start	end	text
2640	6700	Hi, this is Austin Scott. And this is five quick wins for
6700	11200	improving your ICS cybersecurity posture. I'm a Principal
11200	14240	Industrial Penetration Tester as part of the Dragos
14240	18900	Professional Services team. And I really see the world from the
18900	22760	perspective as a pen tester, just like a hammer sees the
22760	26840	world as a nail. I really see everything from an adversarial
26840	30860	perspective. And that's the point of view we'll be taking in
30860	34840	this presentation today. Really, we're looking for ways
34840	39220	to make it more difficult for an adversary to move through an
39220	42820	ICS environment. Now, my recommendations in and of
42820	45780	themselves won't give you a bulletproof cybersecurity
45780	49780	program or industrial cybersecurity program. But they
49780	53240	will raise the bar for your security posture. Of course,
53240	55400	there's a lot of other things involved in running an
55400	58800	industrial cybersecurity program that are outside of the scope of
58800	62120	this presentation. But in my presentation today, we're going
62120	64540	to talk about a lot of the common things that as an
64540	68320	industrial penetration tester, as an industrial cybersecurity
68320	72320	assessment, practitioner, these are the things that we see over
72320	75740	and over again. And a lot of them can be addressed fairly
75740	81200	easily without a lot of capital or operational expenditure. So
81200	84840	we'll talk about how to address some of these risks and what
84840	90400	these common issues that we identify are. So a lot of this
90400	96500	is based on the 2019 Dragos year in review report. We see a lot
96500	100980	of these common issues as we do assessment after assessment.
100980	106440	It's common to see things like limited visibility or credentials
106440	110540	laying around or routable connections from your corporate
110540	116240	environment into the ICS environment, and even ICS
116240	119900	components directly accessible from the internet these days. So
120760	123180	a lot of these common findings are highlighted in this year in
123180	126120	review report. And we'll be talking about the top five and
126120	130400	how to really address those or identify them in your own
130400	136440	environment and remediate them. So we think it's important to
136440	142080	take a threat-based approach when you're looking at risk in
142080	147300	your industrial cybersecurity environment. Now within Dragos,
147300	151020	we track a number of activity groups that target these
151020	154040	environments. And this will be really done from the perspective
154040	159960	of our own internal activity group called Kyberite, where we
159960	164500	develop our ICS tactics and techniques, really based on a
164500	166700	lot of the other activity groups that we see. So we try to do
166700	169140	some threat emulation as we're working through these networks
169140	174660	and use a lot of the common techniques that we see being
174660	183300	used against ICS environments. And of course, tactics,
183300	188380	techniques and procedures are part of the equation. But we
188380	191140	find these really change depending on the environment
191140	195160	that you have. And it's important to, of course, start
195160	198020	with understanding what you have, whether you're running
198020	201200	Windows Active Directory or Windows Workgroup, what kind of
201200	205300	security controls you have, how the internet access works, how
205300	208860	industrial vendors get in, what your firewall rules look like.
208860	213880	Once you understand these basic environmental factors, and
213880	218020	understand how they change the tactics and techniques of an
218020	222280	activity group, that can really help you reduce your risk and
222280	226600	understand where you need to invest your time and energy to
226600	232000	mitigate some of these risks. Of course, if you if you study
232000	236000	activity groups like Electrum and Xenotime, there are publicly
236000	241720	known techniques that they have used against environments. And I
241720	244080	certainly believe those techniques would change
244080	248000	depending on what was available. As a pen tester, as an
248000	251640	adversary, we're always very dynamic with our approach, we
251640	257400	need to roll with the punches and adjust our techniques to
257400	261720	align with the environment we're faced with. So that's why it's
261720	264800	not one size fits all, you can't take all these TTPs that are
264800	268840	identified and directly apply them to your environment
268840	273540	necessarily. Often the environment dictates what the
273540	280060	TTPs are going to be used, which TTPs are going to be used. So
280060	283980	during this presentation, we'll be talking about our top five
283980	288280	ICS assessment findings for 2019. These are related to
288280	292020	firewall rules, access management, system hardening,
292020	295100	logging and network visibility. So we'll be talking about some
295100	298160	of the tools that we use as penetration testers and ICS
298160	301940	network assessment professionals, some of the tools
301940	305880	that can be used safely in ICS environments without introducing
306760	310860	operational risk or very, at the very least, minimal operational
310860	315800	risk when they are being leveraged in these environments,
315800	319200	how to identify these risks using these tools, and then also
319200	324680	how to mitigate some of these common findings. So at the end
324680	329820	of the day, if you're able to take ownership of your
329820	334540	industrial cybersecurity posture, do some self assessment
334540	338340	work. It's not difficult to do once you understand what tools
