start	end	text
0	6600	Hello and welcome back to the seventh year of the Industrial Control System Village,
6600	15000	the ICS Village at DEF CON. We're really excited this year because, one, we made it. This was a
15000	20640	more difficult year for us than past years because all of those ranges, all of that industrial
20640	24700	control system equipment that you've seen in the past, we had to figure out how to get it
24700	31860	completely virtualized for you. So I want to say thank you to Grim, who has been hosting a lot of
31860	38640	our equipment for us. New this year, besides everything being virtualized for access for
38640	44840	our CTF, the last two years our CTF, the winner, has won a black badge. So crossing our fingers,
44840	52860	we can pull that off for a third time. No guarantees. The Department of Homeland Security
52860	61080	CISA agency is going to be... they have some special range equipment that they have integrated into
61440	67380	a part of our CTF. So there's going to be a lot more fun and a lot more challenges this year.
67380	71380	We have a great lineup of speakers. One of the biggest things that we took advantage of this
71380	77420	year with the conference being completely virtual was reaching out to get a lot of international
77420	82340	speakers. So the kinds of folks that work in industrial control systems elsewhere in the world,
82340	88120	that would not typically be able to make the trip to Vegas. So a lot more variety in international
88120	93480	representation with the speakers. So really looking forward to that. Logistics for it this
93480	99320	year, obviously you know about everything that's going on Discord at DEF CON with the ICS Village
99320	106260	specific channels around that. Q&A will be done there. Some speakers will be doing Q&A for the
106260	111800	live sessions. So live speaker sessions, Q&A will be in Zoom. Otherwise you can meet with the speakers
111800	118760	in Discord. And check out and subscribe to our new channels in YouTube and Twitch, where we'll
118760	127560	be streaming everything live to you. Have a great DEF CON. Our keynote for this year is the director
127560	134320	of CISA, Chris Krebs, reflecting the continued collaboration between the agency and the Village
134320	141320	with bringing education and more equipment to the community. This DEF CON, we are kicking off
141800	148840	the first of many opportunities to bring real ICS to even more hackers to get to work with.
148840	153220	So without further ado, Chris Krebs with the ICS Village keynote for DEF CON.
155660	163340	Hey, hello out there. Welcome to DEF CON ICS Village Safe Mode. My name is Chris Krebs. I am
163340	171780	the director of the U.S. Cyber and Infrastructure Security Agency. Today I'm going to tell you a
171780	176640	little bit about what we've been doing over the last couple years, our approach to control systems,
176640	182860	but more broadly, not just our approach, the things we're doing working with you and the community to
182860	188920	improve control system cybersecurity out there across this great country and throughout the
188920	194890	world. So I think what I want to start with is tell you a little bit about who we are, CISA,
195500	200540	again, the Cyber and Infrastructure Security Agency, youngest federal agency
201440	208980	coming up on our second birthday here, and talk to you a little bit about the threat landscape as
208980	216680	we see it and tie it to a few actors out there that have been improving their capabilities.
216680	222460	And then stitch that all up into a story of the things that we've identified as important and how
222460	229620	we work with you and the rest of the ICS security community to actually achieve these objectives
229620	239340	that we're all working day in, day out towards. So that, yeah, CISA, almost two years old now.
239600	243820	We are a part of the Department of Homeland Security. We've been around in one way, shape,
243820	249860	or form since the creation of the department, but the U.S. Congress gave us the authority
249860	257540	to stand up as a separate operational component, like the Transportation Security Administration,
257540	263680	you normally would have had to deal with if we were in Vegas, like last year and ideally next
263680	272700	year. And FEMA, if you're paying attention to COVID or hurricane season, they're out in front.
272700	279260	So that's where we come in. We're CISA. We are the nation's risk advisor as we style ourselves.
279260	284560	But the concept here is to get an understanding of what the risk landscape looks like and how
284560	289340	it intersects with the nation's critical infrastructure across a number of different
289340	296540	lines of effort, but I tend to distill them down to five. First is traditional InfoSec.
