1
00:00:02,100 --> 00:00:12,020
Welcome everyone to my talk today ICS security operations active defense concept with effective incident response in industrial control systems.

2
00:00:14,440 --> 00:00:16,460
This is John Kurnas.

3
00:00:16,460 --> 00:00:20,760
My name is pronounced as John, which is pretty close in English and John.

4
00:00:21,060 --> 00:00:30,640
And I am working as a OT security consultant and I have GICSP, OSCP, OSWPN certified hacker certifications.

5
00:00:30,640 --> 00:00:34,820
My bachelor is computer engineering and my master is cyber security.

6
00:00:34,820 --> 00:00:39,300
And you can reach me on Twitter and LinkedIn and GitHub as you can see here.

7
00:00:40,180 --> 00:00:49,980
I am of course a bit nervous about the presentation and let's take a deep breath and have some relaxation then we can continue.

8
00:00:50,680 --> 00:00:52,840
Okay, what's today's agenda?

9
00:00:53,020 --> 00:01:08,100
So I will discuss a bit on active defense concept and I will explain briefly threat intelligence, asset identification and network security monitoring, incident response for ICS and then taking the advantage of found threats.

10
00:01:08,920 --> 00:01:12,140
So what is active defense concept?

11
00:01:12,700 --> 00:01:14,400
It is something like this.

12
00:01:14,400 --> 00:01:18,300
Yes, improvising, adapting and overcoming as we agree.

13
00:01:18,820 --> 00:01:24,940
But yeah, it is also related to this picture.

14
00:01:25,840 --> 00:01:40,360
But in general, what I can explain is somewhere in the middle in here in the picture, it is the process of analysts monitoring for responding to and learning from adversaries internal to the network.

15
00:01:40,360 --> 00:02:03,640
So basically that means it is a combination of analyzing the adversaries steps and monitoring constantly to the internal network and then when you see any anomalies responding to that and basically when you see any action, basically create lessons learned and learn from the adversaries.

16
00:02:03,720 --> 00:02:14,780
It is not deployable by itself of course, it is built on the top of the good practices such as good architecture and then the passive defense.

17
00:02:15,480 --> 00:02:18,260
And it is not definitely a hackback.

18
00:02:18,260 --> 00:02:26,580
So you need to stay on your internal network to protect and you do not need to, you do not have to attack back to the adversaries of course.

19
00:02:27,260 --> 00:02:29,520
So why active defense is needed?

20
00:02:30,100 --> 00:02:49,580
As we can see, at least for a couple of years, traditional methods of protection without constant human interaction such as firewalls, IPS and antiviruses only provides a certain level of security and adversaries are getting stronger and stronger every day and the passive defense usually don't stop them,

21
00:02:49,580 --> 00:02:50,670
unfortunately.

22
00:02:52,140 --> 00:02:56,480
So let me take a look to the active cyber defense cycle.

23
00:02:56,540 --> 00:03:04,710
It consists of four elements, threat intelligent conception and asset identification and network security monitoring.

24
00:03:05,330 --> 00:03:15,850
And then incident response when it's necessary and using threat and environment manipulation to get over the adversaries.

25
00:03:15,870 --> 00:03:23,070
Basically this diagram is coming from the suns and references down there.

26
00:03:24,070 --> 00:04:01,590
So basically the idea is monitoring your area of responsibility which is quite necessary to at least have the, let's say, idea of the getting the baselines then checking the anomalies and that said implementing monitoring will bring you the chance for quick response when it's necessary when you see something odd and responding to incidents and attacks on time is of course crucial because especially on the industrial control systems if it affects the industrial control network it's going to cost you a lot.

27
00:04:02,410 --> 00:04:11,490
And constant changes are necessary since you need to beat the adversaries and kick them out of your industrial control network.

28
00:04:12,210 --> 00:04:17,150
And after that you need to share and you need to consume the lessons learned.

