start	end	text
18590	21810	Will you guys let me know when to start?
27480	32960	Good afternoon and good evening, everybody. Welcome to my talk.
33060	36800	Thank you very much for being with me or watching this video.
36800	41940	And thank you, ICS Village organization.
83590	85470	Shall I continue?
86130	87530	Go for it.
88430	90090	Oh, okay.
130630	134030	For those of you tuning into the ICS Village talk,
134030	138330	this is Bryson Borth, the lead for the ICS Village.
138330	144110	We're having some technical difficulties with Marina calling in from Europe.
144250	148010	Her connection keeps dropping, so bear with us.
148010	149710	We're trying to work through this.
149710	154350	If we're not able to successfully pull this off during this hour,
154350	158210	we're going to find another time to record a talk with Marina,
158210	161130	and we will still share that with you after the conference.
250670	252530	Hello, and I'm back.
252630	258030	I don't know, I'm glad that I managed to get to internet connections for this talk.
258030	260090	So now I'm on the backup connection.
260090	264630	So I am a true good, I have a good cybersecurity program in here.
264870	268710	So, well, and so I stopped that.
268710	272110	I used to be this offensive vulnerability researcher.
272110	276570	And in recent years, the word offensive is kind of have a very negative meaning.
276570	279550	And that's why I call myself right now a vulnerability researcher.
279550	283230	And I used to do very like crazy and exotic things.
283230	286810	I have six accepted and five presented black hats.
286810	290570	I have two different CCC troopers, SAS, hack in the box.
290570	293270	I even keynoted at ICS JWG.
293270	295090	So I've done offensive stuff.
295090	299830	And I used to create this travels for asset owners and plant operators.
299830	303970	And I believe that my threats are the most important and urgent to defend against.
303970	308350	And I was very opinionated about that.
308430	311570	But now I'm a manager of the cybersecurity program.
311570	316770	And I'm responsible for keeping my customers plant safe and secure.
316930	320870	Yes, I still think my past research was cool and very important.
321930	328970	But no, I don't think that defending against my cool and very important threat is my priority right now.
328970	331450	And this is what this talk is about.
333630	335850	So this is what's my past life.
335850	337910	And this is what you see here on the photo.
337910	345490	It's how I was getting ready for my Black Hat USA 2017 talk.
345490	348230	And this is somewhere 1am in the night.
348230	353350	And I gladly spent time with all of my hardware and servers and troubleshooting.
353350	355850	And it really was very satisfactory.
355850	359370	But my life has changed entirely since then.
359370	364010	And now I became a consumer of problems I used to create.
364850	368870	So my current life is really extraordinarily boring.
368870	373170	All of those things which all of us typically hate.
374510	377710	Agenda is my second nature right now.
378550	383710	I cooperate on terms like standards, compliance, KPI, policies, procedures.
383710	386130	Everything has to be very cost-effective.
386230	388270	And it's all about risks.
388730	393470	So, you know, at the beginning I was kind of a little bit upset.
393470	397090	Like, what did I agree to do for this job?
397090	401210	And as my very good cybersecurity friend, also a researcher, told me,
401210	403870	well, congratulations, dear, you are a manager now.
403870	405850	So, yeah, my life has changed.
406250	409470	And yes, some of you will probably argue,
409470	413730	but Marina, you previously worked as a lead and senior cybersecurity consultant
413730	416670	and an engineer and a principal threat analyst before.
416670	417570	You've done this job.
417570	421650	You've consulted customers about cybersecurity programs.
421650	424350	You did threat assessments.
424350	425570	You should know all of these things.
425570	427730	This shouldn't be something new for you.
428070	429470	And that is a difference.
429470	433830	As a consultant, it's your job to actually point to the problems.
433830	435130	You have to find them.
435130	438070	And as an analyst, you also have to report about problems.
438070	440430	And then you leave the customer with a recommendation,
440430	443430	and you actually do not see the larger picture.
443610	446750	So money is not involved because you're not actually remediating
447210	449690	or building plans to remediate.
449690	454430	You're not really going into the individual circumstances of individual plans,
454430	458770	maybe internal politics or relationships and whatnot.
458910	462610	So this part was not previously present.
462610	464850	And now I'm responsible for the entire picture,
464850	467230	because I'm going to the sales meetings.
467230	470710	I then participate in bids and project proposals.
470710	474580	I am then participating in the building and configuring systems,
474990	478310	like entire solutions for the customers, networks.
478410	481970	And then when the customer is operating the new environment, for example,
481970	485330	or upgraded environment, or even if it is a brownfield,
485330	490130	I also consult on the advanced service or provide advanced services.
490630	494490	So basically, when I go already with the sales meeting into the customer,
494490	498430	I already see in advance how we will be implementing it and building
498430	499750	and what we will be consulting.
499750	504550	And I need to consult customer in advance what they might need in the future,
504550	506410	because I know what they will need.
506410	511490	So basically, it's really a big difference between then and now.
511490	517250	And maybe the best way to explain is that previously I've seen this local optimum.
517250	519390	So I was working on one task, like, for example,
519390	525490	hey, I just do assessment of one plant and then maybe I even propose mitigations
526070	529570	and maybe even in a prioritized fashion, but it's a local optimum.
529570	532390	Now I work, for example, for building cybersecurity programs
532390	535630	for the entire company with multiple plants.
