WEBVTT 00:00.000 --> 00:02.900 Well, hello ICS Village. 00:02.900 --> 00:21.900 I'm coming to you live from sunny Amsterdam and today I'm going to be talking about critical infrastructure and a presentation that I gave recently at the United Nations after an invitation at the United Nations Institute for Disarmament Research. 00:21.920 --> 00:23.920 So, I hope you enjoy it. 00:24.460 --> 00:28.000 If you don't know who I am, that's fine. 00:28.080 --> 00:43.600 I'm certainly not a household name, but my name is Chris Kubecka and I am the CEO of two companies, one in the Netherlands, one in the UK, dealing with cyber warfare and ICS, IoT, and IT proactive security. 00:43.600 --> 00:47.240 I'm also a Distinguished Non-Resident Fellow at the Middle East Institute. 00:47.520 --> 01:01.180 And previous to all of this, I used to head the Information Protection Group for Aramco and I was a Aircrew member and was in Space Command dealing with many control systems. 01:01.180 --> 01:22.900 One might say I'm also a bit of a reformed hacker or at least now a reformed unethical hacker because I come from it from a slightly different point of view where I started as a kid being a black hat hacker and got busted at the age of 12 doing very, very naughty things. 01:23.200 --> 01:28.480 So, why is this particular talk and this topic important? 01:28.480 --> 01:33.840 Well, one of the reasons is we now live in this wonderful digital world. 01:33.840 --> 01:42.120 We're able to have DEF CON in the ICS village remotely and we depend absolutely on technology. 01:42.120 --> 01:51.720 And if we want our modern world to continue, we have to deal with the simple fact that hopefully our technology will not be used to kill us. 01:51.840 --> 02:05.600 So, the United Nations has been involved a little bit late in the game and they are very concerned about member states and their responsibilities securing the ICT assets within their own borders. 02:06.720 --> 02:23.900 So, in 2015, I did say they were a little late, a group of governmental experts published a report, Report H, that stated four main facts that every member state is supposed to secure its own country's cyberspace. 02:23.900 --> 02:28.460 That includes IT, IoT, and ICS security. 02:28.460 --> 02:34.180 In addition to that, every single member state should have a computer emergency response team. 02:34.180 --> 02:35.260 Fantastic. 02:36.000 --> 02:59.640 And also with that, if there is a country where an attack is coming from and then transiting through, that if you are a transit country, say like something coming through the Netherlands, aiming at Austria or the United States, then that transit country and their telecoms should be able to provide aid. 02:59.640 --> 03:19.900 And also, any member state that's under major attack should be able to exchange information on the incident and also technology, and if at all possible, additional subject matter experts like CERT teams to assist in a major attack. 03:19.900 --> 03:32.780 Now, this sounds all wonderful, lovely, jubbly, and at the UN, the majority of member states did agree to this particular report and thought that these things were very, very important to have. 03:32.900 --> 03:45.560 However, at the UN level, at this global scale, lots of government experts don't actually realize what's really going down on the ground. 03:45.820 --> 03:49.580 So, this is one of my favorite quotes. 03:49.680 --> 03:54.820 It is, never underestimate how dependent you are on your information technology and systems. 03:54.820 --> 03:56.540 It's become like oxygen. 03:56.580 --> 03:58.840 You think you can live without it, but you can't. 03:58.840 --> 04:05.240 And this was a quote from the CEO of Saudi Aramco after the 2012 Shamoon attacks. 04:05.260 --> 04:25.140 And what you're seeing here is a picture of one of the events that happened after the attack, where there were miles and miles of gasoline trucks that could no longer be loaded up, because the industrial IOT system in between was no longer functioning, 04:25.140 --> 04:27.100 nor were the payment systems. 04:27.320 --> 04:32.160 Now, Saudi Aramco experienced the world's worst cyber warfare attack. 