1
00:00:00,000 --> 00:00:03,040
All right, so what is the problem?

2
00:00:03,700 --> 00:00:20,100
I think one of the things that I really like so much about where DEF CON has grown up with the villages is that when you're looking at industrial control systems, one of the big challenges is not only the technical intimidation of where do I even start to understand how to access this code,

3
00:00:20,100 --> 00:00:28,260
look at these protocols and understand this equipment, but there's also a barrier to entry of this equipment is hard to find.

4
00:00:28,260 --> 00:00:29,520
It's very expensive.

5
00:00:30,200 --> 00:00:45,720
And so being able to get your hands on it and to touch it and to be able to start to play with it is a barrier to being able to start that research and have an open dialogue between the security research community and of course the vendors and the corporations that use this equipment.

6
00:00:45,800 --> 00:00:53,860
And the villages of course have all of these things there set up for you with experts happy to walk you through, let you touch it, ask those questions.

7
00:00:54,240 --> 00:01:06,680
So I encourage any of you who haven't been to the ICS village or any of the other villages, please do so because this is that kind of opportunity where the kinds of things that we're going to talk about, you get to go actually physically touch that and it's not just abstract.

8
00:01:18,380 --> 00:01:23,280
The second year, it was a bit more, there's a lot of us on this wire.

9
00:01:24,120 --> 00:01:26,360
We continue to see further digging in.

10
00:01:26,360 --> 00:01:29,740
The opportunity is being taken, but it needs to be encouraged.

11
00:01:29,740 --> 00:01:31,540
We're still way beyond the eight ball.

12
00:01:32,360 --> 00:01:35,680
And Atlas aside for the most part, this is not sexy.

13
00:01:36,140 --> 00:01:38,820
So it's not the challenges.

14
00:01:39,880 --> 00:01:41,380
Strike the pose again, please.

15
00:01:41,880 --> 00:01:44,380
That says industrial control systems.

16
00:01:46,520 --> 00:01:48,960
Thanks for dropping the beat, man.

17
00:01:52,520 --> 00:01:53,540
It's not sexy.

18
00:01:53,540 --> 00:01:58,360
And a lot of the challenges and a lot of the solutions and a lot of things that need to be done are not sexy.

19
00:01:58,440 --> 00:02:12,200
I mean, when you start looking at a lot of the conversation that's happening in the research community at large, sexy, zero day being dropped, SWIFT being compromised, sexy, man speed infrastructure.

20
00:02:13,180 --> 00:02:14,460
We have another mic?

21
00:02:14,480 --> 00:02:16,080
Don't drop it.

22
00:02:16,080 --> 00:02:19,320
Far enough.

23
00:02:19,660 --> 00:02:21,960
You don't know how far I'm going to go.

24
00:02:23,300 --> 00:02:24,720
All right.

25
00:02:25,080 --> 00:02:36,840
So sexy, the SWIFT, the various things, banking and maybe, well, destruction of dams is pretty cool, but it doesn't dive into the problem deeply enough.

26
00:02:37,560 --> 00:02:44,040
But a number of years ago we did have some sexy parts of the grid and it was called AMI, advanced metering infrastructure.

27
00:02:44,040 --> 00:03:03,540
The concepts were relatively new, they were exciting, they had ARA grant money, they had backing, they had momentum, and yet industrial control system sat on the back burner and every IOU I spoke with, IOU, industrial utility, everyone that I spoke with just kind of shut the conversation.

28
00:03:03,540 --> 00:03:05,260
Oh, no, that's something very different.

29
00:03:05,260 --> 00:03:08,360
We don't have money for that at the moment, but we're working on it.

30
00:03:09,360 --> 00:03:12,600
The other part of the not sexy, of course, is we're people.

31
00:03:12,600 --> 00:03:14,400
We do what we're incentivized to do.

32
00:03:14,400 --> 00:03:30,340
Part of that, of course, is we're pursuing our individual passions, but starting to take that challenge of cost and limited ability to start to do this, and in the last two years we've started to see the rise of the bug bounty concept and crowd-sourced vulnerability disclosure programs.

33
00:03:30,820 --> 00:03:33,240
Where are those for this kind of community?

34
00:03:33,240 --> 00:03:34,760
Where's that kind of incentive?

35
00:03:36,720 --> 00:03:38,200
You want to touch on longevity?

36
00:03:38,820 --> 00:03:42,940
Yeah, I thought you were hitting longevity.

37
00:03:42,940 --> 00:03:46,580
I was going to, but I forgot it, so I'm passing it back to you.

38
00:03:48,260 --> 00:03:50,300
There, I touched on it.

39
00:03:51,080 --> 00:03:52,320
Longevity.

40
00:03:53,180 --> 00:03:56,460
We have industrial control systems.

41
00:03:56,460 --> 00:03:57,640
Hey, big surprise.

42
00:03:57,640 --> 00:04:00,860
They're built to withstand many decades.

43
00:04:01,820 --> 00:04:08,960
Okay, it's not surprising, because these systems control that which makes our life what it is.

