Scenarios

Cyber Vision Solution Overview

Value Proposition: Cisco Cyber Vision provides organizations a deeper level of understanding of what industrial devices are on the network, which devices are communicating with each other, as well as how and exactly what is being exchanged. The tool is designed to be leveraged across an organization including operations, IT, and security. In this section you will highlight the information the system is able to collect and the functions that make it a valuable tool for all users.

Procedure

1	After clicking the VIEW button it may take a few moments for the login landing page to appear. If necessary the following credentials can be used to log in as Auditor@cisco.com using password C1sco12345 otherwise you should land on the Cisco Cyber Vision dashboard.
2	You will be at the main dashboard:
3	Note the system has already had data loaded for demo purposes. There is currently no live traffic in the system.
4	This dashboard provides a quick view into system activity and consists of 2 parts: Operational overview and Security overview. Operational overviewtab gives the information about the following: Protocol distribution – Number of activities catched for different protocols Most critical events – List of latest event grouped by severity Preset highlights – information such Risk score, Last precomputation, Devices, Vulnerabilities and Events numbers for different built-in presets
5	Click the Security overview tab.
6	You get Security overview view. It contains the following information: Vulnerable devices – Number of vulnerable devices grouped by severity Devices by risk score – Number of devices with risk score assigned grouped by risk score severity Most critical events – Last 10 events sorted by severity Events by category – Number of security events for different categories Preset highlights – information such Risk score, Last precomputation, Devices, Vulnerabilities and Events numbers for different built-in presets
7	Note the navigation bar on the left-hand side:
8	You will go through these sections as you navigate this demonstration. Also note the bar can be minimized by clicking the left-hand pointer at the bottom of the bar (or expanded back by clicking the right-hand pointer at the bottom when minimized):
9	Select the Explore menu from the top left-hand side:
10	The first screen that loads is the Presets section. Note at the top of the screen the navigation bar shows you the location where you are: Explore / All Presets /. This will change as we continue to navigate through the screens.
11	In the Cyber Vision Center a preset is essentially a set of filters to only look at the information a user is concerned with. This may be a method to filter to only look at a specific type of device or devices only in a specific area.
12	Note there are two types of presets: system presets that are pre-populated and custom presets that users create. Our demo system today has custom presets already created that are not part of a fresh install. All custom (user created) presets are under the My preset section, all the others are system presets.
13	Scroll through the list and note the various types of system presets. Since Cyber Vision is a tool that can be used by IT users, Operational Users, and Security professionals you can see how some of the automatic presets can allow those personas to quickly access the information they are concerned with.
14	Click the [Munich] OT Traffic preset under the My preset section.
15	Note that when the page loads, the navigation at the top shows you are at the Explore / [Munich] OT Traffic / Dashboard:
16	At any point you can change the preset or the view from the drop-downs in the navigation bar.
17	The Dashboard is another quick highlight view of all the devices inside the selected preset. In this case we are looking at everything that is essentially Control System Behavior—not broadcast or ARP traffic. But first we need to change the date frame of our fabric window. The following steps set a time frame that matches our test network database since we do not have a live network available.
18	Notice there is a time frame shown near the top (actual times displayed will vary). This allows you to filter on what time range you want to view data. By default, this view is set to the last hour, though may be different on the display due to the nature of the instant demonstration environment. As mentioned, this system is Looking at stale data so let us change that to look at a larger time frame. Click the Pencil icon ( ).
19	Timespan Settings pop-up appears. From the Duration drop-down list select Custom period, enter 30d (which means 30 last days) and then click OK.
20	Now dashboard populates with the data.
21	Notice that various places in the interface use this time range. This ability to look at data from any point and time provides the ability to go back and see what has changed over time or if any unexpected behavior has occurred. This allows Cyber Vision to be the industrial networks ‘Flight recorder’. Some fields may differ unless otherwise noted.
22	In the dashboard you see information at the top of the page including the global risk score, number of devices, activities, vulnerabilities and eventsvariables. There is also a count of the number of variables and credentials. If Cisco Cyber Vision sees any credentials, here we will see a count of those (there are none in this demo data). Note: New in Cyber Vision v4.0. Preset data are now pre-computed. Cyber Vision automatically updates data in the background when changes occur. Click Refresh or New data to update shown data.