04:32.160 --> 04:38.180 It isn't spoken about too much, because I'm currently the only person authorized to actually discuss it. 04:38.380 --> 04:43.940 In about two hours, 85% of their IT systems were lost. 04:44.020 --> 04:58.640 And when I say IT systems, this is a VoIP phone, this is the payment systems, this is the HR data, some of the backups were wiped, some of the firewalls were affected, and there were two production plants were actually affected. 04:59.060 --> 05:02.180 And unfortunately, Aramco was unprepared. 05:02.180 --> 05:10.840 They believed, you know what, barely anybody knows about us, unless you're in the oil and gas industry, so why would we ever be a target? 05:11.020 --> 05:19.260 Well, unfortunately for them, around the same time, Arab Spring was going on, and attacks that had recently occurred. 05:19.260 --> 05:24.280 And Saudi Arabia and Iran are not very good friends. 05:24.720 --> 05:37.180 And because of this lack of understanding, their systems, both on the IT side, IoT side, and ICS side, were not very prepared or secure at all. 05:37.700 --> 05:48.660 Now, in addition to this, the attack affected countrywide internet connectivity, taking out two of the three mobile providers, because they actually severed the internet connection. 05:48.760 --> 06:03.060 And Aramco provided internet connectivity for emergency services, hospitals, schools, police stations, universities, and you see where I'm going with this, it was not a very nice picture. 06:03.340 --> 06:13.600 14 days after the initial attack, Qatar's national oil company, Rasgas, a joint venture between Qatar and ExxonMobil, was hit with a different variant. 06:13.740 --> 06:20.000 The Shamoon variant for Saudi Aramco had a burning American flag, the Qatar one did not. 06:20.400 --> 06:35.300 And what we estimated after the attack, if the two companies had actually fallen and could not restore themselves as quickly as possible, we estimated that a barrel of oil could hit as high as $450 per barrel. 06:35.700 --> 06:42.980 And if that had happened, it would have caused a domino chain of global economic and supply chain damage. 06:42.980 --> 06:54.780 We see COVID right now where it's causing a lot of issues, but imagine if nobody could purchase oil, no cargo ships could purchase oil because it would be too expensive. 06:54.780 --> 06:56.760 You see where I'm going with this. 06:56.760 --> 07:03.780 We teetered precariously on the edge of a modern age, bronze age collapse due to a cyber malicious attack. 07:04.280 --> 07:16.460 The reason why I know about this attack in depth was because I was the person requested to help recover international business operations and establish their mature digital security and cyber threat intelligence. 07:17.480 --> 07:24.900 So one of the things we have to understand is the vast majority of critical infrastructure is actually privately owned. 07:24.900 --> 07:32.860 And there are limitations to how much a state can regulate, legislate, and ultimately dictate to the private sector. 07:32.860 --> 07:37.280 There are major costs associated with going, hey, guess what? 07:37.280 --> 07:38.900 You got this legacy stuff. 07:38.900 --> 07:40.820 It's not really up to snuff. 07:40.820 --> 07:42.800 So you're just going to have to replace it. 07:42.800 --> 07:52.980 So then comes into the question, what should water actually cost versus a beautifully near risk-free ICS system? 07:53.060 --> 08:11.900 And now that we're in the middle of pandemic, unfortunately, are hospitals going to have to choose between securing their systems, which also includes a lot of medical IoT devices, or are they going to have to go ventilator to cure ICT? 08:12.000 --> 08:17.940 And I think all of us right now watching this, we would kind of like those ventilators. 08:19.100 --> 08:27.200 Now, when it comes to establishing a computer emergency response team, this is a fantastic step. 08:27.200 --> 08:34.040 However, we have to understand that a CERT team is a very reactive team. 08:34.040 --> 08:36.380 They are constantly putting out fires. 08:36.380 --> 08:39.520 And usually these teams are not very big. 08:40.440 --> 08:48.980 What happens as well is they have to do putting out fires, write advisements to constituents, advisements to governments. 08:48.980 --> 08:56.500 They're doing a whole bunch of stuff in investigations and give training, and especially give training to critical infrastructure. 