338340	343900	are available and how to approach some of these problems
344420	347080	and highlight some of these problems. If you're able to
347080	351200	mitigate a lot of these common issues, even prior to doing
351200	354200	another assessment, it allows that red team or that
354200	357400	penetration testing team or that assessment team to really focus
357400	360080	on the more interesting problems. So you're getting rid
360080	364140	of all the low hanging fruit. So the adversary group has to dig
364220	368260	a lot deeper and focus on some of the more challenging
368260	373080	problems. And you're also raising the bar like when you
373080	376180	when you address a lot of these low hanging fruit, a lot of
376180	382260	these low level issues, it really reduces the playbook that
382260	387440	the adversary can can use. They're not able to fall back on
387440	393120	their normal, normal operating plans, they need to think
393120	395920	outside the box a little more, they need to experiment more, do
395920	398280	more reconnaissance. And whenever they do that, when they
398280	402400	have to work harder, you have more opportunities to detect
402400	405800	them, you have more opportunities to stop them. And
408460	411140	and also you make their lives a lot more difficult, which is,
411140	413840	you know, something you want to do. You want these, these
413840	416860	adversaries who are targeting critical infrastructure, who
416860	419800	are trying to turn the lights off in your in your town or, or
419800	424540	impact these important industrial processes, you want
424540	427960	them to have to lay in bed at night, questioning their life
427960	432220	choices that brought them to that position of why they're
432220	436680	targeting civilian infrastructure. So starting off
436680	441120	with firewall rules, what we see when we do these assessments,
441120	446880	often will ask for the the rules to be shared with us. Usually
446880	451680	like a white box approach is best. When we're doing ICS
451680	454860	assessments, we really need to be transparent with the
454860	459940	operating operators, the sites, and the site personnel. Turns
459940	464220	out, industrial asset owners and industrial operators don't like
464220	469140	surprises. So we found that it's very important to be open and
469140	472280	clear with what we're doing, whenever we're doing it within
472280	477900	these ICS assessments. The more information we can share, the
477900	482640	more we can work closely with the operations team and start to
482640	487680	build that trust and that build that bridge between the
488320	492900	cybersecurity team and the OT or the ICS operations team, which
492900	496660	is which is so important to be successful in this environment.
496800	500600	So when we ask for these firewall rules, we'll usually
500600	506180	use a tool to make sense of them. There's dozens of different
506180	510100	firewalls out there and they all provide their rules in different
510100	513280	formats. Fortunately, there are some commercial tools that you
513280	516880	can use and even some free tools you can use to make sense of
516880	519600	these rules and work through them in more of an Excel
519600	524240	spreadsheet kind of format. One free tool we like to use is the
524240	528980	SolarWinds free firewall browser. So what you can do is
528980	532500	export your firewall rules and then import them using this
532500	537120	SolarWinds free firewall browser and then just go kind of line by
537120	542440	line. What you're really looking for is interactive protocols
542440	548780	that allow remote access between your different trust zones. So
548780	552740	typically between your corporate network and your ICS network, or
552740	555850	even between different trust zones within the ICS network.
556430	560770	You're looking for SSH, Telnet, remote desktop, VNC, even things
560770	567430	like WMI or remote management, RPC, SMB, even protocols like
567430	573490	OPC, like OPCDA, the older OPC protocols can allow remote
573490	582510	access and often do. So we often find there are temporary
582510	589530	firewall rules still in these configurations from the time of
589530	593810	commissioning, we find there's vendor dictated rules and vendor
593810	596110	access rules that have never really been evaluated or
596110	598850	questioned. So it's important to go line by line and really
598850	601390	question why do we have this? Like what, what purpose does it
601390	604270	serve? Who's using this? And to knock off as many of those
604270	609990	temporary or vendor dictated rules as you can. Of course, you
609990	612890	want to communicate with your vendor, if that vendor is using
612890	618270	that for remote access, you want to identify those and make sure
618270	622270	they are still able to access or maybe propose a more secure
622270	627950	method if the method that you're using is introducing risk in
627950	632550	your environment. So this is what the free firewall browser
632550	636850	looks like. It just breaks down the rules line by line in sort
636850	639590	of an Excel spreadsheet format. And you can see we've got a
639590	644530	couple interesting interactive rules here on 3389, which is the
644530	647690	remote desktop protocol. So things to watch out for when
647690	651230	you're going through these assessments. There's commercial
651230	654130	tools you can use as well like Nipper that can help you
654130	660990	identify issues. Often we still find any rules or what's
660990	663850	equivalent to any rules. Sometimes these firewall rules
663850	668210	can get quite complicated. And you put enough rules overlapping
668210	672070	on top of each other and it can basically equate to any rule.