44
00:04:09,640 --> 00:04:21,220
An attack, not to be too accelerant, but a certain type of attack could potentially change the way we live.

45
00:04:22,520 --> 00:04:25,180
So, do we get into this?

46
00:04:25,360 --> 00:04:27,640
Crap, I'm forgetting what's in the next slide.

47
00:04:27,760 --> 00:04:30,520
So, forgive me if I say things twice.

48
00:04:31,370 --> 00:04:51,360
So, what we have is a problem of systems that were created, designed 20 years ago, put in place 15 years ago, but they've got a 20 to 30 year lifespan that has been amortized by utilities and people deploying, anybody who's deploying ICS.

49
00:04:51,860 --> 00:04:59,040
The manufacturers have been strong armed into the lowest possible price or it will go somewhere else.

50
00:04:59,740 --> 00:05:05,620
They didn't build in money to maintain these systems for long enough.

51
00:05:05,620 --> 00:05:16,100
They were never intended to be connected to the internet, but as we all know, every IP network wants to and will eventually be connected to the internet.

52
00:05:16,320 --> 00:05:27,780
So, the where's Waldo of industrial control systems is if you're looking at a box and you want to know whether it's an industrial control system or just a traditional computer, if it's at least 20 years old, it's an industrial control system.

53
00:05:28,020 --> 00:05:31,200
I mean, we're talking top of the line 30 megahertz.

54
00:05:32,400 --> 00:05:34,940
That's an impressive piece of equipment.

55
00:05:35,820 --> 00:05:51,720
And actually, funny story here, just since we've been talking about insecurity, we'd actually had props as a part of this presentation where keeping in line with OSHA, which prescribes the standards for folks that are working with dangerous things like industrial control systems and SCADA,

56
00:05:51,720 --> 00:05:55,760
etc., that we would have hard hats on and safety vests.

57
00:05:55,760 --> 00:05:57,000
They were stolen.

58
00:05:57,060 --> 00:06:01,300
So, that just kind of shows you that you got to have physical security at all times as well.

59
00:06:01,940 --> 00:06:06,400
So, God grant me serenity.

60
00:06:07,180 --> 00:06:09,040
What can we change?

61
00:06:09,040 --> 00:06:10,640
What can you change?

62
00:06:10,980 --> 00:06:14,620
This is an actual statistic that we made up that 93

63
00:06:20,760 --> 00:06:23,480
percent of all code is shit.

64
00:06:23,480 --> 00:06:25,500
And that is the technical jargon for it.

65
00:06:25,500 --> 00:06:27,560
And we made that up, but we're not wrong.

66
00:06:28,100 --> 00:06:32,940
And that code is code built on top of code built on top of code.

67
00:06:32,940 --> 00:06:42,640
I think one of the more interesting conversations I've ever had with a manufacturer was through some level of acquisition, they had code through some little subsystem of one of their boards.

68
00:06:42,640 --> 00:06:45,640
And they're like, nobody knows what that code is.

69
00:06:45,640 --> 00:06:46,720
Nobody has any idea.

70
00:06:46,720 --> 00:06:51,040
Whoever wrote that is long gone through some acquisition of some time ago.

71
00:06:51,080 --> 00:06:51,780
We have no idea.

72
00:06:51,780 --> 00:06:57,140
We just kind of let it go and we sort of know how to poke it and occasionally it pokes back, but that's it.

73
00:06:57,940 --> 00:07:06,040
So, we have to accept that crappy code is going to make it into the systems that protect our lives and provide for the way that we like to live.

74
00:07:06,680 --> 00:07:08,320
Do we give up on code?

75
00:07:08,320 --> 00:07:10,000
Do we say, oh, it's crap?

76
00:07:10,000 --> 00:07:10,920
No.

77
00:07:11,200 --> 00:07:16,660
Just recognize there is a natural tendency towards crap, chaos.

78
00:07:17,100 --> 00:07:18,300
Entropy.

79
00:07:18,300 --> 00:07:19,140
Entropy.

80
00:07:19,140 --> 00:07:21,440
Well, couldn't we just keep them off the internet?

81
00:07:21,840 --> 00:07:22,620
Sure.

82
00:07:22,620 --> 00:07:24,620
I'd like to see you do that.

83
00:07:25,880 --> 00:07:27,580
So, people.

84
00:07:28,500 --> 00:07:29,280
People.

85
00:07:29,280 --> 00:07:30,400
Oh, people.

86
00:07:32,060 --> 00:07:35,840
Management and people on the ground don't know how to talk to each other.

87
00:07:35,840 --> 00:07:36,700
You can't do that.

88
00:07:36,700 --> 00:07:37,660
It's stupid.

89
00:07:37,960 --> 00:07:42,920
If you had any brains in your head, you would not have even suggested that.

90
00:07:42,920 --> 00:07:47,340
You can't do so many less things.

91
00:07:47,340 --> 00:07:47,980
Anyway.

92
00:07:48,120 --> 00:07:49,320
That was loud.