296540	306020	We are the home of U.S. CERT, and we have been working some aspect of InfoSec for two plus
306020	313320	decades now. The second aspect or discipline is control system security. We are also home to ICS
313320	319520	CERT and have been in this game for quite some time with varying levels of investment and
319520	324920	capability, but we are fully committed to this mission. The third is supply chain security.
324920	329920	Lots of activity on the supply chain front over the last couple years, particularly since I've
329920	336220	been here, and really looking forward to building more capability and sight and maturity across the
336220	341420	supply chain risk management discipline. And the last two pieces, insider threat,
341420	347900	and this is more about that blending of close access operations, allowing an adversary into
347900	353460	your network or into your perimeter that they can then combine with other techniques to achieve
353460	358720	their objectives. And then lastly, physical security. So in this broader cybersecurity and
358720	365360	infrastructure security space, we're also out there day in, day out conducting physical security
365360	372840	assessments of facilities to help protect things like schools and hospitals right now,
372840	379420	and places of worship. Back when sports start up again at larger scale and you can actually go
379420	386040	attend the sporting event, assuming you like sports ball, we are out there helping the
386040	391740	facility owners and operators understand how to best secure their facilities. So that's kind of
392470	399660	the disciplines that we focus on. And we have a very different approach, I think, to engaging
400560	404940	our stakeholders, our customers, as it were, than you might find in other parts of the federal
404940	411040	government. They're usually persuasive hooks that agencies have, whether it's law enforcement
412600	421720	authorities, or it's regulatory authorities, or they have money, things like that. We're in a
421720	428520	public-private partnership business, and that's a kind of cliche thing to say, I think, certainly
428520	438180	over the last 15 plus years. But we spend a lot of time listening. So it's not that old, tired,
438180	443280	you know, we're from the government and we're here to help. It's more along the lines of,
443280	447280	we're from the government, we're here to listen. We want to understand what your problems are,
447280	453880	your challenges are, what your gaps are. We have certain advantages where, at the end of the day,
454560	464560	profit and revenue is not our prime objective. We have the ability to overcome places where there's
464560	470680	no legitimate business model for the private sector to chip in and contribute. So that's
470680	476080	kind of a sweet spot for us. And of course, there are other aspects here. We have access to
476080	481300	classified information. And when we know what the bad guys are trying to do, or, oh, I don't know,
481300	489580	actually doing, we're able to distill that down and bring partners into the fight to counter those
489580	500440	efforts. And so again, we're this public-private partnership, voluntary effort agency. I'm not
500440	507860	going to lie, it's tough. When you really have to work that extra bit to understand what a partner's
507860	513980	challenges are, and then go back and craft something that is going to help them, that takes
514120	519680	a lot more work than I think some of the other authorities that other agencies have. But in
520360	527740	a sense, it's also pretty darn easy if you listen the right way. If you listen to really what the
527740	533320	challenges and the gaps are in the critical infrastructure community, whether it's on the
533320	541500	Infosec side or the OT control system side, if you listen really hard, and you isolate the issue,
541500	549560	and you address the issue and deliver some value, it's a self-fulfilling prophecy in terms of your
549560	555560	ultimate success. So we, in a certain sense, are like the private sector, right? We're like an
555560	562720	organization that has to develop the capability, turn it, do the market research, pull together a
562720	570340	product lifecycle, have a team to deliver it to customers, and then have feedback and dial it in.
570340	577620	So we very much have that private sector mentality. In that philosophy, that approach is in part why
577620	585340	I'm here today, wherever here is. But that's why I'm here today. It's part of market research,
585340	589740	it's part of engaging a community and understanding what the challenges are and
589740	597720	how we can all work together to close out those gaps. And I honestly think,
598460	605580	which means I'm not lying to you right now, I guess, that right now, the threat landscape,
606220	613440	the bad guys out there doing bad things, is as active as I've ever seen it.
614000	619440	And that's not to say that the bad guys out there haven't been doing bad things for a long time.
619620	624980	2012, 2013, dating all the way back, we've seen, particularly in the control system space and the
624980	632720	hard infrastructure space, really dramatic adversary activity. So go back and look at
632720	638440	the 2019 Worldwide Threat Assessment. There's a very specific piece in there that talks about
638440	646460	Chinese capabilities to disrupt pipelines, cause localized outages. That goes back several years.