23	Also note the tags at the bottom of the page. Component tags are applied to devices themselves Activity tags are assigned to activities
24	Multiple tags can be applied to a single device or activity. Tags are a method to simplify the information learned about a device or an activity without requiring the user to understand all the specifics of what a device is or how a protocol works. Tags are automatically applied by Cisco Cyber Vision and are not modifiable here in the GUI. However, a user can create their own tags and rules on how they are applied via the RESTful API, which is beyond the scope of this demonstration.
25	Note the filter information on the left-hand side. You can hide filter details of each category by clicking the carat to the right of each entry. Note: If a device has multiple tags for example broadcast and arp, if you exclude broadcast, you still see the device since it is also arp. Tags, groups, and source sensor are the high-level filters available here.
26	At the top navigation bar, choose the drop-down next to Dashboard and then select Map.
27	The Map is essentially showing a logical view of which devices and activities are part of the preset. If devices are grouped, they show (in a colored box) what group they are part of (nested groups supported). The activity between the devices is shown in the form of links or arrows. Note, this is a logical view of how devices are communicating; it is not a physical or topology view.
28	The devices are laid out by the system, but you can select the Camera fit icon in the lower-left corner to return to the system default layout. If what is displayed does not match the image above, click Explore from the left pane and then select the [Munich] OT Traffic preset. You can zoom in and out using the controls in the lower left of the graphic window:
29	PDF and CSV export is implemented across the platform. Several buttons are available in the GUI to download list or map as csv and pdf files. On the top right will see the Export to PDF icon. Click over the icon to generate the PDF file. Now at the bottom left of your screen will see the pdf file downloaded. Click on the file to open the PDF MAP.
30	The legend in the top-left shows the color coding related to the activity between devices. Note: New in Cyber Vision v4.0. Cyber Vision 4.0 now lists Devices while Cyber Vision 3.x was listing Components. Component: Hardware identified by a MAC or IP addresses or Slot IDs. Can be directly related to the network logic of the OT process Device: Physical devices made of several components. Can be directly related to the device performing a certain task in the industrial process New double-border icons ( ) indicate a device on the Map.
31	In this view we can quickly see there is important traffic and control system behavior that has been observed between these devices. Icons of the device/vendor are applied to known devices. If there is a device that does not have enough information or is unknown to Cyber Vision, it will show as a gear icon.
32	Cisco Cyber Vision Map have the ability to aggregate activities to simplify the view. Activities with groups or with aggregated objects are now presented in a specific representation, which will replace several flows displayed on the map. Aggregation is enabled by default, to show network activities check the corresponding checkbox. Note: [Munich] OT Traffic preset is configured such way that there are no activities on the map which can be aggregated. You can check how this feature works using [Lyon] IT Traffic or [Munich] IT Traffic presets.
33	Vulnerabilities are shown as a number in a red circle on the top-left of the device icon.
34	Click the S7-400 station_1 icon.
35	A slider pane will appear from the right side and show more details about the device. From here the tags quickly show what types of activities have been observed such as a Start CPU and Stop CPU command as well as variables that have been read. This again shows the benefit of the automated tagging that quickly bubbles up information without requiring a user to have a deep understanding or needing to look at all the flow information. There is also information about Risk score (will be covered later) and components of this device.
36	At the bottom of the slide out we can quickly see the number of activities, events, vulnerabilities, credentials, and variables we have observed related to this device.
37	Click the Technical Sheet link near the middle of the slide out:
38	Here are more details that Cyber Vision has learned about the device such as the vendor, model name, fw-version, and more. If you scroll to the bottom you can also see a list of components of the device as well as an explanation of the component tags that have been applied to the device.
39	Click the Risk score tab. Note: New in Cyber Vision v4.0. Risk scoring helps focus on what’s important. Guides non-expert users to devices they should deal with first A first step in security management to help make urgent decisions Provides simple information on the security posture Defining the Cyber Vision risk scores: Risk = Likelihood x Impact Likelihood Activity tags (some communications create more risks) Exposure to external IP addresses Discovered vulnerabilities Impact Device tags (some devices can create more damages) User-defined industrial impact for groups S7-400 station_1 device has been assigned risk score 56 based on it’s type, group impact, activities and vulnerabilities discovered. The page gives understanding what impacts the risk score and how to lower risk.
