1
00:00:04,170 --> 00:00:06,110
Okay, hello everyone.

2
00:00:06,110 --> 00:00:15,610
My name is Joe Slowik, and I'm going to be talking about something I call mission kill, focusing on process targeting in ICS attacks.

3
00:00:15,610 --> 00:00:19,610
So getting into that first, who am I?

4
00:00:19,610 --> 00:00:32,870
So currently I am a adversary hunter, a fancy way of saying threat intelligence I suppose, working at Dragos, focusing on industrial control system threats and threat activities.

5
00:00:32,870 --> 00:00:39,390
I also do some cyber threat intelligence training through a side gig called Paralys.

6
00:00:39,390 --> 00:00:44,810
If you're hanging around the Blue Team Village, you'll see me with a workshop on cyber threat intelligence later today.

7
00:00:44,950 --> 00:00:57,390
But in addition to my current time working with Dragos on ICS threats, I formerly led the incident response team at Los Alamos National Laboratory and did some sidery things for the U.S.

8
00:00:57,390 --> 00:00:59,890
Navy as an officer back in the day.

9
00:00:59,950 --> 00:01:03,950
But enough about me, we really want to get to our agenda for today.

10
00:01:04,170 --> 00:01:12,310
And along those lines, we're going to start with just a definition of what an attack means.

11
00:01:14,430 --> 00:01:22,230
There's a lot of confusion around the word, and so just get a common conception of what the term means in the context of ICS events.

12
00:01:22,230 --> 00:01:38,530
And then review three process targeting incidents from the past few years and what those teach us and the consequences of seeing adversaries migrate into a more refined or a more focused way of trying to impact control system environments.

13
00:01:38,530 --> 00:01:49,770
And conclude with defensive options and implications for what it is that asset owners and operators need to do in order to meet this type of or category of threat.

14
00:01:49,770 --> 00:01:57,780
So first to define attack, principally I'm looking at attack as being those deny, destroy operations.

15
00:01:57,780 --> 00:02:03,520
So just simply scanning a device, sending a phishing message, don't really constitute attacks.

16
00:02:03,520 --> 00:02:22,820
These can come into play in terms of certain preparatory actions, but trying to determine what is simply a route to economic espionage versus what is a precursor to an attack really depends upon being able to discern or identify adversary intent.

17
00:02:22,820 --> 00:02:26,340
And short of being able to read minds, it's very hard to do that.

18
00:02:26,340 --> 00:02:41,360
So really for the purposes of this discussion, we're really only talking about those sorts of incidents where there has been noticeable process disruption, degradation, or denying control over an industrial process.

19
00:02:41,640 --> 00:02:45,680
So looking at that, we can map this and there are several ways of doing this.

20
00:02:45,680 --> 00:02:50,820
There's the ICS specific kill chain, as well as the various other kill chains that are out there.

21
00:02:50,820 --> 00:02:53,300
Since we can't just have one, we need multiple.

22
00:02:53,300 --> 00:03:18,600
But really looking at a sequence of events going from typically breaching a victim's IT network, identifying points of contact with the industrial environment, enumerating and categorizing that environment in order to determine what sort of capabilities are necessary in order to interact with or make some change or disruptive effect within that environment,

23
00:03:18,600 --> 00:03:22,660
and then finally being in a position to deliver effects on objectives.

24
00:03:22,660 --> 00:03:38,100
So a sequence of events that are interdependent, that if you fail in one, you essentially fail in all, that defines what it is required in order to execute something disruptive or destructive within an industrial environment.

25
00:03:38,160 --> 00:03:46,000
And so with that in mind, looking at a lot of headlines, we see things that are mentioned as attacks that really don't meet that bar.