535630	538330	So now I have to optimize the global optimum.
538330	543430	And actually, for me personally, this is the best analogies to describe
543430	548150	what I'm doing right now and overall what I need to achieve right now
548150	551130	in my new role is the best example is linear programming.
551130	553950	I don't know how many of you know about that, but as an engineer,
553950	556950	this is what I used to do a lot for engineering problems.
557390	561270	And I put the link into the Wikipedia. I highly recommend to check it out.
561270	565730	And it's basically every problem you need to solve or optimize,
565730	570030	because this problem, this linear program is frequently used for operating,
570030	576550	for solving operational problems and finding there, optimizing,
576550	580990	for example, profit or something else based on the constraints
580990	584150	which need to be fulfilled. And you then formulate the problem
584150	586990	which you need to optimize and you formulate your constraints
586990	592830	and then specific applications will try to solve you that optimization problem.
592830	594790	And sometimes it takes hours and whatnot.
594790	598530	So this is how I actually think about pretty much every problem
598530	604010	because we always try to find this optimum based on the constraints we have.
604050	607610	And then my new role is just like the optimization equations got longer
607610	611050	and the list of constraints got longer.
611050	615550	So optimization is becoming more and more difficult and challenging and trickier.
615750	617610	But that's the beauty about it.
617970	621730	So, and maybe the situation in which I am right now,
621730	624570	it reminds me a little bit of Carsten Noll's story,
625590	629530	because he used to be a cybersecurity researcher, he is still,
629530	631470	and he was a source of troubles.
631470	636230	And at some point he became a CISO of the richest startup in the world.
636230	641070	It was in India. And basically he became a consumer of own troubles.
641610	647150	And he gives insightful talks on how it is impossible to build
647150	653550	the perfect cybersecurity program or just security for any application or anything,
653550	656130	even with all the money and knowledge in the world.
656130	659830	And it's really fascinating talks which he gives.
659830	661330	Unfortunately, there are no recordings,
661330	665230	but I was lucky enough to see it in person a couple of times.
665330	668570	But it's interesting to see that even if you have all the money
668570	671230	and all the knowledge, you know, finding this,
671230	674650	optimizing that equation with so many constraints is impossible.
674650	677210	You just have to find like basically good enough.
678050	681970	So before I go into jump into the talk, a couple of disclaimers.
681970	685030	This is the least technical talk I've ever gave.
685030	691610	Still too many slides. I'm still working on trying to have fewer slides for my talks.
691750	694830	I think maybe some of you this talk may be boring.
694830	696750	So I'm sorry for that.
698150	702170	And I know that many of the professionals in this field,
702170	706310	especially who has many years of experience after seeing this talk,
706310	712230	they will say, well, I told you so. Yes, I know you did 10 and 7 or 5 years ago.
712230	715850	But I was a different person at the time. I agree with you now.
716850	720970	So this talk is based on my own thoughts and considerations.
720970	726690	So whatever tips and suggestions I provide, no warranty they will work for you.
726690	733530	And honestly, for my current life phase, I work on so many projects at the same time.
733530	738870	I have to switch quickly. I realized I really became comfortable that good enough is actually perfect.
738870	741130	I used to be such a perfectionist.
741410	747010	So basically, like who I was in all good times, you know, that was my entire world.
747010	753810	You know, like I've been looking for the most weird, difficult, exotic ways of exploiting cyber-physical systems.
753810	757870	I was mostly working at the layout of controllers and physical processes.
758030	763810	And the more difficult and challenging problem was, the more I was interested and determined to find the solutions.
763870	773130	And, you know, like I used to have calls with my security researchers friends and bashing about like,
773130	778750	oh my gosh, can you imagine they did not touch that vulnerability, how terrible it is.
778750	781230	You know, I used to be all of that person.
781230	793630	And now when somebody is telling me like my customers telling me, well, do you think we need to publish that remote code execution vulnerability in some device?
793630	799790	And I say like, no, if you have some time and money to spend, please build your demilitarized zone.
800550	808270	So and basically, like if I would try to explain like what suggestions I was previously given, this would be example.
808930	816390	For example, this picture, this cluttered room is basically a good example of how traditional OT environments look like.
816390	821610	Like many of them, you know, it's just like, like this cluttered room, you know, like there is everything everywhere.
821610	825930	There is no really structure. Nobody knows what, where, somehow it works.
825930	828550	And I guess many of my OT colleagues will understand.
828550	837570	And I was saying that like if the context of this cluttered room, I was telling that if we would apply some very advanced cybersecurity solutions.
838370	847890	You know, like for example, an analogy would be to put this beautiful chandelier in this room and it will suddenly this room will become beautiful and organized.
847890	859870	And in reality, it won't, you know, like I was trying to tell like, like if you put this chandelier room or basically it will transform that room into the Omnia club in the Las Vegas.
859870	863870	You know, I'm not nostalgic at this point, but of course it won't happen.
863870	871670	So obviously when I was recommending like skip the basics, apply some advanced cybersecurity controls and you will be fine.
871670	877410	Clearly that was a really wrong recommendation and I am admitting it now.
878390	892970	So, and basically now that I was that person, and now like now when I basically my customer come to me and saying like hey this is my cybersecurity budget, and I need to understand how best I spend it.
