Well, hello ICS Village. I'm coming to you live from sunny Amsterdam and today I'm going to be
talking about critical infrastructure and a presentation that I gave recently at the United
Nations after an invitation at the United Nations Institute for Disarmament Research.
So, I hope you enjoy it. If you don't know who I am, that's fine. I'm certainly not a household
name, but my name is Chris Kubecka and I am the CEO of two companies, one in the Netherlands,
one in the UK, dealing with cyber warfare and ICS, IoT, and IT proactive security.
I'm also a Distinguished Non-Resident Fellow at the Middle East Institute.
And previous to all of this, I used to head the Information Protection Group
for Aramco and I was a Aircrew member and was in Space Command dealing with many control systems.
One might say I'm also a bit of a reformed hacker or at least now a reformed unethical hacker
because I come from it from a slightly different point of view where I started as a kid being a
black hat hacker and got busted at the age of 12 doing very, very naughty things.
So, why is this particular talk and this topic important? Well, one of the reasons is we now live
in this wonderful digital world. We're able to have DEF CON in the ICS village remotely
and we depend absolutely on technology. And if we want our modern world to continue,
we have to deal with the simple fact that hopefully our technology will not be used to
kill us. So, the United Nations has been involved a little bit late in the game and they are very
concerned about member states and their responsibilities securing the ICT assets
within their own borders. So, in 2015, I did say they were a little late, a group of governmental
experts published a report, Report H, that stated four main facts that every member state is
supposed to secure its own country's cyberspace. That includes IT, IoT, and ICS security. In
addition to that, every single member state should have a computer emergency response team.
Fantastic. And also with that, if there is a country where an attack is coming from and
then transiting through, that if you are a transit country, say like something coming
through the Netherlands, aiming at Austria or the United States, then that transit country
and their telecoms should be able to provide aid. And also, any member state that's under
major attack should be able to exchange information on the incident and also technology,
and if at all possible, additional subject matter experts like CERT teams to assist in a major
attack. Now, this sounds all wonderful, lovely, jubbly, and at the UN, the majority of member
states did agree to this particular report and thought that these things were very, very important
to have. However, at the UN level, at this global scale, lots of government experts don't actually
realize what's really going down on the ground. So, this is one of my favorite quotes. It is,
never underestimate how dependent you are on your information technology and systems. It's become
like oxygen. You think you can live without it, but you can't. And this was a quote from the CEO
of Saudi Aramco after the 2012 Shamoon attacks. And what you're seeing here is a picture of one
of the events that happened after the attack, where there were miles and miles of gasoline
trucks that could no longer be loaded up, because the industrial IOT system in between
was no longer functioning, nor were the payment systems. Now, Saudi Aramco experienced the world's
worst cyber warfare attack. It isn't spoken about too much, because I'm currently the only person
authorized to actually discuss it. In about two hours, 85% of their IT systems were lost.
And when I say IT systems, this is a VoIP phone, this is the payment systems, this is the HR data,
some of the backups were wiped, some of the firewalls were affected, and there were two
production plants were actually affected. And unfortunately, Aramco was unprepared. They
believed, you know what, barely anybody knows about us, unless you're in the oil and gas industry,
so why would we ever be a target? Well, unfortunately for them, around the same time,
Arab Spring was going on, and attacks that had recently occurred. And Saudi Arabia and Iran are
not very good friends. And because of this lack of understanding, their systems, both on the IT
side, IoT side, and ICS side, were not very prepared or secure at all. Now, in addition to this, the
attack affected countrywide internet connectivity, taking out two of the three mobile providers,
because they actually severed the internet connection. And Aramco provided internet
connectivity for emergency services, hospitals, schools, police stations, universities, and you
see where I'm going with this, it was not a very nice picture. 14 days after the initial attack,
Qatar's national oil company, Rasgas, a joint venture between Qatar and ExxonMobil, was hit
with a different variant. The Shamoon variant for Saudi Aramco had a burning American flag,
the Qatar one did not. And what we estimated after the attack, if the two companies had actually
fallen and could not restore themselves as quickly as possible, we estimated that a barrel of oil
could hit as high as $450 per barrel. And if that had happened, it would have caused a domino chain
of global economic and supply chain damage. We see COVID right now where it's causing a lot of issues,
but imagine if nobody could purchase oil, no cargo ships could purchase oil because it would
be too expensive. You see where I'm going with this. We teetered precariously on the edge of a modern
age, bronze age collapse due to a cyber malicious attack. The reason why I know about this attack in
depth was because I was the person requested to help recover international business operations
and establish their mature digital security and cyber threat intelligence.