26
00:03:46,000 --> 00:04:03,980
Whether we have items like the infamous dam, New York dam incident from almost 10 years ago now, to items like the Baku-Sehan-Tbilisi pipeline incident, or even just plain made up items like in the wild ransomware that was a company tech demo and whatnot,

27
00:04:03,980 --> 00:04:17,420
that we see the word attack thrown about quite frequently but done so in ways that really don't align well with a conception of what an attack really means or where the implications are quite real.

28
00:04:17,500 --> 00:04:21,820
We do, however, see general attacks that impact ICS.

29
00:04:21,820 --> 00:04:43,140
So whether we're looking at something like the Shamoon event or the sequence of Shamoon events since the first one in 2012, moving on to items like there was a recent very interesting event that took place in the United States just last year, where there was a denial of service condition on a router that inhibited control over a wind farm for a period of time.

30
00:04:43,140 --> 00:04:45,300
But while concerning, it seemed very untargeted.

31
00:04:45,300 --> 00:04:53,300
And then getting into things like various ransomware strains that migrate into and have some impact on industrial operations.

32
00:04:53,300 --> 00:05:02,540
While all of these are very concerning, they're also somewhat dumb or very untargeted and kind of sloppy in impact.

33
00:05:02,540 --> 00:05:13,440
They're not terribly focused and not really taking into consideration the nature of or the specifics of the targeted industrial environment or the underlying process.

34
00:05:13,440 --> 00:05:29,240
Because today, what we want to talk about is a more focused type of attack that I refer to as process targeting, where instead of just blindly looking to disrupt whatever is reachable within an environment, attackers instead focus on a specific stage or aspect of an industrial process.

35
00:05:29,240 --> 00:05:38,700
And this can be technical, such as looking for specific equipment or software, targeting a known vulnerability or something along those lines, or it could be operational.

36
00:05:38,700 --> 00:05:55,580
So understanding what the sequence of events required for an industrial process, such as a manufacturing line that goes through three distinct states, and knowing which is a critical path node that if it's disrupted, it results in the entire line being brought down,

37
00:05:55,580 --> 00:06:00,520
represents a more operational way of looking at things and targeting those sorts of weak points.

38
00:06:00,520 --> 00:06:11,800
So we're really trying to move away from the discussions on indiscriminate wiping, ransomware, worms, etc., which define most of the industrial impacting events that we've seen thus far.

39
00:06:11,940 --> 00:06:24,780
But the thing is, don't just describe all of the industrial events that we've seen to date, because there are a subset of industrial impacting events, some in cyber, but one that's actually physical that I think presents some very important lessons.

40
00:06:24,780 --> 00:06:33,220
And so I'm going to bring that into the discussion today, that represent true process targeting for impacts and industrial control environments.

41
00:06:33,220 --> 00:06:51,880
So we'll talk to the 2016 Ukraine event, which involved the crash-over-rod malware, also referred to as Indestroyer, the 2017 Saudi Arabia incident that involved the use of the Triton or Trisys malware, and then talk about something that happened in Saudi Arabia in 2019 that wasn't cyber in origin,

42
00:06:51,880 --> 00:06:58,380
but really emphasizes how attackers are evolving when it comes to operating in industrial spaces.

43
00:06:58,580 --> 00:07:01,120
So first, the crash-over-ride incident.

44
00:07:01,140 --> 00:07:11,060
This was something that was briefed at Black Hat a couple of years ago between Mike, myself, and some Draco's colleagues, as well as Anton Cherpenov and Robert Lepofsky of ESET.

45
00:07:11,420 --> 00:07:35,560
An interesting event in that it represented the second cyber event impacting electric operations in Ukraine after the 2015 incident, but the 2016 event was a little bit more interesting because it represented a technical evolution in that it introduced a specific piece of malware with capabilities for manipulating the distribution,

46
00:07:35,560 --> 00:07:44,520
well, transmission operations within a substation in order to cause a disruption of the delivery of power.

47
00:07:44,520 --> 00:08:01,960
So the way that this attack worked is first, penetrate the environment and place malware on computers that can communicate to the field devices that actually control the breakers, and schedule that malware in order to open breakers at the target transmission site to do a sort of coordinated effort.