893390	900690	You know, like, I have to be pragmatic and cost effective, and I have to change the way how I think.
900690	905030	And this is how I've learned actually to like secure architectures.
905830	917890	So for example, we all know how the traditional ICS network would look like we have a corporate network and skater network and somewhere on the bottom of it we have a physical application which we are trying to protect.
920370	936410	And basically, typically we build such networks in a layered fashion you know about that and it's all determined by the data flows at the bottom we have real time data exchange, and it's become less real time at the top.
936410	949310	And in general, this could be basically divided into two parts like process control and monitoring at the bottom and process management in ideally you should build them in such a way that you could always decouple this upper part.
949490	960290	So you may lose all of your corporate and layer three, like this process management, you should be able to operate, you might not be able to serve your customers like dispatch your chemicals or whatnot.
960290	969990	But you still save and you still can produce and if you're, you know, like vessels are full you may just shut down plant, but in a safe manner.
970370	980490	And like basically if you look at the entire architecture how it's like the very classic Purdue reference architecture look like and this is looks like this.
980490	992830	And actually I previously, I mean of course it always made sense for me from the data processing standpoint but now I started to appreciate it from the organizing and building cybersecurity.
993490	1006450	And I will explain why. And this is basically it also helps me to explain customers, how they should prioritize their expenditures so that I could have a meaningful conversation which they also this argumentation which they can follow.
1006450	1021350	And at the bottom, we have actually this is where our physical process and this is where the hazards leave, and we are trying to prevent hazardous situation and we have sensors and actuators, which are solid units, which are completely trusted.
1021350	1030390	At the moment there is no security controls which we can apply there and it's considered to be trusted there is so basically there is nothing what we can do from the security standpoint there at the moment.
1030390	1033870	But this is where we actually this is the layer which we are trying to protect.
1033870	1050770	And then we have a very gigantic this layer one layer two ways you distributed control system. And here's actually one more disclaimer is that clearly I'm mostly specializing in chemical pharmaceutical oil and gas so basically large continuous processes
1050770	1054250	so this is a background which I use in my presentation.
1054250	1065950	So, this is why I'm talking in the context of distributed control system. And while this is already system with the computers and we could actually apply traditional security controls which we apply in the corporate network.
1065950	1081630	Things are very difficult in here and this is why I put, it's complicated. At the moment, unfortunately, the situation is such that the market is full of really fantastic solutions which we could apply for security and a lot of IT companies also basically
1081630	1084830	trying to push their solutions into this layer.
1085130	1095470	But at the moment we still did not find a good way how to basically approve and manage and apply this security solutions in this layers.
1095470	1106910	And the point is the truth is also that vendors like ABB and all others whatever you think of, like Siemens the most famous Yokogawa Honeywell and so on.
1107050	1122750	Each vendor has to approve specific solutions to be applied. So the customer is pretty much limited to what they can use. And because at the moment there is such a competition and a variety of products they're still not even sure what is the best and what is most
1122750	1132270	cost effective, that it's actually very difficult to apply like really implement proper cybersecurity technical cybersecurity controls in this layer.
1132590	1142570	So where we actually left with is our layer three and layer and demilitarized zone, and this is where you actually can.
1142570	1155510	This is already full fledged servers, you can patch them you can use a host agent for advanced threat detection you can you can do vulnerability scanning threat hunting whatnot.
1155570	1167570	It's all yours. So this is where you can actually collect the logs from firewalls monitor data flows and whatnot. So this is actually you can implement the full fledged cybersecurity program in here.
1169950	1175510	And basically apply patches and reboot service without interrupting productions.
1175930	1185870	And you would probably argue, but Marina, we still want to have this defense in depth, you know, like we should still do something in layer two and level one.
1185870	1196070	And here's where I actually find a good argument why we should still concentrate most of our efforts on demilitarized zone and level three.
1196070	1204490	So when we talk about level one and level two, this is already they are actually part already of the safety protections and I will explain you why.
1204550	1219910	So this slide you see actually the relationship between security and safety like if you put it like in a temporary temporary fashion. So we have layers of security protections which actually protects us from stress, and behind the every set of human is
1219910	1246110	always behind me it's something intentional. And if the attacker was able to go through the all the layers of security protections we have already security incident, and then we say, well, this is where we rely on the layers of safety protections, so that the
1246110	1253150	you can see it on the slide. They are actually already part of the security layers. These are layers of safety
1257850	1268830	preventions measures. So we basically, it suddenly makes more sense to keep attacker as far away so we basically have to really build a very strong perimeter and make sure
1268830	1287050	basically minimize chances that even the attacker will even approach our layers of safety protection because it's our last line of defense. But there is one more argument, and it goes into the finances, we all know that, you know, like operations, even a small
1287050	1304010	hiccup on the network when maybe packets is not arrived, that already may cause process upset and majority of incidents or cyber related incident when which happens in the plans, they're not security they're cyber incident we are not enough memory not not
1304010	1318530	enough storage network congestion, or whatnot. But all of those, they already introduced interruptions into the normal operations and actually reducing the efficiency of how we run the process.
1319230	1331130	And this is a really big problem for the operators because they are operating on there. So, yes, the number one priority is safety but their second number two priority is to maintain actually
1334010	1343030	their operations. And if you look at the, like on the left you have a slide, when we look, look at the about integrity protection layer three we have alarms in there.
