start	end	text
4170	10050	Okay, hello everyone. My name is Joe Slowik, and I'm going to be talking about something I call
10050	18850	mission kill, focusing on process targeting in ICS attacks. So getting into that first,
18850	26590	who am I? So currently I am a adversary hunter, a fancy way of saying threat intelligence I suppose,
26590	32870	working at Dragos, focusing on industrial control system threats and threat activities.
32870	39390	I also do some cyber threat intelligence training through a side gig called Paralys.
39390	43270	If you're hanging around the Blue Team Village, you'll see me with a workshop on cyber threat
43270	50070	intelligence later today. But in addition to my current time working with Dragos on ICS threats,
50070	55290	I formerly led the incident response team at Los Alamos National Laboratory and did some
55290	61150	sidery things for the U.S. Navy as an officer back in the day. But enough about me, we really
61150	68010	want to get to our agenda for today. And along those lines, we're going to start with just a
68970	78070	definition of what an attack means. There's a lot of confusion around the word, and so just get a
78070	84650	common conception of what the term means in the context of ICS events. And then review three
84650	89130	process targeting incidents from the past few years and what those teach us and the consequences
89130	96230	of seeing adversaries migrate into a more refined or a more focused way of trying to
96230	101710	impact control system environments. And conclude with defensive options and implications for
101710	108430	what it is that asset owners and operators need to do in order to meet this type of or category
108430	115960	of threat. So first to define attack, principally I'm looking at attack as being those deny,
115960	122440	destroy operations. So just simply scanning a device, sending a phishing message, don't really
122440	128500	constitute attacks. These can come into play in terms of certain preparatory actions, but trying
128500	137220	to determine what is simply a route to economic espionage versus what is a precursor to an attack
137220	143520	really depends upon being able to discern or identify adversary intent. And short of being
143520	148240	able to read minds, it's very hard to do that. So really for the purposes of this discussion,
148240	154860	we're really only talking about those sorts of incidents where there has been noticeable process
154860	163000	disruption, degradation, or denying control over an industrial process. So looking at that,
163000	167600	we can map this and there are several ways of doing this. There's the ICS specific kill chain,
167600	172100	as well as the various other kill chains that are out there. Since we can't just have one,
172100	178340	we need multiple. But really looking at a sequence of events going from typically breaching
178740	184640	a victim's IT network, identifying points of contact with the industrial environment,
184640	189400	enumerating and categorizing that environment in order to determine what sort of capabilities
189400	198000	are necessary in order to interact with or make some change or disruptive effect within that
198000	202660	environment, and then finally being in a position to deliver effects on objectives.
202660	208380	So a sequence of events that are interdependent, that if you fail in one, you essentially fail in
208380	215860	all, that defines what it is required in order to execute something disruptive or destructive
215860	221840	within an industrial environment. And so with that in mind, looking at a lot of headlines,
221840	226900	we see things that are mentioned as attacks that really don't meet that bar. Whether we have items
226900	234500	like the infamous dam, New York dam incident from almost 10 years ago now, to items like the
234500	240900	Baku-Sehan-Tbilisi pipeline incident, or even just plain made up items like in the wild ransomware
240900	247400	that was a company tech demo and whatnot, that we see the word attack thrown about quite frequently
247400	253800	but done so in ways that really don't align well with a conception of what an attack really means
253800	261820	or where the implications are quite real. We do, however, see general attacks that impact ICS.