93
00:07:50,860 --> 00:07:52,880
You almost... Bet you don't want to hear me anymore.

94
00:07:52,880 --> 00:07:55,500
No, you almost threw off my pacemaker.

95
00:07:56,300 --> 00:07:57,920
That would be the next talk.

96
00:07:57,920 --> 00:07:58,980
That's another talk.

97
00:07:58,980 --> 00:08:00,280
We do medical devices.

98
00:08:01,260 --> 00:08:06,140
The challenge here is the classic nerd versus operations and management.

99
00:08:06,880 --> 00:08:09,620
Nerds speak nerd.

100
00:08:09,760 --> 00:08:11,660
They're kind of abusive actually.

101
00:08:11,860 --> 00:08:12,440
Unchecked.

102
00:08:12,440 --> 00:08:13,860
We kind of beat each other up.

103
00:08:13,860 --> 00:08:14,140
Why?

104
00:08:14,140 --> 00:08:15,440
Because we were beaten up as kids.

105
00:08:15,440 --> 00:08:16,640
We're nerds.

106
00:08:17,160 --> 00:08:19,240
Now that I have some power, man.

107
00:08:20,940 --> 00:08:25,620
Meanwhile, management is there ensuring the function of the operation, right?

108
00:08:25,620 --> 00:08:26,840
They're caring about revenue.

109
00:08:26,840 --> 00:08:29,480
They're caring about the business and they're trying to do that.

110
00:08:29,520 --> 00:08:31,280
You make that sound really sexy.

111
00:08:31,280 --> 00:08:33,060
As an engineer, I'm kind of offended.

112
00:08:33,720 --> 00:08:36,460
I don't know what the interpretive dance is for dollar sign.

113
00:08:36,460 --> 00:08:37,180
I do, actually.

114
00:08:37,180 --> 00:08:37,980
We're in Vegas.

115
00:08:43,100 --> 00:08:53,320
Management is focused on operations and the nerd guy runs down and is like, hey, boss, we have this huge problem that we just found out.

116
00:08:53,320 --> 00:08:57,160
There's this issue with code and immediately starts running down into the technical bits.

117
00:08:58,740 --> 00:09:02,160
Management glazes it over, waits for him to leave the room.

118
00:09:03,620 --> 00:09:04,300
You know what happened?

119
00:09:04,300 --> 00:09:05,120
I don't know what happened.

120
00:09:05,120 --> 00:09:11,840
Stupid or not, the management has a job and they have things that are very important to them.

121
00:09:12,040 --> 00:09:13,240
Maybe their paycheck.

122
00:09:13,240 --> 00:09:24,160
Maybe they actually care about security or at least safety and the mission of their organization or if you have a great environment, they may actually care about you.

123
00:09:25,740 --> 00:09:29,120
However, what's the secret to communication?

124
00:09:29,820 --> 00:09:32,040
Understanding the other side.

125
00:09:32,060 --> 00:09:35,180
I like to say that there are no crazy people on this planet.

126
00:09:36,560 --> 00:09:41,260
You just don't understand the system of reference or their decision making.

127
00:09:41,260 --> 00:09:42,600
There are no crazy people.

128
00:09:43,600 --> 00:09:45,260
What's important to you?

129
00:09:45,720 --> 00:09:47,120
What's in it for me?

130
00:09:47,840 --> 00:09:49,660
Oh, you had to go there.

131
00:09:49,660 --> 00:09:58,760
A little bit later we're going to go through a little bit more granularity about the different kinds of stakeholders in this and the pieces of the supply chain.

132
00:09:59,080 --> 00:10:04,620
But fundamentally you have this challenge of this, the two sides speaking Greek.

133
00:10:04,620 --> 00:10:09,080
Nerd speaking nerd, management speaking operations and in the middle of this gap.

134
00:10:09,100 --> 00:10:15,000
And this is often times where security research companies like us come in between because we're there to bridge that gap between.

135
00:10:15,000 --> 00:10:21,500
We have the technical understanding of working with the equipment at a very granular level and understanding the implications there.

136
00:10:21,500 --> 00:10:27,900
And then importantly we can tie it back to the business context and impact because that's the key.

137
00:10:27,900 --> 00:10:29,140
That's how you got to bridge that.

138
00:10:29,140 --> 00:10:33,140
When you're thinking about, it's not code, it's the impact of the code.

139
00:10:33,400 --> 00:10:36,400
Compromise is not compromise is not compromise.

140
00:10:36,540 --> 00:10:44,700
Compromise or a hack or an exploit only has value within how does that vulnerability affect the business, affect the operation.

141
00:10:44,700 --> 00:10:47,900
That impact helps you understand prioritization.

142
00:10:48,100 --> 00:10:58,020
That impact helps you understand the correct remedial solution because it's not just a question of, there are lots of different ways to fix problems.

143
00:10:58,020 --> 00:11:01,860
It's fixing it the right way for the context of how it's being used.

144
00:11:01,860 --> 00:11:08,320
And you don't want to take responsibility as an engineer for something that is going to get your boss fired.

