WEBVTT 00:02.100 --> 00:12.020 Welcome everyone to my talk today ICS security operations active defense concept with effective incident response in industrial control systems. 00:14.440 --> 00:16.460 This is John Kurnas. 00:16.460 --> 00:20.760 My name is pronounced as John, which is pretty close in English and John. 00:21.060 --> 00:30.640 And I am working as a OT security consultant and I have GICSP, OSCP, OSWPN certified hacker certifications. 00:30.640 --> 00:34.820 My bachelor is computer engineering and my master is cyber security. 00:34.820 --> 00:39.300 And you can reach me on Twitter and LinkedIn and GitHub as you can see here. 00:40.180 --> 00:49.980 I am of course a bit nervous about the presentation and let's take a deep breath and have some relaxation then we can continue. 00:50.680 --> 00:52.840 Okay, what's today's agenda? 00:53.020 --> 01:08.100 So I will discuss a bit on active defense concept and I will explain briefly threat intelligence, asset identification and network security monitoring, incident response for ICS and then taking the advantage of found threats. 01:08.920 --> 01:12.140 So what is active defense concept? 01:12.700 --> 01:14.400 It is something like this. 01:14.400 --> 01:18.300 Yes, improvising, adapting and overcoming as we agree. 01:18.820 --> 01:24.940 But yeah, it is also related to this picture. 01:25.840 --> 01:40.360 But in general, what I can explain is somewhere in the middle in here in the picture, it is the process of analysts monitoring for responding to and learning from adversaries internal to the network. 01:40.360 --> 02:03.640 So basically that means it is a combination of analyzing the adversaries steps and monitoring constantly to the internal network and then when you see any anomalies responding to that and basically when you see any action, basically create lessons learned and learn from the adversaries. 02:03.720 --> 02:14.780 It is not deployable by itself of course, it is built on the top of the good practices such as good architecture and then the passive defense. 02:15.480 --> 02:18.260 And it is not definitely a hackback. 02:18.260 --> 02:26.580 So you need to stay on your internal network to protect and you do not need to, you do not have to attack back to the adversaries of course. 02:27.260 --> 02:29.520 So why active defense is needed? 02:30.100 --> 02:49.580 As we can see, at least for a couple of years, traditional methods of protection without constant human interaction such as firewalls, IPS and antiviruses only provides a certain level of security and adversaries are getting stronger and stronger every day and the passive defense usually don't stop them, 02:49.580 --> 02:50.670 unfortunately. 02:52.140 --> 02:56.480 So let me take a look to the active cyber defense cycle. 02:56.540 --> 03:04.710 It consists of four elements, threat intelligent conception and asset identification and network security monitoring. 03:05.330 --> 03:15.850 And then incident response when it's necessary and using threat and environment manipulation to get over the adversaries. 03:15.870 --> 03:23.070 Basically this diagram is coming from the suns and references down there. 03:24.070 --> 04:01.590 So basically the idea is monitoring your area of responsibility which is quite necessary to at least have the, let's say, idea of the getting the baselines then checking the anomalies and that said implementing monitoring will bring you the chance for quick response when it's necessary when you see something odd and responding to incidents and attacks on time is of course crucial because especially on the industrial control systems if it affects the industrial control network it's going to cost you a lot. 04:02.410 --> 04:11.490 And constant changes are necessary since you need to beat the adversaries and kick them out of your industrial control network. 04:12.210 --> 04:17.150 And after that you need to share and you need to consume the lessons learned. 04:17.150 --> 04:30.430 At least you need to share with the community and you need to observe and collect the lessons learned from the community to develop better defenses on your systems, on your ICS. 04:31.860 --> 04:34.770 So what is threat intelligence? 04:34.770 --> 04:40.290 I'm gonna, I'm trying to explain this pretty quick. 04:40.290 --> 04:42.230 Let's start with the intelligence. 