WEBVTT 00:02.640 --> 00:04.500 Hi, this is Austin Scott. 00:04.500 --> 00:09.700 And this is five quick wins for improving your ICS cybersecurity posture. 00:10.060 --> 00:16.200 I'm a Principal Industrial Penetration Tester as part of the Dragos Professional Services team. 00:16.200 --> 00:23.800 And I really see the world from the perspective as a pen tester, just like a hammer sees the world as a nail. 00:23.800 --> 00:27.980 I really see everything from an adversarial perspective. 00:27.980 --> 00:32.820 And that's the point of view we'll be taking in this presentation today. 00:33.220 --> 00:40.540 Really, we're looking for ways to make it more difficult for an adversary to move through an ICS environment. 00:40.540 --> 00:48.620 Now, my recommendations in and of themselves won't give you a bulletproof cybersecurity program or industrial cybersecurity program. 00:48.620 --> 00:52.940 But they will raise the bar for your security posture. 00:52.940 --> 01:00.540 Of course, there's a lot of other things involved in running an industrial cybersecurity program that are outside of the scope of this presentation. 01:00.540 --> 01:13.320 But in my presentation today, we're going to talk about a lot of the common things that as an industrial penetration tester, as an industrial cybersecurity assessment, practitioner, these are the things that we see over and over again. 01:13.320 --> 01:21.020 And a lot of them can be addressed fairly easily without a lot of capital or operational expenditure. 01:21.020 --> 01:29.540 So we'll talk about how to address some of these risks and what these common issues that we identify are. 01:29.540 --> 01:35.240 So a lot of this is based on the 2019 Dragos year in review report. 01:35.240 --> 01:40.980 We see a lot of these common issues as we do assessment after assessment. 01:40.980 --> 01:59.800 It's common to see things like limited visibility or credentials laying around or routable connections from your corporate environment into the ICS environment, and even ICS components directly accessible from the internet these days. 01:59.800 --> 02:04.080 So a lot of these common findings are highlighted in this year in review report. 02:04.080 --> 02:13.180 And we'll be talking about the top five and how to really address those or identify them in your own environment and remediate them. 02:14.400 --> 02:24.960 So we think it's important to take a threat-based approach when you're looking at risk in your industrial cybersecurity environment. 02:25.500 --> 02:32.180 Now within Dragos, we track a number of activity groups that target these environments. 02:32.220 --> 02:46.220 And this will be really done from the perspective of our own internal activity group called Kyberite, where we develop our ICS tactics and techniques, really based on a lot of the other activity groups that we see. 02:46.220 --> 02:57.640 So we try to do some threat emulation as we're working through these networks and use a lot of the common techniques that we see being used against ICS environments. 03:00.320 --> 03:06.980 And of course, tactics, techniques and procedures are part of the equation. 03:06.980 --> 03:11.900 But we find these really change depending on the environment that you have. 03:11.900 --> 03:28.860 And it's important to, of course, start with understanding what you have, whether you're running Windows Active Directory or Windows Workgroup, what kind of security controls you have, how the internet access works, how industrial vendors get in, what your firewall rules look like. 03:28.860 --> 03:49.060 Once you understand these basic environmental factors, and understand how they change the tactics and techniques of an activity group, that can really help you reduce your risk and understand where you need to invest your time and energy to mitigate some of these risks. 03:49.880 --> 04:00.240 Of course, if you if you study activity groups like Electrum and Xenotime, there are publicly known techniques that they have used against environments. 04:00.320 --> 04:06.420 And I certainly believe those techniques would change depending on what was available. 04:06.420 --> 04:19.860 As a pen tester, as an adversary, we're always very dynamic with our approach, we need to roll with the punches and adjust our techniques to align with the environment we're faced with. 04:19.880 --> 04:29.920 So that's why it's not one size fits all, you can't take all these TTPs that are identified and directly apply them to your environment necessarily. 04:31.300 --> 04:38.240 Often the environment dictates what the TTPs are going to be used, which TTPs are going to be used. 04:39.540 --> 04:47.100 So during this presentation, we'll be talking about our top five ICS assessment findings for 2019. 04:47.160 --> 04:53.820 These are related to firewall rules, access management, system hardening, logging and network visibility. 