29
00:04:17,150 --> 00:04:30,430
At least you need to share with the community and you need to observe and collect the lessons learned from the community to develop better defenses on your systems, on your ICS.

30
00:04:31,860 --> 00:04:34,770
So what is threat intelligence?

31
00:04:34,770 --> 00:04:40,290
I'm gonna, I'm trying to explain this pretty quick.

32
00:04:40,290 --> 00:04:42,230
Let's start with the intelligence.

33
00:04:42,230 --> 00:04:55,550
So intelligence basically means the process of collecting data, turning into information and producing an assessment that satisfies a previously identified knowledge gap.

34
00:04:55,670 --> 00:05:05,530
So you need to obtain the, from the raw data to important information.

35
00:05:05,730 --> 00:05:18,690
So normally you can do, everybody can say yeah you can you can do this with the tools but unfortunately tools can only help and your analysts can create intelligence not the tools.

36
00:05:20,070 --> 00:05:31,950
An intelligence life cycle, when we take a look to the intelligence life cycle, it starts with planning and direction, then collection, then processing and exploitation.

37
00:05:31,950 --> 00:05:37,970
Exploitation here means, doesn't look like the exploitation in the computer science.

38
00:05:37,970 --> 00:05:46,850
It is more like clarifying and filtering the information that you need, that make it useful.

39
00:05:46,850 --> 00:05:52,290
And then analysis and production and dissemination and integration.

40
00:05:52,290 --> 00:05:56,530
Basically the intelligence life cycle consists of these elements.

41
00:05:57,650 --> 00:06:08,330
And then if we, if we discuss about the open source intelligence, it is a type of intelligence which is quite useful for adversaries as well as also for you.

42
00:06:09,170 --> 00:06:13,710
It is low cost and low impact but it gives essential information about you.

43
00:06:13,710 --> 00:06:21,250
So most of the time adversaries are googling on the internet, checking related documents and data about you.

44
00:06:21,250 --> 00:06:32,470
But you can also use this as your own beneficial by checking these documents and trying to reduce your threat landscape.

45
00:06:32,470 --> 00:06:40,310
Normally these sources can be public relation documents or partnership announcements that you share.

46
00:06:40,310 --> 00:06:48,850
Most of the time these documents are not considered dangerous but they are dangerous because they contain valuable information.

47
00:06:49,770 --> 00:06:52,110
Company information of course.

48
00:06:52,430 --> 00:07:05,490
If the company is a public company and if the company shares monthly or quarterly or, I don't know, annual reports, these reports also have valuable information about the company.

49
00:07:05,510 --> 00:07:12,030
Most of the time job descriptions basically leak the technologies of course.

50
00:07:12,030 --> 00:07:21,230
And advisories and alerts sometimes also might be related to your systems and give some hints about your systems.

51
00:07:21,230 --> 00:07:24,910
And of course your internet connected devices.

52
00:07:25,230 --> 00:07:29,370
These are the most dangerous things.

53
00:07:30,490 --> 00:07:44,370
So if you continue with the threat intelligence, in simple terms again threat intelligence is analyzing information related to adversaries that have intent, capability and opportunity to harm you.

54
00:07:44,970 --> 00:07:57,610
So that specific type of intelligence gives defenders knowledge of the adversary, their actions within the defender's environment and the capabilities as well as their tactics, techniques and procedures.

55
00:07:58,410 --> 00:08:17,110
And the threat intelligence is often shared in different methods, for example indicators of compromise, IOCs, as I mentioned tactics, techniques and procedures, TTPs and oftentimes complete report about an incident or an attack.

56
00:08:19,390 --> 00:08:25,330
And what do we need to do to identify our threat landscape?

57
00:08:25,490 --> 00:08:32,490
Threat landscape is a combination of information attack space, threat groups, industry and non-technical influences.