672070	675170	So it's important to study these firewall rules closely and
675170	678970	identify opportunities to pivot through these different trust
678970	685570	zones. Now another common issue that we run into is access
685570	691610	management. And what we really find is it's not necessary most
691610	700210	of the time to use any exploits or have to dig too deep in
700210	707430	these ICS networks to pivot or escalate privilege because the
707430	712250	access management is so poor in these environments. Often we'll
712250	718010	run into shared Active Directory environments between corporate
718010	723730	and the ICS. So once we take that corporate Active Directory
723730	726190	environment, we're able to easily pivot and take full
726190	729810	control over the ICS environment. Other situations where there is
729970	733290	a dedicated Active Directory environment in the ICS, it's
733290	737970	poorly maintained and hasn't really been configured properly.
737970	741330	So usually we see almost everybody's a domain admin or
741330	744430	there's lots of service accounts that are domain admins. Lots of
744430	749790	these common issues in Active Directory that we run into. So
749790	752990	what do you do? How do you identify these issues? Well, what
752990	757690	we typically do is run a tool called Bloodhound. Now it's a
757690	763350	free open source tool and it's been used by pen testing teams
763350	769450	and red teams to unravel the yarn ball that is Active
769450	773190	Directory. For years, Active Directory kind of experienced
773190	777650	this security through obscurity where it's so complicated that
777650	780850	even the adversaries couldn't really figure out all of the
780850	783810	groups and groups and users and groups and how all those
783810	786570	unwind to different permission levels. But with the
786570	790670	introduction of Bloodhound, this tool uses graph theory to
791370	794490	really map out what the implications of all these
794490	799050	permissions are, how to unravel all these groups to determine
799050	802670	who's really a domain admin and how you can pivot from the
802670	806870	average user to domain admin fairly easily. So it shows you
806870	809430	all these different paths and overprivileged accounts that
809430	812570	you can identify and potentially lock down. And it's fairly
812570	815830	safe, too. There's a very low operational risk because it
815830	819330	only communicates with the Active Directory server in the
819330	821850	network. It's not going to scan your network or hit all the
821850	824590	PLCs in your network or anything like that. It's only going to
824590	828590	communicate with the Active Directory environment. And it's
828590	831870	only going to send LDAP requests, which are fairly
831870	835270	normal. It's just the same kind of network activity that you
835270	839390	would introduce if you were logging into a machine or remote
839390	843470	desktoping into a machine. It's nothing unusual for that
843470	848430	environment. There's certainly a big spike of LDAP when you use
848430	851510	that tool, but it's nothing that would create an operational
851510	856690	risk in that environment. So what does that look like? So
856690	861430	here's an example of Bloodhound unraveling a path to the domain
861430	866490	admin from this RTAM user. We can see he's a member of this
866490	870630	group that's an administrator on this machine. And because
870630	876150	they're an admin on this machine, they're able to gain
876730	885170	access to potentially the password or the hash of this
885170	888150	user who is also logged into this machine, and then use that
888150	893950	user's privilege to gain domain administrator access in that
893950	897450	network. So this can really make sense of Active Directory and
897450	901350	help identify some of those common issues and common
901350	905410	misconfigurations. So access management part two. So what if
905410	908270	you don't have Active Directory? What if it's a Windows work
908270	911850	group environment, which is also fairly common to see in ICS? And
911850	915150	even if you do have Active Directory, there's other
915150	918430	passwords that exist outside of Active Directory within these
918430	923150	ICS networks. So I'm talking about things like VNC and SSH,
923150	928670	credentials into switchgear, networkgear, stuff like that.