1343050	1357350	And there is even explicitly stated financial alarm, you know like we're losing money. And on the right you see another graph, where we still operating may still operate in the normal operational envelope is still producing our product, but we already not in
1357350	1371250	profit. We already losing money because we are not producing effectively, the product is still up to specification but we are using too much energy, losing too much useful chemicals maybe in the purge or whatnot.
1371250	1373010	So they're not.
1373170	1389510	And this is why you know like we know that pretty much any hiccup on this on the DCS operations may cause this inefficiency in the productions. And this is one second reason why we really want to keep the attacker away.
1389510	1397370	We want to minimize chances of attacker, even reaching that level we don't want any random person roaming in our industrial control network.
1397370	1402170	And this is actually to give you an example.
1402810	1418810	Like how much money we may lose if the operator will not, for example, react on time. So, on the left you see that, for example, when we talk about minor effects something what you know just minor it's not even medium it's not meant major it's minor.
1418810	1448570	It's when you lose estimated like from 10k and 100k, you know, if you talk about the budget of 100k, I think people cannot even imagine such budgets you know like this will be fantastic pentest of the entire corporate network, and we fight for years to get that, you know,
1448570	1457930	they basically have to react to emergency alarms first, and this is when they have very little if you can see we have very little reaction time five to 15 minutes.
1458410	1467010	And if they will not react within that time, like for example within 15 minutes, the loss could be up to from one to 10 million or even more than 10 million.
1467010	1470490	So imagine just those numbers. So imagine them.
1470770	1480050	We do not really strong build strong perimeter, and we say well even if the attacker gets to the control layer.
1480390	1482870	We will still try to detect him in there.
1482870	1496930	But if the attacker will manage to suppress just one stream was one, this critical alarm. If the operator just basically lost his visibility for a few minutes, he fails to react on time, and the losses can go up to 10 million.
1496930	1514730	So, as you can see because of this very short reaction time high losses. We really want to keep all the attackers away from our control environments, and this is why I still argue that we have to introduce as many technical controls in the layer three and demilitarized
1514730	1524690	and try to detect. So make sure that the only conduit into your control network has so basically the attacker has to go through the demilitarized zone and through layer three.
1524690	1535650	There is no any other way into the control network. So basically the attacker has to go there, and you try to maximize maximum to detect an intrusion in those layers.
1535650	1551570	So this is why I say this is your top priority. And for example prioritize spending 80% of your expenditures in those layers. And that means also that you first have to actually build your proper reference architecture, you need to form a proper DMZ zone.
1551570	1566830	You need to properly form your level three, and this is very expensive, it's very difficult, it's complex, but this is should be your number one priority and I can't believe I'm saying that because two years ago I would not believe that I would be saying something like that.
1566830	1581570	And actually the layer one and two, this is where most your security controls at the moment can take form of policies, procedures, and common sense, prayers, you know, like check karma of your employees and whatnot.
1582690	1594750	So, of course, you know, like, there is also slight deviation, you know, the standards will tell you how the absolutely ideas, ideal network architecture should look like.
1594750	1605790	And then, you know, there is a reality because you know it's all about balancing security versus usability and versus cost. Again, we're talking about linear programming optimization.
1605790	1623550	And for example for our ABB control system and I'm saying this is for ABB, it might not be applicable to every organization. We built for example, slightly, I would not want to say simplified because this is security level four architecture, but it's a little
1623550	1639150	bit more manageable because, for example, for certain operations like for example for antivirus updates and backup, we do allow routing of the traffic between DMZ and level two, but that is because the way how we implement those services because we still do them
1639150	1654310	in a very secure very conservative way. And we are very well aware that this is not a risky to do so but it is much more manageable architecture. And that is the point that for every organization that architecture security architecture will look.
1654650	1665430	I mean it must be individual and might look differently. It's all about basically implementing all of your data flows and access control and identity management in a secure way.
1665430	1676630	So for example, once you map all of your data flows and file exchange routes, and you make sure that all they are very secure, then you're good.
1677050	1686010	So, but that is has to be properly analyzed. And again I'm saying that it might not be looking like a traditional Purdue architecture but it still has to be secure.
1686010	1702630	But once you build a security architecture and unfortunately in this talk I do not even have time to go in all of the zones and conduits and why it is so amazing. But once you have this granular and properly build architecture which is capable of managing, then it is very
1702630	1712250	easy to actually introduce any other service because, like I will jump back to the slide we have like layer three where you have operations management, this is basically your service layer.
1712510	1724870	And you actually may share it so if you have a site with several plans, you may share that level three between multiple sites, you will have multiple level two but then one layer three which will be services for all sites.
1724870	1740070	And again, once you build this properly format, and you're capable of managing your architecture, introducing new services become really plug and play. So this is an example I remove the name of the application but this is one of the ABP application
1740070	1755470	advanced service, like advanced application for process control. And we already build them and implement them in such a way that it will you just plug and play to your existing infrastructure and integrating a new service and introducing it and configuring
1755470	1757390	is extremely easy.
1757470	1762650	And it's just example of ABB but it's could be any application and any vendor.
1762650	1769450	So, when I work with a customer so this is exactly the processes and explanations which I'm going through.