58
00:08:32,510 --> 00:08:47,290
So basically to identify your threat landscape you need to ask yourself who is interested to attack your organization and why, what would be the reason of causing damage and how can they get into your organization.

59
00:08:48,590 --> 00:09:00,710
And after you identify the threat landscape you need to reduce the threat landscape and most of the times asset and network identification is necessary to succeed.

60
00:09:00,710 --> 00:09:22,330
First of all you need to clarify your external and internal landscapes because you need to focus on your responsibility areas and as well as you would have some connections from third-party vendors or any other third-party service providers etc.

61
00:09:22,330 --> 00:10:01,090
Then using known information you need to try to reduce your threat landscape basically by checking these information and trying to prevent any leaking information like that and performing assessments and measurements also with the third-party companies or external companies because sometimes you need to have a second opinion or second eye to check that and after that you need to continue doing these again and again to reduce your landscape.

62
00:10:01,990 --> 00:10:34,410
An external threat intelligence is the threat intelligence comes from the specialized teams which can be professional services companies such as Dragos and or it could be from ICS search and other search basically provides indicator of compromises and TTPs and most of the time it is for large audiences it might not be relevant for you but still it is important to follow these threat intelligence reports,

63
00:10:34,410 --> 00:10:41,410
but sometimes of course the industry is not relevant for you and you don't need to take an action.

64
00:10:42,170 --> 00:10:53,330
But oftentimes ICS threat intelligence are limited, it's really hard to find, especially purely ICS threat intelligence, but when you find it, it's really priceless.

65
00:10:53,750 --> 00:11:13,570
And ICS search, multiple ISACs and old ISACs can provide SANS internet storm center, also providing threat intelligence, threat feeds, and reports from vendors and professional service companies, as I mentioned, like from Mandiant or from Dragos, for example,

66
00:11:13,570 --> 00:11:14,910
or FireEye.

67
00:11:15,710 --> 00:11:18,090
What is internal threat intelligence?

68
00:11:18,090 --> 00:11:20,570
Internal threat intelligence comes from your data.

69
00:11:21,050 --> 00:11:34,030
It is usable against the current problems in your environment because the data is coming from your environment and after you analyze, you basically realize there are some problems and it's directly relevant to your issues.

70
00:11:34,030 --> 00:11:44,490
But it requires personnel in order to do the analysis and it requires specialized skills such as malware and threat analysis.

71
00:11:47,430 --> 00:12:04,070
And if you summarize threat intelligence, tactical threat intelligence contains TTPs and IOCs, which are quite useful to add, change and implement your defense, or at least search for intrusions in your environment.

72
00:12:04,130 --> 00:12:11,290
And strategic threat intelligence can be used to look overall patterns, suspected attribution, trends and teams.

73
00:12:11,290 --> 00:12:17,310
It is also useful to identify where your defense might fail or already failing.

74
00:12:19,070 --> 00:12:36,370
So if you go for asset identification and network security monitoring, the purpose and importance of the asset identification is it is really hard to defend if you don't know what you have in your plant, in your facility or in your environment in general.

75
00:12:36,370 --> 00:12:41,170
Because if you don't know what's there, you cannot protect it basically.

76
00:12:41,470 --> 00:12:48,110
And advanced security solutions that you have also not effective if you can't provide the whole map to defend.

77
00:12:48,390 --> 00:12:56,110
So you need to at least provide the fundamental security to have this.

78
00:12:56,230 --> 00:13:05,550
And network security monitoring, threat intelligence and instant response usually works better if you have the network knowledge, if you have internal network knowledge.

79
00:13:06,650 --> 00:13:11,470
And how do we identify the assets in the ICS network then?

80
00:13:11,470 --> 00:13:15,890
We can say first we need to start determining the area of responsibility.

81
00:13:15,890 --> 00:13:23,950
Because as I mentioned, most of the times there are some remote connections that you need, you shouldn't include.

