start	end	text
7010	14060	Hi everyone, we are AboDefense and we will make a presentation about Mexico's cybersecurity status.
14180	19360	In this presentation we will talk around industrial cybersecurity footprint, key data,
19360	25300	perspective, smart production, and sensor security experience, honeypot, lesson learns,
25300	32100	and opportunities. Thank you ICI Village DEF CON 28 and the cyber colleagues on this opportunity
32100	36180	to make a presentation about Mexico's industrial cybersecurity.
37800	45080	Talking about Mexico facts and figures, we have facts and figures in terms of the economy.
45080	51320	Mexico is ranking under position 12 around the world. Manufacturing services, transportation,
51320	55690	utilities, and spending are the main economical activities in Mexico.
56140	62220	In concern of the industrial sector, the manufacturing has an activity of 175 billion
62220	68860	U.S. dollars. Key subject focus on IC industrial security for this presentation.
69680	76780	The top industrial sectors are in Mexico the automotive industry. It's the top five world
76780	83420	with OEMs and their supply chain change. Medical is the second position in Latin America
84380	89180	behind Brazil. Aeronautics 60 percent, more competitive, and electronics the
89180	96160	largest economical region worldwide. Also Mexico have other industries like oil, electricity,
96480	105320	food, textiles, agriculture, chemical services, consumers, and furniture, I mean other sectors.
105540	113080	On the industrial sectors, more are important that the main manufacturing companies use 55 percent
113080	121920	of insulated PLCs inside the IC area. Most are insulated and most not connected to any network.
121920	128480	Three percent of use industrial service at the shop floor and connected to the network.
128800	132920	Most of these industrial services are set by the automotive international companies
132920	139820	like from Germany or Japan, among other ones. Most of the industrial companies are located
139820	143720	from center to the north of Mexico. As an example, the automotive industry is located
144590	150840	from the center and the north of Mexico. In the case of aerospace and medical industries are
150840	157420	situated on the northwest of Mexico. On the network subjects, we will see that the strongest future
157420	165130	is based more in the north of Mexico. Southern Mexico is more agriculture and other topics.
166170	176330	Mexico has around 50.3 million IP addresses, an average of 7.5 megabits and the cyber attacks
176330	184550	around 28 from 195 countries. So basically, the most important in the case of the cyber attacks
184550	194930	is mainly attacks to the government offices and other departments like, you know, banks and services.
196790	203110	In terms of the SWAT, the IC security, the strengths is that Mexico is growing in the industry
203110	208490	from point zero. It's focused to the smart production, smart logistics, smart enterprises,
208490	213510	among other ones, which require in a short period of time the implementation of the industrial
213510	221710	cybersecurity practices. For the U.S.-Mexico-Canada trade, which was released the 1st of July 2020,
221710	227790	covered the topic on digital and cyber security rules and process between the countries.
228110	235670	It's a major important thing, because, especially for Mexico, because Mexico needs to follow up
235670	240650	and implement the good practices and lessons necessary to accomplish the digital security
240650	247770	and internet policies from this trade. In terms of the weakness, Mexico has no deep
247770	253110	knowledge on ICS security topics. Also, the companies and the owners have no idea, even
253110	259090	awareness, about industrial cybersecurity. For those insecure systems, there is insufficient
259090	264990	information. There are opportunities as well. The U.S.-Mexico-Canada trade is focused to increase
264990	271250	commercial competitiveness region against other markets, Asian markets or European markets.
271250	276610	These trades include specific actions to meet cybersecurity terms, as the first one.
277610	283990	Trade, according to our experience, the most attack to industrial is related to ransomware,
283990	289610	especially on the R&P systems, as well as on all the internal attacks,
289610	296390	is not recorded at this time. Based on the automotive industrial sector,
297850	303530	Mexico is located... Mexico are located American companies, as well as European and Japanese
303530	312150	companies, which are located on the supplier chain. The European most use the industrial
312150	321430	cybersecurity architecture, according with the ISO and the improved and performance basis 4.0.
322050	326510	The merits of the concept are the data in real-time and non-real-time, the integration
326510	332250	and sharing data and connectivity. For the American enterprises, they follow the American
334630	343370	industry internal reference architecture, call it IIRA. They use it as a key merit,
343370	347470	real-time, non-real-time integration, shared data and connectivity, but as well,
347470	352150	they use the protocols, those protocols like a profit boost, mod boost, scan internet,
352150	358250	profit net, and the programs like a ladder and other devices with different kind of protocols,
358250	363410	which is one of the important things to use for industrial architecture cybersecurity.