646720	653180	A couple years ago, the Russians, what we called at the time alien viper, but they absolutely
653180	660120	targeted energy infrastructure. They went through the supply chain, they went through contractors,
660120	665420	construction organizations in this case, they knew where they were wanting to go.
666080	671860	And they used a range of capabilities, a range of accesses to get there.
672200	680080	Even more recently, we, alongside the National Security Agency, issued an alert that was pretty
680080	686160	clear and pretty stark in the terms of, if you have OT systems that touch the internet,
686160	692100	you need to get them offline. You need to harden them. You need to protect them. You need to
692100	697880	install or implement better email security measures because what we found is flat, unsegmented
697880	705040	networks provides the adversary the ability to pivot off the business network into the OT networks.
705040	713820	Again, these are very, very active targets for the bad guys. It's only a matter of time, as I
713820	719960	think Dale Peterson said back in January down at S4, in an interview I did with him, that
721020	729620	ransomware will come to the control system space. It's a matter of time. Let's get there before them.
729900	737980	So our mindset has been going back to that general philosophy of the agency. How do we understand,
737980	743100	how do we build a community of practice here? We're not the ones building it, to be clear.
743100	751200	We want to be able to foster that community of practice. And so a year and a half or so ago now,
751200	757540	when we came out of a pretty historic, not pretty, but a historic shutdown of the U.S.
757540	764740	federal government, I laid out a series of priorities for this agency. First, half my
764740	769920	budget goes, if you haven't checked and you don't, who looks at the federal government budgets,
769920	777780	but half of my budget goes to federal cybersecurity. That's a big chunk of money, and so that's a top
777780	782740	priority for me. What else is a top priority for me? Election security. Looking forward to
782740	788020	participating, parts of my team participating in the voting village, DEFCON voting village as well.
788580	796060	We're also doing physical security, as I mentioned, for crowded places and soft targets. But I think
796740	803440	when we were sitting there as a team trying to identify the greatest areas for opportunity,
803440	810160	the greatest areas for community progress, two things immediately jumped to mind,
810160	818440	and they're related. Supply chain. Supply chain risk management is an untapped area
818440	825460	that we are putting a significant amount of effort behind. But the last piece of care,
825460	828460	of course, why I'm here today, industrial control systems. As I mentioned,
828460	833140	we are the home of ICS CERT. It's a game that we've been playing for quite some time,
833140	840080	and we are reinvigorating our partnerships, we're reinvigorating our investments,
840080	848740	bringing and building a fantastic team. And our overall objectives is to be able to stitch
848740	856860	together the U.S. government in support of industry and the control system security community.
857520	863500	Together. That's it. Together. We're just working on doing this together. And so coming out of that
863500	869680	shutdown, I challenged the team, said, tell me how we're going to do this. And of course,
869680	874960	federal government agencies is what we do. We build strategies, right? So in July, we released
874960	879920	our industrial control systems initiative, which is our strategy. It says, here are the things that
879920	888060	we are aiming to accomplish. Here's the main thrust of activity. Now, you didn't come here
888060	893760	today to hear me talk about a strategy about another federal government plan. Another, it's
893760	901620	actually pretty tight in terms of page count, but that's not why we're here. But I do need to lay out
901620	907480	what our objectives are and how we're going to do that. And then I'm going to tell you about
907480	913600	the mechanisms we're using and some of the key implementation priorities. And that'll give you
913740	921280	a sense of where we're going. Most importantly, how you can participate. Because together, to me,
921280	926060	means one thing. And I mentioned it earlier this year at the industrial control systems
926060	932520	joint working group that we had to do online, just like this. Our top line objective
933160	940300	is to democratize industrial control systems security efforts. And what that means is making
940300	948440	it open for everyone, bringing the community together. It's not about releasing products
948440	955100	and tools and services that only a handful can afford. It's not about restricting access. It's
955100	962800	about diversity. It's about inclusion. It's about democratizing security. That's what's
962800	971540	behind our strategy. So real quick, the philosophy behind the strategy is about empowering you,
971540	977800	empowering vendors and owners, operators, and integrators to make better risk management
977800	984680	decisions. It's about informing your investments. It's about integrating the U.S. government
985560	989840	and our partners in the intelligence community, Department of Defense and FBI. It's about
989840	996220	integrating our efforts into yours. It's about moving to a proactive industrial control systems
996220	1005160	posture. And lastly, it's about driving towards a sustainable, long-lasting control systems
1005160	1011840	security community. That's the top line. All right. How are we doing this? Pillars. We got
1011840	1016900	four pillars. Every strategy's got to have pillars. We have four pillars. First pillar is
1016900	1022680	asking more of the community, but doing more for the community from the federal government
1022680	1031020	perspective as well. The second is advancing technology and the ability to secure our
1031020	1039460	systems. Not just tomorrow's systems, but we have to figure out how to continue to defend today's
1039460	1046860	deployments while thinking through the next generation and having more security baked in.
