1
00:00:02,640 --> 00:00:04,500
Hi, this is Austin Scott.

2
00:00:04,500 --> 00:00:09,700
And this is five quick wins for improving your ICS cybersecurity posture.

3
00:00:10,060 --> 00:00:16,200
I'm a Principal Industrial Penetration Tester as part of the Dragos Professional Services team.

4
00:00:16,200 --> 00:00:23,800
And I really see the world from the perspective as a pen tester, just like a hammer sees the world as a nail.

5
00:00:23,800 --> 00:00:27,980
I really see everything from an adversarial perspective.

6
00:00:27,980 --> 00:00:32,820
And that's the point of view we'll be taking in this presentation today.

7
00:00:33,220 --> 00:00:40,540
Really, we're looking for ways to make it more difficult for an adversary to move through an ICS environment.

8
00:00:40,540 --> 00:00:48,620
Now, my recommendations in and of themselves won't give you a bulletproof cybersecurity program or industrial cybersecurity program.

9
00:00:48,620 --> 00:00:52,940
But they will raise the bar for your security posture.

10
00:00:52,940 --> 00:01:00,540
Of course, there's a lot of other things involved in running an industrial cybersecurity program that are outside of the scope of this presentation.

11
00:01:00,540 --> 00:01:13,320
But in my presentation today, we're going to talk about a lot of the common things that as an industrial penetration tester, as an industrial cybersecurity assessment, practitioner, these are the things that we see over and over again.

12
00:01:13,320 --> 00:01:21,020
And a lot of them can be addressed fairly easily without a lot of capital or operational expenditure.

13
00:01:21,020 --> 00:01:29,540
So we'll talk about how to address some of these risks and what these common issues that we identify are.

14
00:01:29,540 --> 00:01:35,240
So a lot of this is based on the 2019 Dragos year in review report.

15
00:01:35,240 --> 00:01:40,980
We see a lot of these common issues as we do assessment after assessment.

16
00:01:40,980 --> 00:01:59,800
It's common to see things like limited visibility or credentials laying around or routable connections from your corporate environment into the ICS environment, and even ICS components directly accessible from the internet these days.

17
00:01:59,800 --> 00:02:04,080
So a lot of these common findings are highlighted in this year in review report.

18
00:02:04,080 --> 00:02:13,180
And we'll be talking about the top five and how to really address those or identify them in your own environment and remediate them.

19
00:02:14,400 --> 00:02:24,960
So we think it's important to take a threat-based approach when you're looking at risk in your industrial cybersecurity environment.

20
00:02:25,500 --> 00:02:32,180
Now within Dragos, we track a number of activity groups that target these environments.

21
00:02:32,220 --> 00:02:46,220
And this will be really done from the perspective of our own internal activity group called Kyberite, where we develop our ICS tactics and techniques, really based on a lot of the other activity groups that we see.

22
00:02:46,220 --> 00:02:57,640
So we try to do some threat emulation as we're working through these networks and use a lot of the common techniques that we see being used against ICS environments.

23
00:03:00,320 --> 00:03:06,980
And of course, tactics, techniques and procedures are part of the equation.

24
00:03:06,980 --> 00:03:11,900
But we find these really change depending on the environment that you have.

25
00:03:11,900 --> 00:03:28,860
And it's important to, of course, start with understanding what you have, whether you're running Windows Active Directory or Windows Workgroup, what kind of security controls you have, how the internet access works, how industrial vendors get in, what your firewall rules look like.

26
00:03:28,860 --> 00:03:49,060
Once you understand these basic environmental factors, and understand how they change the tactics and techniques of an activity group, that can really help you reduce your risk and understand where you need to invest your time and energy to mitigate some of these risks.

27
00:03:49,880 --> 00:04:00,240
Of course, if you if you study activity groups like Electrum and Xenotime, there are publicly known techniques that they have used against environments.

28
00:04:00,320 --> 00:04:06,420
And I certainly believe those techniques would change depending on what was available.

29
00:04:06,420 --> 00:04:19,860
As a pen tester, as an adversary, we're always very dynamic with our approach, we need to roll with the punches and adjust our techniques to align with the environment we're faced with.

