Hello and welcome back to the seventh year of the Industrial Control System Village,
the ICS Village at DEF CON. We're really excited this year because, one, we made it. This was a
more difficult year for us than past years because all of those ranges, all of that industrial
control system equipment that you've seen in the past, we had to figure out how to get it
completely virtualized for you. So I want to say thank you to Grim, who has been hosting a lot of
our equipment for us. New this year, besides everything being virtualized for access for
our CTF, the last two years our CTF, the winner, has won a black badge. So crossing our fingers,
we can pull that off for a third time. No guarantees. The Department of Homeland Security
CISA agency is going to be... they have some special range equipment that they have integrated into
a part of our CTF. So there's going to be a lot more fun and a lot more challenges this year.
We have a great lineup of speakers. One of the biggest things that we took advantage of this
year with the conference being completely virtual was reaching out to get a lot of international
speakers. So the kinds of folks that work in industrial control systems elsewhere in the world,
that would not typically be able to make the trip to Vegas. So a lot more variety in international
representation with the speakers. So really looking forward to that. Logistics for it this
year, obviously you know about everything that's going on Discord at DEF CON with the ICS Village
specific channels around that. Q&A will be done there. Some speakers will be doing Q&A for the
live sessions. So live speaker sessions, Q&A will be in Zoom. Otherwise you can meet with the speakers
in Discord. And check out and subscribe to our new channels in YouTube and Twitch, where we'll
be streaming everything live to you. Have a great DEF CON. Our keynote for this year is the director
of CISA, Chris Krebs, reflecting the continued collaboration between the agency and the Village
with bringing education and more equipment to the community. This DEF CON, we are kicking off
the first of many opportunities to bring real ICS to even more hackers to get to work with.
So without further ado, Chris Krebs with the ICS Village keynote for DEF CON.
Hey, hello out there. Welcome to DEF CON ICS Village Safe Mode. My name is Chris Krebs. I am
the director of the U.S. Cyber and Infrastructure Security Agency. Today I'm going to tell you a
little bit about what we've been doing over the last couple years, our approach to control systems,
but more broadly, not just our approach, the things we're doing working with you and the community to
improve control system cybersecurity out there across this great country and throughout the
world. So I think what I want to start with is tell you a little bit about who we are, CISA,
again, the Cyber and Infrastructure Security Agency, youngest federal agency
coming up on our second birthday here, and talk to you a little bit about the threat landscape as
we see it and tie it to a few actors out there that have been improving their capabilities.
And then stitch that all up into a story of the things that we've identified as important and how
we work with you and the rest of the ICS security community to actually achieve these objectives
that we're all working day in, day out towards. So that, yeah, CISA, almost two years old now.
We are a part of the Department of Homeland Security. We've been around in one way, shape,
or form since the creation of the department, but the U.S. Congress gave us the authority
to stand up as a separate operational component, like the Transportation Security Administration,
you normally would have had to deal with if we were in Vegas, like last year and ideally next
year. And FEMA, if you're paying attention to COVID or hurricane season, they're out in front.
So that's where we come in. We're CISA. We are the nation's risk advisor as we style ourselves.
But the concept here is to get an understanding of what the risk landscape looks like and how
it intersects with the nation's critical infrastructure across a number of different
lines of effort, but I tend to distill them down to five. First is traditional InfoSec.
We are the home of U.S. CERT, and we have been working some aspect of InfoSec for two plus
decades now. The second aspect or discipline is control system security. We are also home to ICS
CERT and have been in this game for quite some time with varying levels of investment and
capability, but we are fully committed to this mission. The third is supply chain security.