1046860	1053880	Secure by design, secure by deployment. The third piece is developing deep data capabilities
1055120	1063680	to better put our understanding of risks against the current deployments and
1063680	1070200	building frameworks, building resources and approaches that take advantage of just this
1070200	1076820	wealth of information we all have. Pull it all together and putting into meaningful frameworks.
1077360	1083320	MITRE continues to lead in this space with the industrial control systems framework. Those are
1083320	1092040	the types of activities and approaches that we look to be a part of. Not necessarily invent,
1092040	1100440	not own, we just want to be a part of this effort. And lastly, increasing that risk understanding
1101040	1108120	of the interdependencies that are out there so that we can drive smarter investments,
1108120	1114480	smarter solutions, smarter engagements between the government and industry to get to that
1114480	1121440	objective of democratizing control system security and making the environment safer and more secure.
1122940	1127760	So it's those four pillars that drive our approaches. So what the heck are our approaches?
1127760	1134740	Okay, this is the part that matters. The strategy is about what we're trying to do.
1135460	1142960	Our approaches are how you can work with us to achieve these objectives. So got a few things
1142960	1147180	that are worth talking about here. I already talked about one of them and that's the industrial
1147180	1155160	control system joint working group. This is what is now a twice a year, that's biannual, twice a year
1156820	1163780	now a virtual event, but it provides a free opportunity for anyone that's either getting
1163780	1170160	into the control systems game or is in a jurisdiction that doesn't have travel funds,
1170160	1173620	because those are always a challenge with, you know,
1174760	1179480	the old days conferences. How do you get the money to go to Vegas? How do you get the money to go to
1179480	1186720	Miami? The ICS JWG is about opening up a more inclusive environment so everyone can come
1186720	1194020	together and learn something, even if it's at the 101 level or the 10 whatever remedial is,
1194020	1200200	100 level, it doesn't matter. The point is we have the opportunity to bring more people
1200200	1206160	into this community and that's what we're working towards with the ICS JWG. We had our most recent
1206160	1212220	one in, I don't know, it was a month or so ago. We've got another one coming up in the fall.
1213480	1220320	So that's point one, ICS JWG. So back to that kind of integrating the federal government with the
1220320	1225900	community. We also have an effort called the Control Systems Interagency Working Group,
1225900	1232480	the CISIWG. Now, it says interagency, but don't take from that that it's just government. Again,
1232480	1241040	this is about bringing the executive leadership of the federal agencies that play in control systems
1241040	1247880	together with leaders from industry, from the research community, from the vendor space,
1247880	1252360	bringing everybody together and figuring out, okay, what are our opportunities,
1253040	1259600	our threats? It's really, in part, we're doing a SWOT analysis. How are we strong together?
1259600	1263240	Where are we weak together? What are our opportunities to work together? And then
1263240	1270800	what are the threats? So coming out of the last year or so work of the control systems
1270800	1278700	interagency working group, well, we figured a few things out. One is the government needs to be
1278700	1285780	more coordinated together. Everybody does some part of this game. How do we do it in a more
1285780	1290980	coordinated fashion? Well, one place we can really achieve, I think, some alignment and
1290980	1297480	advancements is in standards. So if we get all the federal government players together on standards
1298060	1301540	and working towards the same common purpose, we can really drive
1302380	1309880	the advancements we're looking for. Also, we can help work to build the workforce of the future.