145
00:11:08,320 --> 00:11:09,800
It's his responsibility.

146
00:11:09,820 --> 00:11:15,460
Your responsibility is to provide information, to understand and to bring along.

147
00:11:15,460 --> 00:11:24,760
A very dear friend of mine last night at our party said, Atlas, we've had a couple of drinks so we're all kind of reclining by the hot tub.

148
00:11:24,800 --> 00:11:27,420
He says, Atlas, what's important to you?

149
00:11:27,420 --> 00:11:28,540
How do we fix this?

150
00:11:28,540 --> 00:11:29,880
What are you thinking?

151
00:11:31,020 --> 00:11:44,100
And I didn't have this canned but the three things that came out of my mouth were education, motivation and partnership.

152
00:11:44,620 --> 00:11:49,000
I didn't realize that that applied so well to what we're going to talk about today.

153
00:11:49,000 --> 00:11:50,040
Go ahead.

154
00:11:50,940 --> 00:11:52,840
But wait, there's more.

155
00:11:53,100 --> 00:12:04,020
So as we discussed, we talked about the agent incentivization problem where is the security community really incentivized to become engaged in this.

156
00:12:04,020 --> 00:12:08,260
And then of course looking at where's the clear mandate coming from?

157
00:12:08,600 --> 00:12:10,260
Who is in fact pushing that?

158
00:12:10,260 --> 00:12:12,480
Because this is a top-down problem.

159
00:12:12,480 --> 00:12:17,680
You're not going to have the average consumer, which everyone in this room is.

160
00:12:17,680 --> 00:12:20,720
Last time I checked, we all use electricity and water.

161
00:12:21,660 --> 00:12:24,760
Everyone in here is a consumer and a stakeholder.

162
00:12:24,780 --> 00:12:31,880
And we as a large group are not really able to effectively advocate for something that is a very complex problem and set of problems.

163
00:12:31,880 --> 00:12:34,440
This is something that needs to be top-down driven.

164
00:12:36,060 --> 00:12:36,940
Accountability?

165
00:12:37,800 --> 00:12:39,340
Yeah, no, I don't.

166
00:12:39,340 --> 00:12:40,280
I'm not a consumer.

167
00:12:40,280 --> 00:12:41,360
I live in a yurt.

168
00:12:42,620 --> 00:12:44,040
Solar power, dude.

169
00:12:44,220 --> 00:12:45,820
Ryan, how's that yurt coming?

170
00:12:48,540 --> 00:12:50,560
So there's no clear mandate.

171
00:12:50,820 --> 00:12:54,440
Who is responsible for fixing these problems?

172
00:12:54,760 --> 00:12:59,900
The way that we live affects all of us, as he just said.

173
00:13:01,100 --> 00:13:02,920
But who has to fix this?

174
00:13:02,920 --> 00:13:06,700
Is this the vendors, the people who made PLCs, RTUs?

175
00:13:07,180 --> 00:13:08,420
Is it the utilities?

176
00:13:08,420 --> 00:13:09,340
Is it their problem?

177
00:13:09,340 --> 00:13:13,000
I've seen some pretty amazing engineering going on in utilities.

178
00:13:13,400 --> 00:13:14,540
Is it their problem?

179
00:13:14,860 --> 00:13:16,200
How about regulatory agencies?

180
00:13:16,200 --> 00:13:17,440
Show of hands.

181
00:13:17,820 --> 00:13:21,240
Who wants the regulatory agencies to fix this problem for you?

182
00:13:22,360 --> 00:13:23,720
Oh, I love this.

183
00:13:23,720 --> 00:13:24,600
This is great.

184
00:13:29,590 --> 00:13:30,550
Go, Joe.

185
00:13:42,120 --> 00:13:45,420
He's saying if it's regulatory, it will be check the box.

186
00:13:45,420 --> 00:13:47,080
It's the only way that they know how to do it.

187
00:13:47,080 --> 00:13:53,680
And in fact, they're incentivized with both carrot and stick to make it check the box.

188
00:13:54,000 --> 00:13:55,140
Very good answer.

189
00:13:55,940 --> 00:13:59,120
I mean, there are a couple different agencies.

190
00:13:59,120 --> 00:14:00,720
We'll talk about that in a minute.

191
00:14:00,720 --> 00:14:01,400
Go ahead.

192
00:14:02,660 --> 00:14:08,940
So the first thing, let's address the problems that we can right now.

193
00:14:09,280 --> 00:14:11,240
There are things we can do.

194
00:14:11,860 --> 00:14:15,520
We actually want to have a 5, 10, 15 year plan.

195
00:14:15,520 --> 00:14:16,600
Hopefully not 15.

196
00:14:16,600 --> 00:14:18,800
Please, Lord, let us fix this faster.

197
00:14:19,620 --> 00:14:21,460
But there are things we can do right now.

198
00:14:21,800 --> 00:14:22,460
Show of hands.

199
00:14:22,460 --> 00:14:23,920
Anyone want to give an offer?