928750	932170	There's usually passwords just laying around the network and
932170	936710	Excel spreadsheets or notepad files or default credentials for
936850	941830	a lot of devices. Often we find credentials are stored in things
941830	947530	like Chrome or stored in things like Putty or WinSCP or
947530	952470	BatchPatch, or other other tools like that. And when you when you
952470	956070	click that option to save your username and password in these
956070	960650	tools, these tools don't always securely manage those
960650	964270	credentials. So it can be quite trivial for an attacker to pull
964270	969930	out those stored credentials. So what you can do is leverage some
969930	975250	of these client side tools, like Session Gopher that are
975250	979830	free, Session Gopher from FireEye, or even performing
979830	983770	things like an LSAS dump, or using tools like Mimi Cats, Mimi
983770	987570	Kittens, and some of these Nirsoft password utils. Now Mimi
987570	990490	Cats is it's something that's used by almost every activity
990490	995830	group. Once these activity groups get a foothold in an
995830	998850	environment, one of the first things they do is dump their
998850	1002590	post exploitation tools. A lot of those are just trying to find
1002590	1006910	passwords to escalate privilege and move laterally in that
1006910	1010010	environment. So you want to try to understand how you're storing
1010010	1012150	your passwords, what passwords are stored on different
1012150	1015450	endpoints. And you can automate that process just like the
1015450	1021010	activity groups typically do. So what can you do once you've
1021010	1027870	identified the issues or the mis-storage of passwords, you
1027870	1033590	can implement some kind of password storage mechanism, or
1034110	1036790	a privileged access management system, or even just like a
1036790	1042650	vault, or a last pass, or some password vault solution that
1042770	1047110	does a better job protecting these important credentials than
1048610	1056210	WinSCP, or Putty, or other tools typically do. So here's a quick
1056210	1057510	example of running Mimi Cats. And it's something I'd
1057510	1063610	recommend. It's something we always try to do on a safe
1063610	1068510	environment, running Mimi Cats, just to see if it's detected, if
1068510	1073630	it triggers any kind of alerts. If we're able to do like what
1073630	1080950	we're doing here, dump the LSAS memory to a file. So if we dump
1080950	1085410	the LSAS memory using the task manager, just right click on the
1086670	1091090	local security authority process and go create dump file, we can
1091090	1095250	copy that dump file off of the machine and run it through Mimi
1095250	1098650	Cats to see what kind of passwords we pull out of memory.
1098650	1104690	If your Windows endpoints are not hardened, you'll usually be
1104690	1111950	able to pull out the hashes and often clear text passwords from
1111950	1115390	any account that has recently logged into that machine. So
1115390	1118830	it can be quite eye opening to to see that and see these
1118830	1122430	passwords coming through in clear text using Mimi Cats. So
1122430	1127330	it's something we we recommend that our customers do in a safe
1127330	1131790	and safe manner. And even just copying the Mimi Cats
1131790	1135450	executable into one of your ICS assets just to see if it gets
1135450	1138870	caught by Windows Defender or Norton AV and, and to see if
1138870	1143330	that alert makes it someplace to see if you know the your
1144950	1148910	monitoring is set up properly. It should create alerts, it
1148910	1151290	should set off all kinds of alarm bells. So it's a great way
1151290	1158590	of testing your, your monitoring, or malicious files
1158590	1163830	in your ICS network. Here's another example of another tool
1163830	1168010	the FireEye Session Gopher, it looks for passwords and other
1168010	1174270	tools like WinSCP and PuTTY and RDP, like your stored passwords
1174270	1179990	in your remote desktop client. So it'll pull out clear passwords
1179990	1183070	like we see in this example below. And this can be very
1183070	1186670	valuable to an adversary who's looking to move laterally or
1186670	1189890	escalate their privilege in the network. And we almost always,
1189890	1193290	always find credentials when we're doing these assessments.