08:56.640 --> 09:04.160 They don't have a lot of time to do a lot of anything, but yet they're expected to do basically everything. 09:04.320 --> 09:18.200 We also have to understand that a lot of computer emergency response teams are not actually capable of doing all of the services that are expected of them, or are not actually mature enough to provide the majority of services. 09:18.300 --> 09:24.200 There are still CERT teams in various countries that don't even use encryption on their website. 09:24.660 --> 09:29.280 And not all CERTs actually take vulnerability disclosure. 09:29.760 --> 09:36.700 I provided feedback for a person who works for a German think tank who's writing a paper right now for the German government. 09:36.700 --> 09:43.780 And one of the things she noted was the fact that here I live in the European Union, and we have something called CERT-EU. 09:43.960 --> 09:55.460 And she was very puzzled over the fact that nowhere on their website could you find a link or information on how to actually disclose vulnerability information. 09:55.460 --> 10:06.000 And this is a CERT that, in essence, would provide a response for 513 million people. 10:06.000 --> 10:09.600 So there are a lot of limitations with CERTs. 10:09.880 --> 10:16.640 Now, one of the things that I proposed to the United Nations was CERTs, fantastic. 10:16.660 --> 10:25.420 I think that is step one to really taking a look at how member states should really secure their cyberspace. 10:25.420 --> 10:34.460 But at the same time, I proposed to them a CEPT, if one might pronounce it that way, but a Computer Emergency Prevention Team. 10:34.460 --> 10:38.540 And I truly believe that member states should have these. 10:38.540 --> 11:07.440 So a team that actively looks for any sort of issue or high probability of compromise to systems, whether that's IT, IT and ICS, they're exposed to the internet, look at the supply chain issues, which may allow for exposure, and be that kind of like fire alarm and warning system before the fire actually bursts into flames and has to be put out. 11:07.440 --> 11:19.740 In addition to this, they can also take on the role of the advisement, especially in critical infrastructure, allowing the computer emergency response teams to actually put out the fires when they need to. 11:19.740 --> 11:24.440 So I'm a big believer in proactive security. 11:24.660 --> 11:43.040 And currently, I am the subject matter expert for part of the European Union, where we're building the world's first exclusively proactive security team, where we are looking for high probability of compromise systems and detecting compromise as quickly as possible, 11:43.040 --> 11:56.300 and starting the incident response portion of locking down a system and determining what the major risks are before the CERT team comes in for the incident, the rest of the incident portion. 11:57.700 --> 12:05.240 So we live in this wonderful connected world, and I'm going to give you a new term and a hashtag you're free to use. 12:05.640 --> 12:08.420 BYOH, bring your own house. 12:08.420 --> 12:10.400 I happen to be in my home. 12:10.640 --> 12:32.950 But when we connect up to power plants, or any sort of production, or industrial IoT, or even our workplace, which might just be regular IT systems, what has happened in this wonderful pandemic, wonderful at all, is the fact that the employees were sent home, 12:32.950 --> 12:38.110 and this also includes technicians and engineers, and they're like, hey, do your job from home. 12:38.110 --> 12:39.370 Okay, great. 12:39.370 --> 12:48.290 So I share this network with perhaps my kids, perhaps my partner, perhaps I'm stealing the neighbor's Wi-Fi, who knows? 12:48.290 --> 12:56.450 And their home network is now considered perimeter security in many ways. 12:56.450 --> 13:08.550 Now, I'm fortunate to have my own commercial-grade firewall that cost me about 2,500 euro, but most companies are not going to roll that out for their employees. 13:08.910 --> 13:12.770 So perimeter security is now your front door. 13:12.770 --> 13:25.250 And when we take a look at how engineers and operators are trying to stay connected, we are going into a very kind scary area right now. 13:25.250 --> 13:44.470 Because one of the things I did, also preparing for my Red Team Village talk, was to do a massive scan across the internet and try to find some easily found exposed control systems, looking at ICS, industrial IoT. 13:44.630 --> 13:49.010 And unfortunately, I found way too many systems. 