30
00:04:19,880 --> 00:04:29,920
So that's why it's not one size fits all, you can't take all these TTPs that are identified and directly apply them to your environment necessarily.

31
00:04:31,300 --> 00:04:38,240
Often the environment dictates what the TTPs are going to be used, which TTPs are going to be used.

32
00:04:39,540 --> 00:04:47,100
So during this presentation, we'll be talking about our top five ICS assessment findings for 2019.

33
00:04:47,160 --> 00:04:53,820
These are related to firewall rules, access management, system hardening, logging and network visibility.

34
00:04:53,820 --> 00:05:15,800
So we'll be talking about some of the tools that we use as penetration testers and ICS network assessment professionals, some of the tools that can be used safely in ICS environments without introducing operational risk or very, at the very least, minimal operational risk when they are being leveraged in these environments,

35
00:05:15,800 --> 00:05:23,360
how to identify these risks using these tools, and then also how to mitigate some of these common findings.

36
00:05:23,860 --> 00:05:35,320
So at the end of the day, if you're able to take ownership of your industrial cybersecurity posture, do some self assessment work.

37
00:05:35,540 --> 00:05:46,160
It's not difficult to do once you understand what tools are available and how to approach some of these problems and highlight some of these problems.

38
00:05:46,160 --> 00:05:59,060
If you're able to mitigate a lot of these common issues, even prior to doing another assessment, it allows that red team or that penetration testing team or that assessment team to really focus on the more interesting problems.

39
00:05:59,060 --> 00:06:01,780
So you're getting rid of all the low hanging fruit.

40
00:06:01,840 --> 00:06:09,520
So the adversary group has to dig a lot deeper and focus on some of the more challenging problems.

41
00:06:10,540 --> 00:06:25,140
And you're also raising the bar like when you when you address a lot of these low hanging fruit, a lot of these low level issues, it really reduces the playbook that the adversary can can use.

42
00:06:25,340 --> 00:06:37,240
They're not able to fall back on their normal, normal operating plans, they need to think outside the box a little more, they need to experiment more, do more reconnaissance.

43
00:06:37,300 --> 00:06:45,360
And whenever they do that, when they have to work harder, you have more opportunities to detect them, you have more opportunities to stop them.

44
00:06:45,600 --> 00:06:52,440
And and also you make their lives a lot more difficult, which is, you know, something you want to do.

45
00:06:52,440 --> 00:07:14,260
You want these, these adversaries who are targeting critical infrastructure, who are trying to turn the lights off in your in your town or, or impact these important industrial processes, you want them to have to lay in bed at night, questioning their life choices that brought them to that position of why they're targeting civilian infrastructure.

46
00:07:15,000 --> 00:07:25,940
So starting off with firewall rules, what we see when we do these assessments, often will ask for the the rules to be shared with us.

47
00:07:26,200 --> 00:07:29,920
Usually like a white box approach is best.

48
00:07:30,000 --> 00:07:39,600
When we're doing ICS assessments, we really need to be transparent with the operating operators, the sites, and the site personnel.

49
00:07:39,600 --> 00:07:44,980
Turns out, industrial asset owners and industrial operators don't like surprises.

50
00:07:44,980 --> 00:07:54,280
So we found that it's very important to be open and clear with what we're doing, whenever we're doing it within these ICS assessments.

51
00:07:54,600 --> 00:08:16,660
The more information we can share, the more we can work closely with the operations team and start to build that trust and that build that bridge between the cybersecurity team and the OT or the ICS operations team, which is which is so important to be successful in this environment.

52
00:08:16,800 --> 00:08:24,080
So when we ask for these firewall rules, we'll usually use a tool to make sense of them.

53
00:08:24,400 --> 00:08:31,080
There's dozens of different firewalls out there and they all provide their rules in different formats.

54
00:08:31,180 --> 00:08:41,540
Fortunately, there are some commercial tools that you can use and even some free tools you can use to make sense of these rules and work through them in more of an Excel spreadsheet kind of format.

55
00:08:41,540 --> 00:08:47,280
One free tool we like to use is the SolarWinds free firewall browser.

56
00:08:47,680 --> 00:08:58,200
So what you can do is export your firewall rules and then import them using this SolarWinds free firewall browser and then just go kind of line by line.