04:53.820 --> 05:15.800 So we'll be talking about some of the tools that we use as penetration testers and ICS network assessment professionals, some of the tools that can be used safely in ICS environments without introducing operational risk or very, at the very least, minimal operational risk when they are being leveraged in these environments, 05:15.800 --> 05:23.360 how to identify these risks using these tools, and then also how to mitigate some of these common findings. 05:23.860 --> 05:35.320 So at the end of the day, if you're able to take ownership of your industrial cybersecurity posture, do some self assessment work. 05:35.540 --> 05:46.160 It's not difficult to do once you understand what tools are available and how to approach some of these problems and highlight some of these problems. 05:46.160 --> 05:59.060 If you're able to mitigate a lot of these common issues, even prior to doing another assessment, it allows that red team or that penetration testing team or that assessment team to really focus on the more interesting problems. 05:59.060 --> 06:01.780 So you're getting rid of all the low hanging fruit. 06:01.840 --> 06:09.520 So the adversary group has to dig a lot deeper and focus on some of the more challenging problems. 06:10.540 --> 06:25.140 And you're also raising the bar like when you when you address a lot of these low hanging fruit, a lot of these low level issues, it really reduces the playbook that the adversary can can use. 06:25.340 --> 06:37.240 They're not able to fall back on their normal, normal operating plans, they need to think outside the box a little more, they need to experiment more, do more reconnaissance. 06:37.300 --> 06:45.360 And whenever they do that, when they have to work harder, you have more opportunities to detect them, you have more opportunities to stop them. 06:45.600 --> 06:52.440 And and also you make their lives a lot more difficult, which is, you know, something you want to do. 06:52.440 --> 07:14.260 You want these, these adversaries who are targeting critical infrastructure, who are trying to turn the lights off in your in your town or, or impact these important industrial processes, you want them to have to lay in bed at night, questioning their life choices that brought them to that position of why they're targeting civilian infrastructure. 07:15.000 --> 07:25.940 So starting off with firewall rules, what we see when we do these assessments, often will ask for the the rules to be shared with us. 07:26.200 --> 07:29.920 Usually like a white box approach is best. 07:30.000 --> 07:39.600 When we're doing ICS assessments, we really need to be transparent with the operating operators, the sites, and the site personnel. 07:39.600 --> 07:44.980 Turns out, industrial asset owners and industrial operators don't like surprises. 07:44.980 --> 07:54.280 So we found that it's very important to be open and clear with what we're doing, whenever we're doing it within these ICS assessments. 07:54.600 --> 08:16.660 The more information we can share, the more we can work closely with the operations team and start to build that trust and that build that bridge between the cybersecurity team and the OT or the ICS operations team, which is which is so important to be successful in this environment. 08:16.800 --> 08:24.080 So when we ask for these firewall rules, we'll usually use a tool to make sense of them. 08:24.400 --> 08:31.080 There's dozens of different firewalls out there and they all provide their rules in different formats. 08:31.180 --> 08:41.540 Fortunately, there are some commercial tools that you can use and even some free tools you can use to make sense of these rules and work through them in more of an Excel spreadsheet kind of format. 08:41.540 --> 08:47.280 One free tool we like to use is the SolarWinds free firewall browser. 08:47.680 --> 08:58.200 So what you can do is export your firewall rules and then import them using this SolarWinds free firewall browser and then just go kind of line by line. 08:58.200 --> 09:08.620 What you're really looking for is interactive protocols that allow remote access between your different trust zones. 09:08.620 --> 09:15.850 So typically between your corporate network and your ICS network, or even between different trust zones within the ICS network. 09:16.430 --> 09:36.950 You're looking for SSH, Telnet, remote desktop, VNC, even things like WMI or remote management, RPC, SMB, even protocols like OPC, like OPCDA, the older OPC protocols can allow remote access and often do. 09:38.370 --> 09:57.090 So we often find there are temporary firewall rules still in these configurations from the time of commissioning, we find there's vendor dictated rules and vendor access rules that have never really been evaluated or questioned. 09:57.090 --> 10:00.250 So it's important to go line by line and really question why do we have this? 10:00.250 --> 10:01.650 Like what, what purpose does it serve? 