Lots of activity on the supply chain front over the last couple years, particularly since I've
been here, and really looking forward to building more capability and sight and maturity across the
supply chain risk management discipline. And the last two pieces, insider threat,
and this is more about that blending of close access operations, allowing an adversary into
your network or into your perimeter that they can then combine with other techniques to achieve
their objectives. And then lastly, physical security. So in this broader cybersecurity and
infrastructure security space, we're also out there day in, day out conducting physical security
assessments of facilities to help protect things like schools and hospitals right now,
and places of worship. Back when sports start up again at larger scale and you can actually go
attend the sporting event, assuming you like sports ball, we are out there helping the
facility owners and operators understand how to best secure their facilities. So that's kind of
the disciplines that we focus on. And we have a very different approach, I think, to engaging
our stakeholders, our customers, as it were, than you might find in other parts of the federal
government. They're usually persuasive hooks that agencies have, whether it's law enforcement
authorities, or it's regulatory authorities, or they have money, things like that. We're in a
public-private partnership business, and that's a kind of cliche thing to say, I think, certainly
over the last 15 plus years. But we spend a lot of time listening. So it's not that old, tired,
you know, we're from the government and we're here to help. It's more along the lines of,
we're from the government, we're here to listen. We want to understand what your problems are,
your challenges are, what your gaps are. We have certain advantages where, at the end of the day,
profit and revenue is not our prime objective. We have the ability to overcome places where there's
no legitimate business model for the private sector to chip in and contribute. So that's
kind of a sweet spot for us. And of course, there are other aspects here. We have access to
classified information. And when we know what the bad guys are trying to do, or, oh, I don't know,
actually doing, we're able to distill that down and bring partners into the fight to counter those
efforts. And so again, we're this public-private partnership, voluntary effort agency. I'm not
going to lie, it's tough. When you really have to work that extra bit to understand what a partner's
challenges are, and then go back and craft something that is going to help them, that takes
a lot more work than I think some of the other authorities that other agencies have. But in
a sense, it's also pretty darn easy if you listen the right way. If you listen to really what the
challenges and the gaps are in the critical infrastructure community, whether it's on the
Infosec side or the OT control system side, if you listen really hard, and you isolate the issue,
and you address the issue and deliver some value, it's a self-fulfilling prophecy in terms of your
ultimate success. So we, in a certain sense, are like the private sector, right? We're like an
organization that has to develop the capability, turn it, do the market research, pull together a
product lifecycle, have a team to deliver it to customers, and then have feedback and dial it in.
So we very much have that private sector mentality. In that philosophy, that approach is in part why
I'm here today, wherever here is. But that's why I'm here today. It's part of market research,
it's part of engaging a community and understanding what the challenges are and
how we can all work together to close out those gaps. And I honestly think,
which means I'm not lying to you right now, I guess, that right now, the threat landscape,
the bad guys out there doing bad things, is as active as I've ever seen it.
And that's not to say that the bad guys out there haven't been doing bad things for a long time.
2012, 2013, dating all the way back, we've seen, particularly in the control system space and the
hard infrastructure space, really dramatic adversary activity. So go back and look at
the 2019 Worldwide Threat Assessment. There's a very specific piece in there that talks about
Chinese capabilities to disrupt pipelines, cause localized outages. That goes back several years.
A couple years ago, the Russians, what we called at the time alien viper, but they absolutely
targeted energy infrastructure. They went through the supply chain, they went through contractors,
construction organizations in this case, they knew where they were wanting to go.
And they used a range of capabilities, a range of accesses to get there.
Even more recently, we, alongside the National Security Agency, issued an alert that was pretty
clear and pretty stark in the terms of, if you have OT systems that touch the internet,
you need to get them offline. You need to harden them. You need to protect them. You need to
install or implement better email security measures because what we found is flat, unsegmented
networks provides the adversary the ability to pivot off the business network into the OT networks.
Again, these are very, very active targets for the bad guys. It's only a matter of time, as I
think Dale Peterson said back in January down at S4, in an interview I did with him, that
ransomware will come to the control system space. It's a matter of time. Let's get there before them.
So our mindset has been going back to that general philosophy of the agency. How do we understand,
how do we build a community of practice here? We're not the ones building it, to be clear.