57
00:08:58,200 --> 00:09:08,620
What you're really looking for is interactive protocols that allow remote access between your different trust zones.

58
00:09:08,620 --> 00:09:15,850
So typically between your corporate network and your ICS network, or even between different trust zones within the ICS network.

59
00:09:16,430 --> 00:09:36,950
You're looking for SSH, Telnet, remote desktop, VNC, even things like WMI or remote management, RPC, SMB, even protocols like OPC, like OPCDA, the older OPC protocols can allow remote access and often do.

60
00:09:38,370 --> 00:09:57,090
So we often find there are temporary firewall rules still in these configurations from the time of commissioning, we find there's vendor dictated rules and vendor access rules that have never really been evaluated or questioned.

61
00:09:57,090 --> 00:10:00,250
So it's important to go line by line and really question why do we have this?

62
00:10:00,250 --> 00:10:01,650
Like what, what purpose does it serve?

63
00:10:01,650 --> 00:10:02,830
Who's using this?

64
00:10:02,830 --> 00:10:09,290
And to knock off as many of those temporary or vendor dictated rules as you can.

65
00:10:09,290 --> 00:10:28,970
Of course, you want to communicate with your vendor, if that vendor is using that for remote access, you want to identify those and make sure they are still able to access or maybe propose a more secure method if the method that you're using is introducing risk in your environment.

66
00:10:29,310 --> 00:10:33,330
So this is what the free firewall browser looks like.

67
00:10:33,330 --> 00:10:38,670
It just breaks down the rules line by line in sort of an Excel spreadsheet format.

68
00:10:38,670 --> 00:10:46,330
And you can see we've got a couple interesting interactive rules here on 3389, which is the remote desktop protocol.

69
00:10:46,330 --> 00:10:50,630
So things to watch out for when you're going through these assessments.

70
00:10:50,630 --> 00:10:57,110
There's commercial tools you can use as well like Nipper that can help you identify issues.

71
00:10:57,110 --> 00:11:02,710
Often we still find any rules or what's equivalent to any rules.

72
00:11:02,710 --> 00:11:05,490
Sometimes these firewall rules can get quite complicated.

73
00:11:05,550 --> 00:11:12,070
And you put enough rules overlapping on top of each other and it can basically equate to any rule.

74
00:11:12,070 --> 00:11:19,930
So it's important to study these firewall rules closely and identify opportunities to pivot through these different trust zones.

75
00:11:20,270 --> 00:11:26,650
Now another common issue that we run into is access management.

76
00:11:26,650 --> 00:11:50,590
And what we really find is it's not necessary most of the time to use any exploits or have to dig too deep in these ICS networks to pivot or escalate privilege because the access management is so poor in these environments.

77
00:11:50,590 --> 00:11:59,110
Often we'll run into shared Active Directory environments between corporate and the ICS.

78
00:11:59,110 --> 00:12:08,210
So once we take that corporate Active Directory environment, we're able to easily pivot and take full control over the ICS environment.

79
00:12:08,210 --> 00:12:17,970
Other situations where there is a dedicated Active Directory environment in the ICS, it's poorly maintained and hasn't really been configured properly.

80
00:12:17,970 --> 00:12:24,170
So usually we see almost everybody's a domain admin or there's lots of service accounts that are domain admins.

81
00:12:24,170 --> 00:12:29,610
Lots of these common issues in Active Directory that we run into.

82
00:12:29,610 --> 00:12:30,650
So what do you do?

83
00:12:30,650 --> 00:12:32,690
How do you identify these issues?

84
00:12:32,690 --> 00:12:37,050
Well, what we typically do is run a tool called Bloodhound.

85
00:12:37,050 --> 00:12:49,830
Now it's a free open source tool and it's been used by pen testing teams and red teams to unravel the yarn ball that is Active Directory .

86
00:12:49,830 --> 00:13:05,490
For years, Active Directory kind of experienced this security through obscurity where it's so complicated that even the adversaries couldn't really figure out all of the groups and groups and users and groups and how all those unwind to different permission levels.

87
00:13:05,490 --> 00:13:25,890
But with the introduction of Bloodhound, this tool uses graph theory to really map out what the implications of all these permissions are, how to unravel all these groups to determine who's really a domain admin and how you can pivot from the average user to domain admin fairly easily.