48
00:08:01,980 --> 00:08:15,360
And then there was some after-effect limited system wipe and some disabling events on infected machines that induced the loss of at least logical or state of control in the specific environment.

49
00:08:15,740 --> 00:08:28,700
And then there was this thing that at least at the time, and I've since analyzed this quite extensively in my presentation at the ICS Village last year actually, as well as in a subsequent white paper, on a protective relay denial of service that took place post-attack,

50
00:08:28,700 --> 00:08:34,680
which actually starts to become more significant when you look at this attack in terms of process dependencies.

51
00:08:34,920 --> 00:08:51,520
Because when we start looking back at 2015, the attackers used a wiper ostensibly to delay recovery in 2015, that we will disable all the SCADA workstations, all the engineering workstations, in order to inhibit the ability to restore operations in an effective and efficient way.

52
00:08:51,520 --> 00:09:04,200
But from the 2015 attack, it was proved that the operators in question were quite happy and willing to rapidly shift into manual operations in order to restore electric service as quickly as possible.

53
00:09:04,200 --> 00:09:17,420
And we can assume that the attackers weren't stupid, and there are significant pieces of evidence that have been reported publicly, as well as a lot of things I've written privately, that the attackers in these incidents, if not, are the same, or at least are very much tightly linked,

54
00:09:17,420 --> 00:09:29,340
that they took note and that the wiper functionality in 2016 really seems kind of superfluous if you know that the operators are going to go out to the transmission yard and start closing breakers manually.

55
00:09:29,420 --> 00:09:36,100
So other than just being an asshole and wiping computers and making restoration just more painful in the long term, why would you do this?

56
00:09:36,100 --> 00:09:52,280
Well, it seems that instead the wiper was intended for other purposes, that rather than to inhibit restoration, because you know that the operators are going to get into manual operations, instead the wiper seems more aligned with eliminating logical view and control of the SCADA environment.

57
00:09:52,300 --> 00:10:04,620
And that brings us to protective relays, because that denial of service condition on protective relays becomes fairly significant when you realize what a protective relay does in the context of electric utility operations.

58
00:10:04,620 --> 00:10:31,740
So especially a digital protective relay is a smart device that works to ensure the process, maybe not necessarily safety, but certainly process control and certain degrees of process protection to make sure that fluctuations in electric distribution and transmission operations don't propagate beyond the relay operations in order to induce potential physical damage to electric distribution,

59
00:10:31,740 --> 00:10:33,820
transmission, or even generation gear.

60
00:10:33,840 --> 00:10:43,180
So looking at this is that we see protective relays as being a significant aspect of electric operations at multiple stages of the electric utility landscape.

61
00:10:43,180 --> 00:11:01,380
And while you can operate without them, it induces a certain level of risk in that fluctuations in normal fluctuations is the part of electric operations, let alone the introduction of potential disasters, natural or engineered, means that with the absence of relay protection,

62
00:11:01,380 --> 00:11:10,820
anomalous events would propagate beyond that protective layer to start impacting equipment directly, thus creating the preconditions for physical equipment damage.

63
00:11:10,840 --> 00:11:23,200
So looking at the event in Ukraine, the Siemens SuperTech denial of service is pretty interesting in that it doesn't take the device offline, but rather the denial of service wipes all the protective logic from it.

64
00:11:23,200 --> 00:11:33,240
It's one of those, this is a feature as opposed to a bug, in that it's used to free up memory to allow for a firmware upgrade or reprogramming of the device.

65
00:11:33,240 --> 00:11:47,340
So the device is still network accessible, it looks powered on, so if you're running through the yard trying to figure out what's going on or through the control room, it might look like the device is still up and running, but all the actual protection logic is removed,

66
00:11:47,340 --> 00:11:49,080
so it's not doing its job.

