Protected: Cisco Cyber Vision Deployment and Operation (INCVDO)

Module 1: OT Cybersecurity Fundamentals and Cisco Cyber Vision Introduction

• An Overview of ICS/OT and Industrial IoT architectures
• Identifying common threats, vulnerabilities, and attack surfaces in OT/ICS environments
• OT concepts, terms, and daily operational challenges
• Understanding convergence challenges (IT/OT integration)
• Key components and elements of Cisco Cyber Vision architecture
• Introducing Cisco Cyber Vision UI (navigation and main functionalities overview)

Module 2: Cisco Cyber Vision Deployment and Implementation

• Deployment methodologies (Centralized, Distributed Sensor deployment approaches)
• Detailed review of sensor types, functionalities, and appropriate deployment scenarios
• Installation and provisioning Cisco Cyber Vision Center
• Installation and configuration of Cisco Cyber Vision sensors
• Performing initial data capturing and validating sensor communications

Module 3: Cisco Cyber Vision Operational Management

• Familiarization with advanced GUI features and customizations (Dashboards, Views, Panels)
• Event Management: Monitoring events, alerts, and audits for cyber incidents and anomalies
• Understanding the use and management of monitor mode
• Baselining facilities and managing change detection
• Intrusion Detection System (IDS) integration, configuration, and management using SNORT
• Advanced Vulnerability Management within Cisco Cyber Vision usage
• Active Discovery methodology and best practices
• Administration of the Cisco Cyber Vision ecosystem (licensing, user management, RBAC, LDAP

Module 4: Cisco Cyber Vision Integration with Cisco Catalyst Center

• Integration Architecture Overview
• Use Cases for Integration
• Configuration Workflow
• Operational Verification

Module 5: Cisco Cyber Vision Integration with Cisco Identity Services Engine (ISE)

• Overview of Cisco ISE in OT Environments
• Value of asset profiling and visibility in OT networks
• Understanding role-based access control and segmentation in OT environments
• Integration architecture between Cisco Cyber Vision and Cisco ISE
• Configuration and data exchange using pxGrid integration
• Operational workflow of asset profiling, visibility, and dynamic policy enforcement based on Cyber Vision insights
• Best practices and use-case scenarios (segmentation, dynamic NAC enforcement, access control)

Module 6: Cisco Cyber Vision Integration with Splunk (SIEM)

• Introduction to Splunk integration and OT cybersecurity use-cases
• Understanding the value-added by integration with SIEM platforms
• Configuring Cisco Cyber Vision event-forwarding integration with Splunk:
• Syslog configuration (CEF)
• Event data normalization and parsing
• Splunk dashboards design for Cisco Cyber Vision:
• Scenario-driven OT/ICS risk visibility dashboards
• Incident detection and operational analytics dashboards
• Alerting and event correlation using Splunk Cyber Vision integration for security operations teams
• Practical use-cases: OT security event and incident response management

Lab Outline:

Labs are designed to assure learners a whole practical experience, through the following practical activities:

Discovery Lab 1: Installation of Cyber Vision Center and Global Center   

• Task 1: Cyber Vision Architecture Overview
• Task 2: Installation of Cisco Cyber Vision
• Task 3: Loading a PCAP
• Task 4: Initial interaction and familiarity with Cisco Cyber Vision GUI

Discovery Lab 2: Exploring practical OT attack scenarios and their potential impacts                 

•  Task 1: Unauthorized PLC Control Command
• Task 2 Unauthorized Write to PLC Variables

Discovery Lab 3: Configue Catalyst 9300 for CCV Sensor deployment               

• Task 1 Catalyst 9300 configuration

Discovery Lab 4: Deploy CCV Sensor on Cat9300                 

• Task 1: Install CCV Deployment Tool

Discovery Lab 5: Configure event-forwarding from Cisco Cyber Vision to Splunk (CEF/syslog)        

• Task 1: Manage Cyber Vision apps in Splunk
• Task 2: Generate an API token in Cyber Vision Center
• Task 3: Add Account to Cisco Cyber Vision Splunk Add-On

Discovery Lab 6: Import and configure Cyber Vision dashboards and analytics views in Splunk         

• Task 1: Add inputs to Splunk
• Task 2: Add syslog data source in Splunk
• Task 3: Add syslog configuration in Cyber Vision Center

Discovery Lab 7: Organizing initial dataset using groups and network presets

• Task 1: Organizing the Devices in Groups
• Task 2: Organize Data by Preset Filters

Discovery Lab 8: Creating and managing security baselines, event management, and real-time alerting

• Task 1: Creating and managing security baselines
• Task 2: Review CCV Events
• Task 3: Filter and Search in the Events

Discovery Lab 9: Performing Active Discovery and Identify Vulnerabilities          

• Task 1: Active Discovery
• Task 2: Vulnerability Dashboard

Discovery Lab 10: System administration and practical configuration tasks: user management, licensing, RBAC      

• Task 1: Create an Account
• Task 2: Licensing

Discovery Lab 11: Configuring advanced IDS profiles and analyzing threat data     

• Task 1: Anomaly Detection and IDS

Discovery Lab 12: Configure pxGrid integration between Cisco Cyber Vision and Cisco ISE       

• Task 1: Enable pxGrid in Cisco ISE
• Task 2: Create profiling policies in Cisco ISE using the endpoint device attribute data collected from Cisco Cyber Vision
• Task 3: Generate Client Certificate in Cisco ISE
• Task 4: Create Client Certificate in Cisco Cyber Vision
• Task 5: Import Cisco Cyber Vision’s Certificate Authority into Cisco ISE and Enable Trust for Authentication
• Task 6: Validate the integration in Cisco ISE and Cisco Cyber Vision

Discovery Lab 13: Cisco Catalyst Center and ISE Integration   

• Task 1: Integrating ISE with Catalyst Center
• Task 2 Cisco Cyber Vision Sensor discovery

Discovery Lab 14: Practical scenario: detection, observation, correlation, and response to simulated OT network security events via Splunk dashboards and features 

• Task 1 Cyber Vision dashboards
• Task 2: Detection, observation, correlation, and response to simulated OT network security events via Splunk dashboards