Once the ICS device is installed and in production, the goal is to keep it performing at peak efficiency. This includes keeping an eye on its performance and monitoring any alarms or events it may generate by tying the device into a central logging and monitoring solution such as the SIEM we discussed in an earlier chapter. Where possible, devices should be configured to generate security-related events when, for example, someone fails to log onto an SSH service. Keep in mind, though, that just logging alarms and performance parameters isn't enough. Someone must actively watch for anomalies and act upon them.
Another important factor to maintaining smooth operation of your ICS ...