261820	266000	So whether we're looking at something like the Shamoon event or the sequence of Shamoon events
266000	273800	since the first one in 2012, moving on to items like there was a recent very interesting event
273800	277960	that took place in the United States just last year, where there was a denial of service condition
277960	284000	on a router that inhibited control over a wind farm for a period of time. But while concerning,
284000	289480	it seemed very untargeted. And then getting into things like various ransomware strains that migrate
289480	295140	into and have some impact on industrial operations. While all of these are very concerning,
295140	303080	they're also somewhat dumb or very untargeted and kind of sloppy in impact. They're not terribly
303080	310620	focused and not really taking into consideration the nature of or the specifics of the targeted
310620	315880	industrial environment or the underlying process. Because today, what we want to talk about is a
315880	321400	more focused type of attack that I refer to as process targeting, where instead of just blindly
321400	326560	looking to disrupt whatever is reachable within an environment, attackers instead focus on a
326560	331960	specific stage or aspect of an industrial process. And this can be technical, such as looking for
331960	337480	specific equipment or software, targeting a known vulnerability or something along those lines,
337480	343060	or it could be operational. So understanding what the sequence of events required for an industrial
343060	349740	process, such as a manufacturing line that goes through three distinct states, and knowing which
349740	355580	is a critical path node that if it's disrupted, it results in the entire line being brought down,
355580	360520	represents a more operational way of looking at things and targeting those sorts of weak points.
360520	365760	So we're really trying to move away from the discussions on indiscriminate wiping, ransomware,
365760	371800	worms, etc., which define most of the industrial impacting events that we've seen thus far.
371940	375800	But the thing is, don't just describe all of the industrial events that we've seen to date,
375800	382100	because there are a subset of industrial impacting events, some in cyber, but one that's actually
382100	385840	physical that I think presents some very important lessons. And so I'm going to bring that into the
385840	391540	discussion today, that represent true process targeting for impacts and industrial control
392280	398420	environments. So we'll talk to the 2016 Ukraine event, which involved the crash-over-rod malware,
398420	405020	also referred to as Indestroyer, the 2017 Saudi Arabia incident that involved the use of the
405020	409800	Triton or Trisys malware, and then talk about something that happened in Saudi Arabia in 2019
409800	415560	that wasn't cyber in origin, but really emphasizes how attackers are evolving when it comes to
415560	422140	operating in industrial spaces. So first, the crash-over-ride incident. This was something that
422140	427400	was briefed at Black Hat a couple of years ago between Mike, myself, and some Draco's colleagues,
427400	433380	as well as Anton Cherpenov and Robert Lepofsky of ESET. An interesting event in that it represented
433380	441280	the second cyber event impacting electric operations in Ukraine after the 2015 incident,
441280	447160	but the 2016 event was a little bit more interesting because it represented a technical
447160	453640	evolution in that it introduced a specific piece of malware with capabilities for manipulating
453640	462980	the distribution, well, transmission operations within a substation in order to cause a
462980	467960	disruption of the delivery of power. So the way that this attack worked is first, penetrate the
467960	473120	environment and place malware on computers that can communicate to the field devices that actually
473120	477740	control the breakers, and schedule that malware in order to open breakers at the target transmission
477740	486600	site to do a sort of coordinated effort. And then there was some after-effect limited system wipe
486600	491800	and some disabling events on infected machines that induced the loss of at least logical or
491800	497240	state of control in the specific environment. And then there was this thing that at least at the
497240	501940	time, and I've since analyzed this quite extensively in my presentation at the ICS Village
501940	506680	last year actually, as well as in a subsequent white paper, on a protective relay denial of
506680	510640	service that took place post-attack, which actually starts to become more significant
510640	516400	when you look at this attack in terms of process dependencies. Because when we start looking back
516400	523440	at 2015, the attackers used a wiper ostensibly to delay recovery in 2015, that we will disable all
523440	528060	the SCADA workstations, all the engineering workstations, in order to inhibit the ability
528060	534280	to restore operations in an effective and efficient way. But from the 2015 attack, it was proved that
534280	540340	the operators in question were quite happy and willing to rapidly shift into manual operations
540340	545640	in order to restore electric service as quickly as possible. And we can assume that the attackers
545640	550660	weren't stupid, and there are significant pieces of evidence that have been reported publicly,
550660	554860	as well as a lot of things I've written privately, that the attackers in these incidents, if not,
554860	559220	are the same, or at least are very much tightly linked, that they took note and that the wiper