200
00:14:24,060 --> 00:14:25,060
Any ideas?

201
00:14:27,080 --> 00:14:31,300
I can build my house on stilts so that when the dam breaks, I'm good to go.

202
00:14:32,000 --> 00:14:33,280
I like the idea.

203
00:14:33,280 --> 00:14:34,500
I already have my house built.

204
00:14:34,500 --> 00:14:36,380
I'm not sure that I want to jack it all up.

205
00:14:38,460 --> 00:14:39,580
Anyone else?

206
00:14:40,040 --> 00:14:40,640
Tim, I know you.

207
00:14:40,640 --> 00:14:41,560
No, I'm just kidding.

208
00:14:41,920 --> 00:14:43,040
So where do we start?

209
00:14:43,840 --> 00:14:49,360
Well, we begin by assessing what the problem is in our own backyard.

210
00:14:50,280 --> 00:15:00,000
Every one of the people on the last page, even the regulators, we want to become aware of the problems that we can fix right now.

211
00:15:00,000 --> 00:15:07,040
For example, if we are still using Modbus, probably a good idea to get that off the wire.

212
00:15:07,040 --> 00:15:08,680
I don't care if you're doing serial.

213
00:15:09,800 --> 00:15:11,960
Okay, there are worse things to use.

214
00:15:12,640 --> 00:15:17,800
But if you're using Modbus right now over Ethernet, please stop.

215
00:15:18,240 --> 00:15:19,720
There are other options.

216
00:15:20,040 --> 00:15:26,200
And I'm sure that there are business decisions that made Modbus the right thing and it takes money and time and effort.

217
00:15:26,200 --> 00:15:27,980
But it's something that we can fix.

218
00:15:27,980 --> 00:15:43,480
If the protocols that you use offer security, lab it up, make sure we don't roll out some big change and take down the grid or the water supply or back up the poop.

219
00:15:44,440 --> 00:15:47,820
I mean, we're talking about more than just the electric grid, right?

220
00:15:50,500 --> 00:15:57,280
But lab it up, test it, migrate to something that at least offers security, even if it's not perfect.

221
00:15:57,440 --> 00:15:59,560
DMP3 has tons of bugs.

222
00:15:59,560 --> 00:16:12,960
But at least it, as he stepped on the chair, I was thinking he was going to call out the fact that you may be still kind of surrounded by shit, but if you can get a little higher, you can be in it less.

223
00:16:13,140 --> 00:16:14,280
Pick something better.

224
00:16:14,280 --> 00:16:33,720
If you have systems that are, have replacement upgrades and you can put into place a better system, maybe a system that actually has a vendor that's still around or a vendor that you trust to partner with you, this is a good first step.

225
00:16:34,740 --> 00:16:45,160
There are many things that you or we, whoever is doing this assessment, can sit down and identify, within the next year, we can do this.

226
00:16:45,200 --> 00:16:52,420
Let's talk to the right people, work it out, get something as part of a bigger process.

227
00:16:52,560 --> 00:16:56,560
To emphasize, this is the all is not lost slide.

228
00:16:57,000 --> 00:17:07,140
You can start somewhere and have that vision of where things can get better, circle the wagons where you can establish control and then iterate from there.

229
00:17:10,660 --> 00:17:12,120
Best practices.

230
00:17:12,820 --> 00:17:21,400
I mean, so, a few other things that we can throw into the mix that you can do within the next year to two.

231
00:17:23,180 --> 00:17:25,720
Authentication is a problem we all deal with.

232
00:17:25,720 --> 00:17:30,840
There are many technologies available because everybody is struggling with it.

233
00:17:31,120 --> 00:17:34,460
Two-factor authentication for the right systems is a good first start.

234
00:17:34,680 --> 00:17:40,220
If you have to use passwords and not tokens or keys or fobs, please.

235
00:17:42,140 --> 00:17:50,420
The next step, guys, I know that we didn't mean to plug the grid into the internet, but we've done it.

236
00:17:51,620 --> 00:17:59,100
We didn't design our systems and our networks to withstand the type of onslaught that a nation state is willing to offer.

237
00:17:59,100 --> 00:18:08,740
In fact, the state of many organizations, many people here without state funding could do it.

238
00:18:09,380 --> 00:18:14,560
So, I'd like to lay out the idea of a multi-tiered castle.

239
00:18:14,680 --> 00:18:26,660
At the very center, with the most restrictive protections in place, you have crown jewels, you have head ends, you have things that actually change significant parts of life.

240
00:18:27,100 --> 00:18:35,160
Outside of that, you have slightly less trusted, less protected systems, but still very highly protected.

241
00:18:35,300 --> 00:18:37,400
And so on and so forth.

242
00:18:37,400 --> 00:18:40,580
I recommend three to five layers at least.

243
00:18:42,140 --> 00:18:47,800
And these layers play into a potential for protection.

244
00:18:47,800 --> 00:18:57,360
So if you have a system that there's absolutely no way that you can have assurance that it is protected, then it falls in the outer ring.