04:42.230 --> 04:55.550 So intelligence basically means the process of collecting data, turning into information and producing an assessment that satisfies a previously identified knowledge gap. 04:55.670 --> 05:05.530 So you need to obtain the, from the raw data to important information. 05:05.730 --> 05:18.690 So normally you can do, everybody can say yeah you can you can do this with the tools but unfortunately tools can only help and your analysts can create intelligence not the tools. 05:20.070 --> 05:31.950 An intelligence life cycle, when we take a look to the intelligence life cycle, it starts with planning and direction, then collection, then processing and exploitation. 05:31.950 --> 05:37.970 Exploitation here means, doesn't look like the exploitation in the computer science. 05:37.970 --> 05:46.850 It is more like clarifying and filtering the information that you need, that make it useful. 05:46.850 --> 05:52.290 And then analysis and production and dissemination and integration. 05:52.290 --> 05:56.530 Basically the intelligence life cycle consists of these elements. 05:57.650 --> 06:08.330 And then if we, if we discuss about the open source intelligence, it is a type of intelligence which is quite useful for adversaries as well as also for you. 06:09.170 --> 06:13.710 It is low cost and low impact but it gives essential information about you. 06:13.710 --> 06:21.250 So most of the time adversaries are googling on the internet, checking related documents and data about you. 06:21.250 --> 06:32.470 But you can also use this as your own beneficial by checking these documents and trying to reduce your threat landscape. 06:32.470 --> 06:40.310 Normally these sources can be public relation documents or partnership announcements that you share. 06:40.310 --> 06:48.850 Most of the time these documents are not considered dangerous but they are dangerous because they contain valuable information. 06:49.770 --> 06:52.110 Company information of course. 06:52.430 --> 07:05.490 If the company is a public company and if the company shares monthly or quarterly or, I don't know, annual reports, these reports also have valuable information about the company. 07:05.510 --> 07:12.030 Most of the time job descriptions basically leak the technologies of course. 07:12.030 --> 07:21.230 And advisories and alerts sometimes also might be related to your systems and give some hints about your systems. 07:21.230 --> 07:24.910 And of course your internet connected devices. 07:25.230 --> 07:29.370 These are the most dangerous things. 07:30.490 --> 07:44.370 So if you continue with the threat intelligence, in simple terms again threat intelligence is analyzing information related to adversaries that have intent, capability and opportunity to harm you. 07:44.970 --> 07:57.610 So that specific type of intelligence gives defenders knowledge of the adversary, their actions within the defender's environment and the capabilities as well as their tactics, techniques and procedures. 07:58.410 --> 08:17.110 And the threat intelligence is often shared in different methods, for example indicators of compromise, IOCs, as I mentioned tactics, techniques and procedures, TTPs and oftentimes complete report about an incident or an attack. 08:19.390 --> 08:25.330 And what do we need to do to identify our threat landscape? 08:25.490 --> 08:32.490 Threat landscape is a combination of information attack space, threat groups, industry and non-technical influences. 08:32.510 --> 08:47.290 So basically to identify your threat landscape you need to ask yourself who is interested to attack your organization and why, what would be the reason of causing damage and how can they get into your organization. 08:48.590 --> 09:00.710 And after you identify the threat landscape you need to reduce the threat landscape and most of the times asset and network identification is necessary to succeed. 09:00.710 --> 09:22.330 First of all you need to clarify your external and internal landscapes because you need to focus on your responsibility areas and as well as you would have some connections from third-party vendors or any other third-party service providers etc. 09:22.330 --> 10:01.090 Then using known information you need to try to reduce your threat landscape basically by checking these information and trying to prevent any leaking information like that and performing assessments and measurements also with the third-party companies or external companies because sometimes you need to have a second opinion or second eye to check that and after that you need to continue doing these again and again to reduce your landscape. 