88
00:13:25,890 --> 00:13:31,970
So it shows you all these different paths and overprivileged accounts that you can identify and potentially lock down.

89
00:13:31,970 --> 00:13:33,610
And it's fairly safe, too.

90
00:13:33,610 --> 00:13:39,690
There's a very low operational risk because it only communicates with the Active Directory server in the network.

91
00:13:39,690 --> 00:13:43,850
It's not going to scan your network or hit all the PLCs in your network or anything like that.

92
00:13:43,850 --> 00:13:47,810
It's only going to communicate with the Active Directory environment.

93
00:13:47,950 --> 00:13:52,510
And it's only going to send LDAP requests, which are fairly normal.

94
00:13:52,510 --> 00:14:00,670
It's just the same kind of network activity that you would introduce if you were logging into a machine or remote desktoping into a machine.

95
00:14:00,670 --> 00:14:04,030
It's nothing unusual for that environment.

96
00:14:04,030 --> 00:14:13,590
There's certainly a big spike of LDAP when you use that tool, but it's nothing that would create an operational risk in that environment.

97
00:14:14,310 --> 00:14:16,490
So what does that look like?

98
00:14:16,490 --> 00:14:23,690
So here's an example of Bloodhound unraveling a path to the domain admin from this RTAM user.

99
00:14:23,690 --> 00:14:30,090
We can see he's a member of this group that's an administrator on this machine.

100
00:14:30,210 --> 00:14:54,830
And because they're an admin on this machine, they're able to gain access to potentially the password or the hash of this user who is also logged into this machine, and then use that user's privilege to gain domain administrator access in that network.

101
00:14:54,990 --> 00:15:02,810
So this can really make sense of Active Directory and help identify some of those common issues and common misconfigurations.

102
00:15:03,130 --> 00:15:05,090
So access management part two.

103
00:15:05,090 --> 00:15:06,950
So what if you don't have Active Directory?

104
00:15:06,950 --> 00:15:11,690
What if it's a Windows work group environment, which is also fairly common to see in ICS?

105
00:15:11,690 --> 00:15:19,850
And even if you do have Active Directory, there's other passwords that exist outside of Active Directory within these ICS networks.

106
00:15:19,850 --> 00:15:28,670
So I'm talking about things like VNC and SSH, credentials into switchgear, networkgear, stuff like that.

107
00:15:28,750 --> 00:15:38,190
There's usually passwords just laying around the network and Excel spreadsheets or notepad files or default credentials for a lot of devices.

108
00:15:38,190 --> 00:15:51,230
Often we find credentials are stored in things like Chrome or stored in things like Putty or WinSCP or BatchPatch, or other other tools like that.

109
00:15:51,230 --> 00:16:00,990
And when you when you click that option to save your username and password in these tools, these tools don't always securely manage those credentials.

110
00:16:00,990 --> 00:16:06,750
So it can be quite trivial for an attacker to pull out those stored credentials.

111
00:16:07,330 --> 00:16:27,230
So what you can do is leverage some of these client side tools, like Session Gopher that are free, Session Gopher from FireEye, or even performing things like an LSAS dump, or using tools like Mimi Cats, Mimi Kittens, and some of these Nirsoft password utils.

112
00:16:27,230 --> 00:16:30,970
Now Mimi Cats is it's something that's used by almost every activity group.

113
00:16:30,970 --> 00:16:40,910
Once these activity groups get a foothold in an environment, one of the first things they do is dump their post exploitation tools.

114
00:16:40,910 --> 00:16:47,450
A lot of those are just trying to find passwords to escalate privilege and move laterally in that environment.

115
00:16:47,450 --> 00:16:52,990
So you want to try to understand how you're storing your passwords, what passwords are stored on different endpoints.

116
00:16:52,990 --> 00:16:57,530
And you can automate that process just like the activity groups typically do.

117
00:16:58,290 --> 00:17:29,030
So what can you do once you've identified the issues or the mis-storage of passwords, you can implement some kind of password storage mechanism, or a privileged access management system, or even just like a vault , or a last pass, or some password vault solution that does a better job protecting these important credentials than WinSCP ,

118
00:17:29,030 --> 00:17:32,290
or Putty, or other tools typically do.