67
00:11:49,080 --> 00:11:54,880
And it's a trivial attack to execute just by setting a single UDP packet within the environment.

68
00:11:54,880 --> 00:11:58,000
It is worth noting that there was an endingness mistake in the malware.

69
00:11:58,140 --> 00:12:10,200
Not sure if they were counting on this being translated in some fashion, although working in a lab environment, not quite sure how this was supposed to have worked, but it doesn't look like the payload would have been delivered properly, at least in the actual attack.

70
00:12:10,200 --> 00:12:13,860
And this is one of a number of mistakes that were made as part of the crash override event.

71
00:12:14,160 --> 00:12:36,360
But even though it didn't work quite as to the extent or in the fashion that the attackers wanted to, the intentions and the capabilities deployed in the 2016 Ukraine incident show a much more ambitious event than what we saw in 2015, in that the attackers induced a widespread outage and a loss of view condition through that wiping aspect,

72
00:12:36,360 --> 00:12:39,600
and then removed line protection from transmission operations.

73
00:12:39,600 --> 00:12:52,780
Now, removing line protection on a de-energized line makes no sense when you think about it, but if you're anticipating that operators will rush to restore operations irrespective of their ability to ascertain the process safety and protection of the environment,

74
00:12:52,780 --> 00:13:04,300
now you're setting up a staged attack where there's potential physically destructive consequences when you restore power to those de-energized lines in the absence of process protection.

75
00:13:04,300 --> 00:13:22,840
So while it didn't work as intended, crash override was appears as though it was designed to try to achieve physical process destruction within the context of electric transmission operations that would have had disruptive effects lasting potentially months in order to try to restore,

76
00:13:22,840 --> 00:13:27,080
recover, and ultimately likely replace damaged gear.

77
00:13:27,080 --> 00:13:37,230
And a lot of this comes from knowing both the combination of how the operators in question worked within their environment as well as the importance of protective relays for electric operations.

78
00:13:38,180 --> 00:13:44,880
Moving on to 2017, we had the Triton Trisis incident at a petrochemical facility in Saudi Arabia.

79
00:13:44,980 --> 00:13:51,680
And there was much discussion at the time about Triton Trisis as being malware that can kill and who was behind it.

80
00:13:51,680 --> 00:13:52,340
Is it Iran?

81
00:13:52,340 --> 00:13:53,140
Is it Russia?

82
00:13:53,140 --> 00:13:54,760
Or is it some other entity?

83
00:13:54,800 --> 00:14:07,540
But a lot of the discussion really masked some of the subtleties and really quite interesting technical details around what Trisis was capable of and how it would work as part of a overall attack sequence.

84
00:14:07,540 --> 00:14:24,040
Because again, similar to what we saw in 2016, Triton Trisis was not a bolt from the blue but rather the end result, well not even the end result as we'll see shortly, in a sequence of events to achieve physical process disruption or destruction within the victim environment.

85
00:14:24,040 --> 00:14:45,960
So we have a combination of items of repeated credential harvesting and reuse to pivot around the environment and to replay access through legitimate VPNs in order to get remote access into the ICS environment, continuing to pivot through credential capture until the attacker is able to get direct communication to a safety instrumented system on which Trisis could be deployed.

86
00:14:45,960 --> 00:14:55,740
And that's an interesting part and requires us to understand what a safety instrumented system is within the context of industrial operations generally and petrochemical facilities specifically.

87
00:14:55,740 --> 00:15:17,140
Because safety systems, while they don't ensure that nothing bad ever does happen, a safety instrumented system typically acts as sort of an emergency control system in parallel to the basic or operator controlled environment, such that in the event of a hazardous or dangerous set of conditions within the plant environment,

88
00:15:17,140 --> 00:15:29,080
that automated controls are put into place to ensure an easier or less physically disruptive recovery of the plant environment to minimize damage, disruption, and facilitate recovery.

