saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/implementing-patch-management-for-ot-systems/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.9 KiB
Raw Blame History

API Reference: Implementing Patch Management for OT Systems

ICS-CERT Advisory API

# Query CISA ICS advisories (RSS/JSON)
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | jq '.vulnerabilities[] | select(.vendorProject | test("Siemens|Rockwell|Schneider"))'

# NVD API for ICS CVEs
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=SCADA&resultsPerPage=20"

Vendor Patch Sources

Vendor Advisory Source Notification
Siemens ProductCERT (cert.siemens.com) RSS + Email
Rockwell Knowledgebase (rockwellautomation.custhelp.com) Email
Schneider PSIRT (se.com/ww/en/work/support/cybersecurity) RSS + Email
ABB Cybersecurity Advisory (abb.com) Email
Honeywell PSIRT Advisories Email

Patch Prioritization Matrix

CVSS Score Exploited OT Impact Priority SLA
9.0 - 10.0 Yes Safety system P1 Emergency Next maintenance window
7.0 - 8.9 Yes Control system P2 Critical 30 days
7.0 - 8.9 No Non-safety P3 High 90 days
4.0 - 6.9 No Any P4 Medium 180 days
0.1 - 3.9 No Any P5 Low Next scheduled outage

NERC CIP-007-6 R2 Requirements

Sub-Requirement Description
R2.1 Patch management process for tracking
R2.2 Evaluate patches within 35 days of availability
R2.3 Implement applicable patches within timeframe
R2.4 Document mitigation plans for patches not applied

IEC 62443-2-3 Patch Management Lifecycle

Phase Action
Monitor Subscribe to vendor advisories and ICS-CERT
Assess Evaluate patch compatibility with OT environment
Test Validate in staging environment mirroring production
Plan Schedule during maintenance window with rollback
Deploy Staged rollout with process verification
Verify Confirm functionality and safety post-patch

Compensating Controls (When Patching Not Possible)

Control Use Case
Network segmentation Isolate unpatched systems
Application whitelisting Prevent exploit execution
Virtual patching (IPS rules) Block known exploit vectors
Enhanced monitoring Detect exploitation attempts
Physical access restriction Limit console access

WSUS/SCCM OT Configuration

# WSUS: Approve patch for OT test group only
Approve-WsusUpdate -Update $update -Action Install -TargetGroupName "OT-Test-Ring"

References