WEBVTT 00:00.000 --> 00:03.040 All right, so what is the problem? 00:03.700 --> 00:20.100 I think one of the things that I really like so much about where DEF CON has grown up with the villages is that when you're looking at industrial control systems, one of the big challenges is not only the technical intimidation of where do I even start to understand how to access this code, 00:20.100 --> 00:28.260 look at these protocols and understand this equipment, but there's also a barrier to entry of this equipment is hard to find. 00:28.260 --> 00:29.520 It's very expensive. 00:30.200 --> 00:45.720 And so being able to get your hands on it and to touch it and to be able to start to play with it is a barrier to being able to start that research and have an open dialogue between the security research community and of course the vendors and the corporations that use this equipment. 00:45.800 --> 00:53.860 And the villages of course have all of these things there set up for you with experts happy to walk you through, let you touch it, ask those questions. 00:54.240 --> 01:06.680 So I encourage any of you who haven't been to the ICS village or any of the other villages, please do so because this is that kind of opportunity where the kinds of things that we're going to talk about, you get to go actually physically touch that and it's not just abstract. 01:18.380 --> 01:23.280 The second year, it was a bit more, there's a lot of us on this wire. 01:24.120 --> 01:26.360 We continue to see further digging in. 01:26.360 --> 01:29.740 The opportunity is being taken, but it needs to be encouraged. 01:29.740 --> 01:31.540 We're still way beyond the eight ball. 01:32.360 --> 01:35.680 And Atlas aside for the most part, this is not sexy. 01:36.140 --> 01:38.820 So it's not the challenges. 01:39.880 --> 01:41.380 Strike the pose again, please. 01:41.880 --> 01:44.380 That says industrial control systems. 01:46.520 --> 01:48.960 Thanks for dropping the beat, man. 01:52.520 --> 01:53.540 It's not sexy. 01:53.540 --> 01:58.360 And a lot of the challenges and a lot of the solutions and a lot of things that need to be done are not sexy. 01:58.440 --> 02:12.200 I mean, when you start looking at a lot of the conversation that's happening in the research community at large, sexy, zero day being dropped, SWIFT being compromised, sexy, man speed infrastructure. 02:13.180 --> 02:14.460 We have another mic? 02:14.480 --> 02:16.080 Don't drop it. 02:16.080 --> 02:19.320 Far enough. 02:19.660 --> 02:21.960 You don't know how far I'm going to go. 02:23.300 --> 02:24.720 All right. 02:25.080 --> 02:36.840 So sexy, the SWIFT, the various things, banking and maybe, well, destruction of dams is pretty cool, but it doesn't dive into the problem deeply enough. 02:37.560 --> 02:44.040 But a number of years ago we did have some sexy parts of the grid and it was called AMI, advanced metering infrastructure. 02:44.040 --> 03:03.540 The concepts were relatively new, they were exciting, they had ARA grant money, they had backing, they had momentum, and yet industrial control system sat on the back burner and every IOU I spoke with, IOU, industrial utility, everyone that I spoke with just kind of shut the conversation. 03:03.540 --> 03:05.260 Oh, no, that's something very different. 03:05.260 --> 03:08.360 We don't have money for that at the moment, but we're working on it. 03:09.360 --> 03:12.600 The other part of the not sexy, of course, is we're people. 03:12.600 --> 03:14.400 We do what we're incentivized to do. 03:14.400 --> 03:30.340 Part of that, of course, is we're pursuing our individual passions, but starting to take that challenge of cost and limited ability to start to do this, and in the last two years we've started to see the rise of the bug bounty concept and crowd-sourced vulnerability disclosure programs. 03:30.820 --> 03:33.240 Where are those for this kind of community? 03:33.240 --> 03:34.760 Where's that kind of incentive? 03:36.720 --> 03:38.200 You want to touch on longevity? 03:38.820 --> 03:42.940 Yeah, I thought you were hitting longevity. 03:42.940 --> 03:46.580 I was going to, but I forgot it, so I'm passing it back to you. 03:48.260 --> 03:50.300 There, I touched on it. 03:51.080 --> 03:52.320 Longevity. 03:53.180 --> 03:56.460 We have industrial control systems. 03:56.460 --> 03:57.640 Hey, big surprise. 