82
00:13:24,190 --> 00:13:32,450
Because yeah, of course, VPN endpoints on your side, that can count on your responsibility.

83
00:13:32,450 --> 00:13:39,310
But still, there are some ways that goes to outbound and not in your responsibility anymore.

84
00:13:39,410 --> 00:13:43,190
And then finding and utilizing the existing information.

85
00:13:43,750 --> 00:13:52,990
For example, if you already have some network diagrams that you have, you need to start with this, then you can validate non-information.

86
00:13:53,310 --> 00:14:04,950
And if it's not sufficient, and if you think you need to, let's say, create a new one, you can try to collect by doing physical inspection, which is normally a bit harder and takes much more time.

87
00:14:04,990 --> 00:14:12,030
You can do traffic analysis in your ICS network, passive analysis, that we can also say.

88
00:14:12,250 --> 00:14:14,950
We can do configuration file analysis.

89
00:14:15,470 --> 00:14:28,590
And we can do active scanning, which is not recommended, except you're, let's say, you are not in the production or if you're in a turnaround, you can do that.

90
00:14:28,590 --> 00:14:30,430
But otherwise, it's a bit dangerous.

91
00:14:30,610 --> 00:14:42,050
And then collecting the data in all the assets, you need to document it again, in order to have a nicely done diagram and have the old assets.

92
00:14:43,230 --> 00:14:47,170
And unfortunately, most of the ICS networks are flat networks.

93
00:14:47,170 --> 00:15:00,730
You'll notice that once you've done the asset identification, after identifying the assets, it's often required to have a physical or logical separation or both.

94
00:15:00,730 --> 00:15:06,170
It is quite necessary since it makes more difficult to adversaries to pivot in your network.

95
00:15:06,170 --> 00:15:13,590
Otherwise, if it's a flat network, normally a game would be over within, let's say, half an hour or one hour.

96
00:15:13,770 --> 00:15:21,890
For the active defense concept, it is really crucial because you need to build on top of the good architecture and passive defense.

97
00:15:23,490 --> 00:15:29,870
At least for me, the aim would be separating the network as explained in purging model.

98
00:15:29,870 --> 00:15:32,870
So it could be a good reference to start with.

99
00:15:33,150 --> 00:15:40,330
And then if you want to have more separation, then you can use micro-segmentation, etc.

100
00:15:40,330 --> 00:15:43,590
But it is the fundamental for the ICS networks.

101
00:15:45,370 --> 00:15:57,350
And network security monitoring is a continuous process to collect, detect, analyze indication of threats in order to respond faster to incidents and attacks in your network.

102
00:15:57,690 --> 00:16:04,130
It is threat centering approach instead of traditional vulnerability centering approach.

103
00:16:04,130 --> 00:16:09,270
Network security monitoring requires dedicated personnel as analysts.

104
00:16:09,310 --> 00:16:15,970
And it also requires preparation for infrastructure and also tools ahead of time.

105
00:16:16,110 --> 00:16:22,890
And it brings proactive approach to security and detection of the threats.

106
00:16:22,890 --> 00:16:32,310
So you can take some remediations once you identify the issues in your network.

107
00:16:34,170 --> 00:16:41,530
And network security monitoring provides visibility and helps you to identify the changes and anomalies.

108
00:16:41,670 --> 00:16:51,790
Might not be relevant to only adversaries, but also some misconfigurations for troubleshooting misconfigurations.

109
00:16:51,790 --> 00:16:58,150
And it helps you to detect intrusion attempts and movements within ICS SCADA networks.

110
00:16:58,250 --> 00:17:04,290
And it can evaluate separation and segregation for levels that you have and zones that you have.

111
00:17:04,610 --> 00:17:09,730
And it can help fine-tuning and validating the settings of passive defense elements.

112
00:17:09,730 --> 00:17:17,670
For example, checking the firewall rules and to see if it's correctly implemented or missing some points, etc.