119
00:17:33,270 --> 00:17:36,850
So here's a quick example of running Mimi Cats.

120
00:17:36,850 --> 00:17:38,270
And it's something I'd recommend.

121
00:17:39,910 --> 00:17:50,950
It's something we always try to do on a safe environment, running Mimi Cats, just to see if it's detected, if it triggers any kind of alerts.

122
00:17:50,950 --> 00:17:58,930
If we're able to do like what we're doing here, dump the LSAS memory to a file.

123
00:17:58,930 --> 00:18:18,650
So if we dump the LSAS memory using the task manager, just right click on the local security authority process and go create dump file, we can copy that dump file off of the machine and run it through Mimi Cats to see what kind of passwords we pull out of memory.

124
00:18:18,650 --> 00:18:35,130
If your Windows endpoints are not hardened, you'll usually be able to pull out the hashes and often clear text passwords from any account that has recently logged into that machine.

125
00:18:35,130 --> 00:18:42,390
So it can be quite eye opening to to see that and see these passwords coming through in clear text using Mimi Cats.

126
00:18:42,390 --> 00:18:49,050
So it's something we we recommend that our customers do in a safe and safe manner.

127
00:18:49,330 --> 00:19:07,170
And even just copying the Mimi Cats executable into one of your ICS assets just to see if it gets caught by Windows Defender or Norton AV and, and to see if that alert makes it someplace to see if you know the your monitoring is set up properly.

128
00:19:07,510 --> 00:19:10,710
It should create alerts, it should set off all kinds of alarm bells.

129
00:19:10,710 --> 00:19:20,170
So it's a great way of testing your, your monitoring, or malicious files in your ICS network.

130
00:19:21,750 --> 00:19:37,010
Here's another example of another tool the FireEye Session Gopher, it looks for passwords and other tools like WinSCP and PuTTY and RDP, like your stored passwords in your remote desktop client.

131
00:19:37,590 --> 00:19:42,390
So it'll pull out clear passwords like we see in this example below.

132
00:19:42,390 --> 00:19:48,850
And this can be very valuable to an adversary who's looking to move laterally or escalate their privilege in the network.

133
00:19:48,850 --> 00:19:53,290
And we almost always, always find credentials when we're doing these assessments.

134
00:19:53,290 --> 00:19:58,690
One way or another, there's there's always, almost always poor storage of these credentials.

135
00:20:00,430 --> 00:20:09,610
So another thing that can help address that credential storage issue is some basic Windows system hardening.

136
00:20:09,790 --> 00:20:16,490
It's a very common issue that we see where a lot of these ICS Windows assets, they haven't performed any hardening.

137
00:20:16,490 --> 00:20:21,290
Often we find things like the firewall is completely turned off on these Windows endpoints.

138
00:20:22,030 --> 00:20:37,750
Just because these ICS networks are so sensitive at times, once the operators or the system integrators get things working, they're afraid to change anything or lock anything down in case it breaks something.

139
00:20:37,750 --> 00:20:43,750
So usually, once they get things working, they just kind of leave it as is.

140
00:20:43,750 --> 00:20:47,470
And it's rare to find any system hardening really performed.

141
00:20:47,490 --> 00:20:55,390
And without some basic Windows system hardening, it's so easy to cut through those networks as an adversary.

142
00:20:55,850 --> 00:21:15,530
The default Windows installation, especially Windows 7 and older Windows versions, there's just so many backwards compatibility features that are turned on that make it so easy to pull passwords, escalate privilege to a system that once you're in that network,

143
00:21:15,530 --> 00:21:21,830
you can own it within a matter of minutes without some system hardening happening.

144
00:21:38,920 --> 00:21:42,180
Oops, looks like my internet connection had a bit of a blip there.

145
00:21:42,180 --> 00:21:43,600
I'll start that over.

146
00:21:43,620 --> 00:21:58,500
Now system hardening does have the potential to create an operational or introduce operational risk, you'll need to work closely with your vendor to ensure that any hardening you're doing won't impact your operating process.

147
00:21:58,580 --> 00:22:10,420
Often, the major vendors will have system hardening guides that you can follow, and the recommended hardening that they have tested and approved.

