start	end	text
0	8540	Well, hello ICS Village. I'm coming to you live from sunny Amsterdam and today I'm going to be
8540	15140	talking about critical infrastructure and a presentation that I gave recently at the United
15140	21900	Nations after an invitation at the United Nations Institute for Disarmament Research.
21920	29100	So, I hope you enjoy it. If you don't know who I am, that's fine. I'm certainly not a household
29100	35760	name, but my name is Chris Kubecka and I am the CEO of two companies, one in the Netherlands,
35760	43600	one in the UK, dealing with cyber warfare and ICS, IoT, and IT proactive security.
43600	47240	I'm also a Distinguished Non-Resident Fellow at the Middle East Institute.
47520	52120	And previous to all of this, I used to head the Information Protection Group
52120	61180	for Aramco and I was a Aircrew member and was in Space Command dealing with many control systems.
61180	68840	One might say I'm also a bit of a reformed hacker or at least now a reformed unethical hacker
69670	76100	because I come from it from a slightly different point of view where I started as a kid being a
76100	82900	black hat hacker and got busted at the age of 12 doing very, very naughty things.
83200	91520	So, why is this particular talk and this topic important? Well, one of the reasons is we now live
91520	97080	in this wonderful digital world. We're able to have DEF CON in the ICS village remotely
97780	105540	and we depend absolutely on technology. And if we want our modern world to continue,
105540	110660	we have to deal with the simple fact that hopefully our technology will not be used to
110660	118400	kill us. So, the United Nations has been involved a little bit late in the game and they are very
118400	123840	concerned about member states and their responsibilities securing the ICT assets
123840	131260	within their own borders. So, in 2015, I did say they were a little late, a group of governmental
131260	139340	experts published a report, Report H, that stated four main facts that every member state is
139340	148640	supposed to secure its own country's cyberspace. That includes IT, IoT, and ICS security. In
148640	154180	addition to that, every single member state should have a computer emergency response team.
154180	162440	Fantastic. And also with that, if there is a country where an attack is coming from and
162440	170060	then transiting through, that if you are a transit country, say like something coming
170060	176340	through the Netherlands, aiming at Austria or the United States, then that transit country
176340	181900	and their telecoms should be able to provide aid. And also, any member state that's under
181900	190800	major attack should be able to exchange information on the incident and also technology,
190800	198700	and if at all possible, additional subject matter experts like CERT teams to assist in a major
198700	206800	attack. Now, this sounds all wonderful, lovely, jubbly, and at the UN, the majority of member
206800	211660	states did agree to this particular report and thought that these things were very, very important
211660	221260	to have. However, at the UN level, at this global scale, lots of government experts don't actually
221260	230080	realize what's really going down on the ground. So, this is one of my favorite quotes. It is,
230080	235280	never underestimate how dependent you are on your information technology and systems. It's become
235280	240440	like oxygen. You think you can live without it, but you can't. And this was a quote from the CEO
240440	248900	of Saudi Aramco after the 2012 Shamoon attacks. And what you're seeing here is a picture of one
248900	256140	of the events that happened after the attack, where there were miles and miles of gasoline
256140	262480	trucks that could no longer be loaded up, because the industrial IOT system in between
263240	270220	was no longer functioning, nor were the payment systems. Now, Saudi Aramco experienced the world's
270220	275120	worst cyber warfare attack. It isn't spoken about too much, because I'm currently the only person
275120	283940	authorized to actually discuss it. In about two hours, 85% of their IT systems were lost.