03:57.640 --> 04:00.860 They're built to withstand many decades. 04:01.820 --> 04:08.960 Okay, it's not surprising, because these systems control that which makes our life what it is. 04:09.640 --> 04:21.220 An attack, not to be too accelerant, but a certain type of attack could potentially change the way we live. 04:22.520 --> 04:25.180 So, do we get into this? 04:25.360 --> 04:27.640 Crap, I'm forgetting what's in the next slide. 04:27.760 --> 04:30.520 So, forgive me if I say things twice. 04:31.370 --> 04:51.360 So, what we have is a problem of systems that were created, designed 20 years ago, put in place 15 years ago, but they've got a 20 to 30 year lifespan that has been amortized by utilities and people deploying, anybody who's deploying ICS. 04:51.860 --> 04:59.040 The manufacturers have been strong armed into the lowest possible price or it will go somewhere else. 04:59.740 --> 05:05.620 They didn't build in money to maintain these systems for long enough. 05:05.620 --> 05:16.100 They were never intended to be connected to the internet, but as we all know, every IP network wants to and will eventually be connected to the internet. 05:16.320 --> 05:27.780 So, the where's Waldo of industrial control systems is if you're looking at a box and you want to know whether it's an industrial control system or just a traditional computer, if it's at least 20 years old, it's an industrial control system. 05:28.020 --> 05:31.200 I mean, we're talking top of the line 30 megahertz. 05:32.400 --> 05:34.940 That's an impressive piece of equipment. 05:35.820 --> 05:51.720 And actually, funny story here, just since we've been talking about insecurity, we'd actually had props as a part of this presentation where keeping in line with OSHA, which prescribes the standards for folks that are working with dangerous things like industrial control systems and SCADA, 05:51.720 --> 05:55.760 etc., that we would have hard hats on and safety vests. 05:55.760 --> 05:57.000 They were stolen. 05:57.060 --> 06:01.300 So, that just kind of shows you that you got to have physical security at all times as well. 06:01.940 --> 06:06.400 So, God grant me serenity. 06:07.180 --> 06:09.040 What can we change? 06:09.040 --> 06:10.640 What can you change? 06:10.980 --> 06:14.620 This is an actual statistic that we made up that 93 06:20.760 --> 06:23.480 percent of all code is shit. 06:23.480 --> 06:25.500 And that is the technical jargon for it. 06:25.500 --> 06:27.560 And we made that up, but we're not wrong. 06:28.100 --> 06:32.940 And that code is code built on top of code built on top of code. 06:32.940 --> 06:42.640 I think one of the more interesting conversations I've ever had with a manufacturer was through some level of acquisition, they had code through some little subsystem of one of their boards. 06:42.640 --> 06:45.640 And they're like, nobody knows what that code is. 06:45.640 --> 06:46.720 Nobody has any idea. 06:46.720 --> 06:51.040 Whoever wrote that is long gone through some acquisition of some time ago. 06:51.080 --> 06:51.780 We have no idea. 06:51.780 --> 06:57.140 We just kind of let it go and we sort of know how to poke it and occasionally it pokes back, but that's it. 06:57.940 --> 07:06.040 So, we have to accept that crappy code is going to make it into the systems that protect our lives and provide for the way that we like to live. 07:06.680 --> 07:08.320 Do we give up on code? 07:08.320 --> 07:10.000 Do we say, oh, it's crap? 07:10.000 --> 07:10.920 No. 07:11.200 --> 07:16.660 Just recognize there is a natural tendency towards crap, chaos. 07:17.100 --> 07:18.300 Entropy. 07:18.300 --> 07:19.140 Entropy. 07:19.140 --> 07:21.440 Well, couldn't we just keep them off the internet? 07:21.840 --> 07:22.620 Sure. 07:22.620 --> 07:24.620 I'd like to see you do that. 07:25.880 --> 07:27.580 So, people. 07:28.500 --> 07:29.280 People. 07:29.280 --> 07:30.400 Oh, people. 07:32.060 --> 07:35.840 Management and people on the ground don't know how to talk to each other. 07:35.840 --> 07:36.700 You can't do that. 07:36.700 --> 07:37.660 It's stupid. 07:37.960 --> 07:42.920 If you had any brains in your head, you would not have even suggested that. 07:42.920 --> 07:47.340 You can't do so many less things. 07:47.340 --> 07:47.980 Anyway. 