148
00:22:10,420 --> 00:22:23,080
So it's important when you're building a new greenfield system, when you're building an ICS system from the ground up to ask them to implement these system hardening features to turn security on.

149
00:22:23,080 --> 00:22:29,940
Because what we find is if you don't ask the vendors or the system integrators to do these things, it just doesn't happen.

150
00:22:30,080 --> 00:22:35,820
If you don't set that standard or make that request, they're not going to do it.

151
00:22:36,180 --> 00:22:56,260
So it's very important to be clear that you want the systems hardened, they need to be part of their commissioning plan, part of their site acceptance testing or factory acceptance testing checklist, that these hardening features are turned on and the recommended best practices for system hardening for that vendor have been implemented.

152
00:22:56,640 --> 00:23:18,260
And if the vendor does not, if they're not very mature, and they don't have a hardening guide, you can you can use some of the tools like some of the ones I've listed here, like CHAPS, the configuration hardening assessment, PowerShell script from Cutaway Security,

153
00:23:18,260 --> 00:23:22,160
to identify some of the common hardening issues.

154
00:23:22,160 --> 00:23:34,740
And you can raise those up with the vendor to get them approved or ensure that they're on board with making these changes.

155
00:23:35,820 --> 00:23:50,660
But there's other tools, Microsoft has a great tool called the Security Compliance Toolkit, which does a very thorough analysis, it does require you to install some software in your ICS environments that could cause some issues with your vendors, same with the CIS tools and the state tools,

156
00:23:50,660 --> 00:23:54,480
they do require software to be installed in order to make them work.

157
00:23:54,600 --> 00:24:08,060
But that's why I love the CHAPS tool, it's just a PowerShell script you can run, it doesn't require any software to be installed, it just will do some data collection on that endpoint and highlight some of these common hardening issues.

158
00:24:09,220 --> 00:24:12,280
So again, you have to work closely with the vendor when you're running these things.

159
00:24:12,280 --> 00:24:17,080
But here's an example of the CHAPS hardening demo in action.

160
00:24:19,600 --> 00:24:24,660
You can just run it as a PowerShell command, like I've done above.

161
00:24:24,660 --> 00:24:42,700
And then it gives you sort of a pass fail view, things like W digest DNS client, this, if you implement these hardening recommendations, it will prevent an adversary from being able to pull clear text passwords out of memory, clear hashes out of memory.

162
00:24:43,660 --> 00:24:49,880
It'll prevent them from downgrading to PowerShell 2 and bypassing a lot of the PowerShell security features.

163
00:24:50,020 --> 00:24:56,120
So it also helps reduce the chances of man-in-the-middle attacks and things like that in your ICS network.

164
00:24:56,120 --> 00:25:01,040
So just a little bit of hardening and lockdown can have a huge impact.

165
00:25:02,740 --> 00:25:13,100
So what we're seeing from a logging perspective is usually a complete lack of logging, or no centralized logging.

166
00:25:13,100 --> 00:25:16,460
Sometimes logging is turned on on the Windows endpoints, but it's just not going anywhere.

167
00:25:16,460 --> 00:25:18,380
It's just being stored locally.

168
00:25:18,800 --> 00:25:25,120
And if it is turned on and being centrally managed, they're not always logging the right stuff.

169
00:25:25,140 --> 00:25:30,280
In these ICS environments, they're not logging PowerShell commands or, or new processes.

170
00:25:30,360 --> 00:25:39,900
They're not using things like sysmon to really get the details you need to do proper forensic analysis and incident response in these environments.

171
00:25:40,340 --> 00:25:45,980
And it's not hard to do, it's not difficult to turn these, these things on.

172
00:25:46,040 --> 00:25:58,020
And again, that CHAPS tool can help you identify some of the common logging issues that you may encounter and some of the things you'll want to turn on in your ICS environments.

173
00:25:58,120 --> 00:26:04,760
And really just having that centrally managed logging environment can be such a huge win.

174
00:26:05,060 --> 00:26:13,060
If you ever are doing like an incident response, you'll be so grateful to have that centrally managed logging environment.

175
00:26:13,060 --> 00:26:15,860
And it's all built into Windows, you don't need to have Splunk or anything like that.

176
00:26:15,860 --> 00:26:23,340
You can just use Windows Event Forwarding to centrally manage those those Windows events without having to spend any extra money.