We want to be able to foster that community of practice. And so a year and a half or so ago now,
when we came out of a pretty historic, not pretty, but a historic shutdown of the U.S.
federal government, I laid out a series of priorities for this agency. First, half my
budget goes, if you haven't checked and you don't, who looks at the federal government budgets,
but half of my budget goes to federal cybersecurity. That's a big chunk of money, and so that's a top
priority for me. What else is a top priority for me? Election security. Looking forward to
participating, parts of my team participating in the voting village, DEFCON voting village as well.
We're also doing physical security, as I mentioned, for crowded places and soft targets. But I think
when we were sitting there as a team trying to identify the greatest areas for opportunity,
the greatest areas for community progress, two things immediately jumped to mind,
and they're related. Supply chain. Supply chain risk management is an untapped area
that we are putting a significant amount of effort behind. But the last piece of care,
of course, why I'm here today, industrial control systems. As I mentioned,
we are the home of ICS CERT. It's a game that we've been playing for quite some time,
and we are reinvigorating our partnerships, we're reinvigorating our investments,
bringing and building a fantastic team. And our overall objectives is to be able to stitch
together the U.S. government in support of industry and the control system security community.
Together. That's it. Together. We're just working on doing this together. And so coming out of that
shutdown, I challenged the team, said, tell me how we're going to do this. And of course,
federal government agencies is what we do. We build strategies, right? So in July, we released
our industrial control systems initiative, which is our strategy. It says, here are the things that
we are aiming to accomplish. Here's the main thrust of activity. Now, you didn't come here
today to hear me talk about a strategy about another federal government plan. Another, it's
actually pretty tight in terms of page count, but that's not why we're here. But I do need to lay out
what our objectives are and how we're going to do that. And then I'm going to tell you about
the mechanisms we're using and some of the key implementation priorities. And that'll give you
a sense of where we're going. Most importantly, how you can participate. Because together, to me,
means one thing. And I mentioned it earlier this year at the industrial control systems
joint working group that we had to do online, just like this. Our top line objective
is to democratize industrial control systems security efforts. And what that means is making
it open for everyone, bringing the community together. It's not about releasing products
and tools and services that only a handful can afford. It's not about restricting access. It's
about diversity. It's about inclusion. It's about democratizing security. That's what's
behind our strategy. So real quick, the philosophy behind the strategy is about empowering you,
empowering vendors and owners, operators, and integrators to make better risk management
decisions. It's about informing your investments. It's about integrating the U.S. government
and our partners in the intelligence community, Department of Defense and FBI. It's about
integrating our efforts into yours. It's about moving to a proactive industrial control systems
posture. And lastly, it's about driving towards a sustainable, long-lasting control systems
security community. That's the top line. All right. How are we doing this? Pillars. We got
four pillars. Every strategy's got to have pillars. We have four pillars. First pillar is
asking more of the community, but doing more for the community from the federal government
perspective as well. The second is advancing technology and the ability to secure our
systems. Not just tomorrow's systems, but we have to figure out how to continue to defend today's
deployments while thinking through the next generation and having more security baked in.
Secure by design, secure by deployment. The third piece is developing deep data capabilities
to better put our understanding of risks against the current deployments and
building frameworks, building resources and approaches that take advantage of just this
wealth of information we all have. Pull it all together and putting into meaningful frameworks.
MITRE continues to lead in this space with the industrial control systems framework. Those are
the types of activities and approaches that we look to be a part of. Not necessarily invent,
not own, we just want to be a part of this effort. And lastly, increasing that risk understanding
of the interdependencies that are out there so that we can drive smarter investments,
smarter solutions, smarter engagements between the government and industry to get to that
objective of democratizing control system security and making the environment safer and more secure.
So it's those four pillars that drive our approaches. So what the heck are our approaches?
Okay, this is the part that matters. The strategy is about what we're trying to do.