559220	563880	functionality in 2016 really seems kind of superfluous if you know that the operators
563880	569720	are going to go out to the transmission yard and start closing breakers manually. So other
569720	574020	than just being an asshole and wiping computers and making restoration just more painful in the
574020	578980	long term, why would you do this? Well, it seems that instead the wiper was intended for other
578980	584420	purposes, that rather than to inhibit restoration, because you know that the operators are going to
584420	589920	get into manual operations, instead the wiper seems more aligned with eliminating logical view
589920	595300	and control of the SCADA environment. And that brings us to protective relays, because that
595300	600220	denial of service condition on protective relays becomes fairly significant when you realize what
600360	605720	a protective relay does in the context of electric utility operations. So especially a digital
605720	612880	protective relay is a smart device that works to ensure the process, maybe not necessarily safety,
612880	619620	but certainly process control and certain degrees of process protection to make sure that
619620	624620	fluctuations in electric distribution and transmission operations don't propagate beyond
625220	630640	the relay operations in order to induce potential physical damage to electric
630640	635560	distribution, transmission, or even generation gear. So looking at this is that we see protective
635560	641720	relays as being a significant aspect of electric operations at multiple stages of the electric
641720	647760	utility landscape. And while you can operate without them, it induces a certain level of
647760	653040	risk in that fluctuations in normal fluctuations is the part of electric operations, let alone
653040	660180	the introduction of potential disasters, natural or engineered, means that with the absence of relay
660180	665700	protection, anomalous events would propagate beyond that protective layer to start impacting
665700	672140	equipment directly, thus creating the preconditions for physical equipment damage. So looking at the
672140	677400	event in Ukraine, the Siemens SuperTech denial of service is pretty interesting in that
677400	682280	it doesn't take the device offline, but rather the denial of service wipes all the protective logic
682280	688100	from it. It's one of those, this is a feature as opposed to a bug, in that it's used to free up
688100	693880	memory to allow for a firmware upgrade or reprogramming of the device. So the device is
693880	699500	still network accessible, it looks powered on, so if you're running through the yard trying to
699500	703520	figure out what's going on or through the control room, it might look like the device is still up
703520	709980	and running, but all the actual protection logic is removed, so it's not doing its job. And it's a
710760	715340	trivial attack to execute just by setting a single UDP packet within the environment. It is worth
715340	719360	noting that there was an endingness mistake in the malware. Not sure if they were counting on
719360	724100	this being translated in some fashion, although working in a lab environment, not quite sure how
724100	728080	this was supposed to have worked, but it doesn't look like the payload would have been delivered
728080	732240	properly, at least in the actual attack. And this is one of a number of mistakes that were made as
732240	738440	part of the crash override event. But even though it didn't work quite as to the extent or in the
738440	744680	fashion that the attackers wanted to, the intentions and the capabilities deployed in the 2016 Ukraine
744680	749860	incident show a much more ambitious event than what we saw in 2015, in that the attackers
749860	756720	induced a widespread outage and a loss of view condition through that wiping aspect, and then
756720	761420	removed line protection from transmission operations. Now, removing line protection on a
761420	767880	de-energized line makes no sense when you think about it, but if you're anticipating that operators
767880	771540	will rush to restore operations irrespective of their ability to ascertain the process safety and
771540	776220	protection of the environment, now you're setting up a staged attack where there's potential
776220	781860	physically destructive consequences when you restore power to those de-energized lines in the
781860	788400	absence of process protection. So while it didn't work as intended, crash override was appears as
788400	793660	though it was designed to try to achieve physical process destruction within the context of electric
793660	798980	transmission operations that would have had disruptive effects lasting potentially months
799690	807920	in order to try to restore, recover, and ultimately likely replace damaged gear. And a lot of this
807920	812280	comes from knowing both the combination of how the operators in question worked within their
812280	817230	environment as well as the importance of protective relays for electric operations.
818180	824020	Moving on to 2017, we had the Triton Trisis incident at a petrochemical facility in Saudi
824020	830180	Arabia. And there was much discussion at the time about Triton Trisis as being malware that can kill
830180	835700	and who was behind it. Is it Iran? Is it Russia? Or is it some other entity? But a lot of the
835700	840760	discussion really masked some of the subtleties and really quite interesting technical details
840760	847540	around what Trisis was capable of and how it would work as part of a overall attack sequence.