177
00:26:23,340 --> 00:26:38,320
Just having that those events all in one place can really facilitate things like threat hunting, and can speed up incident response and give you better visibility into your ICS network as well.

178
00:26:38,860 --> 00:26:54,880
So what we recommend is understanding what your Windows event logging capabilities are today, what's being logged, what's not being logged, where is it going, and using again, that CHAPS tool can help identify these issues.

179
00:26:54,880 --> 00:26:57,320
There's really a pretty low operational risk.

180
00:26:57,320 --> 00:26:59,880
It may produce a little more traffic on your network.

181
00:26:59,880 --> 00:27:05,700
But for most modern networks, this shouldn't be a huge issue.

182
00:27:07,100 --> 00:27:11,720
Now here's the output of that CHAPS tool again, that PowerShell script.

183
00:27:11,720 --> 00:27:33,800
And it can show you some of the issues if you have the PowerShell task scheduler, WinRM, WMI activity, all these different log files are important to have turned on and have a larger log size and ensure that they're being forwarded to a central location.

184
00:27:33,800 --> 00:27:37,660
So the CHAPS tool can help identify a lot of these common issues.

185
00:27:37,880 --> 00:27:46,620
So if you turn on the recommended logging from CHAPS, it will make a big difference and reduce your risk quite a bit.

186
00:27:48,120 --> 00:27:50,580
Now on to network visibility.

187
00:27:50,640 --> 00:28:00,500
Another common issue that we see is, as a pen test or a red team, we're able to operate within these ICS networks undetected.

188
00:28:00,580 --> 00:28:04,300
Once we're in them, there's usually very little or no visibility.

189
00:28:04,300 --> 00:28:18,340
So we can move about, move laterally, escalate privilege, take over the domain without any alarm bells going off, and maintain perpetual access as well.

190
00:28:19,000 --> 00:28:36,380
So what you can do is, if you don't have network visibility today, you can start to lay that foundation and start to see if you get the value out of it in a low cost sort of introductory kind of method.

191
00:28:36,780 --> 00:28:52,100
First of all, if you just identify the points in your network that you should be monitoring , what switches you should be attaching or configuring SPAN ports to, or better yet, purchase some network TAPs and install them.

192
00:28:52,100 --> 00:29:06,960
And just having those, just having them in your network that you can tap into to collect data and collect PCAPs, it's extremely valuable in an incident response, or it's extremely valuable in a threat hunting exercise.

193
00:29:07,060 --> 00:29:15,460
So that can really enable your security operations team to do a lot more, just knowing where to plug in.

194
00:29:15,460 --> 00:29:18,040
That's the first step in getting that network visibility.

195
00:29:18,040 --> 00:29:26,220
And once you have that, you can start to collect PCAPs and do some analysis to better understand what's going on, what kind of traffic you see in your network, what's normal.

196
00:29:26,380 --> 00:29:44,220
And then you can start to use some, even some free tools that are available, or commercial tools to perform analysis on those PCAPs, or even install some hardware and software to do continuous monitoring of that network traffic.

197
00:29:44,700 --> 00:29:47,500
And again, it's a pretty low operational risk.

198
00:29:47,660 --> 00:29:52,680
You're connecting to SPAN ports or TAPs.

199
00:29:52,680 --> 00:29:59,500
Now, ideally, we always recommend you use dedicated TAPs, network TAPs rather than SPAN ports.

200
00:29:59,880 --> 00:30:08,580
SPAN ports, when they're configured on a switch, there is a risk that that switch can get kind of overloaded, especially if it's an older piece of equipment.

201
00:30:08,760 --> 00:30:12,220
You should be monitoring the CPU usage of those switches.

202
00:30:12,220 --> 00:30:29,500
Once you enable your SPAN port, if they're in the 80% or 90% utilization, kind of threshold, you may want to consider an alternate option, because that could just put it over the edge and create a network outage.

203
00:30:29,500 --> 00:30:32,000
So you need to need to be a little careful with that.

204
00:30:32,000 --> 00:30:41,300
But it shouldn't, it typically doesn't cause too many issues to set up those SPAN ports.

205
00:30:41,300 --> 00:30:45,760
But in some of the edge cases, it could create some or introduce some operational risks.

