Configuring Security Audit task settings using the Kaspersky ICS CERT vulnerabilities database for SCADA

The task can be run only if you have an active Kaspersky Industrial CyberSecurity for Node license key with an ICS Audit licensed object.

The Kaspersky ICS CERT vulnerabilities database for SCADA is provided and updated together with updates of Kaspersky Endpoint Agent databases and modules. Accordingly, before configuring the Security Audit task settings using the Kaspersky ICS CERT vulnerabilities database for SCADA as a rule source, update the application databases and modules.

To configure Security Audit task settings using the Kaspersky ICS CERT vulnerabilities database for SCADA as a rule source:

1. In the main Kaspersky Security Center Web Console window select Devices → Tasks.
2. Open the task settings window by clicking the name of the Security Audit task.
3. Select the Application settings tab.
4. In the Source of rules section, select Kaspersky ICS CERT vulnerabilities database for SCADA.

   Information about the vulnerability database is displayed. Follow the Details links in the Platforms and Products fields to open windows with lists of the operating systems and products mentioned in the rules of the selected source.

5. In the Scope section, if necessary, change the vulnerability scan mode:
   1. Select one of the modes:
      • Scan all vulnerabilities.

        Kaspersky Endpoint Agent scans the devices to which the task is assigned in order to detect all vulnerabilities described in the rules of the Kaspersky ICS CERT vulnerabilities database for SCADA.

      • Scan all vulnerabilities except added to the list.

        Kaspersky Endpoint Agent scans the devices to which the task is assigned in order to detect all vulnerabilities described in the rules of the Kaspersky ICS CERT vulnerabilities database for SCADA except for those added to the list below.

      • Scan vulnerabilities added to the list.

        Kaspersky Endpoint Agent scans the devices to which the task is assigned in order to detect vulnerabilities added to the list below.

   2. If you selected Scan all vulnerabilities except added to the list or Scan vulnerabilities added to the list, create a list of vulnerabilities using the Add or Add according to conditions.
6. In the Advanced section, if necessary, determine the statuses of directive-based scans that will be included in the security audit task report:
   1. Select the Use Directives check box.
      

      The directive list is loaded from the selected source of security audit rules.

      Possible directives:

      • Compliance – a scan of this category shows if the system configuration settings comply with the security policy.
      • Inventory – a scan of this category shows if the software or hardware specified in the rules is installed in the system.
      • Miscellaneous – custom scan.
      • Patch – a scan of this category shows if the patch specified in the rules is installed in the system.
      • Vulnerability – a scan of this category shows if the vulnerabilities specified in the rules exist in the system.

      The scan result for a directive can have one of the following statuses:

      • True – Positive scan result.
      • False – Negative scan result.
      • Unknown – unclear vulnerability scan result. The scan finishes successfully, no obvious errors were detected, but it is not possible to make a decision.
      • Error – The scan completed with an error.
      • Not evaluated – no decision regarding the vulnerability is made, but not because of an error. For example, it was not possible to calculate the size of the second partition on the hard drive, because the second partition is missing.
      • Not applicable – The scan conditions cannot be applied to the selected scan scope. For example, vulnerability must be applied to a 64-bit operating system, but the test is performed on a 32-bit operating system.
   2. Using the switch next to each directive, determine the statuses of directive-based scans that will be displayed in the security audit task report.

      If the switch next to a directive status is on, results of scans based on the directive's rules that have this status will be displayed in the security audit task report.

      By default, the check boxes next to the True and False scan result are selected for all directives.

7. In the Advanced section, if necessary, configure settings for logging task completion events:
   1. Select the Enable logging check box.
   2. Select the desired Logging level from the list.

      By default, the log is stored in the C:\Program Files\Kaspersky Lab\Kaspersky Security Center Web Console\logs folder.

      The following logging levels are available:

      • Critical level – only Critical events
      • Warning level – only Critical and Warning events
      • Information level – all Critical, Warning and Information events
      • Debug level – all Critical, Warning, Information and Debug events
8. Click OK to save the changes.

   You can start the created task manually or configure a scheduled task start.