113
00:17:17,930 --> 00:17:24,390
And it also can help reduce the threat landscape by hardening non-required ports and services.

114
00:17:24,390 --> 00:17:31,150
Since you are seeing this when you are doing the network security monitoring and you can instantly take remediation.

115
00:17:33,710 --> 00:17:41,170
Network security monitoring is more useful in ICS networks since most of the assets are critical.

116
00:17:41,710 --> 00:17:48,370
And most of the times, all the assets or any assets cannot be immediately patched.

117
00:17:48,630 --> 00:17:54,210
Because, yeah, we know ICS networks are quite, let's say, untouchable.

118
00:17:54,210 --> 00:18:02,160
And then you need to have any other layer to have the protection for your endpoints, etc.

119
00:18:02,590 --> 00:18:13,130
And ICS networks have many dependencies and connections, such as enterprise network connection, vendor connections, business applications, contractor VPNs.

120
00:18:13,130 --> 00:18:28,170
And it is really valuable to monitor these external parties for anomalies because once your vendor or once your contractor, let's say, compromised, it is just a moment to jump into your network by using these VPNs.

121
00:18:28,170 --> 00:18:34,870
And normally, you don't have any vision on these connections without active defense.

122
00:18:35,650 --> 00:18:38,090
And detection approaches.

123
00:18:39,550 --> 00:19:01,410
Most of the time, what we check is identifying the most used IP addresses and ports used within the network to create basically a baseline, identifying biggest bandwidth users, identifying encrypted communication, because most of the times, command and conquer centers are using encrypted communications.

124
00:19:01,590 --> 00:19:12,530
And identifying critical assets and usual traffic is also important to continue on the baseline to have stability on that.

125
00:19:12,530 --> 00:19:28,730
And identifying network anomalies, of course, and identifying lowest bandwidth and communication, because sometimes you can see in the network unusual traffic, which could be pretty less than your usual levels.

126
00:19:28,730 --> 00:19:32,350
And of course, you need to identify exfiltration.

127
00:19:32,890 --> 00:19:38,870
You need to check that when you are doing the detection.

128
00:19:39,730 --> 00:19:43,490
And asset identification and network security monitoring takeaways.

129
00:19:43,650 --> 00:19:49,690
Asset identification and network security monitoring is the key for active defense concepts.

130
00:19:49,890 --> 00:19:57,090
Network security monitoring is a great approach for ICS because most of the ICS networks are quite stable.

131
00:19:57,130 --> 00:20:06,510
And basically, once you create a baseline, it is easy to, let's say, monitor.

132
00:20:07,210 --> 00:20:12,750
And these two elements support implementation of better architecture and passive defense.

133
00:20:12,750 --> 00:20:22,750
Once you implement that, yeah, you can take a look back and you can, let's say, improve your basic fundamental security also.

134
00:20:22,770 --> 00:20:26,470
Detection often relies on the sensors in the ICS network.

135
00:20:26,730 --> 00:20:32,870
You need to be sure that you need to detect the baseline changes, anomalies, and IDS rules.

136
00:20:33,810 --> 00:20:39,590
Because these can basically warn you when you are doing the detection.

137
00:20:39,610 --> 00:20:42,570
And logs and visibility are really important.

138
00:20:42,970 --> 00:20:51,210
But yeah, you need to have an analyst to, let's say, contribute value on that.

139
00:20:51,210 --> 00:20:58,010
Because by itself, logs and visibility doesn't give you the chance that you can prevent.

140
00:20:58,290 --> 00:21:03,690
And analysts need to follow it constantly and verify it if there is an anomaly.

141
00:21:04,350 --> 00:21:08,190
And network security monitoring will eventually lead to instant response.

142
00:21:08,190 --> 00:21:10,530
You need to be ready for instant response.

143
00:21:12,170 --> 00:21:21,790
By saying that instant response for ICS, it is a bit different comparing to usual IT instant response.