10:01.650 --> 10:02.830 Who's using this? 10:02.830 --> 10:09.290 And to knock off as many of those temporary or vendor dictated rules as you can. 10:09.290 --> 10:28.970 Of course, you want to communicate with your vendor, if that vendor is using that for remote access, you want to identify those and make sure they are still able to access or maybe propose a more secure method if the method that you're using is introducing risk in your environment. 10:29.310 --> 10:33.330 So this is what the free firewall browser looks like. 10:33.330 --> 10:38.670 It just breaks down the rules line by line in sort of an Excel spreadsheet format. 10:38.670 --> 10:46.330 And you can see we've got a couple interesting interactive rules here on 3389, which is the remote desktop protocol. 10:46.330 --> 10:50.630 So things to watch out for when you're going through these assessments. 10:50.630 --> 10:57.110 There's commercial tools you can use as well like Nipper that can help you identify issues. 10:57.110 --> 11:02.710 Often we still find any rules or what's equivalent to any rules. 11:02.710 --> 11:05.490 Sometimes these firewall rules can get quite complicated. 11:05.550 --> 11:12.070 And you put enough rules overlapping on top of each other and it can basically equate to any rule. 11:12.070 --> 11:19.930 So it's important to study these firewall rules closely and identify opportunities to pivot through these different trust zones. 11:20.270 --> 11:26.650 Now another common issue that we run into is access management. 11:26.650 --> 11:50.590 And what we really find is it's not necessary most of the time to use any exploits or have to dig too deep in these ICS networks to pivot or escalate privilege because the access management is so poor in these environments. 11:50.590 --> 11:59.110 Often we'll run into shared Active Directory environments between corporate and the ICS. 11:59.110 --> 12:08.210 So once we take that corporate Active Directory environment, we're able to easily pivot and take full control over the ICS environment. 12:08.210 --> 12:17.970 Other situations where there is a dedicated Active Directory environment in the ICS, it's poorly maintained and hasn't really been configured properly. 12:17.970 --> 12:24.170 So usually we see almost everybody's a domain admin or there's lots of service accounts that are domain admins. 12:24.170 --> 12:29.610 Lots of these common issues in Active Directory that we run into. 12:29.610 --> 12:30.650 So what do you do? 12:30.650 --> 12:32.690 How do you identify these issues? 12:32.690 --> 12:37.050 Well, what we typically do is run a tool called Bloodhound. 12:37.050 --> 12:49.830 Now it's a free open source tool and it's been used by pen testing teams and red teams to unravel the yarn ball that is Active Directory . 12:49.830 --> 13:05.490 For years, Active Directory kind of experienced this security through obscurity where it's so complicated that even the adversaries couldn't really figure out all of the groups and groups and users and groups and how all those unwind to different permission levels. 13:05.490 --> 13:25.890 But with the introduction of Bloodhound, this tool uses graph theory to really map out what the implications of all these permissions are, how to unravel all these groups to determine who's really a domain admin and how you can pivot from the average user to domain admin fairly easily. 13:25.890 --> 13:31.970 So it shows you all these different paths and overprivileged accounts that you can identify and potentially lock down. 13:31.970 --> 13:33.610 And it's fairly safe, too. 13:33.610 --> 13:39.690 There's a very low operational risk because it only communicates with the Active Directory server in the network. 13:39.690 --> 13:43.850 It's not going to scan your network or hit all the PLCs in your network or anything like that. 13:43.850 --> 13:47.810 It's only going to communicate with the Active Directory environment. 13:47.950 --> 13:52.510 And it's only going to send LDAP requests, which are fairly normal. 13:52.510 --> 14:00.670 It's just the same kind of network activity that you would introduce if you were logging into a machine or remote desktoping into a machine. 14:00.670 --> 14:04.030 It's nothing unusual for that environment. 14:04.030 --> 14:13.590 There's certainly a big spike of LDAP when you use that tool, but it's nothing that would create an operational risk in that environment. 14:14.310 --> 14:16.490 So what does that look like? 14:16.490 --> 14:23.690 So here's an example of Bloodhound unraveling a path to the domain admin from this RTAM user. 14:23.690 --> 14:30.090 We can see he's a member of this group that's an administrator on this machine. 14:30.210 --> 14:54.830 And because they're an admin on this machine, they're able to gain access to potentially the password or the hash of this user who is also logged into this machine, and then use that user's privilege to gain domain administrator access in that network. 