1193290	1196350	One way or another, there's there's always, almost always
1196870	1201410	poor storage of these credentials. So another thing
1201410	1206330	that can help address that credential storage issue is some
1206950	1211210	basic Windows system hardening. It's a very common issue that we
1211210	1214850	see where a lot of these ICS Windows assets, they haven't
1214850	1218290	performed any hardening. Often we find things like the firewall
1218290	1222630	is completely turned off on these Windows endpoints. Just
1222630	1229170	because these ICS networks are so sensitive at times, once the
1229170	1233690	operators or the system integrators get things working,
1233690	1236350	they're afraid to change anything or lock anything down
1236350	1241590	in case it breaks something. So usually, once they get things
1241590	1245410	working, they just kind of leave it as is. And it's rare to find
1245410	1249190	any system hardening really performed. And without some
1249190	1253070	basic Windows system hardening, it's so easy to cut through
1253070	1257350	those networks as an adversary. The default Windows
1258270	1261990	installation, especially Windows 7 and older Windows versions,
1261990	1267390	there's just so many backwards compatibility features that are
1267390	1270670	turned on that make it so easy to pull passwords, escalate
1270670	1275950	privilege to a system that once you're in that network, you can
1276480	1280510	own it within a matter of minutes without some system
1280510	1301040	hardening happening. Oops, looks like my internet connection had
1301120	1304340	a bit of a blip there. I'll start that over. Now system
1304340	1308140	hardening does have the potential to create an operational
1308140	1311820	or introduce operational risk, you'll need to work closely with
1311820	1315480	your vendor to ensure that any hardening you're doing won't
1315480	1320840	impact your operating process. Often, the major vendors will
1320840	1325220	have system hardening guides that you can follow, and the
1325220	1331040	recommended hardening that they have tested and approved. So
1331040	1333420	it's important when you're building a new greenfield
1333420	1337020	system, when you're building an ICS system from the ground up
1337020	1341820	to ask them to implement these system hardening features to
1341820	1345880	turn security on. Because what we find is if you don't ask the
1345880	1347900	vendors or the system integrators to do these things,
1347900	1352540	it just doesn't happen. If you don't set that standard or make
1352540	1356800	that request, they're not going to do it. So it's very important
1356800	1360540	to be clear that you want the systems hardened, they need to
1360540	1364360	be part of their commissioning plan, part of their site
1364360	1367320	acceptance testing or factory acceptance testing checklist,
1367320	1371960	that these hardening features are turned on and the
1371960	1374700	recommended best practices for system hardening for that vendor
1374700	1379420	have been implemented. And if the vendor does not, if they're
1379420	1384380	not very mature, and they don't have a hardening guide, you can
1385840	1390860	you can use some of the tools like some of the ones I've
1390860	1393600	listed here, like CHAPS, the configuration hardening
1393600	1399240	assessment, PowerShell script from Cutaway Security, to
1399240	1403460	identify some of the common hardening issues. And you can
1403460	1410040	raise those up with the vendor to get them approved or ensure
1410040	1416380	that they're on board with making these changes. But
1416380	1419280	there's other tools, Microsoft has a great tool called the
1419280	1421940	Security Compliance Toolkit, which does a very thorough
1421940	1424940	analysis, it does require you to install some software in your
1424940	1428160	ICS environments that could cause some issues with your
1428160	1431180	vendors, same with the CIS tools and the state tools, they do
1431180	1434980	require software to be installed in order to make them work. But
1434980	1437080	that's why I love the CHAPS tool, it's just a PowerShell
1437080	1439580	script you can run, it doesn't require any software to be
1439580	1444180	installed, it just will do some data collection on that endpoint
1444900	1449520	and highlight some of these common hardening issues. So
1449520	1451680	again, you have to work closely with the vendor when you're
1451680	1453780	running these things. But here's an example of the CHAPS
1453780	1462620	hardening demo in action. You can just run it as a PowerShell
1462620	1466600	command, like I've done above. And then it gives you sort of a
1466600	1471500	pass fail view, things like W digest DNS client, this, if you
1471500	1475440	implement these hardening recommendations, it will prevent
1475440	1479160	an adversary from being able to pull clear text passwords out of
1479160	1485200	memory, clear hashes out of memory. It'll prevent them from
1485200	1487860	downgrading to PowerShell 2 and bypassing a lot of the
1487860	1493180	PowerShell security features. So it also helps reduce the chances