1770390	1786830	It's probably sounds for all of you so boring like Marina like ways vulnerability research where CV, but that is my new world right now and I have to break this complex problems into easy arguments so that I could actually implement the fundamentals right
1786830	1789810	so that I can play to build the advanced security controls.
1789810	1791990	And on.
1792190	1798970	So, many customers rightfully argue that it's expensive to implement correctly the entire architecture.
1798970	1812630	At the beginning. Yes, but in the long term. It's gigantic cost saving factor, and it's, it provides you really very manageable, very high level of security assurance.
1812630	1817330	So, of course life would be boring if it would be easy.
1817410	1833350	You know on one hand you know like it's so easy to say, well just put in firewall and then you're done you just like have your DMZ, the reality is not so easy because you know such projects so every customer is constrained by the available budgets and sometimes
1833350	1837890	by schedule like hey I scheduled my downtime on this time and I need to be very quick.
1837890	1849630	And you see like forming a DMZ, or even just adding a fire extra firewall. If they have already one firewall and we add in like North, they have already North and we add in South.
1849830	1865350	It's not that easy it's not only hardware cost but it's also you know like a lot of. I put here on the slide, it's just a snippet an example from our real project where we are building a DMZ it's not complete I hide the details but just give you an idea how many
1865350	1876810	activities goes into such projects, it all costs money. So eventually it's not just the buying a firewall but executing such project is expensive because a lot of activities goes in there just to configure everything.
1877310	1888970	And, you know, eventually because also building firewall DMZ meaning you know like you have to proper build your services or servers and split services to make sure that everything is secure and everything.
1888970	1900630	But then it's suddenly because you still have this amount of budget and it suddenly become this Tetris for adult game. You know you're trying to shuffle this budget like maybe we will remove a little bit in here and do there.
1900690	1917330	We will remove switch but add a server in there and so on because you're trying to optimize customer value with available budget. So it's not that easy to build it and this is always you know like the most interesting things are like always in the details.
1917330	1935010	But still, I would argue this point of my life and in the current role that for me the proper DMZ is a higher priority activity than for example, patching a code execution vulnerability in the control at some lower level, you know, like, and anyway,
1935010	1945630	you know, like, at the moment patching controllers is, I mean depending of course on the CVE but you know like, since most of them do not even have authentication and you can directly talk to them.
1945630	1947970	Why even bother patching.
1948130	1955770	But again, probably many of my cyber security researchers don't like what I'm saying right now, and we can talk about that reach out on Twitter.
1956430	1972330	Well, here's a pro tip, you know, as I said, building security architectures is expensive, and, you know, sometimes plant operator experience really difficulties when making those financial decisions whether or not to invest into extra firewall extra server
1972330	1992350	and so on. So here's my pro tip, like, how to ease that decision making for the customer, conduct a high level simplified risk assessment of specific architecture in hands or data flow and document identify risk, explain risk and potential consequences
1992350	1993870	to the operators.
1995110	2010270	Remind them that ultimately they are responsible for all the risks, they're planned, and they shall eventually address them by accepting or mitigating and if mitigating they considered this point too expensive, they have to be aware that they will have to accept
2010270	2012950	that risk and this is the potential consequences.
2012950	2024130	And typically you know what the simple process makes the decision so much more easier. Okay, you know what, I don't want to be responsible for that, put the firewall, we have we will find budget.
2024390	2026570	So, you're welcome.
2026570	2040330	And, you know, sometimes, also like this is why I learned to like compliance because sometimes you would say well if they're still doubting shall I shall I not you will say hey the standards is telling you or the best practices are telling you and then it's
2040330	2043870	actually makes the decision making also easier for the customer.
2044690	2056550	So, the second part is how I learned to love standards, which I never done before. So, um, in June, last year I actually gave a talk.
2057470	2074350	About 62 443 how it is applied about to this asset. And I actually was bashing about the standard, a little bit I, I was, of course, a factual but I kind of like express couple of disagreement.
2074730	2079330	And because I have a lot of very good friends who actually build the standard.
2079330	2096490	You know like I never published the slides because I was a little bit ashamed, like how could I say some negative things or basically point out to some maybe imperfections in this in the standard and gosh how I'm ashamed of myself because you know like right now.
2096650	2101730	I absolutely love and adore 62 443 that's everything for me right now.
2102110	2103770	And here's the point.
2103770	2121610	So why I started liking it. So, you know, performing technical cybersecurity plans audits is not actually very hard. I have genetic like really extensive experience in auditing plans, and I've done it for multiple organizations for multiple industries
2121610	2139250	globally so that's something where I'm like skilled and I have no issues with that, where it's becoming difficult and complex is when you actually have to build the entire cybersecurity program or build a program for mitigating and prioritize fashion with timeline
2139250	2144270	cost, and suddenly it's becoming a very complex expensive and time consuming process.
2144270	2153530	In addition to that, you know, because if it is a process and you invest money into it. You need actually to justify to find some measured value
2155810	2164490	to justify the expenditures to the project sponsors sometimes it's government sees or whatnot. You actually need to measure your progress.
2164490	2179650	And you actually need also to compare, you know, cybersecurity posture and pro mitigation progress of individual plans which are completely different, different maturity, but you need to compare it in some normalized metrics.
2179650	2185370	And this is where this business risk KPIs all came back into my life, and I suddenly.