14:54.990 --> 15:02.810 So this can really make sense of Active Directory and help identify some of those common issues and common misconfigurations. 15:03.130 --> 15:05.090 So access management part two. 15:05.090 --> 15:06.950 So what if you don't have Active Directory? 15:06.950 --> 15:11.690 What if it's a Windows work group environment, which is also fairly common to see in ICS? 15:11.690 --> 15:19.850 And even if you do have Active Directory, there's other passwords that exist outside of Active Directory within these ICS networks. 15:19.850 --> 15:28.670 So I'm talking about things like VNC and SSH, credentials into switchgear, networkgear, stuff like that. 15:28.750 --> 15:38.190 There's usually passwords just laying around the network and Excel spreadsheets or notepad files or default credentials for a lot of devices. 15:38.190 --> 15:51.230 Often we find credentials are stored in things like Chrome or stored in things like Putty or WinSCP or BatchPatch, or other other tools like that. 15:51.230 --> 16:00.990 And when you when you click that option to save your username and password in these tools, these tools don't always securely manage those credentials. 16:00.990 --> 16:06.750 So it can be quite trivial for an attacker to pull out those stored credentials. 16:07.330 --> 16:27.230 So what you can do is leverage some of these client side tools, like Session Gopher that are free, Session Gopher from FireEye, or even performing things like an LSAS dump, or using tools like Mimi Cats, Mimi Kittens, and some of these Nirsoft password utils. 16:27.230 --> 16:30.970 Now Mimi Cats is it's something that's used by almost every activity group. 16:30.970 --> 16:40.910 Once these activity groups get a foothold in an environment, one of the first things they do is dump their post exploitation tools. 16:40.910 --> 16:47.450 A lot of those are just trying to find passwords to escalate privilege and move laterally in that environment. 16:47.450 --> 16:52.990 So you want to try to understand how you're storing your passwords, what passwords are stored on different endpoints. 16:52.990 --> 16:57.530 And you can automate that process just like the activity groups typically do. 16:58.290 --> 17:29.030 So what can you do once you've identified the issues or the mis-storage of passwords, you can implement some kind of password storage mechanism, or a privileged access management system, or even just like a vault , or a last pass, or some password vault solution that does a better job protecting these important credentials than WinSCP , 17:29.030 --> 17:32.290 or Putty, or other tools typically do. 17:33.270 --> 17:36.850 So here's a quick example of running Mimi Cats. 17:36.850 --> 17:38.270 And it's something I'd recommend. 17:39.910 --> 17:50.950 It's something we always try to do on a safe environment, running Mimi Cats, just to see if it's detected, if it triggers any kind of alerts. 17:50.950 --> 17:58.930 If we're able to do like what we're doing here, dump the LSAS memory to a file. 17:58.930 --> 18:18.650 So if we dump the LSAS memory using the task manager, just right click on the local security authority process and go create dump file, we can copy that dump file off of the machine and run it through Mimi Cats to see what kind of passwords we pull out of memory. 18:18.650 --> 18:35.130 If your Windows endpoints are not hardened, you'll usually be able to pull out the hashes and often clear text passwords from any account that has recently logged into that machine. 18:35.130 --> 18:42.390 So it can be quite eye opening to to see that and see these passwords coming through in clear text using Mimi Cats. 18:42.390 --> 18:49.050 So it's something we we recommend that our customers do in a safe and safe manner. 18:49.330 --> 19:07.170 And even just copying the Mimi Cats executable into one of your ICS assets just to see if it gets caught by Windows Defender or Norton AV and, and to see if that alert makes it someplace to see if you know the your monitoring is set up properly. 19:07.510 --> 19:10.710 It should create alerts, it should set off all kinds of alarm bells. 19:10.710 --> 19:20.170 So it's a great way of testing your, your monitoring, or malicious files in your ICS network. 19:21.750 --> 19:37.010 Here's another example of another tool the FireEye Session Gopher, it looks for passwords and other tools like WinSCP and PuTTY and RDP, like your stored passwords in your remote desktop client. 19:37.590 --> 19:42.390 So it'll pull out clear passwords like we see in this example below. 19:42.390 --> 19:48.850 And this can be very valuable to an adversary who's looking to move laterally or escalate their privilege in the network. 19:48.850 --> 19:53.290 And we almost always, always find credentials when we're doing these assessments. 