10:01.990 --> 10:34.410 An external threat intelligence is the threat intelligence comes from the specialized teams which can be professional services companies such as Dragos and or it could be from ICS search and other search basically provides indicator of compromises and TTPs and most of the time it is for large audiences it might not be relevant for you but still it is important to follow these threat intelligence reports, 10:34.410 --> 10:41.410 but sometimes of course the industry is not relevant for you and you don't need to take an action. 10:42.170 --> 10:53.330 But oftentimes ICS threat intelligence are limited, it's really hard to find, especially purely ICS threat intelligence, but when you find it, it's really priceless. 10:53.750 --> 11:13.570 And ICS search, multiple ISACs and old ISACs can provide SANS internet storm center, also providing threat intelligence, threat feeds, and reports from vendors and professional service companies, as I mentioned, like from Mandiant or from Dragos, for example, 11:13.570 --> 11:14.910 or FireEye. 11:15.710 --> 11:18.090 What is internal threat intelligence? 11:18.090 --> 11:20.570 Internal threat intelligence comes from your data. 11:21.050 --> 11:34.030 It is usable against the current problems in your environment because the data is coming from your environment and after you analyze, you basically realize there are some problems and it's directly relevant to your issues. 11:34.030 --> 11:44.490 But it requires personnel in order to do the analysis and it requires specialized skills such as malware and threat analysis. 11:47.430 --> 12:04.070 And if you summarize threat intelligence, tactical threat intelligence contains TTPs and IOCs, which are quite useful to add, change and implement your defense, or at least search for intrusions in your environment. 12:04.130 --> 12:11.290 And strategic threat intelligence can be used to look overall patterns, suspected attribution, trends and teams. 12:11.290 --> 12:17.310 It is also useful to identify where your defense might fail or already failing. 12:19.070 --> 12:36.370 So if you go for asset identification and network security monitoring, the purpose and importance of the asset identification is it is really hard to defend if you don't know what you have in your plant, in your facility or in your environment in general. 12:36.370 --> 12:41.170 Because if you don't know what's there, you cannot protect it basically. 12:41.470 --> 12:48.110 And advanced security solutions that you have also not effective if you can't provide the whole map to defend. 12:48.390 --> 12:56.110 So you need to at least provide the fundamental security to have this. 12:56.230 --> 13:05.550 And network security monitoring, threat intelligence and instant response usually works better if you have the network knowledge, if you have internal network knowledge. 13:06.650 --> 13:11.470 And how do we identify the assets in the ICS network then? 13:11.470 --> 13:15.890 We can say first we need to start determining the area of responsibility. 13:15.890 --> 13:23.950 Because as I mentioned, most of the times there are some remote connections that you need, you shouldn't include. 13:24.190 --> 13:32.450 Because yeah, of course, VPN endpoints on your side, that can count on your responsibility. 13:32.450 --> 13:39.310 But still, there are some ways that goes to outbound and not in your responsibility anymore. 13:39.410 --> 13:43.190 And then finding and utilizing the existing information. 13:43.750 --> 13:52.990 For example, if you already have some network diagrams that you have, you need to start with this, then you can validate non-information. 13:53.310 --> 14:04.950 And if it's not sufficient, and if you think you need to, let's say, create a new one, you can try to collect by doing physical inspection, which is normally a bit harder and takes much more time. 14:04.990 --> 14:12.030 You can do traffic analysis in your ICS network, passive analysis, that we can also say. 14:12.250 --> 14:14.950 We can do configuration file analysis. 