1493180	1495740	of man-in-the-middle attacks and things like that in your ICS
1495740	1499720	network. So just a little bit of hardening and lockdown can have
1499840	1507900	a huge impact. So what we're seeing from a logging
1507900	1511820	perspective is usually a complete lack of logging, or no
1511820	1514520	centralized logging. Sometimes logging is turned on on the
1514520	1516640	Windows endpoints, but it's just not going anywhere. It's just
1516640	1521460	being stored locally. And if it is turned on and being centrally
1521460	1525660	managed, they're not always logging the right stuff. In
1525660	1528640	these ICS environments, they're not logging PowerShell commands
1528640	1532300	or, or new processes. They're not using things like sysmon to
1532300	1537120	really get the details you need to do proper forensic analysis
1537120	1541180	and incident response in these environments. And it's not hard
1541180	1546280	to do, it's not difficult to turn these, these things on. And
1546280	1549820	again, that CHAPS tool can help you identify some of the common
1550400	1554060	logging issues that you may encounter and some of the things
1554060	1558580	you'll want to turn on in your ICS environments. And really
1558580	1562220	just having that centrally managed logging environment can
1562220	1567000	be such a huge win. If you ever are doing like an incident
1567000	1571560	response, you'll be so grateful to have that centrally managed
1571560	1574080	logging environment. And it's all built into Windows, you
1574080	1576180	don't need to have Splunk or anything like that. You can just
1576180	1580560	use Windows Event Forwarding to centrally manage those those
1580560	1583560	Windows events without having to spend any extra money. Just
1583560	1587900	having that those events all in one place can really facilitate
1587900	1592140	things like threat hunting, and can speed up incident response
1592140	1598320	and give you better visibility into your ICS network as well.
1598860	1603500	So what we recommend is understanding what your Windows
1603500	1607160	event logging capabilities are today, what's being logged,
1607160	1610520	what's not being logged, where is it going, and using again,
1610520	1615140	that CHAPS tool can help identify these issues. There's
1615140	1618460	really a pretty low operational risk. It may produce a little
1618460	1622060	more traffic on your network. But for most modern networks,
1622060	1629240	this shouldn't be a huge issue. Now here's the output of that
1629240	1633360	CHAPS tool again, that PowerShell script. And it can
1633360	1639420	show you some of the issues if you have the PowerShell task
1639420	1645680	scheduler, WinRM, WMI activity, all these different log files
1645680	1651460	are important to have turned on and have a larger log size and
1651460	1653080	ensure that they're being forwarded to a central
1653080	1656180	location. So the CHAPS tool can help identify a lot of these
1656180	1661580	common issues. So if you turn on the recommended logging from
1661580	1664980	CHAPS, it will make a big difference and reduce your risk
1664980	1671380	quite a bit. Now on to network visibility. Another common
1671380	1677120	issue that we see is, as a pen test or a red team, we're able
1677120	1681360	to operate within these ICS networks undetected. Once we're
1681360	1684500	in them, there's usually very little or no visibility. So we
1684500	1689760	can move about, move laterally, escalate privilege, take over
1689760	1696260	the domain without any alarm bells going off, and maintain
1696260	1703020	perpetual access as well. So what you can do is, if you don't
1703020	1706380	have network visibility today, you can start to lay that
1706380	1712440	foundation and start to see if you get the value out of it in a
1712440	1717820	low cost sort of introductory kind of method. First of all, if
1717820	1723400	you just identify the points in your network that you should be
1723400	1726560	monitoring, what switches you should be attaching or
1726560	1730700	configuring SPAN ports to, or better yet, purchase some
1730700	1734960	network TAPs and install them. And just having those, just
1734960	1738080	having them in your network that you can tap into to collect data
1738080	1742380	and collect PCAPs, it's extremely valuable in an incident
1742380	1745980	response, or it's extremely valuable in a threat hunting
1745980	1750700	exercise. So that can really enable your security operations
1750700	1755820	team to do a lot more, just knowing where to plug in. That's
1755820	1758420	the first step in getting that network visibility. And once you
1758420	1761120	have that, you can start to collect PCAPs and do some
1761120	1763680	analysis to better understand what's going on, what kind of
1763680	1766860	traffic you see in your network, what's normal. And then
1766860	1769460	you can start to use some, even some free tools that are
1769460	1774820	available, or commercial tools to perform analysis on those
1774820	1778920	PCAPs, or even install some hardware and software to do
1778920	1785320	continuous monitoring of that network traffic. And again, it's
