Cisco CyberVision Deployment and Operation

Module 1: OT Cybersecurity Fundamentals and Cisco Cyber Vision Introduction

• An Overview of ICS/OT and Industrial IoT architectures
• Identifying common threats, vulnerabilities, and attack surfaces in OT/ICS environments
• OT concepts, terms, and daily operational challenges
• Understanding convergence challenges (IT/OT integration)
• Key components and elements of Cisco Cyber Vision architecture
• Introducing Cisco Cyber Vision UI (navigation and main functionalities overview)

Module 2: Cisco Cyber Vision Deployment and Implementation

• Deployment methodologies (Centralized, Distributed Sensor deployment approaches)
• Detailed review of sensor types, functionalities, and appropriate deployment scenarios
• Installation and provisioning Cisco Cyber Vision Center
• Installation and configuration of Cisco Cyber Vision sensors
• Performing initial data capturing and validating sensor communications

Module 3: Cisco Cyber Vision Operational Management

• Familiarization with advanced GUI features and customizations (Dashboards, Views, Panels)
• Event Management: Monitoring events, alerts, and audits for cyber incidents and anomalies
• Understanding the use and management of monitor mode
• Baselining facilities and managing change detection
• Intrusion Detection System (IDS) integration, configuration, and management using SNORT
• Advanced Vulnerability Management within Cisco Cyber Vision usage
• Active Discovery methodology and best practices
• Administration of the Cisco Cyber Vision ecosystem (licensing, user management, RBAC, LDAP

Module 4: Cisco Cyber Vision Integration with Cisco Catalyst Center

• Integration Architecture Overview
• Use Cases for Integration
• Configuration Workflow
• Operational Verification

Module 5: Cisco Cyber Vision Integration with Cisco Identity Services Engine (ISE)

• Overview of Cisco ISE in OT EnvironmentsValue of asset profiling and visibility in OT networksUnderstanding role-based access control and segmentation in OT environments
• Integration architecture between Cisco Cyber Vision and Cisco ISE
• Configuration and data exchange using pxGrid integration
• Operational workflow of asset profiling, visibility, and dynamic policy enforcement based on Cyber Vision insights
• Best practices and use-case scenarios (segmentation, dynamic NAC enforcement, access control)

Module 6: Cisco Cyber Vision Integration with Splunk (SIEM)

• Introduction to Splunk integration and OT cybersecurity use-casesUnderstanding the value-added by integration with SIEM platforms
• Configuring Cisco Cyber Vision event-forwarding integration with Splunk:Syslog configuration (CEF)Event data normalization and parsing
• Splunk dashboards design for Cisco Cyber Vision:Scenario-driven OT/ICS risk visibility dashboardsIncident detection and operational analytics dashboards
• Alerting and event correlation using Splunk Cyber Vision integration for security operations teams
• Practical use-cases: OT security event and incident response management

Lab Outline: Labs are designed to assure learners a whole practical experience, through the following practical activities: Discovery Lab 1: Installation of Cyber Vision Center and Global Center Task 1: Cyber Vision Architecture Overview Task 2: Installation of Cisco Cyber Vision Task 3: Loading a PCAP Task 4: Initial interaction and familiarity with Cisco Cyber Vision GUI Discovery Lab 2: Exploring practical OT attack scenarios and their potential impacts Task 1: Unauthorized PLC Control Command Task 2 Unauthorized Write to PLC Variables Discovery Lab 3: Configue Catalyst 9300 for CCV Sensor deployment Task 1 Catalyst 9300 configuration Discovery Lab 4: Deploy CCV Sensor on Cat9300 Task 1: Install CCV Deployment Tool Discovery Lab 5: Configure event-forwarding from Cisco Cyber Vision to Splunk (CEF/syslog) Task 1: Manage Cyber Vision apps in Splunk Task 2: Generate an API token in Cyber Vision Center Task 3: Add Account to Cisco Cyber Vision Splunk Add-On Discovery Lab 6: Import and configure Cyber Vision dashboards and analytics views in Splunk Task 1: Add inputs to Splunk Task 2: Add syslog data source in Splunk Task 3: Add syslog configuration in Cyber Vision Center Discovery Lab 7: Organizing initial dataset using groups and network presets Task 1: Organizing the Devices in Groups Task 2: Organize Data by Preset Filters Discovery Lab 8: Creating and managing security baselines, event management, and real-time alerting Task 1: Creating and managing security baselines Task 2: Review CCV Events Task 3: Filter and Search in the Events Discovery Lab 9: Performing Active Discovery and Identify Vulnerabilities Task 1: Active Discovery Task 2: Vulnerability Dashboard Discovery Lab 10: System administration and practical configuration tasks: user management, licensing, RBAC Task 1: Create an Account Task 2: Licensing Discovery Lab 11: Configuring advanced IDS profiles and analyzing threat data Task 1: Anomaly Detection and IDS Discovery Lab 12: Configure pxGrid integration between Cisco Cyber Vision and Cisco ISE Task 1: Enable pxGrid in Cisco ISE Task 2: Create profiling policies in Cisco ISE using the endpoint device attribute data collected from Cisco Cyber Vision Task 3: Generate Client Certificate in Cisco ISE Task 4: Create Client Certificate in Cisco Cyber Vision Task 5: Import Cisco Cyber Vision's Certificate Authority into Cisco ISE and Enable Trust for Authentication Task 6: Validate the integration in Cisco ISE and Cisco Cyber Vision Discovery Lab 13: Cisco Catalyst Center and ISE Integration Task 1: Integrating ISE with Catalyst Center Task 2 Cisco Cyber Vision Sensor discovery Discovery Lab 14: Practical scenario: detection, observation, correlation, and response to simulated OT network security events via Splunk dashboards and features Task 1 Cyber Vision dashboards Task 2: Detection, observation, correlation, and response to simulated OT network security events via Splunk dashboards