19:53.290 --> 19:58.690 One way or another, there's there's always, almost always poor storage of these credentials. 20:00.430 --> 20:09.610 So another thing that can help address that credential storage issue is some basic Windows system hardening. 20:09.790 --> 20:16.490 It's a very common issue that we see where a lot of these ICS Windows assets, they haven't performed any hardening. 20:16.490 --> 20:21.290 Often we find things like the firewall is completely turned off on these Windows endpoints. 20:22.030 --> 20:37.750 Just because these ICS networks are so sensitive at times, once the operators or the system integrators get things working, they're afraid to change anything or lock anything down in case it breaks something. 20:37.750 --> 20:43.750 So usually, once they get things working, they just kind of leave it as is. 20:43.750 --> 20:47.470 And it's rare to find any system hardening really performed. 20:47.490 --> 20:55.390 And without some basic Windows system hardening, it's so easy to cut through those networks as an adversary. 20:55.850 --> 21:15.530 The default Windows installation, especially Windows 7 and older Windows versions, there's just so many backwards compatibility features that are turned on that make it so easy to pull passwords, escalate privilege to a system that once you're in that network, 21:15.530 --> 21:21.830 you can own it within a matter of minutes without some system hardening happening. 21:38.920 --> 21:42.180 Oops, looks like my internet connection had a bit of a blip there. 21:42.180 --> 21:43.600 I'll start that over. 21:43.620 --> 21:58.500 Now system hardening does have the potential to create an operational or introduce operational risk, you'll need to work closely with your vendor to ensure that any hardening you're doing won't impact your operating process. 21:58.580 --> 22:10.420 Often, the major vendors will have system hardening guides that you can follow, and the recommended hardening that they have tested and approved. 22:10.420 --> 22:23.080 So it's important when you're building a new greenfield system, when you're building an ICS system from the ground up to ask them to implement these system hardening features to turn security on. 22:23.080 --> 22:29.940 Because what we find is if you don't ask the vendors or the system integrators to do these things, it just doesn't happen. 22:30.080 --> 22:35.820 If you don't set that standard or make that request, they're not going to do it. 22:36.180 --> 22:56.260 So it's very important to be clear that you want the systems hardened, they need to be part of their commissioning plan, part of their site acceptance testing or factory acceptance testing checklist, that these hardening features are turned on and the recommended best practices for system hardening for that vendor have been implemented. 22:56.640 --> 23:18.260 And if the vendor does not, if they're not very mature, and they don't have a hardening guide, you can you can use some of the tools like some of the ones I've listed here, like CHAPS, the configuration hardening assessment, PowerShell script from Cutaway Security, 23:18.260 --> 23:22.160 to identify some of the common hardening issues. 23:22.160 --> 23:34.740 And you can raise those up with the vendor to get them approved or ensure that they're on board with making these changes. 23:35.820 --> 23:50.660 But there's other tools, Microsoft has a great tool called the Security Compliance Toolkit, which does a very thorough analysis, it does require you to install some software in your ICS environments that could cause some issues with your vendors, same with the CIS tools and the state tools, 23:50.660 --> 23:54.480 they do require software to be installed in order to make them work. 23:54.600 --> 24:08.060 But that's why I love the CHAPS tool, it's just a PowerShell script you can run, it doesn't require any software to be installed, it just will do some data collection on that endpoint and highlight some of these common hardening issues. 24:09.220 --> 24:12.280 So again, you have to work closely with the vendor when you're running these things. 24:12.280 --> 24:17.080 But here's an example of the CHAPS hardening demo in action. 24:19.600 --> 24:24.660 You can just run it as a PowerShell command, like I've done above. 24:24.660 --> 24:42.700 And then it gives you sort of a pass fail view, things like W digest DNS client, this, if you implement these hardening recommendations, it will prevent an adversary from being able to pull clear text passwords out of memory, clear hashes out of memory. 24:43.660 --> 24:49.880 It'll prevent them from downgrading to PowerShell 2 and bypassing a lot of the PowerShell security features. 24:50.020 --> 24:56.120 So it also helps reduce the chances of man-in-the-middle attacks and things like that in your ICS network. 24:56.120 --> 25:01.040 So just a little bit of hardening and lockdown can have a huge impact. 