284020	291280	And when I say IT systems, this is a VoIP phone, this is the payment systems, this is the HR data,
291280	296280	some of the backups were wiped, some of the firewalls were affected, and there were two
296280	302480	production plants were actually affected. And unfortunately, Aramco was unprepared. They
302480	307940	believed, you know what, barely anybody knows about us, unless you're in the oil and gas industry,
307940	313500	so why would we ever be a target? Well, unfortunately for them, around the same time,
313500	322340	Arab Spring was going on, and attacks that had recently occurred. And Saudi Arabia and Iran are
322340	330400	not very good friends. And because of this lack of understanding, their systems, both on the IT
330400	339680	side, IoT side, and ICS side, were not very prepared or secure at all. Now, in addition to this, the
339680	345060	attack affected countrywide internet connectivity, taking out two of the three mobile providers,
345060	351500	because they actually severed the internet connection. And Aramco provided internet
351500	359140	connectivity for emergency services, hospitals, schools, police stations, universities, and you
359140	366100	see where I'm going with this, it was not a very nice picture. 14 days after the initial attack,
366100	371740	Qatar's national oil company, Rasgas, a joint venture between Qatar and ExxonMobil, was hit
371740	378060	with a different variant. The Shamoon variant for Saudi Aramco had a burning American flag,
378060	384600	the Qatar one did not. And what we estimated after the attack, if the two companies had actually
384600	390660	fallen and could not restore themselves as quickly as possible, we estimated that a barrel of oil
390660	399940	could hit as high as $450 per barrel. And if that had happened, it would have caused a domino chain
399940	406400	of global economic and supply chain damage. We see COVID right now where it's causing a lot of issues,
406400	413440	but imagine if nobody could purchase oil, no cargo ships could purchase oil because it would
413440	419060	be too expensive. You see where I'm going with this. We teetered precariously on the edge of a modern
419060	426640	age, bronze age collapse due to a cyber malicious attack. The reason why I know about this attack in
426640	431420	depth was because I was the person requested to help recover international business operations
431420	436460	and establish their mature digital security and cyber threat intelligence.
437480	442420	So one of the things we have to understand is the vast majority of critical infrastructure
442420	449500	is actually privately owned. And there are limitations to how much a state can regulate,
449500	455820	legislate, and ultimately dictate to the private sector. There are major costs associated with
455820	461280	going, hey, guess what? You got this legacy stuff. It's not really up to snuff. So you're
461280	465880	just going to have to replace it. So then comes into the question, what should water actually
465880	475080	cost versus a beautifully near risk-free ICS system? And now that we're in the middle of
475080	481000	pandemic, unfortunately, are hospitals going to have to choose between securing their systems,
481000	490400	which also includes a lot of medical IoT devices, or are they going to have to go ventilator to
490400	497940	cure ICT? And I think all of us right now watching this, we would kind of like those ventilators.
499100	506200	Now, when it comes to establishing a computer emergency response team, this is a fantastic
506200	514240	step. However, we have to understand that a CERT team is a very reactive team. They are
514240	522580	constantly putting out fires. And usually these teams are not very big. What happens as well is
522580	529460	they have to do putting out fires, write advisements to constituents, advisements to governments. They're
529460	534820	doing a whole bunch of stuff in investigations and give training, and especially give training
534820	541440	to critical infrastructure. They don't have a lot of time to do a lot of anything, but yet they're
541440	547520	expected to do basically everything. We also have to understand that a lot of computer emergency
547520	553420	response teams are not actually capable of doing all of the services that are expected of them,
553420	560120	or are not actually mature enough to provide the majority of services. There are still CERT teams
560120	564200	in various countries that don't even use encryption on their website.
564660	572260	And not all CERTs actually take vulnerability disclosure. I provided feedback for a person
572260	576700	who works for a German think tank who's writing a paper right now for the German government.
576700	581480	And one of the things she noted was the fact that here I live in the European Union, and we have
581480	589340	something called CERT-EU. And she was very puzzled over the fact that nowhere on their website could
589340	596160	you find a link or information on how to actually disclose vulnerability information. And this is
596520	607400	a CERT that, in essence, would provide a response for 513 million people. So there are a lot of
607400	613600	limitations with CERTs. Now, one of the things that I proposed to the United Nations was
614240	621960	CERTs, fantastic. I think that is step one to really taking a look at how member states
621960	629100	should really secure their cyberspace. But at the same time, I proposed to them a CEPT,
629100	634460	if one might pronounce it that way, but a Computer Emergency Prevention Team.