245
00:18:57,360 --> 00:18:59,560
For example, pole top devices.

246
00:19:00,620 --> 00:19:12,020
Anyone here that's been at DEF CON, you're not, you cannot possibly argue with me that a system being on top of a pole is not secure.

247
00:19:12,280 --> 00:19:15,440
Unless it's in a compound with guns.

248
00:19:17,260 --> 00:19:18,480
Patching policy.

249
00:19:18,480 --> 00:19:20,640
This is just regular SEC 101.

250
00:19:20,960 --> 00:19:34,680
The systems that are being used to pivot into attack your critical infrastructure, generally people's workstations, check an email, surf on the web, these systems have to be maintained and protected.

251
00:19:34,680 --> 00:19:39,200
Now this is not going to keep off everybody.

252
00:19:39,200 --> 00:19:43,400
I'm going to try not to throw out nation's names because I know everybody's represented here.

253
00:19:45,480 --> 00:19:49,240
But patching, keep at least the end days done.

254
00:19:50,520 --> 00:19:59,060
And then there are configurations in our PLCs and RTUs that again can be used to turn on security features.

255
00:19:59,060 --> 00:20:07,680
Encryption and strong authentication and other things to lock down access that you shouldn't have available on your PLC.

256
00:20:07,680 --> 00:20:15,080
Now there are many who will say encryption takes time and I need point blah blah blah milliseconds response time.

257
00:20:15,720 --> 00:20:25,460
If your critical systems can't handle that type of waylay and processing power, those might fit on your list to replace.

258
00:20:28,390 --> 00:20:31,570
Monitor all the things, all the comms.

259
00:20:32,210 --> 00:20:45,550
So this is while end points might not be the place that you can do that monitoring, certainly there can be transmission paths and one of the challenges with this of course is not all of the communications are going to be wired.

260
00:20:45,570 --> 00:20:53,190
You have to keep in fact that a lot of things are going to have RF communications and you need to start thinking of the physical security and the physical presence of those things.

261
00:20:53,190 --> 00:20:56,750
Please don't allow your cell phones to connect to your network and talk to your head end.

262
00:20:57,190 --> 00:20:59,050
There's one good rule of thumb.

263
00:20:59,230 --> 00:21:04,890
But if you do have cell phones connected to a network, it better be on something you can monitor really well.

264
00:21:05,690 --> 00:21:07,870
Hunting, who here has heard of hunting?

265
00:21:09,230 --> 00:21:12,410
Okay, about one percent of you.

266
00:21:12,470 --> 00:21:15,810
Hunting is the act of scouring your network.

267
00:21:15,810 --> 00:21:20,110
No penetration testing has to go into this if you're worried about breaking things.

268
00:21:20,110 --> 00:21:23,970
Simply monitoring traffic patterns.

269
00:21:24,450 --> 00:21:30,830
Traffic can be cataloged, identified and put into a database and analyzed.

270
00:21:31,050 --> 00:21:39,630
For example, there's no reason why workstation in the office needs to talk directly to head end.

271
00:21:40,270 --> 00:21:49,130
If you have this type of communication or other strange communication, A, that's something you want to understand better.

272
00:21:49,270 --> 00:21:54,430
B, it may be the thing that tells who's on your network.

273
00:21:56,210 --> 00:21:57,630
Fuck Modbus.

274
00:21:58,570 --> 00:22:01,390
We've beaten Modbus.

275
00:22:01,390 --> 00:22:04,130
Modbus is unauthenticated.

276
00:22:05,370 --> 00:22:09,630
And perfectly sane to kick the shit out of here.

277
00:22:09,690 --> 00:22:12,550
There are others like it, but this is Modbus.

278
00:22:13,770 --> 00:22:19,770
Please choose something that has some sort of protectiveness.

279
00:22:19,770 --> 00:22:32,210
If you have critical systems that must use an insecure protocol, maybe because you're worried about latency, you should have armed guards around everywhere that that network touches.

280
00:22:36,060 --> 00:22:44,040
This is the self-promotion slide, so I'm just throwing that out there because this is some of the stuff that we do.

281
00:22:44,340 --> 00:23:04,740
But it's more, even if you don't do it with us, please understand, we have yet to get to the point where I need to throw binary exploitation against most control systems the way we do your laptop, the way we do your servers, the way we do against firewalls and routers.

282
00:23:04,740 --> 00:23:06,160
We don't have to do that.

283
00:23:07,540 --> 00:23:10,760
It's not hard enough to warrant that kind of work.

284
00:23:12,920 --> 00:23:17,780
But there will come a time, hopefully very rapidly, where that's not the case.

285
00:23:17,780 --> 00:23:40,060
As we fix the fixable, digging into hardware, software and firmware, that was sexy, identifying weaknesses in code, weaknesses in design of hardware, weaknesses in what your vendors are shipping out, like hard-coded passwords, these still exist.

286
00:23:40,900 --> 00:23:51,380
Assessments of all three things will provide you, when we finally get our poop in a group, something that is defendable.