25:02.740 --> 25:13.100 So what we're seeing from a logging perspective is usually a complete lack of logging, or no centralized logging. 25:13.100 --> 25:16.460 Sometimes logging is turned on on the Windows endpoints, but it's just not going anywhere. 25:16.460 --> 25:18.380 It's just being stored locally. 25:18.800 --> 25:25.120 And if it is turned on and being centrally managed, they're not always logging the right stuff. 25:25.140 --> 25:30.280 In these ICS environments, they're not logging PowerShell commands or, or new processes. 25:30.360 --> 25:39.900 They're not using things like sysmon to really get the details you need to do proper forensic analysis and incident response in these environments. 25:40.340 --> 25:45.980 And it's not hard to do, it's not difficult to turn these, these things on. 25:46.040 --> 25:58.020 And again, that CHAPS tool can help you identify some of the common logging issues that you may encounter and some of the things you'll want to turn on in your ICS environments. 25:58.120 --> 26:04.760 And really just having that centrally managed logging environment can be such a huge win. 26:05.060 --> 26:13.060 If you ever are doing like an incident response, you'll be so grateful to have that centrally managed logging environment. 26:13.060 --> 26:15.860 And it's all built into Windows, you don't need to have Splunk or anything like that. 26:15.860 --> 26:23.340 You can just use Windows Event Forwarding to centrally manage those those Windows events without having to spend any extra money. 26:23.340 --> 26:38.320 Just having that those events all in one place can really facilitate things like threat hunting, and can speed up incident response and give you better visibility into your ICS network as well. 26:38.860 --> 26:54.880 So what we recommend is understanding what your Windows event logging capabilities are today, what's being logged, what's not being logged, where is it going, and using again, that CHAPS tool can help identify these issues. 26:54.880 --> 26:57.320 There's really a pretty low operational risk. 26:57.320 --> 26:59.880 It may produce a little more traffic on your network. 26:59.880 --> 27:05.700 But for most modern networks, this shouldn't be a huge issue. 27:07.100 --> 27:11.720 Now here's the output of that CHAPS tool again, that PowerShell script. 27:11.720 --> 27:33.800 And it can show you some of the issues if you have the PowerShell task scheduler, WinRM, WMI activity, all these different log files are important to have turned on and have a larger log size and ensure that they're being forwarded to a central location. 27:33.800 --> 27:37.660 So the CHAPS tool can help identify a lot of these common issues. 27:37.880 --> 27:46.620 So if you turn on the recommended logging from CHAPS, it will make a big difference and reduce your risk quite a bit. 27:48.120 --> 27:50.580 Now on to network visibility. 27:50.640 --> 28:00.500 Another common issue that we see is, as a pen test or a red team, we're able to operate within these ICS networks undetected. 28:00.580 --> 28:04.300 Once we're in them, there's usually very little or no visibility. 28:04.300 --> 28:18.340 So we can move about, move laterally, escalate privilege, take over the domain without any alarm bells going off, and maintain perpetual access as well. 28:19.000 --> 28:36.380 So what you can do is, if you don't have network visibility today, you can start to lay that foundation and start to see if you get the value out of it in a low cost sort of introductory kind of method. 28:36.780 --> 28:52.100 First of all, if you just identify the points in your network that you should be monitoring , what switches you should be attaching or configuring SPAN ports to, or better yet, purchase some network TAPs and install them. 28:52.100 --> 29:06.960 And just having those, just having them in your network that you can tap into to collect data and collect PCAPs, it's extremely valuable in an incident response, or it's extremely valuable in a threat hunting exercise. 29:07.060 --> 29:15.460 So that can really enable your security operations team to do a lot more, just knowing where to plug in. 29:15.460 --> 29:18.040 That's the first step in getting that network visibility. 29:18.040 --> 29:26.220 And once you have that, you can start to collect PCAPs and do some analysis to better understand what's going on, what kind of traffic you see in your network, what's normal. 29:26.380 --> 29:44.220 And then you can start to use some, even some free tools that are available, or commercial tools to perform analysis on those PCAPs, or even install some hardware and software to do continuous monitoring of that network traffic. 29:44.700 --> 29:47.500 And again, it's a pretty low operational risk. 29:47.660 --> 29:52.680 You're connecting to SPAN ports or TAPs. 29:52.680 --> 29:59.500 Now, ideally, we always recommend you use dedicated TAPs, network TAPs rather than SPAN ports. 