89
00:15:29,080 --> 00:15:47,880
Now there are certainly additional safeguards within plant environments from blowout valves and pressure release valves and other sorts of items that act as engineering layers of safety control, but these start getting into more difficult circumstances for recovery and may have potentially hazardous conditions of themselves,

90
00:15:47,880 --> 00:15:56,220
like if you're venting product or even high pressure or high temperature steam, in order to reduce pressure in an environment that could lead to physically hazardous conditions.

91
00:15:56,300 --> 00:16:08,920
So while just because you remove the safety layer doesn't mean that you're setting up a plant for absolute tremendous levels of destruction, it still makes for a very hazardous environment where potentially nasty things can take place.

92
00:16:09,020 --> 00:16:26,140
If we start looking at trite and trisis, it becomes important to note that the intrusion itself wasn't just focused on the safety layer, but in talking with the incident responders who worked on the event, the compromise took place through both the safety layer as well as within the plant distributed control system environment.

93
00:16:26,260 --> 00:16:43,740
Using those compromises in parallel, a modification of safety settings means that you can have a manipulation on the DCS side that could cause a hazardous condition and then allow it to propagate through the safety layer in order to produce a hazardous effect within the environment in question .

94
00:16:43,740 --> 00:17:04,500
And this combined intrusion and the interdependency between the two requires some understanding and knowledge of how these different items interact with each other and what sort of changes or what sort of actions you can take that would allow for a cyber action to propagate into actual physical disruption as opposed to merely a plant denial of service.

95
00:17:04,580 --> 00:17:11,480
Because what's interesting about this is that trite and trisis, kind of like the 2016 event, didn't work, at least not as the attackers intended.

96
00:17:11,500 --> 00:17:25,260
So whereas it looks like the intended attack was to modify the sys to eliminate the safety layer, then leverage compromise of the DCS in order to produce a dangerous state that would then propagate beyond the safety layer to cause physical process disruption,

97
00:17:25,260 --> 00:17:39,480
instead of the time of installation of the trisis malware, which happened not just once but twice, at least twice, within the environment, that a error or something else within how the malware was put together caused the safety system to trip.

98
00:17:39,480 --> 00:17:52,860
And as a result, the plant shut down, which is still very disruptive and not a nice thing and cost a lot of money, but doesn't result in the sort of damage that would have happened had this attack actually worked as it looked like it was designed or intended to be carried out.

99
00:17:52,860 --> 00:18:05,580
So again, attackers are getting smarter in terms of knowing what sort of things to look for within industrial environments to sort of maximize damage, but still showing that they have a ways to go before being able to do so successfully or at least on a consistent basis.

100
00:18:05,860 --> 00:18:11,580
Which brings us to something very interesting and a little bit more blunt than some of the cyber operations we've been talking about so far.

101
00:18:12,080 --> 00:18:33,480
Now in September of 2019, there was a very interesting event that took place in Saudi Arabia, again Saudi Arabia, where there was a drone and missile strike on two facilities in Saudi Arabia, the petrochemical facility at Abqaiq and the oil production facilities at the Kurias field within the country.

102
00:18:33,480 --> 00:18:39,540
So certainly very alarming, very concerning, but what the hell does this have to do with cyber and why are you bringing this up, Joe?

103
00:18:39,540 --> 00:18:58,960
Well, the reason is that, for one, this represents the continuation of a series of events, both cyber and physical, against Saudi oil infrastructure from the Shamoud events to multiple physical disruptive and similar drone strikes both on cross-country pipeline operations as well as oil and gas production facilities.

104
00:18:58,960 --> 00:19:15,680
But what makes the September 2019 incident especially interesting is that it was very focused on a specific aspect of Saudi oil and gas operations that show a level of knowledge about how the Saudi oil and gas sector works and going back to the idea of process specific understanding and targeting.

105
00:19:15,700 --> 00:19:22,300
Because when we look at Abqaiq, it is the world's largest oil processing and crude stabilization facility.