634460	642160	And I truly believe that member states should have these. So a team that actively looks for
642160	649400	any sort of issue or high probability of compromise to systems, whether that's IT, IT and ICS,
649400	656360	they're exposed to the internet, look at the supply chain issues, which may allow for exposure,
656900	664100	and be that kind of like fire alarm and warning system before the fire actually
664100	670600	bursts into flames and has to be put out. In addition to this, they can also take on the role
670600	675680	of the advisement, especially in critical infrastructure, allowing the computer emergency
675680	683060	response teams to actually put out the fires when they need to. So I'm a big believer in proactive
683060	689800	security. And currently, I am the subject matter expert for part of the European Union, where we're
689800	697200	building the world's first exclusively proactive security team, where we are looking for high
697200	703460	probability of compromise systems and detecting compromise as quickly as possible, and starting
703460	710980	the incident response portion of locking down a system and determining what the major risks are
710980	716300	before the CERT team comes in for the incident, the rest of the incident portion.
717700	723380	So we live in this wonderful connected world, and I'm going to give you a new term and a hashtag
723380	732940	you're free to use. BYOH, bring your own house. I happen to be in my home. But when we connect up to
733590	741480	power plants, or any sort of production, or industrial IoT, or even our workplace,
741480	748050	which might just be regular IT systems, what has happened in this wonderful pandemic,
748050	754390	wonderful at all, is the fact that the employees were sent home, and this also includes technicians
754390	760490	and engineers, and they're like, hey, do your job from home. Okay, great. So I share this network
760490	768290	with perhaps my kids, perhaps my partner, perhaps I'm stealing the neighbor's Wi-Fi, who knows?
768290	778030	And their home network is now considered perimeter security in many ways. Now, I'm fortunate to have
778050	784910	my own commercial-grade firewall that cost me about 2,500 euro, but most companies are not going
784910	794550	to roll that out for their employees. So perimeter security is now your front door. And when we take
794670	802510	a look at how engineers and operators are trying to stay connected, we are going into a very kind
802510	809970	scary area right now. Because one of the things I did, also preparing for my Red Team Village talk,
809970	818990	was to do a massive scan across the internet and try to find some easily found exposed control
818990	829010	systems, looking at ICS, industrial IoT. And unfortunately, I found way too many systems.
829010	835490	As you can see, I have this wonderful table that says, please hack me. The reason for that is a lot
835490	843390	of these systems, either they don't have very much in the way of security, like the Modbus protocol,
843390	850070	you have to be very careful with that one. Or even if they've got a more modern control system
850690	857790	protocol, it doesn't necessarily mean they're on the newest and greatest firmware, or the fact that
857910	863430	a lot of these things now are really industrial IoT products. And they've got these wonderful
863430	871050	things called web servers. And I'd like to say, if it looks like a web server, hack it like a web server.
871690	879210	And so just because the protocols might be wonderfully put together, or say Siemens S7,
879210	886470	if it's got a web server login exposed to the internet, and it hasn't really been tested for
886470	894830	security, then release the cross-site scripting and a bevy of other different types of attacks.
896470	903430	So one of the problems we have is hacking. And when I say hacking, I don't just mean
904290	911770	my 10-year-old self, or some of the people who deal with offensive security and find
911770	919610	certain vulnerabilities. We also have to consider the fact that a lot of nation-states are involved.
919770	928190	When I say a lot, one of my favorites is actually Ethiopia has a full-fledged offensive security
928190	934870	team that is authorized to do various hacks, because they've been at war and are involved
934870	942610	in various skirmishes with DANTREA. So if Ethiopia has something, lots of other countries
942610	948990	have this particular capability. We also have to take a look at geopolitics and things that are
948990	956970	going on. I was chit-chatting with Bryson Bort before we started, and I'm currently doing research
956970	964110	into cyber guerrilla warfare between Azerbaijan and Armenia, where the Armenian nuclear powder
964110	970610	plant is actually under threat because Azerbaijan has publicly stated that they want to blow it up.
970750	975790	And I don't think that's good for anyone, especially since I live in Europe, and I don't
975790	982170	want to like another trouble, and I don't want cancer. So we have to take the security devices,
982530	988410	the way they're put together, the configuration, if they're exposed or not, think about geopolitics,
988410	994870	but also think about the fact that not everybody is a friend. So if there's a major incident between
994870	1002350	several countries, even transit countries, some countries won't necessarily help others.
