Description

This curriculum spans the design and operational challenges of securing critical infrastructure within a SOC, comparable in scope to a multi-workshop program that integrates threat detection, compliance, and resilience planning across IT, OT, and regulatory domains.

Module 1: Defining and Classifying Critical Infrastructure Assets

Selecting criteria for identifying systems that directly impact business continuity, such as transaction volume, data sensitivity, and regulatory exposure.
Mapping interdependencies between IT and operational technology (OT) systems to determine cascading failure risks.
Establishing ownership roles for asset classification with legal, compliance, and business unit stakeholders.
Integrating CMDB data with threat intelligence to prioritize assets based on exploitability and business impact.
Resolving conflicts between IT operations and security teams over asset criticality ratings during classification exercises.
Updating asset classifications quarterly or after major infrastructure changes to reflect evolving business processes.

Module 2: Integrating SIEM with Critical Infrastructure Monitoring

Configuring log collection from industrial control systems (ICS) without introducing latency or violating operational SLAs.
Normalizing log formats from legacy SCADA systems that lack standard syslog or API support.
Designing correlation rules that distinguish between operational anomalies and potential intrusions in high-noise environments.
Allocating storage and processing resources for long-term retention of logs from critical systems under compliance mandates.
Implementing secure, one-way data diodes for transferring logs from air-gapped environments to central SIEM.
Validating parsing accuracy for custom log sources through continuous log sample testing and parser version control.

Module 3: Threat Detection Architecture for High-Value Systems

Deploying network TAPs or SPAN ports on critical system segments without disrupting real-time control communications.
Selecting between inline and passive IDS/IPS based on availability requirements and fail-open risks.
Developing custom YARA or Sigma rules to detect malware targeting specific ICS protocols like Modbus or DNP3.
Calibrating detection thresholds to minimize false positives in environments with routine anomalous behavior.
Isolating detection infrastructure to prevent lateral movement in the event of SOC component compromise.
Coordinating with engineering teams to schedule vulnerability scans that avoid production outages.

Module 4: Incident Response Planning for Critical Environments

Defining escalation paths that include OT engineers, legal counsel, and executive leadership for infrastructure incidents.
Creating response playbooks that account for system availability constraints, such as no-reboot policies.
Staging forensic toolkits on isolated jump boxes to avoid introducing untrusted software into critical networks.
Establishing pre-approved containment actions, such as network segmentation, that do not require real-time executive approval.
Conducting tabletop exercises with plant managers to validate response procedures under realistic downtime scenarios.
Documenting evidence collection procedures that comply with legal standards while preserving system functionality.

Module 5: Access Control and Identity Governance for SOC Personnel

Implementing just-in-time (JIT) access for SOC analysts to critical system monitoring interfaces.
Enforcing multi-person control (MPC) for privileged actions involving ICS or safety systems.
Integrating PAM solutions with biometric authentication for access to forensic investigation tools.
Auditing access reviews for SOC team members on a monthly basis with signed attestations from supervisors.
Segregating duties between analysts who monitor, investigate, and respond to incidents on critical infrastructure.
Negotiating access rights with third-party vendors who manage proprietary control systems.

Module 6: Resilience and Recovery for Security Operations Infrastructure

Designing redundant SIEM and SOAR nodes in geographically separate data centers to maintain visibility during outages.
Testing failover procedures for log aggregation services during scheduled maintenance windows.
Encrypting and backing up detection rules, playbooks, and case management data daily to immutable storage.
Validating recovery time objectives (RTO) for SOC tools under simulated ransomware conditions.
Documenting manual response fallback procedures when automated systems are unavailable.
Coordinating with cloud providers to ensure SOC SaaS platforms meet uptime SLAs with penalty clauses.

Module 7: Regulatory Compliance and Audit Readiness

Mapping NIST SP 800-82 and IEC 62443 controls to specific monitoring and detection capabilities in the SOC.
Generating evidence packages for auditors that demonstrate continuous monitoring of critical assets.
Responding to regulator inquiries about incident detection timelines without disclosing sensitive methodology.
Archiving incident records in tamper-evident formats to satisfy retention requirements for critical infrastructure sectors.
Conducting internal audits of SOC processes using checklists aligned with CISA Known Exploited Vulnerabilities catalog.
Reconciling compliance reporting needs with operational secrecy requirements for active threat hunting activities.

Module 8: Threat Intelligence Integration and Operationalization

Filtering commercial threat feeds to extract IOCs relevant to industrial control system software and firmware versions.
Automating the ingestion of STIX/TAXII feeds into SOAR platforms while validating source credibility.
Developing confidence scoring models for threat indicators based on source reliability and corroboration.
Sharing anonymized TTPs with ISACs without exposing proprietary network topology or asset details.
Scheduling threat intelligence updates during maintenance windows to avoid performance degradation in detection systems.
Measuring the operational impact of intelligence-driven detections through mean time to detect (MTTD) benchmarks.