40	Click the Security tab.
41	Here users can see a number of vulnerabilities that are known about this device. Historically the vulnerability information was provided via a curated list that users could upload to the system offline to update the database. The Cyber Vision Center essentially is matching all the information it knows about the device with known vulnerabilities against that type of hardware, version of firmware, etc. You can see the vulnerability description, if there is a solution and what that is, the Common Vulnerability Scoring System(CVSS) score, and any relevant links such as from the vendor or ICS-CERT. Users also have the ability to acknowledge the issue or essentially say why they are not going to correct it, to reduce the amount of displayed vulnerabilities against systems they cannot update or that are not relevant, i.e. a vulnerability for a PLC WebServer that the user disabled.
42	Next click the Activity tab.
43	Here users can see a focused Minimap that shows only the activity and flows directly related to this device.
44	Scroll to the bottom of the page to see more details about observed activities such as when the activity was first and last observed, the number of packets and bytes, and the direction of the flow. This also highlights the tags that are being applied to what activity which highlights the application level information.
45	Click the line of the activity that has the Start CPU, Stop CPU, and S7 Tags.
46	A sliding pane appears on the right-hand side with summary about the selected activity. Click Flows counter.
47	You get a flow table for the selected activity. Click the flow with Start CPU, Stop CPU and S7 tags.
48	This screen shows greater detail about the specific flow and protocol level details. Since this is a Siemens device leveraging the S7 protocol, we can see several commands were issued including a plc-stop command and a plc-control command. This detailed view provides a user more granular understanding of exactly what has been sent to the PLC, such as commands and the number of occurrences, to identify any anomalous behavior or trace down any changes to the environment. For a user who is an expert in industrial protocols this information is very useful to gain an understanding of all that is happening. This also shows the benefit of the tags, as without protocol level understanding, it may be difficult to look at these details and fully understand what has occurred. Click the in the top-right to return to the Map view.
49	At the top navigation choose the Map drop-down and then select Device list.
50	The Device list is a table view of all the devices and their components, within the selected preset, that have been discovered by the Cyber Vision Center. Note we can quickly see information including the IP, MAC, associated tags, risk score, activities, vulnerabilities, and variables, as well as the vendor, OS, Model, and Firmware where applicable. At any point you can also click a device to view the device information on the right side slider, as in the Map view.
51	Now click over Export to CSV, at the bottom left of your screen will a CSV file, click on that to open, a text Import form will appear, please click OK to open the file. Once the file is opened will see Name, Group, Industrial Impact, First Activity, and other.
52	At the top navigation choose the Device list drop-down and then select Activity list.
53	This view provides a table of all the activities that match the current preset. Note this is not flows, but a high-level summation of the flows observed and the communication between the devices. Just as before we can see information counts and tags associated with these activities. Export to CSV is available in the activities list, that can be found to the right side top of the screen.
54	You can select any activity and a more detailed view of that specific activity will show on the right-hand slider. Please select the activity between Dell 192.168.105.70 and STATION devices as an example.
55	The appearing slider is exactly the same we covered on step 46.
56	Click the X in the upper right-hand corner when done to close the slider.
57	At the top navigation choose the Activity list drop-down and then select Vulnerabilities.
58	For each preset, a new view is now available - Vulnerability Dashboard: Gives the top 10 vulnerabilities plus full inventory list Is based on presets to drill down data by tags, subnets, VLANs, groups and/or sensors Gives links to quickly identify affected components Displays additional context for impact and remediation
59	Click any Vulnerability title to get detailed information about the vulnerability in a slider pane which appears on the right-hand side.
60	Close the Vulnerability details slider pane. Click Affected components counter for CVE-2017-12741 vulnerability.
61	You get a slider pane on the right-hand side with a list of componets affected by the vulnerability.
62	Close the sliding pane. At the top navigation choose the Vulnerabilities drop-down and then select Perdue Model.