144
00:21:21,790 --> 00:21:33,510
Because you cannot simply bring down the systems during the instant response when you're working on ICS networks.

145
00:21:33,510 --> 00:21:40,470
And the focus is a bit different by saying that maintaining safe and reliable operations is the most important thing.

146
00:21:40,470 --> 00:21:44,250
Acquiring meaningful forensic data within a limited time.

147
00:21:44,250 --> 00:21:46,850
Performing a timely analysis.

148
00:21:46,850 --> 00:21:49,590
And containing and eradicating the threats.

149
00:21:49,630 --> 00:21:55,110
Basically, these are the four elements that you need to follow when you're doing the ICS instant response.

150
00:21:58,640 --> 00:22:00,460
Before that, preparation.

151
00:22:00,460 --> 00:22:03,040
There are some steps that you need to follow.

152
00:22:03,080 --> 00:22:09,800
Preparation, same as traditional IT, but with some limitations such as testing tools, testing methods, but in a lab.

153
00:22:09,900 --> 00:22:11,880
Integrated detection and identification.

154
00:22:11,880 --> 00:22:21,240
Working with network security monitoring team to implement rules and detection capabilities, which is tailored to your threats in order to identify impacted systems.

155
00:22:21,560 --> 00:22:24,660
And evidence acquisition.

156
00:22:25,340 --> 00:22:36,180
Normally, you don't have that much time, like on IT side, you don't have that much time to do forensic analysis because you cannot stop the operations.

157
00:22:36,880 --> 00:22:41,980
Here, the focus is maintaining operations while acquiring enough evidence to perform later.

158
00:22:42,940 --> 00:22:45,780
You'll do the forensic analysis later.

159
00:22:46,080 --> 00:22:56,560
And time critical analysis using fast and well-tested techniques to quickly determine the overall impact to the operations.

160
00:22:57,340 --> 00:22:59,420
And supported activities.

161
00:22:59,480 --> 00:23:03,480
IR teams mostly share information and evidence.

162
00:23:03,480 --> 00:23:10,880
All the evidence should be passed to other teams to begin deep analysis and continue on the active defense cycle.

163
00:23:10,880 --> 00:23:11,700
Containment.

164
00:23:11,840 --> 00:23:18,080
Preserving the operations by collaborating with other teams, operators, and also engineers on the field.

165
00:23:18,760 --> 00:23:20,300
Eradication and recovery.

166
00:23:20,300 --> 00:23:27,560
You need to neutralize the threat by, for example, reimagining the system, reinstalling known good software, implementing patches.

167
00:23:27,860 --> 00:23:42,280
And then you need to provide the lessons learned, which is documents, finding for all, pass information to the network security monitoring team in order to identify and see if there is any reinfection, etc.

168
00:23:43,600 --> 00:23:46,580
And how do you prepare an incident response team?

169
00:23:47,480 --> 00:23:51,520
You need to determine the requirements and dependencies within your facility.

170
00:23:51,820 --> 00:23:57,020
For example, uptime, availability, and specific systems you need to take care.

171
00:23:57,480 --> 00:24:01,140
You need to decide if it's going to be in-house or outsourced.

172
00:24:01,140 --> 00:24:03,500
There are some advantages on both sides.

173
00:24:03,500 --> 00:24:13,220
But you need to decide, at least have a couple of people in your facility to do it more faster.

174
00:24:13,420 --> 00:24:20,720
A team size three, four well-trained people on site would be enough to cover, but you also need to think about the shifts, etc.

175
00:24:20,720 --> 00:24:24,120
So in total, it needs to be at least eight to 10 people.

176
00:24:24,320 --> 00:24:32,660
So chain of command is really important because there will be chaos and someone needs to communicate with the management team, etc.

177
00:24:32,660 --> 00:24:35,880
And it should be incident response director.