364410	370610	According with our experience, during the last couple of years, we implemented for the industrial
370610	376570	sector and the architecture different kind of layers. One of the layers is the sensor integrity
376570	381670	that we will see in the next slides, the equipment, the boost data, and the network.
385020	393720	The word industrial is in terms of the smart factory at this time, using industry 1.0 concept.
394130	401790	They said the connectivity between machines and PLCs and other intelligent sensors, as well
401790	407330	other equipment. So the smart factory has integrated all the elements in the shop floor,
407330	414930	integrated in one unit. To accomplish and fulfill this strategy, we said that a smart
414930	421830	production concept. This smart production concept is accomplished to fulfill the strategy
421830	428690	that we set for the smart production. The smart production is set in individual modules, which
428690	433930	are interconnected to the smart factory. This architecture integrates components from machines,
433930	439950	sensors, PLC, network, servers, database, machine learning, machine-to-machine analytics,
439950	445290	visualization, and artificial intelligence, among other technology and innovations.
445670	450490	For a clean implementation, it was a set additional smart sensors to boost the power
450490	456710	and the brains at the shop floor to implement the full smart production. That is the new trend.
457170	462470	On the next slide, we will talk about the smart sensor cybersecurity. One important note on this
462470	467570	activity that I want to share with you as experience is the synchronization and speed
467570	474350	process key factor for industrial cybersecurity. It means low timing on industrial process is not
474510	481310	a problem as we can use and save the cybersecurity procedures. High speed industrial process, which
481310	488930	required up and down information to act, for example, above or open a sector or review
489430	495450	a model, less than 500 milliseconds make a major complexity to implement the smart factory
495450	502270	with industrial cybersecurity. Also, the lesser lens about the synchronization topic give it two
502270	508430	strategies recommendation in according with our experience. One refers to set the PLC
508430	514830	responsibility as it was designed at the long time means that the devices was to control dedicated
514830	522210	process and machines, only that. We not recommended that the PLC is doing extended activities. That
522210	528810	means doing everything. So everybody can say that a PLC and share and tell you that a PLC make
528810	535230	everything. This is not true. This is a dangerous equation. The second one is to reduce or eliminate
535230	543510	PLC connectivity into industrial pools network. That means that the PLC has to do his own job.
544230	549650	One is concerned, of course, if we put it the PLC on the network is to reduce the potential
549650	555050	vulnerability. And the second one is to reduce the issue on the synchronization on the process
555050	561190	and the boost network. One of the topics to confirm that we have experienced that is difficult to set
561670	570130	a service security, industrial service security. For the smart sensors and service security
570130	578050	strategy that we set as six, which means the S is a sensor, the I is integrity, the C is for
578050	585070	connectivity and the S for security. This concept that we are implemented, we use it, we divide it
585070	590750	in three blocks. One is related to the sensor integrity, the sensor connectivity and the sensor
590750	597330	cybersecurity as mentioned. The sensor integrity includes physical and functionality layers.
597330	603110	The physical take the sense of damage, which is common sometimes that people can damage during
603110	609890	the process at the shop floor or could be not intentional to damage the sensor. So the
609890	615470	cybersecurity protection tell us that the damage is made on the sensor and then we have to be
615470	622070	replaced or make an action immediately. So the cycle life of the sensor is important because
622070	629270	the cycle of the sensor, when the sensor is used by a resistance to review and sense the
629270	634070	level of the water, that can be changed immediately when we see that the response
634070	640250	of the information is not quite right. So we're using this information and review as a status
640250	646750	control loop to be that the cycle life of the center is okay. Actually as well, in terms of
646750	652150	functionality, the views of the sensor as well, the software, the program, there are many key
652150	658270	important things. The software and the program, they can be used or that it can be as well adopted
658270	665750	in terms of the somebody can have and connect it with our C235 or another boost communication,
665750	671990	they can make it and change the software in the program. We as well, we set on this strategy,
671990	678550	you know, the actions and the roadblocks and the firewall that nobody can change the software
678550	684630	and the program. In terms of the sensor connectivity, everybody knows. ProfiBoost,
684630	691470	MotherBoost, so this topic I will not to be in detail. And the subject of sensor cybersecurity,
691470	696210	the status control gives us the opportunity to review that the physical and functionality,
696210	702610	the sensor is okay. I show self-detection and self-assessment is provide as well that the
702610	708310	system as well the protocols of the software program and communication are okay. We put an
708310	714190	outside on this process, the cartography code, because according with the mentioned in the last
714190	721070	slides, the synchronization on the latency of the process in terms of the high performance processes
721600	728490	is not quite okay. We set as well an additional alert console. That means that this process,
728490	734110	the alert console process, we set a different boost communication. It's not in the same protocol
734110	740830	that we send it as the information data send it to the system. We send it in another channel
740830	747850	and as well another kind of information which tell us exactly if the sensor integrity,
747850	758650	physical and functionality is adopted. In terms of the essential of the sensor cybersecurity,
760230	767250	it show in really two blocks, one and three blocks. One is outside of the system,
767250	772810	which is a data interface. The other ones are connected. The detection search,
772810	778770	which is called it on the left block now, we call it a dummy because this is essential,
778770	785110	just one thermal part or just a resistance that they move according to the level of the water.