1002450	1009730	And even if they do help others, they don't necessarily phrase what they need in a proper
1009730	1017490	question so that another country can give proper aid. And one of the other things that we have to
1017490	1023690	think about is before something major happens, groups actually need to start talking to each
1023690	1029370	other because you don't just pick up the phone to a random country and go, hey, I need this stuff,
1029370	1035530	and they're like, I don't even know you. I've never met you. And trust goes a long way, both with formal
1035530	1042510	and informal networks. And one of the previous speakers had mentioned he was from academia,
1042510	1050370	and academia is fantastic, and they can think out of the box in certain ways, but unfortunately,
1050370	1058040	not every person who's in academia who's studying this topic necessarily has that hacker mentality.
1058510	1063240	And currently, there is not enough involvement from the tech community.
1066740	1073750	So we've got some things that are fantastic that we can use at the United Nations,
1073750	1079990	and these are existing treaties. Now, whilst I was giving my presentation, one of the other
1079990	1086370	presenters had brought up previous to me that perhaps we need to create this brand new treaty
1086930	1094550	to tackle these issues. And my response was, guess what? We have stuff that we can use, we can expand
1094550	1099590	on existing conventions, but if we're going to be doing a new treaty, it's going to take years
1099590	1106430	and years and years, if it even gets a certain level of consensus from other member states
1106430	1112670	inside the United Nations. And incidents don't wait years and years. Incidents want attention
1112670	1119130	now, and they need it now. So we can use the Budapest Convention. There's also existing
1119130	1125710	counterterrorism legislation and relationships between countries that also can be utilized
1125710	1130170	if there's a major attack that is happening, going through countries,
1130170	1133150	or hitting a particular country's critical infrastructure.
1135330	1141010	So when it comes to preparation, one of the things that we have to remember is
1141010	1147290	practice, practice, practice, right? And I think we've heard this at many different discussions,
1147290	1154890	whether it's critical infrastructure or other areas. And the way that you get very good at
1154890	1160750	something is to practice it. And obviously not every incident is going to be exactly the same
1160750	1167110	because everyone is unique, everyone is unique and different. But when we talk about exercises,
1167110	1171930	they're still kind of lacking, especially at the UN level for different things like this.
1172170	1178290	Now, a few years ago, I had the opportunity to work with the European Center for Foreign Relations
1178290	1186410	on building NATO and EU member exercises for diplomats and ministers. And I was the only
1187090	1195350	tech person who was a subject matter expert who was not an academic. And I noticed that this was
1195350	1203210	really, really lacking because we need to get certain people involved in this to do a good
1203210	1210710	exercise, accept team members, as well as ministerial advisors, because a minister
1210710	1216670	and an ambassador do not make decisions all by themselves, they have advisors.
1216810	1223710	We also have to involve the public and private sector, obviously grab some academics as well,
1223710	1230810	because they can share a lot of different research. But also consider us, a lot of the people who are
1230810	1235550	watching this talk right now, in the tech community and subject matter experts who have
1235550	1243830	actually dealt with some of these things. Reformed, nice hackers, so to speak, who can think in a way
1244590	1252490	that they can misuse systems and even information that nobody else can really think about within the
1252490	1259990	other groups. So one of the major things that I proposed to the United Nations was
1259990	1267250	we need to get security researchers involved. One of the biggest reasons is when you get the
1267250	1272150	tech community involved, I'll give you a good for instance, there's a CTI league, which was set up
1272150	1280050	of subject matter expert tech community folks, and they volunteer to protect hospitals and medical
1280050	1286850	personnel and medical devices. And they work extremely quickly. They also interface with
1286850	1293830	computer emergency response teams, Europol, and other law enforcement, so that hospitals have some
1293830	1302510	sort of advantage in this game. A few months ago, I was contacted by a particular EU government,
1302510	1308650	because 15 of their hospitals went down on a Friday night, because it was a cyber attack.