14:15.470 --> 14:28.590 And we can do active scanning, which is not recommended, except you're, let's say, you are not in the production or if you're in a turnaround, you can do that. 14:28.590 --> 14:30.430 But otherwise, it's a bit dangerous. 14:30.610 --> 14:42.050 And then collecting the data in all the assets, you need to document it again, in order to have a nicely done diagram and have the old assets. 14:43.230 --> 14:47.170 And unfortunately, most of the ICS networks are flat networks. 14:47.170 --> 15:00.730 You'll notice that once you've done the asset identification, after identifying the assets, it's often required to have a physical or logical separation or both. 15:00.730 --> 15:06.170 It is quite necessary since it makes more difficult to adversaries to pivot in your network. 15:06.170 --> 15:13.590 Otherwise, if it's a flat network, normally a game would be over within, let's say, half an hour or one hour. 15:13.770 --> 15:21.890 For the active defense concept, it is really crucial because you need to build on top of the good architecture and passive defense. 15:23.490 --> 15:29.870 At least for me, the aim would be separating the network as explained in purging model. 15:29.870 --> 15:32.870 So it could be a good reference to start with. 15:33.150 --> 15:40.330 And then if you want to have more separation, then you can use micro-segmentation, etc. 15:40.330 --> 15:43.590 But it is the fundamental for the ICS networks. 15:45.370 --> 15:57.350 And network security monitoring is a continuous process to collect, detect, analyze indication of threats in order to respond faster to incidents and attacks in your network. 15:57.690 --> 16:04.130 It is threat centering approach instead of traditional vulnerability centering approach. 16:04.130 --> 16:09.270 Network security monitoring requires dedicated personnel as analysts. 16:09.310 --> 16:15.970 And it also requires preparation for infrastructure and also tools ahead of time. 16:16.110 --> 16:22.890 And it brings proactive approach to security and detection of the threats. 16:22.890 --> 16:32.310 So you can take some remediations once you identify the issues in your network. 16:34.170 --> 16:41.530 And network security monitoring provides visibility and helps you to identify the changes and anomalies. 16:41.670 --> 16:51.790 Might not be relevant to only adversaries, but also some misconfigurations for troubleshooting misconfigurations. 16:51.790 --> 16:58.150 And it helps you to detect intrusion attempts and movements within ICS SCADA networks. 16:58.250 --> 17:04.290 And it can evaluate separation and segregation for levels that you have and zones that you have. 17:04.610 --> 17:09.730 And it can help fine-tuning and validating the settings of passive defense elements. 17:09.730 --> 17:17.670 For example, checking the firewall rules and to see if it's correctly implemented or missing some points, etc. 17:17.930 --> 17:24.390 And it also can help reduce the threat landscape by hardening non-required ports and services. 17:24.390 --> 17:31.150 Since you are seeing this when you are doing the network security monitoring and you can instantly take remediation. 17:33.710 --> 17:41.170 Network security monitoring is more useful in ICS networks since most of the assets are critical. 17:41.710 --> 17:48.370 And most of the times, all the assets or any assets cannot be immediately patched. 17:48.630 --> 17:54.210 Because, yeah, we know ICS networks are quite, let's say, untouchable. 17:54.210 --> 18:02.160 And then you need to have any other layer to have the protection for your endpoints, etc. 18:02.590 --> 18:13.130 And ICS networks have many dependencies and connections, such as enterprise network connection, vendor connections, business applications, contractor VPNs. 18:13.130 --> 18:28.170 And it is really valuable to monitor these external parties for anomalies because once your vendor or once your contractor, let's say, compromised, it is just a moment to jump into your network by using these VPNs. 18:28.170 --> 18:34.870 And normally, you don't have any vision on these connections without active defense. 18:35.650 --> 18:38.090 And detection approaches. 