106
00:19:22,300 --> 00:19:35,900
Essentially, Abqaiq serves as the linchpin for the entire Saudi... well, for the majority of Saudi oil production in sweetening otherwise sour crude so that it is easier to sell and more acceptable to world markets.

107
00:19:35,900 --> 00:19:51,600
Essentially, if you take out the Abqaiq facility or its ability to operate, the ability for Saudi Arabia to produce oil that the market desires becomes severely degraded and thus producing significant economic disruption as a result of physical disruption.

108
00:19:51,600 --> 00:20:13,320
Because looking at the sweetening operations or the desulfurization of removal of sulfur from crude oil, it's a very complex chemical operation that requires a significant investment in equipment, fairly large physical footprint for plant operations, and as a result,

109
00:20:13,320 --> 00:20:15,620
something that represents a fairly big target.

110
00:20:15,620 --> 00:20:24,220
And it's been the one that's been targeted at least in the context of Abqaiq several times previously but through rather blunt measures such as car bombs and other operations.

111
00:20:24,220 --> 00:20:41,240
Whereas the 2019 strike showed a very specific targeting because if we look at after action reports of the damage, we see that a lot of the primary focus of the attack wasn't on things like oil storage facilities or pumping and transportation infrastructure,

112
00:20:41,240 --> 00:20:53,180
but rather on the vessels and cracking facilities required to perform the hydro desulfurization of crude oil to make it acceptable and for the market or able to export it.

113
00:20:53,180 --> 00:21:14,840
So again, a very focused attack on a very specific aspect of the Saudi industry that shows an understanding of a critical process node or path dependency within Saudi oil operations that could allow for a significantly magnified impact as a result of just attacking one physical component of Saudi oil and gas infrastructure.

114
00:21:14,840 --> 00:21:27,960
So targeting hydro desulfurization facilities would significantly limit Saudi ability to export oil to market, and it did for a while, and there was significant effort placed into trying to restore these operations as rapidly as possible to try and recover.

115
00:21:28,020 --> 00:21:47,580
But as a result, the attacker was able to maximize a fairly limited strike by making sure they targeted just the right facilities in order to cause a magnified impact far out of scope, or at least seemingly out of scope, or at least beyond the immediate impacts of just physical process disruption.

116
00:21:47,580 --> 00:21:58,160
So understanding how these things tie together enables for a much more powerful, much more impactful attack than just simply lobbing bombs into the Abqaiq facility and hoping for the best.

117
00:21:58,360 --> 00:21:59,860
So where does that take us?

118
00:21:59,860 --> 00:22:12,640
Well, it shows that attackers are starting to get a little bit smarter in what they're shooting for when it comes to trying to disrupt industrial environments, whether that comes through cyber operations like we saw in the 2016 Ukraine event and the 2017 Saudi event,

119
00:22:12,640 --> 00:22:18,000
as well as through physical operations such as the Abqaiq drone and missile strike.

120
00:22:18,080 --> 00:22:37,500
Because what we're seeing is that adversaries are learning about how these operations work, and that increased knowledge yields an understanding of functional dependencies within these environments that allow us for adversaries to engage in focused targeting so that they can increase the effectiveness and the disruptive capability of strikes,

121
00:22:37,500 --> 00:22:40,620
no matter how they happen to be executed within plant environments.

122
00:22:40,620 --> 00:22:45,440
And we're looking at these focus points on the three items that we covered in the examples today.

123
00:22:45,440 --> 00:22:55,680
Process protection, the ability to make sure that industrial environments remain in a fashion that avoids physical damage and disruption to the equipment in question.

124
00:22:55,680 --> 00:23:09,300
Process safety, to make sure that equipment is not able to or at least has sufficient safeguards in place so as not to risk the safety or effectiveness of equipment or potentially causing harm to personnel within the plant environment.