07:48.120 --> 07:49.320 That was loud. 07:50.860 --> 07:52.880 You almost... Bet you don't want to hear me anymore. 07:52.880 --> 07:55.500 No, you almost threw off my pacemaker. 07:56.300 --> 07:57.920 That would be the next talk. 07:57.920 --> 07:58.980 That's another talk. 07:58.980 --> 08:00.280 We do medical devices. 08:01.260 --> 08:06.140 The challenge here is the classic nerd versus operations and management. 08:06.880 --> 08:09.620 Nerds speak nerd. 08:09.760 --> 08:11.660 They're kind of abusive actually. 08:11.860 --> 08:12.440 Unchecked. 08:12.440 --> 08:13.860 We kind of beat each other up. 08:13.860 --> 08:14.140 Why? 08:14.140 --> 08:15.440 Because we were beaten up as kids. 08:15.440 --> 08:16.640 We're nerds. 08:17.160 --> 08:19.240 Now that I have some power, man. 08:20.940 --> 08:25.620 Meanwhile, management is there ensuring the function of the operation, right? 08:25.620 --> 08:26.840 They're caring about revenue. 08:26.840 --> 08:29.480 They're caring about the business and they're trying to do that. 08:29.520 --> 08:31.280 You make that sound really sexy. 08:31.280 --> 08:33.060 As an engineer, I'm kind of offended. 08:33.720 --> 08:36.460 I don't know what the interpretive dance is for dollar sign. 08:36.460 --> 08:37.180 I do, actually. 08:37.180 --> 08:37.980 We're in Vegas. 08:43.100 --> 08:53.320 Management is focused on operations and the nerd guy runs down and is like, hey, boss, we have this huge problem that we just found out. 08:53.320 --> 08:57.160 There's this issue with code and immediately starts running down into the technical bits. 08:58.740 --> 09:02.160 Management glazes it over, waits for him to leave the room. 09:03.620 --> 09:04.300 You know what happened? 09:04.300 --> 09:05.120 I don't know what happened. 09:05.120 --> 09:11.840 Stupid or not, the management has a job and they have things that are very important to them. 09:12.040 --> 09:13.240 Maybe their paycheck. 09:13.240 --> 09:24.160 Maybe they actually care about security or at least safety and the mission of their organization or if you have a great environment, they may actually care about you. 09:25.740 --> 09:29.120 However, what's the secret to communication? 09:29.820 --> 09:32.040 Understanding the other side. 09:32.060 --> 09:35.180 I like to say that there are no crazy people on this planet. 09:36.560 --> 09:41.260 You just don't understand the system of reference or their decision making. 09:41.260 --> 09:42.600 There are no crazy people. 09:43.600 --> 09:45.260 What's important to you? 09:45.720 --> 09:47.120 What's in it for me? 09:47.840 --> 09:49.660 Oh, you had to go there. 09:49.660 --> 09:58.760 A little bit later we're going to go through a little bit more granularity about the different kinds of stakeholders in this and the pieces of the supply chain. 09:59.080 --> 10:04.620 But fundamentally you have this challenge of this, the two sides speaking Greek. 10:04.620 --> 10:09.080 Nerd speaking nerd, management speaking operations and in the middle of this gap. 10:09.100 --> 10:15.000 And this is often times where security research companies like us come in between because we're there to bridge that gap between. 10:15.000 --> 10:21.500 We have the technical understanding of working with the equipment at a very granular level and understanding the implications there. 10:21.500 --> 10:27.900 And then importantly we can tie it back to the business context and impact because that's the key. 10:27.900 --> 10:29.140 That's how you got to bridge that. 10:29.140 --> 10:33.140 When you're thinking about, it's not code, it's the impact of the code. 10:33.400 --> 10:36.400 Compromise is not compromise is not compromise. 10:36.540 --> 10:44.700 Compromise or a hack or an exploit only has value within how does that vulnerability affect the business, affect the operation. 10:44.700 --> 10:47.900 That impact helps you understand prioritization. 10:48.100 --> 10:58.020 That impact helps you understand the correct remedial solution because it's not just a question of, there are lots of different ways to fix problems. 10:58.020 --> 11:01.860 It's fixing it the right way for the context of how it's being used. 11:01.860 --> 11:08.320 And you don't want to take responsibility as an engineer for something that is going to get your boss fired. 11:08.320 --> 11:09.800 It's his responsibility. 