178
00:24:36,100 --> 00:24:41,180
Then all the evidence and incident handlers need to report to lead responder.

179
00:24:41,180 --> 00:24:45,260
And the chain of command needs to go up and down like this.

180
00:24:45,300 --> 00:24:50,400
And to build your ICS incident response team, you need to find the right personnel.

181
00:24:50,820 --> 00:24:59,680
Of course, it's the hardest part because incident response is really, to focus and develop yourself.

182
00:25:00,660 --> 00:25:14,420
And then also you need to take care of your jump kits because often jump kits, when you need it during the incident, most of the time you are losing some parts from the jump kit.

183
00:25:14,420 --> 00:25:16,820
It's easy to borrow from the jump kit.

184
00:25:16,820 --> 00:25:21,480
And then when you go to the incident, you are missing a couple of hard disks, etc.

185
00:25:21,480 --> 00:25:23,420
when you need it over there.

186
00:25:23,420 --> 00:25:25,780
So it's important.

187
00:25:26,060 --> 00:25:34,380
So evidence acquisition, you need to take care of the order of volatility.

188
00:25:34,900 --> 00:25:39,340
And you need to decide if it's going to be local or remote acquisition.

189
00:25:39,520 --> 00:25:45,480
I would prefer local because it's less risk and faster.

190
00:25:45,800 --> 00:25:53,820
The tools should be tested before on the systems because we are not talking about regular IT systems.

191
00:25:53,940 --> 00:26:02,840
Acquisition should be coordinated with all involved personnel and you need to discuss beforehand when you are touching any field device with engineers and operators.

192
00:26:02,840 --> 00:26:07,040
You need to gather all the evidence if the time permits.

193
00:26:07,260 --> 00:26:15,480
You need to start from registry and then any memory and then taking the disk images, for example.

194
00:26:15,740 --> 00:26:22,420
And you need to take necessary photos in order to see on the, let's say, devices.

195
00:26:22,540 --> 00:26:33,540
If you see any command prompt, you need to have an evidence because once you turn it off, you will lose it or you can lose it in any second.

196
00:26:33,560 --> 00:26:36,540
And all the data should be analyzed in an approved facility.

197
00:26:37,660 --> 00:26:41,540
What are the sources for the forensic data in ICS networks?

198
00:26:41,540 --> 00:26:57,440
Highly volatile data, system memory, network information, and system processes, and VPN connections, and these logs, and registry hives, HMIs, mostly Windows computers and you can have system logs, etc.

199
00:26:57,440 --> 00:27:09,700
Engineering workstations, controllers such as PLCs and RTUs, and sometimes virtual resources such as VMs and cloud environments if it's connected.

200
00:27:10,160 --> 00:27:16,200
And you need to do the high quality instant response in a timely manner.

201
00:27:16,200 --> 00:27:19,440
It's really important in ICS when you are doing this.

202
00:27:19,600 --> 00:27:22,920
Timely analysis is important to keep operations safe and reliable.

203
00:27:23,260 --> 00:27:28,560
It should focus on understanding the scope and then the type of incident.

204
00:27:29,080 --> 00:27:33,040
And the baseline information comparison will be really helpful when you do that.

205
00:27:33,480 --> 00:27:47,600
And focusing on the new connections in the bandwidth, new routes, anomalies in the VPN connections, registry keys, spawn processes, you need to check these first.

206
00:27:48,140 --> 00:27:53,260
And I said identification and network security monitoring help to respond quickly.

207
00:27:53,780 --> 00:27:58,160
And utilize good tools to reduce the analysis period.

208
00:27:58,160 --> 00:27:59,040
This is also important.

209
00:27:59,040 --> 00:28:02,700
You need to do the practice before going to the real incident.

210
00:28:03,540 --> 00:28:07,180
And how do you use threat intelligence in the instant response?

211
00:28:07,780 --> 00:28:11,980
Indicator of compromise to scope the infected systems.