13:49.010 --> 13:53.590 As you can see, I have this wonderful table that says, please hack me. 13:53.650 --> 14:05.490 The reason for that is a lot of these systems, either they don't have very much in the way of security, like the Modbus protocol, you have to be very careful with that one. 14:05.490 --> 14:22.190 Or even if they've got a more modern control system protocol, it doesn't necessarily mean they're on the newest and greatest firmware, or the fact that a lot of these things now are really industrial IoT products. 14:22.190 --> 14:25.430 And they've got these wonderful things called web servers. 14:25.430 --> 14:31.050 And I'd like to say, if it looks like a web server, hack it like a web server. 14:31.690 --> 14:54.830 And so just because the protocols might be wonderfully put together, or say Siemens S7, if it's got a web server login exposed to the internet, and it hasn't really been tested for security, then release the cross-site scripting and a bevy of other different types of attacks. 14:56.470 --> 15:01.410 So one of the problems we have is hacking. 15:01.410 --> 15:13.590 And when I say hacking, I don't just mean my 10-year-old self, or some of the people who deal with offensive security and find certain vulnerabilities. 15:13.590 --> 15:19.610 We also have to consider the fact that a lot of nation-states are involved. 15:19.770 --> 15:37.530 When I say a lot, one of my favorites is actually Ethiopia has a full-fledged offensive security team that is authorized to do various hacks, because they've been at war and are involved in various skirmishes with DANTREA. 15:37.530 --> 15:45.210 So if Ethiopia has something, lots of other countries have this particular capability. 15:45.370 --> 15:50.290 We also have to take a look at geopolitics and things that are going on. 15:50.290 --> 16:10.610 I was chit-chatting with Bryson Bort before we started, and I'm currently doing research into cyber guerrilla warfare between Azerbaijan and Armenia, where the Armenian nuclear powder plant is actually under threat because Azerbaijan has publicly stated that they want to blow it up. 16:10.750 --> 16:18.750 And I don't think that's good for anyone, especially since I live in Europe, and I don't want to like another trouble, and I don't want cancer. 16:18.770 --> 16:33.010 So we have to take the security devices, the way they're put together, the configuration, if they're exposed or not, think about geopolitics, but also think about the fact that not everybody is a friend. 16:33.010 --> 16:42.350 So if there's a major incident between several countries, even transit countries, some countries won't necessarily help others. 16:42.450 --> 16:54.290 And even if they do help others, they don't necessarily phrase what they need in a proper question so that another country can give proper aid. 16:54.310 --> 17:10.070 And one of the other things that we have to think about is before something major happens, groups actually need to start talking to each other because you don't just pick up the phone to a random country and go, hey, I need this stuff, and they're like, 17:10.070 --> 17:11.330 I don't even know you. 17:11.330 --> 17:12.850 I've never met you. 17:13.170 --> 17:17.650 And trust goes a long way, both with formal and informal networks. 17:17.910 --> 17:38.040 And one of the previous speakers had mentioned he was from academia, and academia is fantastic, and they can think out of the box in certain ways, but unfortunately, not every person who's in academia who's studying this topic necessarily has that hacker mentality. 17:38.510 --> 17:43.240 And currently, there is not enough involvement from the tech community. 17:46.740 --> 17:56.490 So we've got some things that are fantastic that we can use at the United Nations, and these are existing treaties. 17:56.670 --> 18:08.830 Now, whilst I was giving my presentation, one of the other presenters had brought up previous to me that perhaps we need to create this brand new treaty to tackle these issues. 