63	The purpose of this view is to overlay the devices in a Purdue model approach (IEC 62443). The Purdue model is an approach designed to identify devices in levels (0-5) dictated by their function. Level 0 devices interact with the real world (proximity sensors, actuators, valves). Level 1 devices interact with level 0 devices (I/O block), level 2 with level 1 (PLC) and so on. Since Cyber Vision has an understanding of the devices, this is a view to overlay the device type against the levels. Note that many devices could fall into different levels (such as a PLC) so the task of identifying the level is difficult. The tags are what we use to assign the Purdue Level. Level 0 devices interact with the real world (proximity sensors, actuators, valves) Level 1 devices interact with level 0 devices (I/O block) Level 2 with level 1 (PLC) and so on Since Cyber Vision has an understanding of the devices, this is a view to overlay the device type against the levels. Note that many devices could fall into different levels (such as a PLC) so the task of identifying the level is difficult. The tags are what are used to assign the Purdue Level.
64	At the top navigation choose the Perdue Model drop-down and then select Security Insights.
65	[Munich] OT Traffic preset configured to display information about OT activity only that’s why you don’t see any DNS or HTTP requests and SMB Tree Names.
66	Let’s open [Munich] IT Traffic preset. At the top navigation choose the [Munich] OT Traffic drop-down and then select [Munich] IT Traffic.
67	Now the Security Insights page is popolated with information about captured DNS and HTTP requests, SMB Tree names, as far as flows with no tags. You can use a corresponding tab to see necessary information.
68	On the left side select the Reports menu.
69	While the data from Cyber Vision can be accessed via the GUI or via the RESTful API, there are scenarios such as compliance where having a detailed report is beneficial or even required. The four types of reports available are: The Inventory report in the Cyber Vision Center including component details An Activity report including the details of flows between devices A Vulnerability report including details of why relevant A PLC report which focused on PLC specific information such as variable access
70	Select the Activity report.
71	In the History section select one the reports that has been previously generated. The figure below shows an example of a previously created report. Click the download icon to view it in a new tab. For demonstration purposes, this will save the time it takes for a new report to be created.
72	You will see the report being opened viewed in a new browser tab.
73	Return to the Reports - Cisco Cyber Vision browser tab and then select Events on the left side.
74	You get the Events Dashboard. Events are grouped by Severity (colored circles): Critical High Medium Low Under the circles you see detected event types for every severity. You can change the timeframe for shown events, by default the timframe is 1 day. Numbers of events in colored circles in this guide can be different from what you get.
75	Click Calendar in the top-right corner to switch to the calendar view.
76	In the calendar view you see events in the chronological order.
77	From this view you can select different timeframes to show: Day, Week, Month, Year.
78	You can filter events by severity clicking on corresponding colored rectangle. Click on the orange rectangle to show only High Severity Events.
79	You can see the current filter applied on the top of the screen. Click X near ‘high’ to reset the currently applied filter by high severity.
80	Select Monitor on the left side.
81	New baselines can be created from the presets. Then the Cyber Vision can detect changes happened to this baseline and alert you about them. Demo Baseline has been created for All Data preset in this lab. You can see that 34 changes has happened after the baseline creation. Click on DemoBaseline to see the changes.
82	You get the Component list table where you can see New and Changed components.
83	Click Dell 10.0.0.10 component.
84	You get a sliding pane with brief information about the component. Click any property to display more detailed information.
85	You can check Tags and Properties of the component.
86	Click Investigate with flows link to get all the flows associated with the component.
87	Click Collapse to close the sliding pane with flows.
88	Click X to close the sliding pane with the component details.
89	Now click on 9 new activities to see the list of new/changed activities.
90	You get the activities list of the baseline.
91	Click LD810EP to Dell 10.0.0.10 activity and then click any assigned tag.
92	You get the activity details. Note: New in Cyber Vision v4.0. New Snort activity tags. Specific tags associated with events detected by the Snort IDS and provide more precise context to understand malicious activities.
93	Click Investigate with flows to get a list of flows associated with this activity.
94	Click X to close the activity slider pane.
95	At the top navigation choose the Activity list drop-down and then select Map.
96	You get the map view where you can see New (solid red line), Changed (dotted red line) and Unchanged (solid grey line) components.
97	Select Search on the left side.
98	Another very useful tool in Cisco Cyber Vision is this ability to search. Imagine Rockwell suddenly releases an advisory for version 16.3 of their firmware and you need to know exactly where these devices are located. One option is to do a search here. In the search bar type 16.3 and then click Search. Here you can see the result is a 1756-L55/A and you could access the technical sheet for that device on the right side.
99	Now, let us do a search for all Rockwell devices. In the search bar type Rockwell and then click Search. You will see every device that has Rockwell associated with it.