29:59.880 --> 30:08.580 SPAN ports, when they're configured on a switch, there is a risk that that switch can get kind of overloaded, especially if it's an older piece of equipment. 30:08.760 --> 30:12.220 You should be monitoring the CPU usage of those switches. 30:12.220 --> 30:29.500 Once you enable your SPAN port, if they're in the 80% or 90% utilization, kind of threshold, you may want to consider an alternate option, because that could just put it over the edge and create a network outage. 30:29.500 --> 30:32.000 So you need to need to be a little careful with that. 30:32.000 --> 30:41.300 But it shouldn't, it typically doesn't cause too many issues to set up those SPAN ports. 30:41.300 --> 30:45.760 But in some of the edge cases, it could create some or introduce some operational risks. 30:45.760 --> 30:48.720 So something to be aware of, something to watch. 30:49.720 --> 31:00.640 And of course, having visibility in your network can improve your threat detection and threat monitoring capability with the right tools and techniques and procedures. 31:01.260 --> 31:08.360 So there are two free products that Dragos provides. 31:08.460 --> 31:16.300 One of the free products is our old Cyber Lens product, which is it's well suited for PCAP analysis. 31:16.300 --> 31:25.820 It was really designed to just take a PCAP and help visualize what's inside, specific to the ICS protocols and ICS content. 31:25.820 --> 31:29.540 It's a great way to help you understand what assets are in your network. 31:29.680 --> 31:32.900 That's a common challenge we see in the ICS space. 31:32.900 --> 31:33.600 What do I have? 31:33.600 --> 31:36.280 What's on my network at any given time? 31:36.280 --> 31:38.600 So Cyber Lens can help you identify those. 31:38.860 --> 31:44.460 And Sophia is designed for more of the continuous monitoring. 31:44.460 --> 31:50.920 Sophia was the next defense product that was commercially sold to customers all around the world. 31:50.920 --> 31:54.660 And now it's available for free from the Dragos website. 31:54.660 --> 32:04.560 So if you want just continuous asset identification, monitoring just to know what's on your network and have that updated perpetually, Sophia is a great tool for doing that. 32:04.900 --> 32:11.420 And of course, there's commercial tools you can use, like Network Miner to do analysis of PCAPs. 32:11.420 --> 32:15.520 That's a very handy tool for digging into PCAP data. 32:15.520 --> 32:35.120 And of course, the Dragos platform is our commercial product that does a threat -based monitoring of ICS networks with playbooks and feeds into our Intel with the latest activity groups that are targeting these environments. 32:35.120 --> 32:45.520 So if you're ready, if you're seeing the value in your network monitoring, then maybe a commercial product is the next step for you. 32:45.520 --> 33:03.620 But it's always nice to kind of learn to walk before you run, kind of identify those spam ports and kind of ease your way into it to make sure you really see the value and take full advantage of that value of OT network monitoring. 33:05.320 --> 33:15.260 And of course, this is something these self-checks, these common self-assessments can be done regularly. 33:16.020 --> 33:35.600 And there's there's huge benefits to taking ownership of these, just doing like some mini assessments once a year, once every six months, just to see what's on your network, look at how passwords are stored, understand who the big accounts in your Active Directory environment are, 33:35.600 --> 33:38.180 who the domain admins are, and who has access to that. 33:38.180 --> 33:41.280 All these things should be done regularly. 33:41.280 --> 33:51.040 Once you really take ownership of your industrial cybersecurity, of your industrial cyber risk, you can make a big difference in that risk reduction. 33:51.040 --> 33:53.300 You can start to address that. 33:53.300 --> 34:03.880 And it's something that should be done on a regular basis, at a set interval once a year, once every six months, because ICS environments are quite dynamic, they do change. 34:04.060 --> 34:08.760 They're constantly being modified and updated and maintained. 34:08.760 --> 34:12.380 So it's good to do this on a regular basis. 34:12.440 --> 34:18.720 And it can be augmented once you get into this self-check and you're covering off a lot of the low hanging fruit. 34:18.780 --> 34:23.380 That's when you can bring in a professional team to do an assessment. 34:23.380 --> 34:38.960 And then they'll get to really dig into the interesting stuff, the stuff that is uncommon and would require an adversary to dig a little deeper, do more research, and have to sweat a little to move through your network. 34:41.200 --> 34:43.600 And that's the end of my presentation . 34:43.600 --> 34:46.160 Thank you so much for attending.