287
00:23:51,640 --> 00:23:58,980
And if we don't start now, it will just be that much longer before we get to something that's defendable.

288
00:23:59,480 --> 00:24:01,820
But I've got limited budget.

289
00:24:01,860 --> 00:24:03,160
Well then prioritize.

290
00:24:03,600 --> 00:24:09,280
If you have systems that are most widely deployed, those should make pretty high on the list.

291
00:24:09,280 --> 00:24:22,620
If you have significant systems that control large, potentially irreplaceable parts of your systems, that may make a very good top place.

292
00:24:23,540 --> 00:24:25,700
You can get to the older stuff later.

293
00:24:25,700 --> 00:24:28,440
You guys know how to think about boundaries, right?

294
00:24:28,820 --> 00:24:31,920
We do the most important first, we then back up.

295
00:24:31,920 --> 00:24:33,960
We don't stop until we're done.

296
00:24:35,100 --> 00:24:37,500
But we get the best that we can for now.

297
00:24:37,660 --> 00:24:45,500
So while we list three device categories here, of loose categories, there are also three kinds of assessments.

298
00:24:45,520 --> 00:24:47,660
White box, gray box, and black box.

299
00:24:47,660 --> 00:24:53,160
And I list those because those also require careful consideration for what you're trying to accomplish.

300
00:24:53,180 --> 00:25:05,980
A black box assessment is saying, hey, you're just like somebody else out there anywhere and you are required to do all of the open systems intelligence and gathering to try to figure out what kind of information can you gain.

301
00:25:06,440 --> 00:25:12,040
And then from there start to work that to then be able to determine how you're going to conduct your research for exploitation.

302
00:25:12,300 --> 00:25:17,440
Gray box is going to be a mix of you have access to all of the documentation, so there's kind of that in between.

303
00:25:17,740 --> 00:25:31,860
And some of the factors there are going to be trying to understand how much is obfuscation your friend, and obscurity is your friend, versus how much of it do you really want to just get straight to the technical research and understanding, which is what white box is going to do.

304
00:25:31,860 --> 00:25:34,960
And there's also one other thing to point out.

305
00:25:35,740 --> 00:25:38,000
This is not check box things.

306
00:25:38,280 --> 00:25:50,240
Check boxes get you the first layer of an assessment like this, because you can actually put into place a list of things that you want to check to gain knowledge about the next steps.

307
00:25:50,680 --> 00:26:08,020
Once you're past that, you need people who are creatively evil, and you need them to have the time to sit in their creativity and think, oh, hey, Tim, do you think that we could do blah, blah, blah, blah, blah?

308
00:26:08,320 --> 00:26:09,120
Yeah?

309
00:26:09,400 --> 00:26:10,520
Let's go do it.

310
00:26:15,860 --> 00:26:17,560
Oh, this is my slide.

311
00:26:17,640 --> 00:26:18,680
Sorry.

312
00:26:19,300 --> 00:26:28,340
So as we said before, we need devices that we can deploy that have security baked in from vendors who think about security.

313
00:26:28,980 --> 00:26:37,900
We also need, we need to reassess what we're doing for comms, because there are radios that have encryption enabled.

314
00:26:38,320 --> 00:26:39,700
Almost by default.

315
00:26:39,700 --> 00:26:41,980
Oh, but it's really easy to enable them.

316
00:26:42,140 --> 00:26:48,020
You simply have to choose one of 256 standard encryption keys.

317
00:26:49,180 --> 00:26:50,900
That doesn't sound like a lot.

318
00:26:50,900 --> 00:26:52,980
Hey, it's AES fucking 128.

319
00:26:54,080 --> 00:26:57,200
With one of 256 different keys.

320
00:26:58,540 --> 00:27:10,080
And please, understand, one of the things that, actually one of my favorite parts of my career has been breaking into banks, breaking into government buildings, and doing things with cyber that aren't typical pen testing things.

321
00:27:10,120 --> 00:27:11,820
You may think of them as red teaming.

322
00:27:12,460 --> 00:27:13,500
If so, that's great.

323
00:27:13,560 --> 00:27:18,920
But some of our assessments have really gone, oh, well, I can hop the fence.

324
00:27:18,920 --> 00:27:21,080
Okay, here's the device, you're going to get there.

325
00:27:21,100 --> 00:27:23,920
You don't have to hop the fence, I know that you can do it.

326
00:27:24,800 --> 00:27:27,020
And we've gotten our hands on a lot of attacks after.

327
00:27:27,020 --> 00:27:36,580
In fact, the reason that I call out MDS is because they're deplorable in many of their at least older stuff that's still widely deployed.

328
00:27:37,980 --> 00:27:51,460
For being able to use one radio that you purchase off eBay to attack all the others, and even brute force within 18 hours, guaranteed to be on any network.

329
00:27:54,330 --> 00:27:55,810
So, the people.

330
00:27:55,810 --> 00:27:59,130
We've talked about the people, we've talked about the people through multiple things.

331
00:27:59,450 --> 00:28:00,910
Where are these folks, right?