Cyber Vision Utilities Scenario

Value Proposition: Cisco Cyber Vision provides organizations a deeper level of understanding of what industrial devices are on the network, which devices are communicating with each other, as well as how and exactly what is being exchanged. The tool is designed to be leveraged across an organization including operations, IT, and security. In this section you will highlight the information the system is able to collect based on the data from Utilities data and the functions that make it a valuable tool for all users.

Procedure

1	Select the Explore menu from the top left-hand side:
2	Click the Utilities preset under the My preset section.
3	The Dashboard is another quick highlight view of all the devices inside the selected preset.
4	In the dashboard you see information at the top of the page including the global risk score, number of devices, activities, vulnerabilities and eventsvariables. There is also a count of the number of variables and credentials. If Cisco Cyber Vision sees any credentials, here we will see a count of those (there are none in this demo data). Note: New in Cyber Vision v4.0. Preset data are now pre-computed. Cyber Vision automatically updates data in the background when changes occur. Click Refresh or New data to update shown data.
5	Also note the tags at the bottom of the page. Component tags are applied to devices themselves Activity tags are assigned to activities Protocol tags show all the protocols discovered by Cyber Vision Here are some details about discovered protocols: Modbus is a data communications protocol originally published by Modicon (now Schneider Electric) in 1979 for use with its programmable logic controllers (PLCs). Modbus has become a de facto standard communication protocol and is now a commonly available means of connecting industrial electronic devices. Modbus is popular in industrial environments because it is openly published and royalty-free. It was developed for industrial applications, is relatively easy to deploy and maintain compared to other standards, and places few restrictions - other than the datagram (packet) size - on the format of the data to be transmitted. The Modbus protocol uses character serial communication lines, Ethernet, or the Internet protocol suite as a transport layer. Modbus supports communication to and from multiple devices connected to the same cable or Ethernet network. For example, there can be a device that measures temperature and another device to measure humidity connected to the same cable, both communicating measurements to the same computer. Modbus is often used to connect a plant/system supervisory computer with a remote terminal unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems in the electric power industry. Many of the data types are named from industrial control of factory devices, such as Ladder logic because of its use in driving relays: A single physical output is called a coil, and a single physical input is called a discrete input or a contact. DNP3 (Distributed Network Protocol 3) is a set of communications protocols used between components in process automation systems. Its main use is in utilities such as electric and water companies. Usage in other industries is not common. It was developed for communications between various types of data acquisition and control equipment. It plays a crucial role in SCADA systems, where it is used by SCADA Master Stations (a.k.a. Control Centers), Remote Terminal Units (RTUs), and Intelligent Electronic Devices (IEDs). It is primarily used for communications between a master station and RTUs or IEDs. ICCP, the Inter-Control Center Communications Protocol (a part of IEC 60870-6), is used for inter-master station communications. Competing standards include the older Modbus protocol and the newer IEC 61850 protocol. IEC 104 (IEC 60870-5-104) protocol is an extension of IEC 101 protocol with the changes in transport, network, link & physical layer services to suit the complete network access. The standard uses an open TCP/IP interface to network to have connectivity to the LAN (Local Area Network) and routers with different facility (ISDN, X.25, Frame relay etc.) can be used to connect to the WAN (Wide Area Network). Application layer of IEC 104 is preserved same as that of IEC 101 with some of the data types and facilities not used. There are two separate link layers defined in the standard, which is suitable for data transfer over Ethernet & serial line (PPP - Point-to-Point Protocol). The control field data of IEC104 contains various types of mechanisms for effective handling of network data synchronization. Fieldbus HSE (High-speed Ethernet) is an all-digital, serial, two-way communications system that serves as the base-level network in a plant or factory automation environment. It is an open architecture, developed and administered by FieldComm Group. It is targeted for applications using basic and advanced regulatory control, and for much of the discrete control associated with those functions. Foundation Fieldbus technology is mostly used in process industries, but has recently been implemented in powerplants. Operates at 100/1000 Mbit/s and generally connects input/output subsystems, host systems, linking devices and gateways. It doesn't currently provide power over the cable, although work is under way to address this using the IEEE802.3af Power over Ethernet (PoE) standard. C37.118 is the IEEE Standard for Synchrophasor Measurements for Power Systems, which defines synchrophasors, frequency, and rate of change of frequency (ROCOF) measurement under all operating conditions. It specifies methods for evaluating these measurements and requirements for compliance with the standard under both steady-state and dynamic conditions. LonWorks (local operating network) is a networking platform specifically created to address the needs of control applications. The platform is built on a protocol created by Echelon Corporation for networking devices over media such as twisted pair, powerlines, fiber optics, and RF. It is used for the automation of various functions within buildings such as lighting and HVAC