18:39.550 --> 19:01.410 Most of the time, what we check is identifying the most used IP addresses and ports used within the network to create basically a baseline, identifying biggest bandwidth users, identifying encrypted communication, because most of the times, command and conquer centers are using encrypted communications. 19:01.590 --> 19:12.530 And identifying critical assets and usual traffic is also important to continue on the baseline to have stability on that. 19:12.530 --> 19:28.730 And identifying network anomalies, of course, and identifying lowest bandwidth and communication, because sometimes you can see in the network unusual traffic, which could be pretty less than your usual levels. 19:28.730 --> 19:32.350 And of course, you need to identify exfiltration. 19:32.890 --> 19:38.870 You need to check that when you are doing the detection. 19:39.730 --> 19:43.490 And asset identification and network security monitoring takeaways. 19:43.650 --> 19:49.690 Asset identification and network security monitoring is the key for active defense concepts. 19:49.890 --> 19:57.090 Network security monitoring is a great approach for ICS because most of the ICS networks are quite stable. 19:57.130 --> 20:06.510 And basically, once you create a baseline, it is easy to, let's say, monitor. 20:07.210 --> 20:12.750 And these two elements support implementation of better architecture and passive defense. 20:12.750 --> 20:22.750 Once you implement that, yeah, you can take a look back and you can, let's say, improve your basic fundamental security also. 20:22.770 --> 20:26.470 Detection often relies on the sensors in the ICS network. 20:26.730 --> 20:32.870 You need to be sure that you need to detect the baseline changes, anomalies, and IDS rules. 20:33.810 --> 20:39.590 Because these can basically warn you when you are doing the detection. 20:39.610 --> 20:42.570 And logs and visibility are really important. 20:42.970 --> 20:51.210 But yeah, you need to have an analyst to, let's say, contribute value on that. 20:51.210 --> 20:58.010 Because by itself, logs and visibility doesn't give you the chance that you can prevent. 20:58.290 --> 21:03.690 And analysts need to follow it constantly and verify it if there is an anomaly. 21:04.350 --> 21:08.190 And network security monitoring will eventually lead to instant response. 21:08.190 --> 21:10.530 You need to be ready for instant response. 21:12.170 --> 21:21.790 By saying that instant response for ICS, it is a bit different comparing to usual IT instant response. 21:21.790 --> 21:33.510 Because you cannot simply bring down the systems during the instant response when you're working on ICS networks. 21:33.510 --> 21:40.470 And the focus is a bit different by saying that maintaining safe and reliable operations is the most important thing. 21:40.470 --> 21:44.250 Acquiring meaningful forensic data within a limited time. 21:44.250 --> 21:46.850 Performing a timely analysis. 21:46.850 --> 21:49.590 And containing and eradicating the threats. 21:49.630 --> 21:55.110 Basically, these are the four elements that you need to follow when you're doing the ICS instant response. 21:58.640 --> 22:00.460 Before that, preparation. 22:00.460 --> 22:03.040 There are some steps that you need to follow. 22:03.080 --> 22:09.800 Preparation, same as traditional IT, but with some limitations such as testing tools, testing methods, but in a lab. 22:09.900 --> 22:11.880 Integrated detection and identification. 22:11.880 --> 22:21.240 Working with network security monitoring team to implement rules and detection capabilities, which is tailored to your threats in order to identify impacted systems. 22:21.560 --> 22:24.660 And evidence acquisition. 22:25.340 --> 22:36.180 Normally, you don't have that much time, like on IT side, you don't have that much time to do forensic analysis because you cannot stop the operations. 22:36.880 --> 22:41.980 Here, the focus is maintaining operations while acquiring enough evidence to perform later. 22:42.940 --> 22:45.780 You'll do the forensic analysis later. 22:46.080 --> 22:56.560 And time critical analysis using fast and well-tested techniques to quickly determine the overall impact to the operations. 22:57.340 --> 22:59.420 And supported activities. 22:59.480 --> 23:03.480 IR teams mostly share information and evidence. 23:03.480 --> 23:10.880 All the evidence should be passed to other teams to begin deep analysis and continue on the active defense cycle. 23:10.880 --> 23:11.700 Containment. 