So one of the things we have to understand is the vast majority of critical infrastructure
is actually privately owned. And there are limitations to how much a state can regulate,
legislate, and ultimately dictate to the private sector. There are major costs associated with
going, hey, guess what? You got this legacy stuff. It's not really up to snuff. So you're
just going to have to replace it. So then comes into the question, what should water actually
cost versus a beautifully near risk-free ICS system? And now that we're in the middle of
pandemic, unfortunately, are hospitals going to have to choose between securing their systems,
which also includes a lot of medical IoT devices, or are they going to have to go ventilator to
cure ICT? And I think all of us right now watching this, we would kind of like those ventilators.
Now, when it comes to establishing a computer emergency response team, this is a fantastic
step. However, we have to understand that a CERT team is a very reactive team. They are
constantly putting out fires. And usually these teams are not very big. What happens as well is
they have to do putting out fires, write advisements to constituents, advisements to governments. They're
doing a whole bunch of stuff in investigations and give training, and especially give training
to critical infrastructure. They don't have a lot of time to do a lot of anything, but yet they're
expected to do basically everything. We also have to understand that a lot of computer emergency
response teams are not actually capable of doing all of the services that are expected of them,
or are not actually mature enough to provide the majority of services. There are still CERT teams
in various countries that don't even use encryption on their website.
And not all CERTs actually take vulnerability disclosure. I provided feedback for a person
who works for a German think tank who's writing a paper right now for the German government.
And one of the things she noted was the fact that here I live in the European Union, and we have
something called CERT-EU. And she was very puzzled over the fact that nowhere on their website could
you find a link or information on how to actually disclose vulnerability information. And this is
a CERT that, in essence, would provide a response for 513 million people. So there are a lot of
limitations with CERTs. Now, one of the things that I proposed to the United Nations was
CERTs, fantastic. I think that is step one to really taking a look at how member states
should really secure their cyberspace. But at the same time, I proposed to them a CEPT,
if one might pronounce it that way, but a Computer Emergency Prevention Team.
And I truly believe that member states should have these. So a team that actively looks for
any sort of issue or high probability of compromise to systems, whether that's IT, IT and ICS,
they're exposed to the internet, look at the supply chain issues, which may allow for exposure,
and be that kind of like fire alarm and warning system before the fire actually
bursts into flames and has to be put out. In addition to this, they can also take on the role
of the advisement, especially in critical infrastructure, allowing the computer emergency
response teams to actually put out the fires when they need to. So I'm a big believer in proactive
security. And currently, I am the subject matter expert for part of the European Union, where we're
building the world's first exclusively proactive security team, where we are looking for high
probability of compromise systems and detecting compromise as quickly as possible, and starting
the incident response portion of locking down a system and determining what the major risks are
before the CERT team comes in for the incident, the rest of the incident portion.
So we live in this wonderful connected world, and I'm going to give you a new term and a hashtag
you're free to use. BYOH, bring your own house. I happen to be in my home. But when we connect up to
power plants, or any sort of production, or industrial IoT, or even our workplace,
which might just be regular IT systems, what has happened in this wonderful pandemic,
wonderful at all, is the fact that the employees were sent home, and this also includes technicians
and engineers, and they're like, hey, do your job from home. Okay, great. So I share this network
with perhaps my kids, perhaps my partner, perhaps I'm stealing the neighbor's Wi-Fi, who knows?
And their home network is now considered perimeter security in many ways. Now, I'm fortunate to have
my own commercial-grade firewall that cost me about 2,500 euro, but most companies are not going
to roll that out for their employees. So perimeter security is now your front door. And when we take
a look at how engineers and operators are trying to stay connected, we are going into a very kind
scary area right now. Because one of the things I did, also preparing for my Red Team Village talk,
was to do a massive scan across the internet and try to find some easily found exposed control
systems, looking at ICS, industrial IoT. And unfortunately, I found way too many systems.