11:09.820 --> 11:15.460 Your responsibility is to provide information, to understand and to bring along. 11:15.460 --> 11:24.760 A very dear friend of mine last night at our party said, Atlas, we've had a couple of drinks so we're all kind of reclining by the hot tub. 11:24.800 --> 11:27.420 He says, Atlas, what's important to you? 11:27.420 --> 11:28.540 How do we fix this? 11:28.540 --> 11:29.880 What are you thinking? 11:31.020 --> 11:44.100 And I didn't have this canned but the three things that came out of my mouth were education, motivation and partnership. 11:44.620 --> 11:49.000 I didn't realize that that applied so well to what we're going to talk about today. 11:49.000 --> 11:50.040 Go ahead. 11:50.940 --> 11:52.840 But wait, there's more. 11:53.100 --> 12:04.020 So as we discussed, we talked about the agent incentivization problem where is the security community really incentivized to become engaged in this. 12:04.020 --> 12:08.260 And then of course looking at where's the clear mandate coming from? 12:08.600 --> 12:10.260 Who is in fact pushing that? 12:10.260 --> 12:12.480 Because this is a top-down problem. 12:12.480 --> 12:17.680 You're not going to have the average consumer, which everyone in this room is. 12:17.680 --> 12:20.720 Last time I checked, we all use electricity and water. 12:21.660 --> 12:24.760 Everyone in here is a consumer and a stakeholder. 12:24.780 --> 12:31.880 And we as a large group are not really able to effectively advocate for something that is a very complex problem and set of problems. 12:31.880 --> 12:34.440 This is something that needs to be top-down driven. 12:36.060 --> 12:36.940 Accountability? 12:37.800 --> 12:39.340 Yeah, no, I don't. 12:39.340 --> 12:40.280 I'm not a consumer. 12:40.280 --> 12:41.360 I live in a yurt. 12:42.620 --> 12:44.040 Solar power, dude. 12:44.220 --> 12:45.820 Ryan, how's that yurt coming? 12:48.540 --> 12:50.560 So there's no clear mandate. 12:50.820 --> 12:54.440 Who is responsible for fixing these problems? 12:54.760 --> 12:59.900 The way that we live affects all of us, as he just said. 13:01.100 --> 13:02.920 But who has to fix this? 13:02.920 --> 13:06.700 Is this the vendors, the people who made PLCs, RTUs? 13:07.180 --> 13:08.420 Is it the utilities? 13:08.420 --> 13:09.340 Is it their problem? 13:09.340 --> 13:13.000 I've seen some pretty amazing engineering going on in utilities. 13:13.400 --> 13:14.540 Is it their problem? 13:14.860 --> 13:16.200 How about regulatory agencies? 13:16.200 --> 13:17.440 Show of hands. 13:17.820 --> 13:21.240 Who wants the regulatory agencies to fix this problem for you? 13:22.360 --> 13:23.720 Oh, I love this. 13:23.720 --> 13:24.600 This is great. 13:29.590 --> 13:30.550 Go, Joe. 13:42.120 --> 13:45.420 He's saying if it's regulatory, it will be check the box. 13:45.420 --> 13:47.080 It's the only way that they know how to do it. 13:47.080 --> 13:53.680 And in fact, they're incentivized with both carrot and stick to make it check the box. 13:54.000 --> 13:55.140 Very good answer. 13:55.940 --> 13:59.120 I mean, there are a couple different agencies. 13:59.120 --> 14:00.720 We'll talk about that in a minute. 14:00.720 --> 14:01.400 Go ahead. 14:02.660 --> 14:08.940 So the first thing, let's address the problems that we can right now. 14:09.280 --> 14:11.240 There are things we can do. 14:11.860 --> 14:15.520 We actually want to have a 5, 10, 15 year plan. 14:15.520 --> 14:16.600 Hopefully not 15. 14:16.600 --> 14:18.800 Please, Lord, let us fix this faster. 14:19.620 --> 14:21.460 But there are things we can do right now. 14:21.800 --> 14:22.460 Show of hands. 14:22.460 --> 14:23.920 Anyone want to give an offer? 14:24.060 --> 14:25.060 Any ideas? 14:27.080 --> 14:31.300 I can build my house on stilts so that when the dam breaks, I'm good to go. 14:32.000 --> 14:33.280 I like the idea. 14:33.280 --> 14:34.500 I already have my house built. 14:34.500 --> 14:36.380 I'm not sure that I want to jack it all up. 14:38.460 --> 14:39.580 Anyone else? 14:40.040 --> 14:40.640 Tim, I know you. 14:40.640 --> 14:41.560 No, I'm just kidding. 14:41.920 --> 14:43.040 So where do we start? 14:43.840 --> 14:49.360 Well, we begin by assessing what the problem is in our own backyard. 