Our approaches are how you can work with us to achieve these objectives. So got a few things
that are worth talking about here. I already talked about one of them and that's the industrial
control system joint working group. This is what is now a twice a year, that's biannual, twice a year
now a virtual event, but it provides a free opportunity for anyone that's either getting
into the control systems game or is in a jurisdiction that doesn't have travel funds,
because those are always a challenge with, you know,
the old days conferences. How do you get the money to go to Vegas? How do you get the money to go to
Miami? The ICS JWG is about opening up a more inclusive environment so everyone can come
together and learn something, even if it's at the 101 level or the 10 whatever remedial is,
100 level, it doesn't matter. The point is we have the opportunity to bring more people
into this community and that's what we're working towards with the ICS JWG. We had our most recent
one in, I don't know, it was a month or so ago. We've got another one coming up in the fall.
So that's point one, ICS JWG. So back to that kind of integrating the federal government with the
community. We also have an effort called the Control Systems Interagency Working Group,
the CISIWG. Now, it says interagency, but don't take from that that it's just government. Again,
this is about bringing the executive leadership of the federal agencies that play in control systems
together with leaders from industry, from the research community, from the vendor space,
bringing everybody together and figuring out, okay, what are our opportunities,
our threats? It's really, in part, we're doing a SWOT analysis. How are we strong together?
Where are we weak together? What are our opportunities to work together? And then
what are the threats? So coming out of the last year or so work of the control systems
interagency working group, well, we figured a few things out. One is the government needs to be
more coordinated together. Everybody does some part of this game. How do we do it in a more
coordinated fashion? Well, one place we can really achieve, I think, some alignment and
advancements is in standards. So if we get all the federal government players together on standards
and working towards the same common purpose, we can really drive
the advancements we're looking for. Also, we can help work to build the workforce of the future.
Rather than doing bits and pieces here and there, let's have a collective approach to workforce and
a lot of credit to NIST and their efforts in job coding, creating clarity in messaging,
and hiring practices. So we have an opportunity there. And also on the investment alignment. So
R&D, lots of different R&D efforts across the federal government. We should have a more unified
R&D agenda that can get better uses out of our investments, maybe eliminate some
duplication or redundancy in efforts. Always a good thing. Maybe put those saved dollars
towards another effort. And then lastly, working towards a more unified, streamlined,
coherent, and value-added incident response approach within the USG. And in part,
what we want to do with this is make sure that we're taking the relevant information out of an
incident response effort and sharing that information back out in a protected way for
the victim. We're not in the business of re-victimizing a victim. But to the extent
that we can extract insights from single or multiple incident responses, that's a good thing.
And that's something that we've done recently. In fact, in the oil and natural gas sector,
we issued an alert earlier this year. Now, we're not perfect yet. We're still working at this.
But your feedback on all of our control systems products is always welcome. So go to cissa.gov,
c-i-s-a.gov. Check out our control systems page and all of the products we have there, the alerts,
the guidance, the advisories. Let us know where we're hitting the mark. Let us know what else we
need to do. And then work with us through the Industrial Control Systems Joint Working Group.
There are a few other things that are worth highlighting, particularly since we're doing
this DEFCON safe mode thing, something you'll hear about. And that got kicked off last year,
rather earlier this year, down in Miami, ICS for ICS, Industrial Control Systems for Incident
Command System. Not sure if everybody knows what the Incident Command System is, but it's what the
physical emergency responders use to coordinate their efforts, whether it's a hurricane, a
wildfire. It's actually the firefighters out in California, the fire service, they're the ones
that develop the Incident Command System. But it's got a great application for physical disasters.
But I bet if we ever have one of those big time, larger scale, physical or cyber-enabled
physical event, guess who's going to show up? The fire department, the emergency managers,
state and local officials. There's absolutely a role in control system security and incident
response for state and locals. But they also recognize, we recognize, that there are roles
for the security community. So what we've got to be able to do is develop those frameworks,
develop the frameworks that put everybody together, clarity of roles and responsibilities.
So a lot of credit to Megan Sanford for her work there, and ICS for ICS,
and looking forward to continuing to contribute to that effort.
And of course, the best for last here, ICS Village. This year, we were proud to partner
with the ICS Village. A lot of credit and thanks goes to Bryson Borg for his efforts.