125
00:23:09,300 --> 00:23:19,180
As well as process dependencies, looking at how critical a single facility like Abqaiq would be to the overall export of petroleum products for the Kingdom of Saudi Arabia.

126
00:23:19,820 --> 00:23:31,120
And the risks of this and the implications are that attackers, by being able to focus on specific aspects of industrial operations, open up very interesting avenues for what kind of damage they can cause.

127
00:23:31,120 --> 00:23:46,560
Everything from making sure they could cause more focused and potentially longer lasting process disruption, thus increasing downtime, towards in scarier items like a potential loss of life scenario, which may have manifested had crisis actually worked out as it was intended,

128
00:23:46,560 --> 00:23:52,300
or physical damage like was the which was the likely intention in the 2016 Ukraine event.

129
00:23:52,300 --> 00:24:13,640
So looking at this, we're seeing adversaries evolve over time from rather blunt and somewhat simplistic attacks like IT-based wipers, such as the Shamoon events and some other incidents where just deploy something that network and cause as much disruption as you can in a fairly untargeted and widespread fashion,

130
00:24:13,640 --> 00:24:29,480
then getting into more untargeted disruption, just trying to disconnect processes and inhibit control, something like we saw with the 2015 Ukraine event, and then getting into more advanced and more specific targeting, such as the focus on protective relays in 2016,

131
00:24:29,480 --> 00:24:38,580
the focus on safety systems in 2017, or the focus on hydro desulphurization operations in the 2019 kinetic strike.

132
00:24:39,000 --> 00:24:48,780
What we do about this is an open question, though, because when we look at defense in a classical sense, we usually think of throwing up walls and trying to keep adversaries out.

133
00:24:48,780 --> 00:25:03,780
And while this is not necessarily a bad thing, and we certainly want to keep adversaries out, this is a very limited view and not necessarily helpful in trying to really adapt with how adversaries are shifting when it comes to trying to impact industrial environments.

134
00:25:03,900 --> 00:25:18,820
Because looking at industrial environments, we have the combination of not just IT-based or IT-like equipment, which is amenable to IT-like controls, but also combined with that, the physical process environment, both in terms of what the environment is designed to do,

135
00:25:18,820 --> 00:25:28,040
as well as the implications of undesired or unintentional modifications to that environment that can cause disruption and potentially even damage.

136
00:25:28,040 --> 00:25:43,300
So instead, we need to have process-aware defense as part of ICS operations, where traditional IT-centric defense certainly forms a major plank of what we're trying to do, because we have lots of information systems that now reside within industrial environments.

137
00:25:43,300 --> 00:26:00,440
But we want to combine this with process-specific monitoring and analysis so that we can marry a logical view of the environment along with a physics-centric or process-centric view of just what's going on within the plant environment, so that we can ascertain things such as the status of process protection,

138
00:26:00,440 --> 00:26:10,660
process safety, or how different items of the overall process environment are interacting and what our IT visibility may indicate certain entities are trying to do within that environment.

139
00:26:10,660 --> 00:26:14,360
But also, we want to make sure that we're investing in resilience and recovery.

140
00:26:14,380 --> 00:26:18,140
This is always an uncomfortable topic, because it implies that bad things have already happened.

141
00:26:18,140 --> 00:26:34,220
But if we look at events like the 2016 and 2017 events, we need to make sure as ICS defenders and ICS operators that we have the capability of not only identifying what changes have taken place within the operating environment, such as the removal of process protection and process safety,

142
00:26:34,220 --> 00:26:58,920
but also have a way of ascertaining what those changes were and how to restore or recover from those changes, so that we're not just restoring availability in the sense of bringing processes back online, but also making sure that we're maintaining process integrity and that operations are restored to a known good and known safe state in order to make sure that we're not endangering operations or the personnel within that plant environment.

143
00:26:59,480 --> 00:27:04,580
And a key to doing this is making sure that we're improving visibility into industrial environments.