14:50.280 --> 15:00.000 Every one of the people on the last page, even the regulators, we want to become aware of the problems that we can fix right now. 15:00.000 --> 15:07.040 For example, if we are still using Modbus, probably a good idea to get that off the wire. 15:07.040 --> 15:08.680 I don't care if you're doing serial. 15:09.800 --> 15:11.960 Okay, there are worse things to use. 15:12.640 --> 15:17.800 But if you're using Modbus right now over Ethernet, please stop. 15:18.240 --> 15:19.720 There are other options. 15:20.040 --> 15:26.200 And I'm sure that there are business decisions that made Modbus the right thing and it takes money and time and effort. 15:26.200 --> 15:27.980 But it's something that we can fix. 15:27.980 --> 15:43.480 If the protocols that you use offer security, lab it up, make sure we don't roll out some big change and take down the grid or the water supply or back up the poop. 15:44.440 --> 15:47.820 I mean, we're talking about more than just the electric grid, right? 15:50.500 --> 15:57.280 But lab it up, test it, migrate to something that at least offers security, even if it's not perfect. 15:57.440 --> 15:59.560 DMP3 has tons of bugs. 15:59.560 --> 16:12.960 But at least it, as he stepped on the chair, I was thinking he was going to call out the fact that you may be still kind of surrounded by shit, but if you can get a little higher, you can be in it less. 16:13.140 --> 16:14.280 Pick something better. 16:14.280 --> 16:33.720 If you have systems that are, have replacement upgrades and you can put into place a better system, maybe a system that actually has a vendor that's still around or a vendor that you trust to partner with you, this is a good first step. 16:34.740 --> 16:45.160 There are many things that you or we, whoever is doing this assessment, can sit down and identify, within the next year, we can do this. 16:45.200 --> 16:52.420 Let's talk to the right people, work it out, get something as part of a bigger process. 16:52.560 --> 16:56.560 To emphasize, this is the all is not lost slide. 16:57.000 --> 17:07.140 You can start somewhere and have that vision of where things can get better, circle the wagons where you can establish control and then iterate from there. 17:10.660 --> 17:12.120 Best practices. 17:12.820 --> 17:21.400 I mean, so, a few other things that we can throw into the mix that you can do within the next year to two. 17:23.180 --> 17:25.720 Authentication is a problem we all deal with. 17:25.720 --> 17:30.840 There are many technologies available because everybody is struggling with it. 17:31.120 --> 17:34.460 Two-factor authentication for the right systems is a good first start. 17:34.680 --> 17:40.220 If you have to use passwords and not tokens or keys or fobs, please. 17:42.140 --> 17:50.420 The next step, guys, I know that we didn't mean to plug the grid into the internet, but we've done it. 17:51.620 --> 17:59.100 We didn't design our systems and our networks to withstand the type of onslaught that a nation state is willing to offer. 17:59.100 --> 18:08.740 In fact, the state of many organizations, many people here without state funding could do it. 18:09.380 --> 18:14.560 So, I'd like to lay out the idea of a multi-tiered castle. 18:14.680 --> 18:26.660 At the very center, with the most restrictive protections in place, you have crown jewels, you have head ends, you have things that actually change significant parts of life. 18:27.100 --> 18:35.160 Outside of that, you have slightly less trusted, less protected systems, but still very highly protected. 18:35.300 --> 18:37.400 And so on and so forth. 18:37.400 --> 18:40.580 I recommend three to five layers at least. 18:42.140 --> 18:47.800 And these layers play into a potential for protection. 18:47.800 --> 18:57.360 So if you have a system that there's absolutely no way that you can have assurance that it is protected, then it falls in the outer ring. 18:57.360 --> 18:59.560 For example, pole top devices. 19:00.620 --> 19:12.020 Anyone here that's been at DEF CON, you're not, you cannot possibly argue with me that a system being on top of a pole is not secure. 19:12.280 --> 19:15.440 Unless it's in a compound with guns. 19:17.260 --> 19:18.480 Patching policy. 19:18.480 --> 19:20.640 This is just regular SEC 101. 19:20.960 --> 19:34.680 The systems that are being used to pivot into attack your critical infrastructure, generally people's workstations, check an email, surf on the web, these systems have to be maintained and protected. 