1308650	1315130	And that particular country came out publicly saying, this country who did these attacks,
1315130	1323930	stop attacking our hospitals. But defending and realizing that there are some exploitable systems
1323930	1329750	out there, if you've got the tech community involved, they can go ahead and interface
1330630	1336070	like that, like the snap of your fingers. Unfortunately, when you're dealing with
1336070	1342670	diplomats and countries on that much higher level, those formal networks are kind of slow.
1343390	1348990	Now, another thing that I brought up to the United Nations is the fact that the majority of ICT
1348990	1357210	vulnerabilities, both IT, ITICS areas, they're still discovered by good hackers like us, attending
1357210	1365910	DEF CON, SIGMO. And this is fantastic, because a lot of us do this, maybe for a t-shirt, some stickers,
1365910	1371890	sometimes a bug bounty, but really because we want these systems protected, so we can use them when
1371890	1380110	we say, go to a hospital. And unfortunately, we still face a lot of legal barriers. As I mentioned
1380110	1385610	before, not all certs actually will take vulnerability disclosures. And sometimes if
1385610	1393590	you contact a company or a power plant or a hospital or whatever, they might have the reaction of,
1393590	1399350	who the heck are you? Are you trying to extort us for money? Are you some sort of criminal?
1399350	1405210	So there's some legal barriers. And sometimes you have to deal with very strange laws, like in the
1405210	1409870	Netherlands, you're not allowed to ping a computer system. That's written in our cyber law. Even
1409870	1418470	computer systems you own, which is still kind of odd, but depending on the country or the laws,
1418470	1422510	you could actually be arrested for reporting some of these things.
1423310	1429990	Now, another issue is who to contact. Here you've got this major thing,
1429990	1435630	and you want to be able to contact people as quickly as possible in a secure manner,
1435630	1442170	but who do you contact? Using the CertEU example, I have no idea. And neither does the person
1442170	1452490	writing the paper for Germany. So what we have to realize is, as we all plainly know right now,
1452510	1459310	we live in this digital world. And we are absolutely as dependent on ICT systems as we are
1459310	1466450	to oxygen in this modern world. So my closing recommendation to the United Nations was that the
1466450	1473530	UN and member states should lead the effort in establishing computer emergency prevention teams,
1473530	1480410	because it is much easier, cheaper, quicker to prevent a major attack against critical
1480410	1489030	infrastructure than it is to try to put out a fire. So I have some references, which I can
1489030	1496510	copy and paste somehow and put into Discord, or folks can take screenshots. The first one is
1496510	1505030	the UN Group of Governmental Experts Report H from July 2015. There will be a new report coming out
1505030	1510950	from my presentation and other people's presentations that we gave at the United
1510950	1517830	Nations last month. And also, if you want to take a look at a very, very good
1517830	1524830	convention that actually deals with cybercrime that can be utilized for information sharing,
1524830	1530090	technology sharing, subject matter expert sharing, etc. when a major incident occurs,
1530090	1538170	Budapest Convention on Cybercrime is excellent. And last but not least, thank you very much ICS
1538170	1545230	Village and doing this safe mode. I know it took a lot of work. And Mr. Bryson Bort for inviting me
1545230	1551190	to do this talk. And if you want to know more about me, I'm available on Twitter. If you take
1551190	1560070	DMs, just no weird pictures, please. And also, we're doing a lot of work. We have just started
1560090	1566390	the cyber portion of the Middle East Institute. I'm the first distinguished non-resident fellow
1566890	1573070	and person coming in as a non-resident coming into the Middle East Institute specifically for
1573070	1579610	cyber to look at these particular issues. So, that ends my presentation. And what I'll do is
1579610	1585290	I will look on this Discord. And hopefully, there are some questions.
1586730	1595650	And there doesn't seem to be that many questions, but that's okay. Does the ICS Village have any
1595650	1612150	questions? Or I'll just dance. I'm up and it's after midnight and I'm still here, somehow.
1614710	1621170	Well, since no one has any more questions, thank you very much, everyone. And hopefully,
1621170	1628110	the United Nations will take some of my recommendations on how to secure their
1628110	1635750	individual member state cyberspace, specifically critical infrastructure, a lot better in the near
1635750	1637870	future. Thank you.