6	Multiple tags can be applied to a single device or activity. Tags are a method to simplify the information learned about a device or an activity without requiring the user to understand all the specifics of what a device is or how a protocol works. Tags are automatically applied by Cisco Cyber Vision and are not modifiable here in the GUI. However, a user can create their own tags and rules on how they are applied via the RESTful API, which is beyond the scope of this demonstration.
7	At the top navigation bar, choose the drop-down next to Dashboard and then select Map.
8	The Map is essentially showing a logical view of which devices and activities are part of the preset. If devices are grouped, they show (in a colored box) what group they are part of (nested groups supported). The activity between the devices is shown in the form of links or arrows. Note, this is a logical view of how devices are communicating; it is not a physical or topology view. The devices are laid out by the system, but you can select the Camera fit icon in the lower-left corner to return to the system default layout. You can zoom in and out using the controls in the lower left of the graphic window: In an Utility environment we see 3 high level grouping of the Network: Enterprise Network Control Center Subtstation Network In this Map you see these 3 groups and assets in each group.
9	The legend in the top-left shows the color coding related to the activity between devices. Note: New in Cyber Vision v4.0. Cyber Vision 4.0 now lists Devices while Cyber Vision 3.x was listing Components. Component: Hardware identified by a MAC or IP addresses or Slot IDs. Can be directly related to the network logic of the OT process Device: Physical devices made of several components. Can be directly related to the device performing a certain task in the industrial process New double-border icons ( ) indicate a device on the Map.
10	In this view we can quickly see there is important traffic and control system behavior that has been observed between these devices and groups. Icons of the device/vendor are applied to known devices. If there is a device that does not have enough information or is unknown to Cyber Vision, it will show as a gear icon.
11	Cisco Cyber Vision Map have the ability to aggregate activities to simplify the view. Activities with groups or with aggregated objects are now presented in a specific representation, which will replace several flows displayed on the map. Aggregation is enabled by default, to show network activities check the corresponding checkbox.
12	With Show network activities checkbox enabled the map looks the following way:
13	Vulnerabilities are shown as a number in a red circle on the top-left of the device icon.
14	Click the Relay 1 icon.
15	A slider pane will appear from the right side and show more details about the device. From here the tags quickly show what types of activities have been observed such as a modbus traffic as well as variables that have been read amd written. This again shows the benefit of the automated tagging that quickly bubbles up information without requiring a user to have a deep understanding or needing to look at all the flow information. There is also information about Risk score and components of this device.
16	At the bottom of the slide out we can quickly see the number of activities, events, vulnerabilities, credentials, and variables we have observed related to this device.
17	Click the Technical Sheet link near the middle of the slide out:
18	Here are more details that Cyber Vision has learned about the device such as the vendor, model name, fw-version, and more. If you scroll to the bottom you can also see a list of components of the device as well as an explanation of the component tags that have been applied to the device.
19	Click the Risk score tab. Note: New in Cyber Vision v4.0. Risk scoring helps focus on what’s important. Guides non-expert users to devices they should deal with first A first step in security management to help make urgent decisions Provides simple information on the security posture Defining the Cyber Vision risk scores: Risk = Likelihood x Impact Likelihood Activity tags (some communications create more risks) Exposure to external IP addresses Discovered vulnerabilities Impact Device tags (some devices can create more damages) User-defined industrial impact for groups Relay 1 has been assigned risk score 56 based on it’s type, group impact, activities and vulnerabilities discovered. The page gives understanding what impacts the risk score and how to lower risk.
20	Click the Automation tab.
21	Here a user can see which variables or memory pointers inside the device are being accessed and how. In this case it is a Schweitzer 10.39.58.130 device accessing 16-Bit Analog Input index 0 via dnp3 protocol for example and the data is being read. A user can also see what device is accessing that data point, and when the first and last access occurred. This screen can quickly identify, at an application layer, what information is being leveraged by the process.
22	Next click the Activity tab.
23	Here users can see a focused Minimap that shows only the activity and flows directly related to this device.
24	Scroll to the bottom of the page to see more details about observed activities such as when the activity was first and last observed, the number of packets and bytes, and the direction of the flow. This also highlights the tags that are being applied to what activity which highlights the application level information.