847540	852680	Because again, similar to what we saw in 2016, Triton Trisis was not a bolt from the blue but
852680	859000	rather the end result, well not even the end result as we'll see shortly, in a sequence of
859000	864040	events to achieve physical process disruption or destruction within the victim environment.
864040	869640	So we have a combination of items of repeated credential harvesting and reuse to pivot around
869640	875000	the environment and to replay access through legitimate VPNs in order to get remote access
875000	879880	into the ICS environment, continuing to pivot through credential capture until the attacker
879880	885140	is able to get direct communication to a safety instrumented system on which Trisis could be
885140	889240	deployed. And that's an interesting part and requires us to understand what a safety instrumented
889240	894540	system is within the context of industrial operations generally and petrochemical facilities
894540	901440	specifically. Because safety systems, while they don't ensure that nothing bad ever does happen,
901700	907040	a safety instrumented system typically acts as sort of an emergency control system in parallel
907040	914200	to the basic or operator controlled environment, such that in the event of a hazardous or dangerous
914200	919860	set of conditions within the plant environment, that automated controls are put into place to
919860	925960	ensure an easier or less physically disruptive recovery of the plant environment to minimize
925960	932560	damage, disruption, and facilitate recovery. Now there are certainly additional safeguards within
932560	937540	plant environments from blowout valves and pressure release valves and other sorts of items
937540	941680	that act as engineering layers of safety control, but these start getting into
941680	947480	more difficult circumstances for recovery and may have potentially hazardous conditions of
947480	951920	themselves, like if you're venting product or even high pressure or high temperature steam,
951920	956220	in order to reduce pressure in an environment that could lead to physically hazardous conditions.
956300	960460	So while just because you remove the safety layer doesn't mean that you're setting up a plant for
960460	965640	absolute tremendous levels of destruction, it still makes for a very hazardous environment
965640	971040	where potentially nasty things can take place. If we start looking at trite and trisis, it becomes
971040	976380	important to note that the intrusion itself wasn't just focused on the safety layer, but in talking
976380	981480	with the incident responders who worked on the event, the compromise took place through both
981480	986560	the safety layer as well as within the plant distributed control system environment. Using
986560	993920	those compromises in parallel, a modification of safety settings means that you can have a
993920	998760	manipulation on the DCS side that could cause a hazardous condition and then allow it to propagate
998760	1003200	through the safety layer in order to produce a hazardous effect within the environment in
1003200	1009720	question. And this combined intrusion and the interdependency between the two requires some
1009720	1013620	understanding and knowledge of how these different items interact with each other and what sort of
1013620	1019720	changes or what sort of actions you can take that would allow for a cyber action to propagate into
1019720	1025300	actual physical disruption as opposed to merely a plant denial of service. Because what's interesting
1025300	1030220	about this is that trite and trisis, kind of like the 2016 event, didn't work, at least not as the
1030220	1035340	attackers intended. So whereas it looks like the intended attack was to modify the sys to eliminate
1035340	1041120	the safety layer, then leverage compromise of the DCS in order to produce a dangerous state that
1041120	1045880	would then propagate beyond the safety layer to cause physical process disruption, instead of the
1045880	1052000	time of installation of the trisis malware, which happened not just once but twice, at least twice,
1052000	1057020	within the environment, that a error or something else within how the malware was put together
1057020	1063040	caused the safety system to trip. And as a result, the plant shut down, which is still very disruptive
1063040	1067140	and not a nice thing and cost a lot of money, but doesn't result in the sort of damage that would
1067140	1071480	have happened had this attack actually worked as it looked like it was designed or intended to
1071480	1076260	be carried out. So again, attackers are getting smarter in terms of knowing what sort of things to
1076260	1080640	look for within industrial environments to sort of maximize damage, but still showing that they
1080640	1085580	have a ways to go before being able to do so successfully or at least on a consistent basis.