785110	792810	We call it a dummy sensor. It is dummy sensor connected via an I2C protocol.
792810	800730	This protocol has four modes. The standard mode is usually with a speed of 0.1 megabits per second.
801350	807010	The information is digitalized and then used to perform on the program with a specific language.
807010	811510	The program with this has an algorithm and make the action and perform the activities
811510	817530	that which it was programming. One of them is to send the information via a standard protocol to
817530	822510	outside of the world, which means that to send the information to the PLC or the motherboards
822510	829910	or another kind of communication to the data interface, which is important because the
829910	836790	different kind of net protocols, it was difficult to make a cybersecurity performance. That means
836790	843890	experience that we have is that synchronization is a very key factor. One topic is in defense of
843890	849830	the I2C protocol. Sensing information in some processes is a critical element, especially
849830	855810	with a high performance process. Process with production and security information can be lost
855810	861990	information only because the process of the boost communication synchronization is not aligned with
861990	869210	the process synchronization. And the PLC, if it has a timer and a timing delay,
869210	876630	if it's possible to miss key information of the process. That means on the case that latency
876630	884970	less than 500 milliseconds and use an attractive code on this communication can be put in a
884970	890130	dangerous situation the entire system. So we solve this issue using new security paths in
890130	895190	the entire architecture. This is clear that integrated crypto code, as we know from the
895190	899950	sensor to outside to the boost node, is not feasible, according to our experience today,
899950	904310	based on the total boost and the process synchronization. Both things are important
904310	909670	and important to do the cybersecurity, industrial cybersecurity activities.
910990	916610	The opportunities that we have in I2C cybersecurity is in terms of the monitoring.
916610	920730	Monitoring the sensor integrity as we saw, the equipment safely, and the boost security
920730	927190	as main architectural visibility and center management. Defense detections in terms of the
927190	932110	boost protocol and the peripheral devices evaluation, the threat detection as a sensor
932110	937910	equipment, the malicious code as well, the prevention as the incident response and services,
937910	943150	and as well the equipment risk assessment, which means to review the peripheral devices,
943150	945610	the service equipment, and the network devices.
946910	951970	During this process, in terms of the I2C industrial cybersecurity opportunities,
951970	959010	we set a deception exercise. We set a honeypot, lesser lengths, and the training that my friend
959630	967110	and colleague of this entire venture, with Alfonso as well, we will see in the next presentation from
967110	974550	Victor. Well guys, thank you for your time. I'm glad to be here. And well, as you know,
974550	979570	there are many experiments at previous publications about honeypots. We apply it for
979570	985710	this work on two areas that could be joining it in a small footprint. I mean, a small footprint
985710	995830	to detect internal events and incidents. Well, the first one is the training to learn core
995830	1000930	concepts from previous incidents and learn beyond buzzwords and clickbait cybersecurity
1001610	1010050	because we think that this could be overwhelming for many of us. The second one is to be productive.
1010050	1016930	I mean, to get productive data that allow us to have enough evidence to resolve an incident.
1018610	1025190	To implement this, there are previous conditions, previous steps that are important to be known
1025190	1032210	by the network owners, like a correct networking solution, a legal review,
1032210	1040140	and patents to see results focused on ICS systems versus general malware.