As you can see, I have this wonderful table that says, please hack me. The reason for that is a lot
of these systems, either they don't have very much in the way of security, like the Modbus protocol,
you have to be very careful with that one. Or even if they've got a more modern control system
protocol, it doesn't necessarily mean they're on the newest and greatest firmware, or the fact that
a lot of these things now are really industrial IoT products. And they've got these wonderful
things called web servers. And I'd like to say, if it looks like a web server, hack it like a web server.
And so just because the protocols might be wonderfully put together, or say Siemens S7,
if it's got a web server login exposed to the internet, and it hasn't really been tested for
security, then release the cross-site scripting and a bevy of other different types of attacks.
So one of the problems we have is hacking. And when I say hacking, I don't just mean
my 10-year-old self, or some of the people who deal with offensive security and find
certain vulnerabilities. We also have to consider the fact that a lot of nation-states are involved.
When I say a lot, one of my favorites is actually Ethiopia has a full-fledged offensive security
team that is authorized to do various hacks, because they've been at war and are involved
in various skirmishes with DANTREA. So if Ethiopia has something, lots of other countries
have this particular capability. We also have to take a look at geopolitics and things that are
going on. I was chit-chatting with Bryson Bort before we started, and I'm currently doing research
into cyber guerrilla warfare between Azerbaijan and Armenia, where the Armenian nuclear powder
plant is actually under threat because Azerbaijan has publicly stated that they want to blow it up.
And I don't think that's good for anyone, especially since I live in Europe, and I don't
want to like another trouble, and I don't want cancer. So we have to take the security devices,
the way they're put together, the configuration, if they're exposed or not, think about geopolitics,
but also think about the fact that not everybody is a friend. So if there's a major incident between
several countries, even transit countries, some countries won't necessarily help others.
And even if they do help others, they don't necessarily phrase what they need in a proper
question so that another country can give proper aid. And one of the other things that we have to
think about is before something major happens, groups actually need to start talking to each
other because you don't just pick up the phone to a random country and go, hey, I need this stuff,
and they're like, I don't even know you. I've never met you. And trust goes a long way, both with formal
and informal networks. And one of the previous speakers had mentioned he was from academia,
and academia is fantastic, and they can think out of the box in certain ways, but unfortunately,
not every person who's in academia who's studying this topic necessarily has that hacker mentality.
And currently, there is not enough involvement from the tech community.
So we've got some things that are fantastic that we can use at the United Nations,
and these are existing treaties. Now, whilst I was giving my presentation, one of the other
presenters had brought up previous to me that perhaps we need to create this brand new treaty
to tackle these issues. And my response was, guess what? We have stuff that we can use, we can expand
on existing conventions, but if we're going to be doing a new treaty, it's going to take years
and years and years, if it even gets a certain level of consensus from other member states
inside the United Nations. And incidents don't wait years and years. Incidents want attention
now, and they need it now. So we can use the Budapest Convention. There's also existing
counterterrorism legislation and relationships between countries that also can be utilized
if there's a major attack that is happening, going through countries,
or hitting a particular country's critical infrastructure.
So when it comes to preparation, one of the things that we have to remember is
practice, practice, practice, right? And I think we've heard this at many different discussions,
whether it's critical infrastructure or other areas. And the way that you get very good at
something is to practice it. And obviously not every incident is going to be exactly the same
because everyone is unique, everyone is unique and different. But when we talk about exercises,
they're still kind of lacking, especially at the UN level for different things like this.
Now, a few years ago, I had the opportunity to work with the European Center for Foreign Relations
on building NATO and EU member exercises for diplomats and ministers. And I was the only
tech person who was a subject matter expert who was not an academic. And I noticed that this was
really, really lacking because we need to get certain people involved in this to do a good
exercise, accept team members, as well as ministerial advisors, because a minister
and an ambassador do not make decisions all by themselves, they have advisors.