1085860	1089040	Which brings us to something very interesting and a little bit more blunt than some of the
1089040	1094760	cyber operations we've been talking about so far. Now in September of 2019, there was a very
1094760	1100340	interesting event that took place in Saudi Arabia, again Saudi Arabia, where there was a drone and
1100340	1109380	missile strike on two facilities in Saudi Arabia, the petrochemical facility at Abqaiq and the oil
1109380	1115400	production facilities at the Kurias field within the country. So certainly very alarming, very
1115400	1119540	concerning, but what the hell does this have to do with cyber and why are you bringing this up, Joe?
1119540	1125240	Well, the reason is that, for one, this represents the continuation of a series of events, both
1125240	1131160	cyber and physical, against Saudi oil infrastructure from the Shamoud events to multiple physical
1131160	1137220	disruptive and similar drone strikes both on cross-country pipeline operations as well as oil
1137220	1142360	and gas production facilities. But what makes the September 2019 incident especially interesting
1142360	1148260	is that it was very focused on a specific aspect of Saudi oil and gas operations that show a level
1148260	1153380	of knowledge about how the Saudi oil and gas sector works and going back to the idea of process
1153380	1159520	specific understanding and targeting. Because when we look at Abqaiq, it is the world's largest oil
1159520	1164620	processing and crude stabilization facility. Essentially, Abqaiq serves as the linchpin for the
1164620	1170600	entire Saudi... well, for the majority of Saudi oil production in sweetening otherwise sour crude
1170600	1177340	so that it is easier to sell and more acceptable to world markets. Essentially, if you take out
1177340	1183780	the Abqaiq facility or its ability to operate, the ability for Saudi Arabia to produce oil that
1183780	1189340	the market desires becomes severely degraded and thus producing significant economic disruption
1189340	1195220	as a result of physical disruption. Because looking at the sweetening operations or the
1198120	1205220	desulfurization of removal of sulfur from crude oil, it's a very complex chemical operation that
1205220	1210380	requires a significant investment in equipment, fairly large physical footprint for plant
1210380	1216100	operations, and as a result, something that represents a fairly big target. And it's been
1216100	1220120	the one that's been targeted at least in the context of Abqaiq several times previously but
1220120	1225540	through rather blunt measures such as car bombs and other operations. Whereas the 2019 strike
1225540	1231700	showed a very specific targeting because if we look at after action reports of the damage, we see
1231700	1237140	that a lot of the primary focus of the attack wasn't on things like oil storage facilities
1238140	1244060	or pumping and transportation infrastructure, but rather on the vessels and cracking facilities
1244060	1251660	required to perform the hydro desulfurization of crude oil to make it acceptable and for the market
1251660	1256880	or able to export it. So again, a very focused attack on a very specific aspect of the Saudi
1256880	1261920	industry that shows an understanding of a critical process node or path dependency
1261920	1265880	within Saudi oil operations that could allow for a significantly
1268040	1273680	magnified impact as a result of just attacking one physical component of Saudi oil and gas
1273680	1279680	infrastructure. So targeting hydro desulfurization facilities would significantly limit Saudi ability
1279680	1284420	to export oil to market, and it did for a while, and there was significant effort placed into trying
1284420	1289640	to restore these operations as rapidly as possible to try and recover. But as a result, the attacker
1289640	1295420	was able to maximize a fairly limited strike by making sure they targeted just the right facilities
1295420	1300120	in order to cause a magnified impact far out of scope, or at least seemingly
1302260	1307760	out of scope, or at least beyond the immediate impacts of just physical process disruption. So
1307760	1312420	understanding how these things tie together enables for a much more powerful, much more
1312420	1318160	impactful attack than just simply lobbing bombs into the Abqaiq facility and hoping for the best.