1310080	1315520	Rather than doing bits and pieces here and there, let's have a collective approach to workforce and
1315980	1324060	a lot of credit to NIST and their efforts in job coding, creating clarity in messaging,
1324060	1332640	and hiring practices. So we have an opportunity there. And also on the investment alignment. So
1332640	1338420	R&D, lots of different R&D efforts across the federal government. We should have a more unified
1339080	1347380	R&D agenda that can get better uses out of our investments, maybe eliminate some
1347900	1353620	duplication or redundancy in efforts. Always a good thing. Maybe put those saved dollars
1353620	1361700	towards another effort. And then lastly, working towards a more unified, streamlined,
1361700	1370360	coherent, and value-added incident response approach within the USG. And in part,
1370360	1377700	what we want to do with this is make sure that we're taking the relevant information out of an
1377700	1385140	incident response effort and sharing that information back out in a protected way for
1385140	1389480	the victim. We're not in the business of re-victimizing a victim. But to the extent
1389480	1397060	that we can extract insights from single or multiple incident responses, that's a good thing.
1397060	1406940	And that's something that we've done recently. In fact, in the oil and natural gas sector,
1406940	1412420	we issued an alert earlier this year. Now, we're not perfect yet. We're still working at this.
1412520	1418720	But your feedback on all of our control systems products is always welcome. So go to cissa.gov,
1418720	1426500	c-i-s-a.gov. Check out our control systems page and all of the products we have there, the alerts,
1426500	1430860	the guidance, the advisories. Let us know where we're hitting the mark. Let us know what else we
1430860	1436620	need to do. And then work with us through the Industrial Control Systems Joint Working Group.
1436620	1440920	There are a few other things that are worth highlighting, particularly since we're doing
1440920	1447640	this DEFCON safe mode thing, something you'll hear about. And that got kicked off last year,
1448430	1456860	rather earlier this year, down in Miami, ICS for ICS, Industrial Control Systems for Incident
1456860	1461300	Command System. Not sure if everybody knows what the Incident Command System is, but it's what the
1461300	1466140	physical emergency responders use to coordinate their efforts, whether it's a hurricane, a
1466140	1470520	wildfire. It's actually the firefighters out in California, the fire service, they're the ones
1470520	1477200	that develop the Incident Command System. But it's got a great application for physical disasters.
1477680	1485000	But I bet if we ever have one of those big time, larger scale, physical or cyber-enabled
1485580	1492060	physical event, guess who's going to show up? The fire department, the emergency managers,
1492060	1498980	state and local officials. There's absolutely a role in control system security and incident
1498980	1505360	response for state and locals. But they also recognize, we recognize, that there are roles
1505360	1511280	for the security community. So what we've got to be able to do is develop those frameworks,
1511280	1515320	develop the frameworks that put everybody together, clarity of roles and responsibilities.
1515320	1519420	So a lot of credit to Megan Sanford for her work there, and ICS for ICS,
1519420	1523260	and looking forward to continuing to contribute to that effort.
1523260	1531540	And of course, the best for last here, ICS Village. This year, we were proud to partner
1531540	1536440	with the ICS Village. A lot of credit and thanks goes to Bryson Borg for his efforts.
1536660	1542480	But the idea is we can do more together. That's why we're here. That's why you're seeing
1542480	1547520	the feds show up at DEF CON, even if it's virtually. We were there last year,
1548000	1554300	but we look forward to really growing out this and building out this partnership with the ICS
1554300	1560420	Village and other villages. We're doing that in a couple ways. This year, we've got our
1560420	1566560	Control Environment Laboratory Resource, or CELER, that is going to give simulated environments so
1566560	1572400	that everybody can walk through a couple different scenarios, work on your blue team skills,
1573340	1578560	and run some incident response. This is an effort that we think, again,
1578560	1588700	plays to that democratizing industrial control systems. It's been a long day.
1588700	1593420	Industrial control systems security. Again, democratizing, making it more open. If we can
1593420	1600740	pull more resources out of the National Capital Region, out of specific locations out west,
1600740	1606080	and then make them broadly available virtually, good for everyone. If we can put things on wheels
1606080	1611860	and drive them around to various parts of the country, again, these are good things. That's
1611860	1617000	what we're trying to accomplish here. A control systems ecosystem, security ecosystem, that is
1617000	1622600	open and accessible to everyone. Whether you're in the private sector or you're a municipal water
1622600	1627860	facility, everyone's got requirements. We have to be able to do this together.