2186550	2201650	It's reminded in all my knowledge from which I got so I have an MBA degree and suddenly all that knowledge came handy to me and I started like basically remembering all of what I've learned in my MBA, and I put it into practice.
2202410	2208530	And here's another thing. So, the fourth principle of economics are 10 of 10 of them.
2209250	2222130	The fourth one is my favorite people respond to incentives, it means that we do certain actions and make decisions based on their perceived value to us, it could be also negative and it could be positive value.
2222130	2227770	And this is a fun story when I had a meeting with a season for very large
2230310	2231990	industrial organization.
2233030	2249390	And I will keep telling that him about our success stories where we've done fantastic projects for our customers and then I told him like, hey, we built for a large LNG plan to cyber security program where we matured customer from quadrant five to 1111 it's
2249390	2256890	kind of recommended for oil and gas industry so basically security level three maturity level three.
2257650	2275490	And, um, and his immediate questions was, and where we are now, you know like people are competitive, you know like they want to compare themselves, and I was just like, well, let's build your KPIs about those and let's explain you how you can get from some lower
2275490	2277830	quadrants into the higher quadrant.
2278090	2290510	And the, what I like about 62443 is that it's provides a lot of logical and meaningful ways to build your KPIs when building cyber security programs.
2290690	2303010	So for example, even, I must admit I previously was skeptical about the security levels and how they are described. Right now I like them because they really helped me to.
2303010	2315450	For example, when we talk about security architectures you know like we need to perform risk assessment of every system like fire and gas and emergency shutdown and process control and safety and whatnot.
2315590	2326390	And then we need to assign security levels based on the criticality risk criticality and also sign those security levels to conduits and then we need to meet those requirements.
2326390	2343210	And right now, I really like it because it gives me something tangible to work with. And we know that different plans are have different maturity so some of them terribly legacy some of them, a mixture of legacy new some very new.
2343210	2361510	And the standards is also provide us with additional metrics so that you can for example measure capability security level like well like legacy system will not be very capable, but your target security level is, let's say your capability level is one
2361510	2373730	and your target is three, then the standards will tell. Well, you can use compensating controls and see whether to achieve the target level and then you measure your progress.
2374570	2388630	With this achieved security level you probably will go from level one to level two and level three. So all of the security levels in the standard they provide a really way to build very nice KPIs to measure the effectiveness of your program.
2389490	2406570	And then of course you need to measure also how well you're doing. And that standard has a maturity levels, and this is virtual actually forms those quadrants, it's basically like which security level you were able to achieve and how mature you in maintaining
2406570	2424130	that security. So security controls, and what I like about this maturity levels so for example, if you already have. So, level one is just like you have a security control and level two if you basically build your documented process about that you already
2424130	2438590	updated in level two it's so easy to progress in those quadrants and level three is actually if you are practicing so for example, you have antivirus level two you have a documented process how to update an antivirus and level three you actually updating that antivirus
2438590	2455850	and you already. So basically you can use this quadrants for pretty much every security controls and that will help you to actually monitor and measure the progress, your mitigations progress, which for any season governance will make very fantastic numbers
2455850	2464110	and of course you can build much more smarter and more interesting KPI but this could be building you a very fantastic foundation.
2464110	2472270	So, this is also what I can work with in terms of easy to explain to the customer, and it seems like an achievable process.
2474290	2475170	So,
2475170	2494470	and this is an interest not this interesting thing that I used to hate, even the word policies and procedure. I used to teach ISO 2701 at the university, and it was the least my favorite topics, I would have an allergy for the word policy and procedure.
2494750	2505150	And now this is my number one to go. So when I start working as a customer with says like well we've never done anything with the security and now we understand it's an important part.
2505150	2507170	Government wants it.
2507290	2512270	We understand that the risks are higher the moment you want to build the cybersecurity program.
2512430	2522970	And that is the number one what I need from them is like guys, we need to establish policies and procedures. Policies will tell you what I want in terms of security.
2522970	2537690	Your all security goals need to be described in the policy it's very high level, very in short sentences and procedures will actually tell you how you're going to implement it, because even if you talk about the backup there is thousands of way to implement
2537690	2551830	the backup. We need to describe procedure will tell you how what is acceptable level way of implementing backups in this specific organization which is based on their network architecture based on the risk assessment on perceived risk
2551830	2555390	or acceptable risk personal preferences.
2556030	2566390	And if this is not this documents do not exist, we will always be unsure, but what is a good way of implementing your backup. We need first to formulate the procedures.
2566390	2583290	And then the beauty part of the procedures is that you number one you have roles and responsibilities, people will be assigned like a responsibility for specific tasks, and they will put their signature, and as soon as people put their signature they feel responsible
2583290	2600810	things will start happening. If nothing is described nothing is defined, nobody's responsible there is no cyber security program and for me the number one working first step when working with the organization, developing policies and procedures, assigning roles and responsibilities,
2600810	2617090	is to train those who are responsible and then on top we can suddenly start building a program, because somebody is responsible. And I hate, I remember how much I hate the word Rossi this responsibility assignment metrics, and now I love it.
2617690	2629410	Well, and then, basically, the last tip is basically it's my. So how do you, because when I'm asked by the customer.
2629410	2638130	Can you please build me the cyber security program that number one is that they know how it is expensive, and the stakeholders and the CEO they want to know.