144
00:27:04,580 --> 00:27:18,240
So while we already see process data captured for operations purposes, we have data historians that do this job already, but we need to combine that with improved host and network visibility, much like what we've seen over the past five years in enterprise IT environments,

145
00:27:18,240 --> 00:27:36,700
to combine data sets to develop a full scope ICS aware visibility of both the IT and ICS specific aspects of an operating environment to truly understand and track what is going on within the control system environment, both for a defensive perspective,

146
00:27:36,700 --> 00:27:48,080
as well as to just understand purely what's going on, should we have a malicious insider or other entity begin making changes to the environment that could have significant or harmful repercussions.

147
00:27:48,700 --> 00:27:54,640
And then finally, we need to make sure that we're including planning for response and resilience.

148
00:27:54,640 --> 00:28:17,800
That means adapting or modifying the existing contingency planning that exists from an engineering perspective to incorporate cyber, not just in the ability to restore operations, but also do you have the tools and the capability to perform root cause analysis to see that a modification or an attempted modification was made to a safety system or the denial of service condition on the super tech protective relay.

149
00:28:17,840 --> 00:28:35,960
And this also involves a focus of effort on those critical path nodes that allows us to better allocate or smartly allocate resources on those sort of crown jewel processes around which the entire operation revolves around so that we make sure that we're taking care of the most important assets in our environment.

150
00:28:36,160 --> 00:28:53,640
And as a result of all of this, we should be able to allocate resources in such a fashion to facilitate rapid critical resource restoration in an incident to not just minimize downtime, but to make sure we're again restoring to a known good, known safe state instead of just blindly bringing operations back up and hoping for the best.

151
00:28:54,500 --> 00:29:13,660
Ultimately, we're really looking to try and build out a robust defense in depth where we're covering things certainly at the IT layer, but also bringing things into a multi-layered understanding visualization and visibility into control system environments to track not just items like opportunistic ransomware or IT wipers,

152
00:29:13,660 --> 00:29:25,460
but also getting into process specific targeting and modifications that could lead to far more serious effects and building that all into an industrial focused and industrial aware security program.

153
00:29:25,460 --> 00:29:27,440
So with that, I'm right at time.

154
00:29:27,440 --> 00:29:30,120
I believe these slides will be posted somewhere.

155
00:29:30,420 --> 00:29:39,960
There's just a selection of resources, both things that I've written as well as from peers from ESET and FireEye and some of the events that we talked about today.

156
00:29:39,960 --> 00:29:42,900
But if we have some time, I can answer questions.

157
00:29:42,900 --> 00:29:46,040
I don't know how big of a cushion we're leaving between talks.

158
00:30:24,050 --> 00:30:25,750
Well, I hope this was interesting.

159
00:30:25,890 --> 00:30:34,030
Certainly feel free to reach out to me, email, Twitter, whatever works for you, as I'm always happy to discuss this and related items.

160
00:30:34,030 --> 00:30:44,070
I think it's quite fascinating, especially as we start looking into the more strategic and operations focused aspects of cyber events within industrial environments.

161
00:30:44,070 --> 00:30:49,570
It certainly is a lot more interesting than some of the things we see in IT environments, I think, but I'm a little biased there.

162
00:30:50,550 --> 00:30:54,650
But yeah, I don't know, Bryson, if you've got anything for me or anyone else?

163
00:30:58,640 --> 00:30:59,840
No, I think you're good.

164
00:30:59,840 --> 00:31:00,840
Thank you.

165
00:31:04,610 --> 00:31:08,610
Stop the share and I will let the program move on.

166
00:31:08,610 --> 00:31:13,430
I'll be hanging around within the Discord and elsewhere if anyone has thoughts that came up after the fact.

167
00:31:13,430 --> 00:31:16,610
But otherwise, I hope everyone enjoys the ICS Village, as I know I always do.

168
00:31:16,610 --> 00:31:17,150
Thank you.