19:34.680 --> 19:39.200 Now this is not going to keep off everybody. 19:39.200 --> 19:43.400 I'm going to try not to throw out nation's names because I know everybody's represented here. 19:45.480 --> 19:49.240 But patching, keep at least the end days done. 19:50.520 --> 19:59.060 And then there are configurations in our PLCs and RTUs that again can be used to turn on security features. 19:59.060 --> 20:07.680 Encryption and strong authentication and other things to lock down access that you shouldn't have available on your PLC. 20:07.680 --> 20:15.080 Now there are many who will say encryption takes time and I need point blah blah blah milliseconds response time. 20:15.720 --> 20:25.460 If your critical systems can't handle that type of waylay and processing power, those might fit on your list to replace. 20:28.390 --> 20:31.570 Monitor all the things, all the comms. 20:32.210 --> 20:45.550 So this is while end points might not be the place that you can do that monitoring, certainly there can be transmission paths and one of the challenges with this of course is not all of the communications are going to be wired. 20:45.570 --> 20:53.190 You have to keep in fact that a lot of things are going to have RF communications and you need to start thinking of the physical security and the physical presence of those things. 20:53.190 --> 20:56.750 Please don't allow your cell phones to connect to your network and talk to your head end. 20:57.190 --> 20:59.050 There's one good rule of thumb. 20:59.230 --> 21:04.890 But if you do have cell phones connected to a network, it better be on something you can monitor really well. 21:05.690 --> 21:07.870 Hunting, who here has heard of hunting? 21:09.230 --> 21:12.410 Okay, about one percent of you. 21:12.470 --> 21:15.810 Hunting is the act of scouring your network. 21:15.810 --> 21:20.110 No penetration testing has to go into this if you're worried about breaking things. 21:20.110 --> 21:23.970 Simply monitoring traffic patterns. 21:24.450 --> 21:30.830 Traffic can be cataloged, identified and put into a database and analyzed. 21:31.050 --> 21:39.630 For example, there's no reason why workstation in the office needs to talk directly to head end. 21:40.270 --> 21:49.130 If you have this type of communication or other strange communication, A, that's something you want to understand better. 21:49.270 --> 21:54.430 B, it may be the thing that tells who's on your network. 21:56.210 --> 21:57.630 Fuck Modbus. 21:58.570 --> 22:01.390 We've beaten Modbus. 22:01.390 --> 22:04.130 Modbus is unauthenticated. 22:05.370 --> 22:09.630 And perfectly sane to kick the shit out of here. 22:09.690 --> 22:12.550 There are others like it, but this is Modbus. 22:13.770 --> 22:19.770 Please choose something that has some sort of protectiveness. 22:19.770 --> 22:32.210 If you have critical systems that must use an insecure protocol, maybe because you're worried about latency, you should have armed guards around everywhere that that network touches. 22:36.060 --> 22:44.040 This is the self-promotion slide, so I'm just throwing that out there because this is some of the stuff that we do. 22:44.340 --> 23:04.740 But it's more, even if you don't do it with us, please understand, we have yet to get to the point where I need to throw binary exploitation against most control systems the way we do your laptop, the way we do your servers, the way we do against firewalls and routers. 23:04.740 --> 23:06.160 We don't have to do that. 23:07.540 --> 23:10.760 It's not hard enough to warrant that kind of work. 23:12.920 --> 23:17.780 But there will come a time, hopefully very rapidly, where that's not the case. 23:17.780 --> 23:40.060 As we fix the fixable, digging into hardware, software and firmware, that was sexy, identifying weaknesses in code, weaknesses in design of hardware, weaknesses in what your vendors are shipping out, like hard-coded passwords, these still exist. 23:40.900 --> 23:51.380 Assessments of all three things will provide you, when we finally get our poop in a group, something that is defendable. 23:51.640 --> 23:58.980 And if we don't start now, it will just be that much longer before we get to something that's defendable. 23:59.480 --> 24:01.820 But I've got limited budget. 24:01.860 --> 24:03.160 Well then prioritize. 