1628360	1634360	So the last thing I'll talk about before wrapping this one up is our role in vulnerability management.
1634900	1643180	This has been hell year, I think, for the vulnerability managers out there. Six months
1643180	1649600	of week after week of big vuln after big vuln. I was thinking at some point it's almost a race
1649600	1654680	to the bottom, because think about it, you drop one vulnerability and somebody's probably going
1654680	1661340	to drop one next week, and so you've got tops of seven days in the new cycle. But it's really
1661340	1669480	stressing the teams that historically we haven't invested too much in. The vulnerability management
1669480	1677580	side is one of the most important teams within any organization. We play a key role here in
1677580	1685940	coordinating vulnerability disclosure. We fund and support the CERT Coordination Center, CERT-CC,
1685940	1690060	up at Carnegie Mellon. We also fund the National Vulnerability Database
1691980	1699300	at NIST. So between the CERT-CC CVE process and the National Vulnerability Database,
1699300	1704380	two key resources for any network defendant or any vulnerability manager of understanding
1704380	1710940	what's new, what's coming, and how do you defend against it. We also play a role again through that
1711560	1717600	CERT-CC process where the private sector or a security researcher rather, if they identify
1717600	1726440	something, we can help facilitate the conversation between the appropriate vendor. Now sometimes we
1726440	1733820	don't need to play a role. In fact, we encourage programs, we encourage vendors to have vulnerability
1733820	1740960	disclosure programs, to have as needed bug bounty programs. Again, have a healthy, vibrant
1741620	1745500	ability to engage with the security researcher where you don't need the government,
1745500	1750420	even if it's just fostering or facilitating a protected conversation. But that's not always
1751140	1757620	how things are right now. That's not where some organizations are in their maturity
1758300	1763660	of their own vulnerability disclosure practices. So we play a vital role. Last year, calendar year
1763660	1775400	19, we processed and managed through our CBE process, 11,500 plus vulnerabilities. I think
1775400	1781900	based on this year, we're probably going to exceed that. But that's a role we are happy to play.
1781900	1788000	Again, we are going to continue to issue advice and guidance to organizations of all sizes and
1788000	1795880	stripes. Guidance on how they can set up their own vulnerability disclosure programs. Just last
1795880	1801400	week, we issued some guidance to our partners in the state and local election community about how
1801400	1808380	they can set up vulnerability disclosure programs for their systems. And so it's not just about the
1808380	1814260	code, the software they're coding or whatever. It's their implementations. If you find a vulnerability
1814950	1821260	in a voter registration database, please, you know, first off, if you own that database,
1821260	1825800	you need a process. But if you find that vulnerability, you need a way to report it
1825800	1830820	in a coordinated manner so it can get closed out so that it's closed out before the bad guys get
1830820	1837920	there. So vulnerability management is exactly where we are going to continue investing more
1837920	1845600	broadly in the InfoSec space. And in fact, little known fact, this was supposed to be the year of
1845600	1852480	vulnerability management. That was a theme we had. Little did we know that it was again, it was going
1852480	1857360	to be vulnerability management hell year. But here we are. We're here. We're part of the team. Let us
1857360	1864620	know what help you need. So I'm going to wrap this one up right now. Again, CISA is here as an advisor,
1864620	1872460	as a partner, as a friend. Our objective, again, top line, democratizing industrial control system
1872460	1879160	security at all levels. I don't care where you are. We want to work with you. We are here to
1879160	1886540	provide support, resources, technical assistance, and the information you need to be able to protect
1886540	1894380	your systems. But ultimately, it's not just about defending today's deployments. We've got to make
1894380	1900860	sure that tomorrow's deployments are secure by design, secure by deployment. So with that, I'm
1900860	1906440	going to wrap up these remarks, and I'm going to jump in a time machine, and I'm going to have a
1906440	1910680	costume change and all that, and I think we're going to do some live Q&A. Thanks.