212
00:28:11,980 --> 00:28:16,140
Then after that, you need to identify the network data on host.

213
00:28:16,220 --> 00:28:20,620
And TTPs to identify adversary efforts.

214
00:28:20,620 --> 00:28:27,080
And you need to utilize and ensure threats are gone after you've done the incident response.

215
00:28:28,280 --> 00:28:30,420
And instant response takeaways.

216
00:28:30,620 --> 00:28:41,780
You need to focus on providing actionable information about the scope of the threat and its potential impacts while you are acquiring the evidence without breaking operations and safety.

217
00:28:42,380 --> 00:28:44,920
ICS instant response should be tailor-made.

218
00:28:44,920 --> 00:28:47,780
It's a bit different than the IT, as I mentioned.

219
00:28:48,240 --> 00:28:52,060
Efforts must align with the goals and requirements of the operations.

220
00:28:52,060 --> 00:28:53,740
This is the first priority.

221
00:28:54,700 --> 00:28:57,100
Preparations should be done ahead of time.

222
00:28:57,500 --> 00:29:00,600
You really need to practice before it really happens.

223
00:29:00,720 --> 00:29:05,700
And acquired evidence and lessons learned should be shared with other personnel.

224
00:29:05,780 --> 00:29:12,880
So once you get evidence, you need to share it to move forward the active defense cycle.

225
00:29:14,400 --> 00:29:16,920
And let's summarize this.

226
00:29:16,920 --> 00:29:18,880
Taking the advantage of the found threats.

227
00:29:18,880 --> 00:29:30,840
Once you complete the instant response, if we can safely interact and understand with the threat, we can have the best source of defense information from the adversary's best capability.

228
00:29:30,840 --> 00:29:37,680
We can feed the active cyber defense center with the found threat intelligence to build better defense.

229
00:29:37,680 --> 00:29:45,360
It is important to identify and use indicators of compromises from the threats to help instant response.

230
00:29:45,820 --> 00:29:54,800
And understanding the malware's tactics to identify weaknesses in the current ICS architecture is valuable because after that, you need to improve your architecture.

231
00:29:54,960 --> 00:29:57,820
So these steps are really valuable.

232
00:29:58,440 --> 00:30:04,380
And my last presentation is about lessons learned sessions for long term success.

233
00:30:04,380 --> 00:30:12,340
For the success of active cyber defense cycle, lessons learned should be shared between the teams internally.

234
00:30:12,520 --> 00:30:17,420
And also necessary actions needs to be taken to build better defense.

235
00:30:17,560 --> 00:30:22,520
And after that, either during the incident and after the incident.

236
00:30:22,820 --> 00:30:37,720
And after that, once you share it internally, it's also recommended to share your lessons learned in an appropriate way with the ICS community because if you had that threat, someone else might get this soon.

237
00:30:37,720 --> 00:30:40,400
So it is really important and valuable.

238
00:30:42,080 --> 00:30:44,460
And yeah, I think I'm just on time.

239
00:30:44,460 --> 00:30:47,080
Thank you very much for listening to me.

240
00:30:47,080 --> 00:30:54,340
If you have any questions, either you can send me a message on LinkedIn or Twitter or you can ask now.

241
00:30:54,660 --> 00:30:55,640
Thank you.

242
00:30:56,180 --> 00:30:57,280
John, this is...

243
00:31:04,960 --> 00:31:12,540
Okay, so everybody look forward to see John and ask questions and all sorts of different things.

244
00:31:12,800 --> 00:31:16,540
On the DEF CON discord server, we're in the ICS village subgroup.

245
00:31:17,200 --> 00:31:18,460
And John, thank you very much.

246
00:31:18,460 --> 00:31:20,020
That was a fantastic presentation.

247
00:31:20,020 --> 00:31:21,040
Thank you.

248
00:31:21,420 --> 00:31:22,360
Cheers, bye.