24:03.600 --> 24:09.280 If you have systems that are most widely deployed, those should make pretty high on the list. 24:09.280 --> 24:22.620 If you have significant systems that control large, potentially irreplaceable parts of your systems, that may make a very good top place. 24:23.540 --> 24:25.700 You can get to the older stuff later. 24:25.700 --> 24:28.440 You guys know how to think about boundaries, right? 24:28.820 --> 24:31.920 We do the most important first, we then back up. 24:31.920 --> 24:33.960 We don't stop until we're done. 24:35.100 --> 24:37.500 But we get the best that we can for now. 24:37.660 --> 24:45.500 So while we list three device categories here, of loose categories, there are also three kinds of assessments. 24:45.520 --> 24:47.660 White box, gray box, and black box. 24:47.660 --> 24:53.160 And I list those because those also require careful consideration for what you're trying to accomplish. 24:53.180 --> 25:05.980 A black box assessment is saying, hey, you're just like somebody else out there anywhere and you are required to do all of the open systems intelligence and gathering to try to figure out what kind of information can you gain. 25:06.440 --> 25:12.040 And then from there start to work that to then be able to determine how you're going to conduct your research for exploitation. 25:12.300 --> 25:17.440 Gray box is going to be a mix of you have access to all of the documentation, so there's kind of that in between. 25:17.740 --> 25:31.860 And some of the factors there are going to be trying to understand how much is obfuscation your friend, and obscurity is your friend, versus how much of it do you really want to just get straight to the technical research and understanding, which is what white box is going to do. 25:31.860 --> 25:34.960 And there's also one other thing to point out. 25:35.740 --> 25:38.000 This is not check box things. 25:38.280 --> 25:50.240 Check boxes get you the first layer of an assessment like this, because you can actually put into place a list of things that you want to check to gain knowledge about the next steps. 25:50.680 --> 26:08.020 Once you're past that, you need people who are creatively evil, and you need them to have the time to sit in their creativity and think, oh, hey, Tim, do you think that we could do blah, blah, blah, blah, blah? 26:08.320 --> 26:09.120 Yeah? 26:09.400 --> 26:10.520 Let's go do it. 26:15.860 --> 26:17.560 Oh, this is my slide. 26:17.640 --> 26:18.680 Sorry. 26:19.300 --> 26:28.340 So as we said before, we need devices that we can deploy that have security baked in from vendors who think about security. 26:28.980 --> 26:37.900 We also need, we need to reassess what we're doing for comms, because there are radios that have encryption enabled. 26:38.320 --> 26:39.700 Almost by default. 26:39.700 --> 26:41.980 Oh, but it's really easy to enable them. 26:42.140 --> 26:48.020 You simply have to choose one of 256 standard encryption keys. 26:49.180 --> 26:50.900 That doesn't sound like a lot. 26:50.900 --> 26:52.980 Hey, it's AES fucking 128. 26:54.080 --> 26:57.200 With one of 256 different keys. 26:58.540 --> 27:10.080 And please, understand, one of the things that, actually one of my favorite parts of my career has been breaking into banks, breaking into government buildings, and doing things with cyber that aren't typical pen testing things. 27:10.120 --> 27:11.820 You may think of them as red teaming. 27:12.460 --> 27:13.500 If so, that's great. 27:13.560 --> 27:18.920 But some of our assessments have really gone, oh, well, I can hop the fence. 27:18.920 --> 27:21.080 Okay, here's the device, you're going to get there. 27:21.100 --> 27:23.920 You don't have to hop the fence, I know that you can do it. 27:24.800 --> 27:27.020 And we've gotten our hands on a lot of attacks after. 27:27.020 --> 27:36.580 In fact, the reason that I call out MDS is because they're deplorable in many of their at least older stuff that's still widely deployed. 27:37.980 --> 27:51.460 For being able to use one radio that you purchase off eBay to attack all the others, and even brute force within 18 hours, guaranteed to be on any network. 27:54.330 --> 27:55.810 So, the people. 27:55.810 --> 27:59.130 We've talked about the people, we've talked about the people through multiple things. 