We also have to involve the public and private sector, obviously grab some academics as well,
because they can share a lot of different research. But also consider us, a lot of the people who are
watching this talk right now, in the tech community and subject matter experts who have
actually dealt with some of these things. Reformed, nice hackers, so to speak, who can think in a way
that they can misuse systems and even information that nobody else can really think about within the
other groups. So one of the major things that I proposed to the United Nations was
we need to get security researchers involved. One of the biggest reasons is when you get the
tech community involved, I'll give you a good for instance, there's a CTI league, which was set up
of subject matter expert tech community folks, and they volunteer to protect hospitals and medical
personnel and medical devices. And they work extremely quickly. They also interface with
computer emergency response teams, Europol, and other law enforcement, so that hospitals have some
sort of advantage in this game. A few months ago, I was contacted by a particular EU government,
because 15 of their hospitals went down on a Friday night, because it was a cyber attack.
And that particular country came out publicly saying, this country who did these attacks,
stop attacking our hospitals. But defending and realizing that there are some exploitable systems
out there, if you've got the tech community involved, they can go ahead and interface
like that, like the snap of your fingers. Unfortunately, when you're dealing with
diplomats and countries on that much higher level, those formal networks are kind of slow.
Now, another thing that I brought up to the United Nations is the fact that the majority of ICT
vulnerabilities, both IT, ITICS areas, they're still discovered by good hackers like us, attending
DEF CON, SIGMO. And this is fantastic, because a lot of us do this, maybe for a t-shirt, some stickers,
sometimes a bug bounty, but really because we want these systems protected, so we can use them when
we say, go to a hospital. And unfortunately, we still face a lot of legal barriers. As I mentioned
before, not all certs actually will take vulnerability disclosures. And sometimes if
you contact a company or a power plant or a hospital or whatever, they might have the reaction of,
who the heck are you? Are you trying to extort us for money? Are you some sort of criminal?
So there's some legal barriers. And sometimes you have to deal with very strange laws, like in the
Netherlands, you're not allowed to ping a computer system. That's written in our cyber law. Even
computer systems you own, which is still kind of odd, but depending on the country or the laws,
you could actually be arrested for reporting some of these things.
Now, another issue is who to contact. Here you've got this major thing,
and you want to be able to contact people as quickly as possible in a secure manner,
but who do you contact? Using the CertEU example, I have no idea. And neither does the person
writing the paper for Germany. So what we have to realize is, as we all plainly know right now,
we live in this digital world. And we are absolutely as dependent on ICT systems as we are
to oxygen in this modern world. So my closing recommendation to the United Nations was that the
UN and member states should lead the effort in establishing computer emergency prevention teams,
because it is much easier, cheaper, quicker to prevent a major attack against critical
infrastructure than it is to try to put out a fire. So I have some references, which I can
copy and paste somehow and put into Discord, or folks can take screenshots. The first one is
the UN Group of Governmental Experts Report H from July 2015. There will be a new report coming out
from my presentation and other people's presentations that we gave at the United
Nations last month. And also, if you want to take a look at a very, very good
convention that actually deals with cybercrime that can be utilized for information sharing,
technology sharing, subject matter expert sharing, etc. when a major incident occurs,
Budapest Convention on Cybercrime is excellent. And last but not least, thank you very much ICS
Village and doing this safe mode. I know it took a lot of work. And Mr. Bryson Bort for inviting me
to do this talk. And if you want to know more about me, I'm available on Twitter. If you take
DMs, just no weird pictures, please. And also, we're doing a lot of work. We have just started
the cyber portion of the Middle East Institute. I'm the first distinguished non-resident fellow
and person coming in as a non-resident coming into the Middle East Institute specifically for
cyber to look at these particular issues. So, that ends my presentation. And what I'll do is
I will look on this Discord. And hopefully, there are some questions.
And there doesn't seem to be that many questions, but that's okay. Does the ICS Village have any
questions? Or I'll just dance. I'm up and it's after midnight and I'm still here, somehow.
Well, since no one has any more questions, thank you very much, everyone. And hopefully,
the United Nations will take some of my recommendations on how to secure their
individual member state cyberspace, specifically critical infrastructure, a lot better in the near
future. Thank you.