2638410	2650910	Are we doing well, like, was this even budget and just spending the budget was justified and we know that with a security it's difficult to measure because you know like if nothing is happening.
2651150	2655910	People believe that why do we need that security we are not detecting even anything.
2655910	2675250	And this is why I measure the effectiveness differently. So, what I do I take the corporate risk metrics, and I tell them that you know what, in order to make sure that you are socially responsible that you're minimizing your potential business risk, you want to
2675250	2692150	basically in terms of cyber security risk you want to be in quadrant, like in those green area. And if we bring like if we implement security controls and we conduct all of this risk assessment and specific documented way on which we all agree.
2692150	2704710	And we believe that with implement security controls we minimize risks to acceptable level, then the program was justified and then when the government will knock your door or who not.
2704710	2709650	They will, you will show hey I'm managing my risk, I am responsible.
2709650	2728810	And if you talk about the same things with a person, use the word license to operate, because they will understand what it means. For example, when we talk about the safety, you know, if you did not minimize your safety risks to gain this acceptable level so you
2728810	2733770	never would be allowed to leave red. So it has to be at least amber and green.
2733910	2736470	You will not get your license to operate.
2736470	2747290	This is the same with security, tell them the word of license to operate that now your cyber security risks are minimized to the level which is acceptable and they will then understand, oh, then we did a good job.
2747450	2764970	So you see, the work which I'm doing right now and my current responsibility sounds a little bit so boring high level, but in reality it's so complex and I need really like kind of have to also think hard how to break this complex program problems
2764970	2768710	into manageable and achievable steps.
2769910	2787050	So, and now that basically how I wrote in the, like in my abstract but yeah Marina but still people like you exist and there are advanced attacks like do you think your current approach, like basically concentrate a lot of your security controls in the upper
2787050	2791350	layers is effective against advanced tax and I wanted to give you an example.
2791350	2796630	So, for many years I was dreaming to do something like killing them.
2796630	2800670	What a filter in the photo utility and last year.
2802130	2819850	Yeah, the beginning of last year I was lucky enough that I work with a trust research center in Singapore and their team has nice kindly assisted me in the experiment we are like trying to kill this.
2820830	2825410	Ultra filtration filter in the water utility. It looks like that.
2825630	2836350	And of course when we try to cause a physical damage to a specific piece of equipment it's all have to start, how did that things can be damaged like what is harmful to it.
2836350	2853710	So you have basically have to read the manual and see what are the harmful conditions, and on one hand you can kill it. If you have like too many impurities in water like oil or grease it will basically damage the membrane but I don't know how to implement
2853710	2857590	it, how will they introduce oil into the closed system remotely.
2857590	2877030	But the second condition is that is what will damage the membrane is high pressure. So for example in this specific model it's a two bar. So it's basically and based in overall a prolonged operation on the very peak load which is basically close to two bar will kill
2877030	2885950	that filter. So okay we need to build the pressure in the pipe. So for that we need now to steal the process documentation.
2886710	2903650	And this is the two things that are two ways how that I can find it and it's again it's all of course individual. So, if the entire process was built and programmed and designed in the company, you actually need to infiltrate the company and steal this
2903650	2922130	documentation, but very frequently and it's like really very frequently. So, the designs and actually programming of the PLC is done by the subcontractor so you need to actually to find the subcontractor of the company which is of interest to you and basically
2922130	2925190	in the typically smaller companies not so well protected.
2925570	2942130	And then you have to steal basically the documentation is in there. And this is why in your cybersecurity policy, it has to be there that you need to require your third party providers to achieve certain security posture in their organization, and we know that for example
2942130	2944190	that is a requirement in NERC SIP.
2944190	2958990	So let's assume like I as an attacker I identify the suppliers, I got the documentation I now know that there are two data flows go into this filtering.
2960950	2968450	Basically, I can do it via the HMI screens or PIND diagram.
2968450	2985470	And because the second flow is go from backwash I probably need to take a look what's happening in the backwash and how things are working in there. And then I will understand, basically, which PLCs and which control logic I need to enter and which
2986230	2994490	equipment I need to compromise to actually implement this attack. But then I still, you know, like I don't understand which conditions will trigger.
2995210	3001770	Basically, because I want to flows to flow simultaneously and I don't know how to do that I need to find the conditions.
3002050	3010430	And there's actually guided in the state machine in the PLC, and this is something that I already won't find on any diagram, I actually need the PLC code.
3010450	3019770	So for example, the PLC was programmed in the organization. I need actually already to penetrate the organization and this is where you should really try to prevent me from doing that.
3019770	3024770	Because I need to steal the PLC code and read it in order to identify those conditions.
3026890	3045210	And basically, then I need to manipulate the PLC logic or packets on the network, depending really how things are implemented but let's assume that I found the way to actually pull off this attack and this is specific cases, like in the context of this process
3045210	3055430	I needed basically to implement attacks on two PLCs I need to compromise two different PLC in two different parts of the process so it was stage three and stage four.
3055430	3059010	So they are basically a lot of things for me to compromise.
3059250	3071690	And then so basically we'll assume that from the cyber perspective, I was able to implement it, and now the water from two flows, which never should fall simultaneously it flows gushing through the filter.
