration with Cisco Identity Services Engine (ISE)
- Overview of Cisco ISE in OT Environments
- Value of asset profiling and visibility in OT networks
- Understanding role-based access control and segmentation in OT environments
- Integration architecture between Cisco Cyber Vision and Cisco ISE
- Configuration and data exchange using pxGrid integration
- Operational workflow of asset profiling, visibility, and dynamic policy enforcement based on Cyber Vision insights
- Best practices and use-case scenarios (segmentation, dynamic NAC enforcement, access control)
Module 6: Cisco Cyber Vision Integration with Splunk (SIEM)
- Introduction to Splunk integration and OT cybersecurity use-cases
- Understanding the value-added by integration with SIEM platforms
- Configuring Cisco Cyber Vision event-forwarding integration with Splunk:
- Syslog configuration (CEF)
- Event data normalization and parsing
- Splunk dashboards design for Cisco Cyber Vision:
- Scenario-driven OT/ICS risk visibility dashboards
- Incident detection and operational analytics dashboards
- Alerting and event correlation using Splunk Cyber Vision integration for security operations teams
- Practical use-cases: OT security event and incident response management
Lab Outline
Labs are designed to assure learners a whole practical experience, through the following practical activities:
Discovery Lab 1: Installation of Cyber Vision Center and Global Center
Task 1: Cyber Vision Architecture Overview
Task 2: Installation of Cisco Cyber Vision
Task 3: Loading a PCAP
Task 4: Initial interaction and familiarity with Cisco Cyber Vision GUI
Discovery Lab 2: Exploring practical OT attack scenarios and their potential impacts
Task 1: Unauthorized PLC Control Command
Task 2 Unauthorized Write to PLC Variables
Discovery Lab 3: Configue Catalyst 9300 for CCV Sensor deployment
Task 1 Catalyst 9300 configuration
Discovery Lab 4: Deploy CCV Sensor on Cat9300
Task 1: Install CCV Deployment Tool
Discovery Lab 5: Configure event-forwarding from Cisco Cyber Vision to Splunk (CEF/syslog)
Task 1: Manage Cyber Vision apps in Splunk
Task 2: Generate an API token in Cyber Vision Center
Task 3: Add Account to Cisco Cyber Vision Splunk Add-On
Discovery Lab 6: Import and configure Cyber Vision dashboards and analytics views in Splunk
Task 1: Add inputs to Splunk
Task 2: Add syslog data source in Splunk
Task 3: Add syslog configuration in Cyber Vision Center
Discovery Lab 7: Organizing initial dataset using groups and network presets
Task 1: Organizing the Devices in Groups
Task 2: Organize Data by Preset Filters
Discovery Lab 8: Creating and managing security baselines, event management, and real-time alerting
Task 1: Creating and managing security baselines
Task 2: Review CCV Events
Task 3: Filter and Search in the Events
Discovery Lab 9: Performing Active Discovery and Identify Vulnerabilities
Task 1: Active Discovery
Task 2: Vulnerability Dashboard
Discovery Lab 10: System administration and practical configuration tasks: user management, licensing, RBAC
Task 1: Create an Account
Task 2: Licensing
Discovery Lab 11: Configuring advanced IDS profiles and analyzing threat data
Task 1: Anomaly Detection and IDS
Discovery Lab 12: Configure pxGrid integration between Cisco Cyber Vision and Cisco ISE
Task 1: Enable pxGrid in Cisco ISE
Task 2: Create profiling policies in Cisco ISE using the endpoint device attribute data collected from Cisco Cyber Vision
Task 3: Generate Client Certificate in Cisco ISE
Task 4: Create Client Certificate in Cisco Cyber Vision
Task 5: Import Cisco Cyber Vision's Certificate Authority into Cisco ISE and Enable Trust for Authentication
Task 6: Validate the integration in Cisco ISE and Cisco Cyber Vision
Discovery Lab 13: Cisco Catalyst Center and ISE Integration
Task 1: Integrating ISE with Catalyst Center
Task 2 Cisco Cyber Vision Sensor discovery
Discovery Lab 14: Practical scenario: detection, observation, correlation, and response to simulated OT network security events via Splunk dashboards and features
Task 1 Cyber Vision dashboards
Task 2: Detection, observation, correlation, and response to simulated OT network security events via Splunk dashboards