1785400	1789800	a pretty low operational risk. You're connecting to SPAN ports
1791400	1796200	or TAPs. Now, ideally, we always recommend you use dedicated
1796200	1801700	TAPs, network TAPs rather than SPAN ports. SPAN ports, when
1801700	1804780	they're configured on a switch, there is a risk that that switch
1804780	1807400	can get kind of overloaded, especially if it's an older
1807400	1811460	piece of equipment. You should be monitoring the CPU usage of
1811460	1815340	those switches. Once you enable your SPAN port, if they're in
1815340	1821760	the 80% or 90% utilization, kind of threshold, you may want
1821760	1826580	to consider an alternate option, because that could just put it
1826580	1830520	over the edge and create a network outage. So you need to
1830520	1833280	need to be a little careful with that. But it shouldn't, it
1833280	1840940	typically doesn't cause too many issues to set up those SPAN
1840940	1844320	ports. But in some of the edge cases, it could create some or
1844320	1846560	introduce some operational risks. So something to be aware
1846560	1851780	of, something to watch. And of course, having visibility in
1851780	1855020	your network can improve your threat detection and threat
1855020	1859560	monitoring capability with the right tools and techniques and
1859560	1866340	procedures. So there are two free products that Dragos
1867040	1872240	provides. One of the free products is our old Cyber Lens
1872240	1876520	product, which is it's well suited for PCAP analysis. It was
1876520	1881060	really designed to just take a PCAP and help visualize what's
1881060	1886000	inside, specific to the ICS protocols and ICS content. It's
1886100	1889100	a great way to help you understand what assets are in
1889100	1892260	your network. That's a common challenge we see in the ICS
1892260	1896440	space. What do I have? What's on my network at any given time? So
1896440	1900320	Cyber Lens can help you identify those. And Sophia is designed
1900320	1906300	for more of the continuous monitoring. Sophia was the next
1906300	1909980	defense product that was commercially sold to customers
1909980	1913900	all around the world. And now it's available for free from the
1913900	1916580	Dragos website. So if you want just continuous asset
1916580	1919740	identification, monitoring just to know what's on your network
1919740	1922500	and have that updated perpetually, Sophia is a great
1922500	1926340	tool for doing that. And of course, there's commercial tools
1926340	1931480	you can use, like Network Miner to do analysis of PCAPs. That's
1931560	1936160	a very handy tool for digging into PCAP data. And of course,
1936160	1940120	the Dragos platform is our commercial product that does a
1940120	1948640	threat-based monitoring of ICS networks with playbooks and
1948640	1952660	feeds into our Intel with the latest activity groups that are
1952660	1957200	targeting these environments. So if you're ready, if you're
1957200	1962920	seeing the value in your network monitoring, then maybe a
1962920	1966180	commercial product is the next step for you. But it's always
1966180	1970000	nice to kind of learn to walk before you run, kind of identify
1970000	1974420	those spam ports and kind of ease your way into it to make
1974420	1978520	sure you really see the value and take full advantage of that
1978520	1986520	value of OT network monitoring. And of course, this is
1986520	1992820	something these self-checks, these common self-assessments
1992820	1998040	can be done regularly. And there's there's huge benefits to
1998040	2000420	taking ownership of these, just doing like some mini
2000420	2004120	assessments once a year, once every six months, just to see
2004120	2007720	what's on your network, look at how passwords are stored,
2007720	2014280	understand who the big accounts in your Active Directory
2014280	2017660	environment are, who the domain admins are, and who has access
2017660	2021560	to that. All these things should be done regularly. Once you
2021560	2024800	really take ownership of your industrial cybersecurity, of
2024800	2029560	your industrial cyber risk, you can make a big difference in
2029560	2033600	that risk reduction. You can start to address that. And it's
2033600	2038020	something that should be done on a regular basis, at a set
2038020	2041080	interval once a year, once every six months, because ICS
2041080	2044620	environments are quite dynamic, they do change. They're
2044620	2050240	constantly being modified and updated and maintained. So it's
2050240	2053740	good to do this on a regular basis. And it can be augmented
2053740	2057040	once you get into this self-check and you're covering
2057040	2060340	off a lot of the low hanging fruit. That's when you can bring
2060340	2064080	in a professional team to do an assessment. And then they'll get
2064080	2066760	to really dig into the interesting stuff, the stuff
2066760	2072460	that is uncommon and would require an adversary to dig a
2072460	2077800	little deeper, do more research, and have to sweat a little to
2077800	2083120	move through your network. And that's the end of my
2083120	2086160	presentation. Thank you so much for attending.