3071690	3082970	And I now want to see how much, because I still don't know whether I will be able to reach the pressure, which I need so I'm basically need to measure, am I able to achieve two bars.
3083470	3091090	And we run those experiments that experiment, and it turned out that the maximum differential pressure we were able to achieve in the filter was just one bar.
3091170	3096050	So it's not enough for breakage. So as you can see, the attack is not almighty.
3096990	3114710	But the point the most important point in here that there is no way I can ever figure out this, what the pressure can achieve like for example one bar without actually interacting with the actual physical process, and I might have this fantastic idea
3114710	3128370	this is what I'm saying that the attack is not almighty. And that's a successful implementation of a damage scenario and it's cyber execution will not necessarily result in successful attack because certain things, I will only be able to measure on the
3128370	3129830	life process.
3130370	3144110	And this is what the point which I'm saying that many targeted damage attacks. This is the scenarios where I mostly work in I enjoy working, and it's useful to conduct such research but the point is that such targeted damage attacks require
3144110	3159470	prolonged access to the process equipment, and this is what I'm saying, limit or eliminate such option for the attacker. If the attacker don't have that option they will not be able to execute it or maybe they may try to guess like well I feel like if I will do
3159470	3163330	that implement that attack and they will try to create an autonomous malware.
3163790	3169030	Well, they don't know they will be successful if it's only one bar, you're not damaging anything.
3169870	3187890	So, on the other hand, like myself and my co researchers we recently came up with a really worrisome and way of compiling completely automated and very targeted payloads for industrial processes.
3187890	3200450	We actually were accepted with this talk for a black card but we had to withdraw because me and my co researchers we received new job role so we felt it was inappropriate if you will be talking about basically offensive research.
3200610	3202130	So we have to withdraw.
3202810	3214730	But it's possible but nevertheless, again, the number of scenarios you will be able to implement with such autonomous payloads is much more limited.
3214730	3232270	In comparison, so that's why I'm saying, make sure that every conduit, which leads to the control equipment and physical process goes through the military zone and level three and monitor for the attacker that look for him in their limit eliminate his
3232270	3235990	ways for each having persistent access.
3236390	3241510	And this is where. So for example, yes, if we talk about defense in depth.
3241510	3256190	We still cannot of course guarantee that the attacker will not get those persistent access or continuous access to the process so focus on protecting and monitoring high criticality events data flows, when, for example, something in the, especially
3256190	3269910	the time of the situation which you have alert emergency alarms, and the reaction time five to 15 minutes, maybe have a redundancy so if the attacker managed to spoof or suppress alarm or drop the packet I don't know was this alert.
3269910	3279090	Make a redundancy for every critical alarm that it goes maybe to communication path is so that the operator will not miss it.
3279570	3285130	So, I guess, so that was pretty much it from me.
3285170	3297230	So as you can see, basically the way how I'm building the cyber security program right now is kind of good to actually make life of the advanced attackers like myself.
3297230	3303470	So it might mean we know that the security no guarantees but it's really make life so much more difficult.
3304170	3318350	And I don't have really smart afterwards, as I say this was not a very technical talk it was just my confessions, how about how I think differently right now when I'm working in a different role.
3318350	3337530	And, as I said, building enterprise plant, or plant by cyber security program is not simple but it can be broken into the simplest steps which makes you easier decisions, make your decision making process easier and maybe more transparent and then more
3337530	3345930	prioritized fashion basically applying this how do you eat an elephant principle and in this talk I shared you how I broke down that for myself.
3347590	3359870	Focus on establishing the foundation first, even if it is extremely boring, and, you know, like I can't believe like a couple years ago I wouldn't believe that I would say something like that but I'm saying that.
3359870	3375490	And yes in in process control because you know like if you remember I told it, we don't want even that Tucker be in our control system not even messing up but even be there, it's such a sensitive system, it's just like thinking about like a belly of the cat.
3375490	3388810	It's something soft, we need to build a very hard shell around it, we just want don't want anybody going be even being there. And the success of our security program is about minimizing chances of anybody reaching those layers.
3389570	3399690	And yes, of course I'm missing my cyber security vulnerability research. So if I have a couple of minutes and I guess I have, I would take a couple of questions.
3403100	3405480	Hi, can you hear me. Yes.
3405560	3414860	Okay, so we don't have any questions yet but I do want to share some feedback that happened because there were multiple times in your, your talk that you were saying this.
3415440	3422100	For the record, this is not boring at all. It's really good to see the higher level view, long term strategy, etc.
3422420	3427880	Somebody else, I concur. This is a more realistic topic for asset owners and integrators.
3428160	3438680	In my opinion, there is a large gap between academia, government research, security researchers, and the reality of real operational technology environments.
3441280	3447120	Okay, so I'm very glad that people enjoy the talk. I'm really glad that somebody found it useful.
3448980	3457300	I also informed everybody on the DEF CON discord channel that you would be trying to join there. If you were able to.
3457400	3459320	So we are not live anymore.
3459380	3460680	We are still live.
3460680	3461420	Okay.
3462620	3469660	All right, so I, I thank everybody for the attention and for being here.
3469820	3479680	There was like also good feedback on the Twitter so thank you very much and I will try my best to join this, the channel on the DEF CON right now.
3479720	3482080	Okay, well thank you very much for joining us Marina.
3482600	3483940	Thank you for having me.