27:59.450 --> 28:00.910 Where are these folks, right? 28:00.910 --> 28:09.450 So, first of all, I think that this is, again, what I love about DEF CON is this is the meeting of those passionate folks who really do care about this problem for various reasons. 28:09.450 --> 28:20.210 Either you're motivated by how we can all help humanity together, or you have a particular interest of the matrix metaphor of going down the rabbit hole and seeing how far it can go technically. 28:20.910 --> 28:28.670 Your vendors should be having security-minded people in their hiring process. 28:28.670 --> 28:35.510 They should be actively pursuing not just bullshit bingo security, but true security. 28:35.510 --> 28:37.670 And utilities. 28:37.710 --> 28:39.750 They need to be able to call bullshit. 28:39.750 --> 28:45.390 They need to be able to have the knowledge and skill to say, that's crap. 28:45.930 --> 28:47.070 Fix that. 28:47.250 --> 28:52.430 Or better yet, get out of here, these other vendors, they have people who know what they're doing. 28:54.430 --> 28:56.810 So, go ahead, I'll let you take the top. 28:56.890 --> 28:58.970 How to fix for the who's who. 28:59.130 --> 29:10.270 We have two regulatory agencies, FERC and NERC, and there is a challenge there where there is a mix between the overlap of responsibilities and a difference between suggestion and compliance. 29:10.270 --> 29:19.510 And while we talked about compliance being a challenge from a checklist perspective, we also talked about the fact that this is a top-down mandate that needs to push and encourage this action. 29:19.510 --> 29:22.390 And that is the purpose of government and legislation. 29:22.390 --> 29:28.650 And that's where these organizations need to come into more of a common agreement with the vendors in the industry to help push that. 29:28.650 --> 29:30.750 Now, they need to be light-handed right now. 29:30.750 --> 29:37.990 We've already got some very heavy-handed things in place that do not, that actually can detract from true security. 29:38.150 --> 29:43.110 They have to be careful how they engage, but FERC and NERC do play a very important role. 29:43.310 --> 29:50.630 Our public services commission, our public utility commissions, these are the state-run organizations that kind of keep our utilities in check. 29:50.710 --> 29:53.270 They are the protectors of the consumers. 29:53.670 --> 30:03.110 Now, I have seen some significant investment from several PSCs into researching cyber security. 30:03.110 --> 30:04.270 They want to understand. 30:04.270 --> 30:06.610 They want to know how they can fix the problem. 30:06.610 --> 30:08.110 And they have a big role. 30:08.110 --> 30:11.090 They control how much a utility can make for a year. 30:11.190 --> 30:20.230 They also allow a utility to do a rate hike, which allows them to charge more per kilowatt hour or per gallon of water or whatever. 30:20.570 --> 30:27.890 In the interest of maintaining a grid, a water system, a water treatment system that services our needs. 30:28.530 --> 30:33.490 But our vendors, they're saying, where the hell is the money coming from? 30:33.490 --> 30:35.510 The utilities don't want security. 30:35.510 --> 30:36.610 They're not willing to pay for it. 30:36.610 --> 30:39.030 I can't make it unless they're willing to pay for it. 30:39.310 --> 30:41.250 So utilities, phony up. 30:42.070 --> 30:47.850 Utilities are saying we don't have any vendors that provide things that we can put into place that are defensible. 30:47.850 --> 30:49.050 They have crap. 30:49.050 --> 30:50.890 And this is what I have to deal with. 30:51.570 --> 30:52.850 Encourage. 30:52.890 --> 30:53.950 Educate. 30:53.970 --> 30:55.350 Make the decision. 30:55.610 --> 31:00.410 And in fact, you have a lot of sway. 31:00.710 --> 31:07.490 The unfortunate side is we have decades of utilities beating up vendors for the lowest price. 31:07.830 --> 31:14.670 We have lost the partnership that is provided for our country and our world. 31:15.170 --> 31:16.610 We got to get it back. 31:17.590 --> 31:19.850 And so that concludes the amount of time we have for this. 31:19.850 --> 31:22.070 This was a lot to condense into a short talk. 31:22.070 --> 31:23.310 So I'm Bryson. 31:23.510 --> 31:24.530 I'm Atlas. 31:24.530 --> 31:25.550 And we're Grimm. 31:26.710 --> 31:27.630 Thank you.