But the idea is we can do more together. That's why we're here. That's why you're seeing
the feds show up at DEF CON, even if it's virtually. We were there last year,
but we look forward to really growing out this and building out this partnership with the ICS
Village and other villages. We're doing that in a couple ways. This year, we've got our
Control Environment Laboratory Resource, or CELER, that is going to give simulated environments so
that everybody can walk through a couple different scenarios, work on your blue team skills,
and run some incident response. This is an effort that we think, again,
plays to that democratizing industrial control systems. It's been a long day.
Industrial control systems security. Again, democratizing, making it more open. If we can
pull more resources out of the National Capital Region, out of specific locations out west,
and then make them broadly available virtually, good for everyone. If we can put things on wheels
and drive them around to various parts of the country, again, these are good things. That's
what we're trying to accomplish here. A control systems ecosystem, security ecosystem, that is
open and accessible to everyone. Whether you're in the private sector or you're a municipal water
facility, everyone's got requirements. We have to be able to do this together.
So the last thing I'll talk about before wrapping this one up is our role in vulnerability management.
This has been hell year, I think, for the vulnerability managers out there. Six months
of week after week of big vuln after big vuln. I was thinking at some point it's almost a race
to the bottom, because think about it, you drop one vulnerability and somebody's probably going
to drop one next week, and so you've got tops of seven days in the new cycle. But it's really
stressing the teams that historically we haven't invested too much in. The vulnerability management
side is one of the most important teams within any organization. We play a key role here in
coordinating vulnerability disclosure. We fund and support the CERT Coordination Center, CERT-CC,
up at Carnegie Mellon. We also fund the National Vulnerability Database
at NIST. So between the CERT-CC CVE process and the National Vulnerability Database,
two key resources for any network defendant or any vulnerability manager of understanding
what's new, what's coming, and how do you defend against it. We also play a role again through that
CERT-CC process where the private sector or a security researcher rather, if they identify
something, we can help facilitate the conversation between the appropriate vendor. Now sometimes we
don't need to play a role. In fact, we encourage programs, we encourage vendors to have vulnerability
disclosure programs, to have as needed bug bounty programs. Again, have a healthy, vibrant
ability to engage with the security researcher where you don't need the government,
even if it's just fostering or facilitating a protected conversation. But that's not always
how things are right now. That's not where some organizations are in their maturity
of their own vulnerability disclosure practices. So we play a vital role. Last year, calendar year
19, we processed and managed through our CBE process, 11,500 plus vulnerabilities. I think
based on this year, we're probably going to exceed that. But that's a role we are happy to play.
Again, we are going to continue to issue advice and guidance to organizations of all sizes and
stripes. Guidance on how they can set up their own vulnerability disclosure programs. Just last
week, we issued some guidance to our partners in the state and local election community about how
they can set up vulnerability disclosure programs for their systems. And so it's not just about the
code, the software they're coding or whatever. It's their implementations. If you find a vulnerability
in a voter registration database, please, you know, first off, if you own that database,
you need a process. But if you find that vulnerability, you need a way to report it
in a coordinated manner so it can get closed out so that it's closed out before the bad guys get
there. So vulnerability management is exactly where we are going to continue investing more
broadly in the InfoSec space. And in fact, little known fact, this was supposed to be the year of
vulnerability management. That was a theme we had. Little did we know that it was again, it was going
to be vulnerability management hell year. But here we are. We're here. We're part of the team. Let us
know what help you need. So I'm going to wrap this one up right now. Again, CISA is here as an advisor,
as a partner, as a friend. Our objective, again, top line, democratizing industrial control system
security at all levels. I don't care where you are. We want to work with you. We are here to
provide support, resources, technical assistance, and the information you need to be able to protect
your systems. But ultimately, it's not just about defending today's deployments. We've got to make
sure that tomorrow's deployments are secure by design, secure by deployment. So with that, I'm
going to wrap up these remarks, and I'm going to jump in a time machine, and I'm going to have a
costume change and all that, and I think we're going to do some live Q&A. Thanks.