23:11.840 --> 23:18.080 Preserving the operations by collaborating with other teams, operators, and also engineers on the field. 23:18.760 --> 23:20.300 Eradication and recovery. 23:20.300 --> 23:27.560 You need to neutralize the threat by, for example, reimagining the system, reinstalling known good software, implementing patches. 23:27.860 --> 23:42.280 And then you need to provide the lessons learned, which is documents, finding for all, pass information to the network security monitoring team in order to identify and see if there is any reinfection, etc. 23:43.600 --> 23:46.580 And how do you prepare an incident response team? 23:47.480 --> 23:51.520 You need to determine the requirements and dependencies within your facility. 23:51.820 --> 23:57.020 For example, uptime, availability, and specific systems you need to take care. 23:57.480 --> 24:01.140 You need to decide if it's going to be in-house or outsourced. 24:01.140 --> 24:03.500 There are some advantages on both sides. 24:03.500 --> 24:13.220 But you need to decide, at least have a couple of people in your facility to do it more faster. 24:13.420 --> 24:20.720 A team size three, four well-trained people on site would be enough to cover, but you also need to think about the shifts, etc. 24:20.720 --> 24:24.120 So in total, it needs to be at least eight to 10 people. 24:24.320 --> 24:32.660 So chain of command is really important because there will be chaos and someone needs to communicate with the management team, etc. 24:32.660 --> 24:35.880 And it should be incident response director. 24:36.100 --> 24:41.180 Then all the evidence and incident handlers need to report to lead responder. 24:41.180 --> 24:45.260 And the chain of command needs to go up and down like this. 24:45.300 --> 24:50.400 And to build your ICS incident response team, you need to find the right personnel. 24:50.820 --> 24:59.680 Of course, it's the hardest part because incident response is really, to focus and develop yourself. 25:00.660 --> 25:14.420 And then also you need to take care of your jump kits because often jump kits, when you need it during the incident, most of the time you are losing some parts from the jump kit. 25:14.420 --> 25:16.820 It's easy to borrow from the jump kit. 25:16.820 --> 25:21.480 And then when you go to the incident, you are missing a couple of hard disks, etc. 25:21.480 --> 25:23.420 when you need it over there. 25:23.420 --> 25:25.780 So it's important. 25:26.060 --> 25:34.380 So evidence acquisition, you need to take care of the order of volatility. 25:34.900 --> 25:39.340 And you need to decide if it's going to be local or remote acquisition. 25:39.520 --> 25:45.480 I would prefer local because it's less risk and faster. 25:45.800 --> 25:53.820 The tools should be tested before on the systems because we are not talking about regular IT systems. 25:53.940 --> 26:02.840 Acquisition should be coordinated with all involved personnel and you need to discuss beforehand when you are touching any field device with engineers and operators. 26:02.840 --> 26:07.040 You need to gather all the evidence if the time permits. 26:07.260 --> 26:15.480 You need to start from registry and then any memory and then taking the disk images, for example. 26:15.740 --> 26:22.420 And you need to take necessary photos in order to see on the, let's say, devices. 26:22.540 --> 26:33.540 If you see any command prompt, you need to have an evidence because once you turn it off, you will lose it or you can lose it in any second. 26:33.560 --> 26:36.540 And all the data should be analyzed in an approved facility. 26:37.660 --> 26:41.540 What are the sources for the forensic data in ICS networks? 26:41.540 --> 26:57.440 Highly volatile data, system memory, network information, and system processes, and VPN connections, and these logs, and registry hives, HMIs, mostly Windows computers and you can have system logs, etc. 26:57.440 --> 27:09.700 Engineering workstations, controllers such as PLCs and RTUs, and sometimes virtual resources such as VMs and cloud environments if it's connected. 27:10.160 --> 27:16.200 And you need to do the high quality instant response in a timely manner. 27:16.200 --> 27:19.440 It's really important in ICS when you are doing this. 27:19.600 --> 27:22.920 Timely analysis is important to keep operations safe and reliable. 