206
00:30:45,760 --> 00:30:48,720
So something to be aware of, something to watch.

207
00:30:49,720 --> 00:31:00,640
And of course, having visibility in your network can improve your threat detection and threat monitoring capability with the right tools and techniques and procedures.

208
00:31:01,260 --> 00:31:08,360
So there are two free products that Dragos provides.

209
00:31:08,460 --> 00:31:16,300
One of the free products is our old Cyber Lens product, which is it's well suited for PCAP analysis.

210
00:31:16,300 --> 00:31:25,820
It was really designed to just take a PCAP and help visualize what's inside, specific to the ICS protocols and ICS content.

211
00:31:25,820 --> 00:31:29,540
It's a great way to help you understand what assets are in your network.

212
00:31:29,680 --> 00:31:32,900
That's a common challenge we see in the ICS space.

213
00:31:32,900 --> 00:31:33,600
What do I have?

214
00:31:33,600 --> 00:31:36,280
What's on my network at any given time?

215
00:31:36,280 --> 00:31:38,600
So Cyber Lens can help you identify those.

216
00:31:38,860 --> 00:31:44,460
And Sophia is designed for more of the continuous monitoring.

217
00:31:44,460 --> 00:31:50,920
Sophia was the next defense product that was commercially sold to customers all around the world.

218
00:31:50,920 --> 00:31:54,660
And now it's available for free from the Dragos website.

219
00:31:54,660 --> 00:32:04,560
So if you want just continuous asset identification, monitoring just to know what's on your network and have that updated perpetually, Sophia is a great tool for doing that.

220
00:32:04,900 --> 00:32:11,420
And of course, there's commercial tools you can use, like Network Miner to do analysis of PCAPs.

221
00:32:11,420 --> 00:32:15,520
That's a very handy tool for digging into PCAP data.

222
00:32:15,520 --> 00:32:35,120
And of course, the Dragos platform is our commercial product that does a threat -based monitoring of ICS networks with playbooks and feeds into our Intel with the latest activity groups that are targeting these environments.

223
00:32:35,120 --> 00:32:45,520
So if you're ready, if you're seeing the value in your network monitoring, then maybe a commercial product is the next step for you.

224
00:32:45,520 --> 00:33:03,620
But it's always nice to kind of learn to walk before you run, kind of identify those spam ports and kind of ease your way into it to make sure you really see the value and take full advantage of that value of OT network monitoring.

225
00:33:05,320 --> 00:33:15,260
And of course, this is something these self-checks, these common self-assessments can be done regularly.

226
00:33:16,020 --> 00:33:35,600
And there's there's huge benefits to taking ownership of these, just doing like some mini assessments once a year, once every six months, just to see what's on your network, look at how passwords are stored, understand who the big accounts in your Active Directory environment are,

227
00:33:35,600 --> 00:33:38,180
who the domain admins are, and who has access to that.

228
00:33:38,180 --> 00:33:41,280
All these things should be done regularly.

229
00:33:41,280 --> 00:33:51,040
Once you really take ownership of your industrial cybersecurity, of your industrial cyber risk, you can make a big difference in that risk reduction.

230
00:33:51,040 --> 00:33:53,300
You can start to address that.

231
00:33:53,300 --> 00:34:03,880
And it's something that should be done on a regular basis, at a set interval once a year, once every six months, because ICS environments are quite dynamic, they do change.

232
00:34:04,060 --> 00:34:08,760
They're constantly being modified and updated and maintained.

233
00:34:08,760 --> 00:34:12,380
So it's good to do this on a regular basis.

234
00:34:12,440 --> 00:34:18,720
And it can be augmented once you get into this self-check and you're covering off a lot of the low hanging fruit.

235
00:34:18,780 --> 00:34:23,380
That's when you can bring in a professional team to do an assessment.

236
00:34:23,380 --> 00:34:38,960
And then they'll get to really dig into the interesting stuff, the stuff that is uncommon and would require an adversary to dig a little deeper, do more research, and have to sweat a little to move through your network.

237
00:34:41,200 --> 00:34:43,600
And that's the end of my presentation .

238
00:34:43,600 --> 00:34:46,160
Thank you so much for attending.