25	Click the line of the presented activity.
26	A sliding pane appears on the right-hand side with summary about the selected activity. Click Flows counter.
27	You get a flow table for the selected activity. Click the displayed flow.
28	This screen shows greater detail about the specific flow and protocol level details. Since devices are leveraging the modbus protocol, we can see several commands were issued including a plc-stop command and a plc-control command. This also shows the benefit of the tags, as without protocol level understanding, it may be difficult to look at these details and fully understand what has occurred. Click the in the top-right to return to the Map view.
29	At the top navigation choose the Map drop-down and then select Device list.
30	The Device list is a table view of all the devices and their components, within the selected preset, that have been discovered by the Cyber Vision Center. Note we can quickly see information including the IP, MAC, associated tags, risk score, activities, vulnerabilities, and variables, as well as the vendor, OS, Model, and Firmware where applicable. At any point you can also click a device to view the device information on the right side slider, as in the Map view.
31	At the top navigation choose the Device list drop-down and then select Activity list.
32	This view provides a table of all the activities that match the current preset. Note this is not flows, but a high-level summation of the flows observed and the communication between the devices. Just as before we can see information counts and tags associated with these activities. Export to CSV is available in the activities list, that can be found to the right side top of the screen.
33	You can select any activity and a more detailed view of that specific activity will show on the right-hand slider. Please select the activity between Siemens 10.1.2.3 and Siemens 10.9.8.7 devices as an example.
34	The appearing slider is exactly the same we covered on step 46 of Scenario 1.
35	Click the X in the upper right-hand corner when done to close the slider.
36	At the top navigation choose the Activity list drop-down and then select Vulnerabilities.
37	For each preset, a new view is now available - Vulnerability Dashboard: Gives the top 10 vulnerabilities plus full inventory list Is based on presets to drill down data by tags, subnets, VLANs, groups and/or sensors Gives links to quickly identify affected components Displays additional context for impact and remediation
38	Click any Vulnerability title to get detailed information about the vulnerability in a slider pane which appears on the right-hand side.
39	At the top navigation choose the Vulnerabilities drop-down and then select Perdue Model. Note: Utilities preset does not have any HTTP(S) and SMB traffic, so we skip Security Insights tab as it has no data. You can check Security Insights tab for [Munich] IT Traffic preset.
40	The purpose of this view is to overlay the devices in a Purdue model approach (IEC 62443). The Purdue model is an approach designed to identify devices in levels (0-5) dictated by their function. Level 0 devices interact with the real world (proximity sensors, actuators, valves). Level 1 devices interact with level 0 devices (I/O block), level 2 with level 1 (PLC) and so on. Since Cyber Vision has an understanding of the devices, this is a view to overlay the device type against the levels. Note that many devices could fall into different levels (such as a PLC) so the task of identifying the level is difficult. The tags are what we use to assign the Purdue Level. Level 0 devices interact with the real world (proximity sensors, actuators, valves) Level 1 devices interact with level 0 devices (I/O block) Level 2 with level 1 (PLC) and so on Since Cyber Vision has an understanding of the devices, this is a view to overlay the device type against the levels. Note that many devices could fall into different levels (such as a PLC) so the task of identifying the level is difficult. The tags are what are used to assign the Purdue Level.
41	Select Monitor on the left side.
42	New baselines can be created from presets. Then the Cyber Vision can detect changes happened to this baseline and alert you about them. Click on Utilities Baseline to see the changes for Utilities preset
43	You get the Component list table where you can see New and Changed components.
44	Click Lantronix 192.168.119.211 component.
45	You get a sliding pane with brief information about the component. Click any discovered property to display more detailed information.
46	You can check Tags and Properties of the component.
47	Click Investigate with flows link to get all the flows associated with the component. Click Collapse to close the sliding pane with flows.
48	Click Collapse to close the sliding pane with flows.
49	Click X to close the sliding pane with the component details.
50	Now click on 6 new activities to see the list of new/changed activities.
51	You get the activities list of the baseline.
52	Click Lantronix 192.168.119.211 to Microsoft 192.168.119.210 activity and then click any of discovered variables.
53	You get the activity details.
54	Click X to close the activity slider pane.
55	At the top navigation choose the Activity list drop-down and then select Map.
56	You get the map view where you can see New (solid red line), Changed (dotted red line) and Unchanged (solid grey line) components.
57	Click red dotted line between Beckwith 10.0.0.3 and Beckwith 10.0.0.57 components to see details about changed activity.
58	Click any added tag to get details.

Book Title

Chapter Title

About

About This Demonstration

About This Solution

Scenarios

Cyber Vision Solution Overview

Procedure

Cyber Vision Utilities Scenario

Procedure

What's Next?

What’s Next?