1318360	1322380	So where does that take us? Well, it shows that attackers are starting to get a little bit smarter
1322380	1326620	in what they're shooting for when it comes to trying to disrupt industrial environments, whether
1326620	1332640	that comes through cyber operations like we saw in the 2016 Ukraine event and the 2017 Saudi event,
1332640	1339240	as well as through physical operations such as the Abqaiq drone and missile strike. Because what we're
1339240	1344920	seeing is that adversaries are learning about how these operations work, and that increased knowledge
1344920	1349440	yields an understanding of functional dependencies within these environments that allow us for
1349440	1354460	adversaries to engage in focused targeting so that they can increase the effectiveness and
1354460	1359600	the disruptive capability of strikes, no matter how they happen to be executed within plant
1359600	1364200	environments. And we're looking at these focus points on the three items that we covered in the
1364200	1369580	examples today. Process protection, the ability to make sure that industrial environments remain
1369580	1375680	in a fashion that avoids physical damage and disruption to the equipment in question.
1375680	1381600	Process safety, to make sure that equipment is not able to or at least has sufficient safeguards
1381600	1386320	in place so as not to risk the safety or effectiveness of equipment or potentially
1386320	1390940	causing harm to personnel within the plant environment. As well as process dependencies,
1390940	1396760	looking at how critical a single facility like Abqaiq would be to the overall export of petroleum
1396760	1402060	products for the Kingdom of Saudi Arabia. And the risks of this and the implications are that
1402060	1407620	attackers, by being able to focus on specific aspects of industrial operations, open up very
1407620	1413320	interesting avenues for what kind of damage they can cause. Everything from making sure they could
1413320	1419300	cause more focused and potentially longer lasting process disruption, thus increasing downtime,
1419300	1424220	towards in scarier items like a potential loss of life scenario, which may have manifested had
1424220	1429500	crisis actually worked out as it was intended, or physical damage like was the which was the
1429500	1434760	likely intention in the 2016 Ukraine event. So looking at this, we're seeing adversaries
1434760	1440720	evolve over time from rather blunt and somewhat simplistic attacks like IT-based wipers,
1440720	1445560	such as the Shamoon events and some other incidents where just deploy something that
1445560	1453640	network and cause as much disruption as you can in a fairly untargeted and widespread fashion,
1453640	1460320	then getting into more untargeted disruption, just trying to disconnect processes and inhibit control,
1460320	1465020	something like we saw with the 2015 Ukraine event, and then getting into more advanced and
1465020	1470520	more specific targeting, such as the focus on protective relays in 2016, the focus on safety
1470520	1477600	systems in 2017, or the focus on hydro desulphurization operations in the 2019 kinetic
1477600	1484280	strike. What we do about this is an open question, though, because when we look at defense in a
1484280	1488880	classical sense, we usually think of throwing up walls and trying to keep adversaries out.
1488880	1493660	And while this is not necessarily a bad thing, and we certainly want to keep adversaries out,
1493660	1499360	this is a very limited view and not necessarily helpful in trying to really adapt with how
1499360	1503780	adversaries are shifting when it comes to trying to impact industrial environments.