27:23.260 --> 27:28.560 It should focus on understanding the scope and then the type of incident. 27:29.080 --> 27:33.040 And the baseline information comparison will be really helpful when you do that. 27:33.480 --> 27:47.600 And focusing on the new connections in the bandwidth, new routes, anomalies in the VPN connections, registry keys, spawn processes, you need to check these first. 27:48.140 --> 27:53.260 And I said identification and network security monitoring help to respond quickly. 27:53.780 --> 27:58.160 And utilize good tools to reduce the analysis period. 27:58.160 --> 27:59.040 This is also important. 27:59.040 --> 28:02.700 You need to do the practice before going to the real incident. 28:03.540 --> 28:07.180 And how do you use threat intelligence in the instant response? 28:07.780 --> 28:11.980 Indicator of compromise to scope the infected systems. 28:11.980 --> 28:16.140 Then after that, you need to identify the network data on host. 28:16.220 --> 28:20.620 And TTPs to identify adversary efforts. 28:20.620 --> 28:27.080 And you need to utilize and ensure threats are gone after you've done the incident response. 28:28.280 --> 28:30.420 And instant response takeaways. 28:30.620 --> 28:41.780 You need to focus on providing actionable information about the scope of the threat and its potential impacts while you are acquiring the evidence without breaking operations and safety. 28:42.380 --> 28:44.920 ICS instant response should be tailor-made. 28:44.920 --> 28:47.780 It's a bit different than the IT, as I mentioned. 28:48.240 --> 28:52.060 Efforts must align with the goals and requirements of the operations. 28:52.060 --> 28:53.740 This is the first priority. 28:54.700 --> 28:57.100 Preparations should be done ahead of time. 28:57.500 --> 29:00.600 You really need to practice before it really happens. 29:00.720 --> 29:05.700 And acquired evidence and lessons learned should be shared with other personnel. 29:05.780 --> 29:12.880 So once you get evidence, you need to share it to move forward the active defense cycle. 29:14.400 --> 29:16.920 And let's summarize this. 29:16.920 --> 29:18.880 Taking the advantage of the found threats. 29:18.880 --> 29:30.840 Once you complete the instant response, if we can safely interact and understand with the threat, we can have the best source of defense information from the adversary's best capability. 29:30.840 --> 29:37.680 We can feed the active cyber defense center with the found threat intelligence to build better defense. 29:37.680 --> 29:45.360 It is important to identify and use indicators of compromises from the threats to help instant response. 29:45.820 --> 29:54.800 And understanding the malware's tactics to identify weaknesses in the current ICS architecture is valuable because after that, you need to improve your architecture. 29:54.960 --> 29:57.820 So these steps are really valuable. 29:58.440 --> 30:04.380 And my last presentation is about lessons learned sessions for long term success. 30:04.380 --> 30:12.340 For the success of active cyber defense cycle, lessons learned should be shared between the teams internally. 30:12.520 --> 30:17.420 And also necessary actions needs to be taken to build better defense. 30:17.560 --> 30:22.520 And after that, either during the incident and after the incident. 30:22.820 --> 30:37.720 And after that, once you share it internally, it's also recommended to share your lessons learned in an appropriate way with the ICS community because if you had that threat, someone else might get this soon. 30:37.720 --> 30:40.400 So it is really important and valuable. 30:42.080 --> 30:44.460 And yeah, I think I'm just on time. 30:44.460 --> 30:47.080 Thank you very much for listening to me. 30:47.080 --> 30:54.340 If you have any questions, either you can send me a message on LinkedIn or Twitter or you can ask now. 30:54.660 --> 30:55.640 Thank you. 30:56.180 --> 30:57.280 John, this is... 31:04.960 --> 31:12.540 Okay, so everybody look forward to see John and ask questions and all sorts of different things. 31:12.800 --> 31:16.540 On the DEF CON discord server, we're in the ICS village subgroup. 31:17.200 --> 31:18.460 And John, thank you very much. 31:18.460 --> 31:20.020 That was a fantastic presentation. 31:20.020 --> 31:21.040 Thank you. 31:21.420 --> 31:22.360 Cheers, bye.