my discussion

Cyber Security Improvement Plan

Case Learning Objectives:

This assignment provides practical experience developing a plan to improve security on an Industrial Control System based on a completed Cyber Security risk assessment (provided to the student). The following learning objectives are designed to reinforce the unique requirements associated with Industrial Control System Security.

Document and communicate the current state for security of the ICS
Provide an overview of the network design including major weaknesses in the physical design and layout of network components with suggested network layout improvements
Identify the threats and vulnerabilities facing the assets of an Industrial Control System including Advanced Persistent Threats and recommend potential security measures that could have prevented those incidents
Understand applicable regulations and include provisions for achieving compliance within the plan
Based on knowledge of recommended security best practices and standards, document and communicate the desired future state for security of the ICS
Build the plan in a way that incorporates differing levels of security controls depending on risk and criticality of the various devices within the system
Demonstrate understanding of ICS functionality, network components, and protocols by devising a plan that improves security and concurrently minimizes negative impact to process operations and productivity
Provide multiple options for security enhancements to management with guidance on trade-offs involved with the different options
Demonstrate awareness of the unique challenges the exist in securing Industrial Control Systems and customize security plan to address those challenges

2. Assumptions for this case

Build your security improvement plan while taking into account the following assumptions.

The information provided in the risk assessment is accurate.
Time Horizon for implementation is 12-24 months.
DHS Regulated Chemical of Interest is used at the Pressurization Station which is physically isolated from the main plant site at a remote location with good physical security.
Sample organization is using two ICS standards systems to target Cyber Security improvements:
1. NIST Guide to Industrial Control Systems (ICS) Security as its preferred guidance document.
2. Department of Homeland Security CFATS regulation where chemicals of Interest are used.
Security on the business network is average for a mid-sized corporation but has much room for improvement and routinely deals with malware infection and security incidents.

Assignment Requirements used in grading rubric
The final paper pulls together all the parts you have been working on throughout the course in a comprehensive cyber security improvement plan that could be used by Pureland Chemical. Be sure to include improvements to any content submitted earlier in the course so that errors are not repeated.

Here are the guidelines for writing the paper including required components and grading criteria.

	failing-Below 74	Satisfactory-74-82	Good-83-91	Excellent-92-100
Knowledge of Content: 50% of rubric score	Work marginally reflects the assignment purpose	Work reflects the assignment purpose	Work is accurately detailed, and in line with course content	Work stands-out as exemplary, is accurately detailed, and in line with course content
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Current State provides only basic information	Current State provides general information	Current State provides a detailed description of the security status of the system	Current State provides a clear and concise description of the security status of the system
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Includes a basic overview of the network design without weaknesses identified	Includes a general overview of the network design including basic description of weaknesses but no suggested improvements	Includes a relatively detailed overview of the network design including general description of weaknesses and associated improvements	Includes a clear and concise overview of the network design including detailed description of weaknesses and associated improvements
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Basic description of threats and vulnerabilities facing Industrial Control Systems	Includes a general description of threats and vulnerabilities facing Industrial Control Systems with no mention of APTs	Includes a relatively detailed description of threats and vulnerabilities facing Industrial Control Systems with a general description of APTs	Includes a clear and concise description of threats and vulnerabilities facing Industrial Control Systems with a detailed description of APTs
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Includes description of applicable regulations but no provisions for achieving compliance	Include basic description of applicable regulations and provisions for achieving compliance	Include detailed description of applicable regulations and provisions for achieving compliance	Include clear and concise description of applicable regulations and provisions for achieving compliance
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Desired Future State description provides only basic information	Desired Future State description provides general information	Desired Future State description provides a detailed description of the security status of the system	Desired Future State description provides a clear and concise description of the security status of the system
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Plan suggests less than 5 areas of improvement which are not covered well	Plan thoroughly addresses less than 5 areas of improvement.	Plan covers 5 areas of improvement but not thoroughly	Plan thoroughly addresses 5 or more areas of improvement with at least one page per area
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Uses at least 2 Prof ref to support research with poor integration	Uses at least 3 Prof ref to support research with adequate integration	Uses at least 4 references and integrates them acceptably into the document	Uses 5 or more references and integrates them clearly and concisely into the document
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
	Developing	Competent	Accomplished	Exemplary
Critical Thinking: 30% of rubric score	Ability to incorporate graphical data/info is emerging	Ability to incorporate graphical data/info is basic	Ability to incorporate graphical data/info & link key relationships is proficient	Ability to incorporate graphical data/info & link key relationships is superior
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Plan marginally describes the impact of the unique challenges that exist in securing Industrial Control Systems	Plan assesses the impact of the unique challenges that exist in securing Industrial Control Systems	Plan effectively assess the impact of the unique challenges that exist in securing Industrial Control Systems with generalized solutions to address those challenges	Plan assess in technical detail the impact of the unique challenges that exist in securing Industrial Control Systems with customized solutions to address those challenges
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Written: 20% of rubric score	Developing	Competent	Accomplished	Exemplary
Sentences are somewhat clear and well constructed, but lack variety in format& length	Most sentences are clear and well-constructed some evidence of variety in format, length, and complexity.	Sentences are clear and well-constructed - Some evidence of variety in format, length, and complexity	Varied well-constructed sentences are evident throughout the document with an appropriate stylistic flair
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Paper contains 5 or 6 spelling, punctuation, and/or grammatical errors	Paper contains 3 or 4 spelling, punctuation, and/or grammatical errors	Paper contains 1 or 2 spelling, punctuation, and/or grammatical errors	No spelling, punctuation, and/or grammatical errors are readily apparent
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7
Paper contains 5 or 6 APA errors	Paper contains 3 or 4 APA errors	Paper contains 1 or 2 APA errors	No APA errors are readily apparent
0-12.3	12.4-13.7	13.8-15.2	15.3-16.7