1043170	1051650	And the honeypots as idea and philosophy is very attractive because it's a good way to see
1052290	1060370	an attack in real time. And well, you can learn from it and also helps to replicate previous
1060370	1067410	attacks. In some moments, cybersecurity could be overwhelming for some people. There are too
1067410	1074850	much to learn. But based on previous attacks that we saw, there are core concepts that could be
1074850	1082330	studied. These concepts are covered by the major corporation matrices. And this gave us a
1082330	1088010	structured way to do it. And the second one is, well, how to handle incidents. This could be
1088010	1095870	learned too. And also the ICS architecture concepts are important to give a general fact.
1095870	1103130	And finally, the idea of this experiment or honeypot is that could be installed by power
1103130	1113550	users and not only by cybersecurity people. And learning through analyzing attacks, well,
1113550	1119390	obviously, is the first option, but there is another game. A honeypot could give productive
1119390	1126890	data in a traceable way. There are three main sources to start. The first one, the Windows host
1126890	1133930	from the multiple layers of the ICS and enterprise network. The second one, the network
1133930	1141050	in the different layers too. And finally, the emulation of the services. And well, all of this
1141050	1149950	in the internal network. The first component in our architecture is the Windows host
1149950	1156690	that are being used in different layers. We looked for simple components and tricks
1156690	1164930	that could give us important data about malware. And well, with this setup, we got multiple samples.
1164930	1173690	For example, with the file system trick, we got multiple samples. And also from the network
1173690	1185610	traffic, we observed that the most popular wormhole ports are being used too. And now,
1185610	1190910	regarding lateral movement and ransomware cases, we saw that the biggest and easiest
1191610	1201690	exploits are being used as first option. And from the network side, another component in the
1201690	1209070	architecture, our idea is to keep all the metadata possible as first priority. And the raw data
1210140	1217470	from the multiple sites as second objective. This could be achieved using Seq and Moloch,
1217470	1226110	these open source tools. But to implement these tools, the Malcom project helped us a lot to make
1226390	1232510	a quick setup in a productive environment. With this setup, we were able to investigate
1233150	1236990	multiple network movements from the multiple layers of the network,
1236990	1255090	and also to detect dual home PCs. About the DMZ, as I mentioned in the first slides,
1255090	1261710	our idea is to make an investigation in the internal network. However, as you know, the DMZ
1261710	1267770	setup was analyzed multiple times in previous investigations. And as you know, the detection
1267770	1274150	is very noisy, and also it's a high risk. So for that reason, we focus on internal networks.
1274150	1282630	But some setups were exposed in a short time using Mexican IPs. And there are two important
1282630	1290010	details that were to be mentioned. The first one is the timing of the attack. There is a correlation
1290010	1298710	between the exposition of the IP on a network-passing SENSIC service versus non-indexed
1298710	1308930	IPs. And finally, there is a gain if multiple protocols are being used instead of only one.
1309890	1320190	And, well, finally, to mimic services, a simple setup was performed on these four sides.
1320190	1328870	The first one is a network emulation. With this, we found that there are many pieces of software
1328870	1337110	that allows you to emulate any port, to replicate any port, and copy
1337810	1345030	this kind of behavior. The second one is about the file servers on the shop floor. For this,
1345030	1353030	the use of honey files were the option. And for the web replication from the front-end
1354770	1363650	web admin consoles, we used social engineer toolkit and also HTTP track. And, well, finally,
1363650	1369230	the most important component is Compot. As you know, Compot is a very popular piece of software
1369230	1381530	to deploy honeypots. And we used this with some physical components. And to make a quick setup
1382130	1391130	for the power users, we used Teapot as a main platform. With this, the use of Teapot was the
1391130	1403120	fastest way to make an implementation by the power users. And, well, that's it, guys. Thank
1403120	1412080	you for your time. As a remark, we saw these points. The USMCA trade is an opportunity to
1412780	1418360	improve the cybersecurity. The second one, well, Mexico is an undiscovered market for the ICS
1419160	1428080	cybersecurity. As Octavio mentioned, there are good numbers that prove this. Also, there's an
1428080	1441080	opportunity to train people in this topic. In all the industrial networks, we found that there are
1441240	1451420	a lot of talented people that could learn in a very fast way. And there is a passion about this.
1452240	1460320	The honeypot technology and the use of the ATTCQ metrics for ICS as part of the formal
1460320	1467640	training and detection is a good trick too. And finally, the speed of the network is not
1467940	1475980	a speed of the process talking about cybersecurity. And, well, thank you for your time.
1476400	1484520	If you have questions, please drop us a line. We will be on the ICS Village Discord channel.
1484520	1488720	Thank you for your time. Have a good day. Thank you.