18:08.830 --> 18:12.210 And my response was, guess what? 18:12.210 --> 18:28.450 We have stuff that we can use, we can expand on existing conventions, but if we're going to be doing a new treaty, it's going to take years and years and years, if it even gets a certain level of consensus from other member states inside the United Nations. 18:28.450 --> 18:31.510 And incidents don't wait years and years. 18:31.510 --> 18:35.610 Incidents want attention now, and they need it now. 18:35.930 --> 18:38.130 So we can use the Budapest Convention. 18:38.130 --> 18:53.150 There's also existing counterterrorism legislation and relationships between countries that also can be utilized if there's a major attack that is happening, going through countries, or hitting a particular country's critical infrastructure. 18:55.330 --> 19:03.370 So when it comes to preparation, one of the things that we have to remember is practice, practice, practice, right? 19:03.370 --> 19:12.390 And I think we've heard this at many different discussions, whether it's critical infrastructure or other areas. 19:12.390 --> 19:16.870 And the way that you get very good at something is to practice it. 19:16.870 --> 19:25.030 And obviously not every incident is going to be exactly the same because everyone is unique, everyone is unique and different. 19:25.090 --> 19:31.930 But when we talk about exercises, they're still kind of lacking, especially at the UN level for different things like this. 19:32.170 --> 19:44.950 Now, a few years ago, I had the opportunity to work with the European Center for Foreign Relations on building NATO and EU member exercises for diplomats and ministers. 19:45.050 --> 19:51.890 And I was the only tech person who was a subject matter expert who was not an academic. 19:52.170 --> 20:14.930 And I noticed that this was really, really lacking because we need to get certain people involved in this to do a good exercise, accept team members, as well as ministerial advisors, because a minister and an ambassador do not make decisions all by themselves, 20:14.930 --> 20:16.670 they have advisors. 20:16.810 --> 20:26.990 We also have to involve the public and private sector, obviously grab some academics as well, because they can share a lot of different research. 20:27.110 --> 20:37.950 But also consider us, a lot of the people who are watching this talk right now, in the tech community and subject matter experts who have actually dealt with some of these things. 20:38.490 --> 20:54.230 Reformed, nice hackers, so to speak, who can think in a way that they can misuse systems and even information that nobody else can really think about within the other groups. 20:55.030 --> 21:03.550 So one of the major things that I proposed to the United Nations was we need to get security researchers involved. 21:03.570 --> 21:22.370 One of the biggest reasons is when you get the tech community involved, I'll give you a good for instance, there's a CTI league, which was set up of subject matter expert tech community folks, and they volunteer to protect hospitals and medical personnel and medical devices. 21:22.370 --> 21:25.210 And they work extremely quickly. 21:25.210 --> 21:38.190 They also interface with computer emergency response teams, Europol, and other law enforcement, so that hospitals have some sort of advantage in this game. 21:38.190 --> 21:48.650 A few months ago, I was contacted by a particular EU government, because 15 of their hospitals went down on a Friday night, because it was a cyber attack. 21:48.650 --> 21:57.910 And that particular country came out publicly saying, this country who did these attacks, stop attacking our hospitals. 21:58.050 --> 22:14.050 But defending and realizing that there are some exploitable systems out there, if you've got the tech community involved, they can go ahead and interface like that, like the snap of your fingers. 22:14.610 --> 22:22.670 Unfortunately, when you're dealing with diplomats and countries on that much higher level, those formal networks are kind of slow. 22:23.390 --> 22:38.850 Now, another thing that I brought up to the United Nations is the fact that the majority of ICT vulnerabilities, both IT, ITICS areas, they're still discovered by good hackers like us, attending DEF CON, SIGMO. 22:39.110 --> 22:53.970 And this is fantastic, because a lot of us do this, maybe for a t-shirt, some stickers, sometimes a bug bounty, but really because we want these systems protected, so we can use them when we say, go to a hospital. 