332
00:28:00,910 --> 00:28:09,450
So, first of all, I think that this is, again, what I love about DEF CON is this is the meeting of those passionate folks who really do care about this problem for various reasons.

333
00:28:09,450 --> 00:28:20,210
Either you're motivated by how we can all help humanity together, or you have a particular interest of the matrix metaphor of going down the rabbit hole and seeing how far it can go technically.

334
00:28:20,910 --> 00:28:28,670
Your vendors should be having security-minded people in their hiring process.

335
00:28:28,670 --> 00:28:35,510
They should be actively pursuing not just bullshit bingo security, but true security.

336
00:28:35,510 --> 00:28:37,670
And utilities.

337
00:28:37,710 --> 00:28:39,750
They need to be able to call bullshit.

338
00:28:39,750 --> 00:28:45,390
They need to be able to have the knowledge and skill to say, that's crap.

339
00:28:45,930 --> 00:28:47,070
Fix that.

340
00:28:47,250 --> 00:28:52,430
Or better yet, get out of here, these other vendors, they have people who know what they're doing.

341
00:28:54,430 --> 00:28:56,810
So, go ahead, I'll let you take the top.

342
00:28:56,890 --> 00:28:58,970
How to fix for the who's who.

343
00:28:59,130 --> 00:29:10,270
We have two regulatory agencies, FERC and NERC, and there is a challenge there where there is a mix between the overlap of responsibilities and a difference between suggestion and compliance.

344
00:29:10,270 --> 00:29:19,510
And while we talked about compliance being a challenge from a checklist perspective, we also talked about the fact that this is a top-down mandate that needs to push and encourage this action.

345
00:29:19,510 --> 00:29:22,390
And that is the purpose of government and legislation.

346
00:29:22,390 --> 00:29:28,650
And that's where these organizations need to come into more of a common agreement with the vendors in the industry to help push that.

347
00:29:28,650 --> 00:29:30,750
Now, they need to be light-handed right now.

348
00:29:30,750 --> 00:29:37,990
We've already got some very heavy-handed things in place that do not, that actually can detract from true security.

349
00:29:38,150 --> 00:29:43,110
They have to be careful how they engage, but FERC and NERC do play a very important role.

350
00:29:43,310 --> 00:29:50,630
Our public services commission, our public utility commissions, these are the state-run organizations that kind of keep our utilities in check.

351
00:29:50,710 --> 00:29:53,270
They are the protectors of the consumers.

352
00:29:53,670 --> 00:30:03,110
Now, I have seen some significant investment from several PSCs into researching cyber security.

353
00:30:03,110 --> 00:30:04,270
They want to understand.

354
00:30:04,270 --> 00:30:06,610
They want to know how they can fix the problem.

355
00:30:06,610 --> 00:30:08,110
And they have a big role.

356
00:30:08,110 --> 00:30:11,090
They control how much a utility can make for a year.

357
00:30:11,190 --> 00:30:20,230
They also allow a utility to do a rate hike, which allows them to charge more per kilowatt hour or per gallon of water or whatever.

358
00:30:20,570 --> 00:30:27,890
In the interest of maintaining a grid, a water system, a water treatment system that services our needs.

359
00:30:28,530 --> 00:30:33,490
But our vendors, they're saying, where the hell is the money coming from?

360
00:30:33,490 --> 00:30:35,510
The utilities don't want security.

361
00:30:35,510 --> 00:30:36,610
They're not willing to pay for it.

362
00:30:36,610 --> 00:30:39,030
I can't make it unless they're willing to pay for it.

363
00:30:39,310 --> 00:30:41,250
So utilities, phony up.

364
00:30:42,070 --> 00:30:47,850
Utilities are saying we don't have any vendors that provide things that we can put into place that are defensible.

365
00:30:47,850 --> 00:30:49,050
They have crap.

366
00:30:49,050 --> 00:30:50,890
And this is what I have to deal with.

367
00:30:51,570 --> 00:30:52,850
Encourage.

368
00:30:52,890 --> 00:30:53,950
Educate.

369
00:30:53,970 --> 00:30:55,350
Make the decision.

370
00:30:55,610 --> 00:31:00,410
And in fact, you have a lot of sway.

371
00:31:00,710 --> 00:31:07,490
The unfortunate side is we have decades of utilities beating up vendors for the lowest price.

372
00:31:07,830 --> 00:31:14,670
We have lost the partnership that is provided for our country and our world.

373
00:31:15,170 --> 00:31:16,610
We got to get it back.

374
00:31:17,590 --> 00:31:19,850
And so that concludes the amount of time we have for this.

375
00:31:19,850 --> 00:31:22,070
This was a lot to condense into a short talk.

376
00:31:22,070 --> 00:31:23,310
So I'm Bryson.

377
00:31:23,510 --> 00:31:24,530
I'm Atlas.

378
00:31:24,530 --> 00:31:25,550
And we're Grimm.

379
00:31:26,710 --> 00:31:27,630
Thank you.