22:54.330 --> 22:58.990 And unfortunately, we still face a lot of legal barriers. 22:59.110 --> 23:04.350 As I mentioned before, not all certs actually will take vulnerability disclosures. 23:04.350 --> 23:15.030 And sometimes if you contact a company or a power plant or a hospital or whatever, they might have the reaction of, who the heck are you? 23:15.030 --> 23:17.150 Are you trying to extort us for money? 23:17.430 --> 23:19.350 Are you some sort of criminal? 23:19.350 --> 23:21.730 So there's some legal barriers. 23:21.930 --> 23:28.050 And sometimes you have to deal with very strange laws, like in the Netherlands, you're not allowed to ping a computer system. 23:28.050 --> 23:29.610 That's written in our cyber law. 23:29.610 --> 23:42.510 Even computer systems you own, which is still kind of odd, but depending on the country or the laws, you could actually be arrested for reporting some of these things. 23:43.310 --> 23:47.430 Now, another issue is who to contact. 23:47.710 --> 23:56.990 Here you've got this major thing, and you want to be able to contact people as quickly as possible in a secure manner, but who do you contact? 23:56.990 --> 24:01.110 Using the CertEU example, I have no idea. 24:01.130 --> 24:03.970 And neither does the person writing the paper for Germany. 24:05.670 --> 24:15.210 So what we have to realize is, as we all plainly know right now, we live in this digital world. 24:15.230 --> 24:22.030 And we are absolutely as dependent on ICT systems as we are to oxygen in this modern world. 24:22.030 --> 24:43.610 So my closing recommendation to the United Nations was that the UN and member states should lead the effort in establishing computer emergency prevention teams, because it is much easier, cheaper, quicker to prevent a major attack against critical infrastructure than it is to try to put out a fire. 24:45.770 --> 24:55.430 So I have some references, which I can copy and paste somehow and put into Discord, or folks can take screenshots. 24:55.430 --> 25:03.110 The first one is the UN Group of Governmental Experts Report H from July 2015. 25:03.110 --> 25:13.750 There will be a new report coming out from my presentation and other people's presentations that we gave at the United Nations last month. 25:13.750 --> 25:28.070 And also, if you want to take a look at a very, very good convention that actually deals with cybercrime that can be utilized for information sharing, technology sharing, subject matter expert sharing, etc. 25:28.070 --> 25:33.910 when a major incident occurs, Budapest Convention on Cybercrime is excellent. 25:34.930 --> 25:40.710 And last but not least, thank you very much ICS Village and doing this safe mode. 25:40.710 --> 25:42.350 I know it took a lot of work. 25:42.410 --> 25:43.070 And Mr. 25:43.070 --> 25:46.690 Bryson Bort for inviting me to do this talk. 25:46.770 --> 25:50.650 And if you want to know more about me, I'm available on Twitter. 25:50.650 --> 25:54.570 If you take DMs, just no weird pictures, please. 25:54.990 --> 25:58.350 And also, we're doing a lot of work. 25:58.350 --> 26:03.130 We have just started the cyber portion of the Middle East Institute. 26:03.350 --> 26:15.890 I'm the first distinguished non-resident fellow and person coming in as a non-resident coming into the Middle East Institute specifically for cyber to look at these particular issues. 26:15.950 --> 26:18.630 So, that ends my presentation. 26:18.630 --> 26:22.270 And what I'll do is I will look on this Discord. 26:22.330 --> 26:25.290 And hopefully, there are some questions. 26:26.730 --> 26:32.130 And there doesn't seem to be that many questions, but that's okay. 26:32.810 --> 26:36.710 Does the ICS Village have any questions? 26:38.790 --> 26:40.810 Or I'll just dance. 26:47.150 --> 26:52.150 I'm up and it's after midnight and I'm still here, somehow. 26:54.710 --> 27:00.170 Well, since no one has any more questions, thank you very much, everyone. 27:00.170 --> 27:16.710 And hopefully, the United Nations will take some of my recommendations on how to secure their individual member state cyberspace, specifically critical infrastructure, a lot better in the near future. 27:16.710 --> 27:17.870 Thank you.