1503900	1507840	Because looking at industrial environments, we have the combination of not just
1507840	1514440	IT-based or IT-like equipment, which is amenable to IT-like controls, but also combined with that,
1514440	1518820	the physical process environment, both in terms of what the environment is designed to do,
1518820	1524840	as well as the implications of undesired or unintentional modifications to that environment
1524840	1530320	that can cause disruption and potentially even damage. So instead, we need to have process-aware
1530320	1535580	defense as part of ICS operations, where traditional IT-centric defense certainly
1535580	1539940	forms a major plank of what we're trying to do, because we have lots of information systems
1539940	1545400	that now reside within industrial environments. But we want to combine this with process-specific
1545400	1552120	monitoring and analysis so that we can marry a logical view of the environment along with a
1552120	1556980	physics-centric or process-centric view of just what's going on within the plant environment,
1556980	1561340	so that we can ascertain things such as the status of process protection, process safety,
1561340	1566380	or how different items of the overall process environment are interacting and what our IT
1566380	1571280	visibility may indicate certain entities are trying to do within that environment. But also,
1571280	1574960	we want to make sure that we're investing in resilience and recovery. This is always an
1574960	1578760	uncomfortable topic, because it implies that bad things have already happened. But if we look at
1578760	1585680	events like the 2016 and 2017 events, we need to make sure as ICS defenders and ICS operators
1585680	1589840	that we have the capability of not only identifying what changes have taken place within
1589840	1594660	the operating environment, such as the removal of process protection and process safety, but also
1594660	1600120	have a way of ascertaining what those changes were and how to restore or recover from those changes,
1600120	1605880	so that we're not just restoring availability in the sense of bringing processes back online,
1605880	1611120	but also making sure that we're maintaining process integrity and that operations are
1611120	1615820	restored to a known good and known safe state in order to make sure that we're not endangering
1615820	1621100	operations or the personnel within that plant environment. And a key to doing this is making
1621100	1625140	sure that we're improving visibility into industrial environments. So while we already
1625140	1630660	see process data captured for operations purposes, we have data historians that do this job already,
1630660	1635460	but we need to combine that with improved host and network visibility, much like what we've seen
1635460	1640420	over the past five years in enterprise IT environments, to combine data sets to develop
1640620	1649340	a full scope ICS aware visibility of both the IT and ICS specific aspects of an operating environment
1649340	1655220	to truly understand and track what is going on within the control system environment, both for
1655380	1660440	a defensive perspective, as well as to just understand purely what's going on, should we have
1660560	1665220	a malicious insider or other entity begin making changes to the environment that could have
1665220	1672360	significant or harmful repercussions. And then finally, we need to make sure that we're including
1672360	1677480	planning for response and resilience. That means adapting or modifying the existing contingency
1677480	1682320	planning that exists from an engineering perspective to incorporate cyber, not just in the
1683040	1687200	ability to restore operations, but also do you have the tools and the capability
1687200	1691780	to perform root cause analysis to see that a modification or an attempted modification
1691780	1696160	was made to a safety system or the denial of service condition on the super tech
1696160	1701400	protective relay. And this also involves a focus of effort on those critical path nodes
1701400	1706620	that allows us to better allocate or smartly allocate resources on those sort of crown jewel
1706620	1713240	processes around which the entire operation revolves around so that we make sure that we're
1713240	1717360	taking care of the most important assets in our environment. And as a result of all of this,
1717360	1721820	we should be able to allocate resources in such a fashion to facilitate rapid critical
1721820	1726420	resource restoration in an incident to not just minimize downtime, but to make sure we're again
1726420	1732140	restoring to a known good, known safe state instead of just blindly bringing operations back
1732140	1737280	up and hoping for the best. Ultimately, we're really looking to try and build out a robust
1737280	1741340	defense in depth where we're covering things certainly at the IT layer, but also bringing
1741340	1748000	things into a multi-layered understanding visualization and visibility into control
1748000	1753660	system environments to track not just items like opportunistic ransomware or IT wipers,
1753660	1759080	but also getting into process specific targeting and modifications that could lead to far more
1759080	1763520	serious effects and building that all into an industrial focused and industrial aware
1763520	1769220	security program. So with that, I'm right at time. I believe these slides will be posted
1769220	1775200	somewhere. There's just a selection of resources, both things that I've written as well as from
1775980	1779960	peers from ESET and FireEye and some of the events that we talked about today.
1779960	1784460	But if we have some time, I can answer questions. I don't know how big of a
1784460	1826310	cushion we're leaving between talks. Well, I hope this was interesting.
1826310	1831270	Certainly feel free to reach out to me, email, Twitter, whatever works for you,
1831270	1835270	as I'm always happy to discuss this and related items. I think it's quite fascinating,
1835270	1841570	especially as we start looking into the more strategic and operations focused aspects of
1841570	1845450	cyber events within industrial environments. It certainly is a lot more interesting than
1845450	1849570	some of the things we see in IT environments, I think, but I'm a little biased there.
1850550	1854650	But yeah, I don't know, Bryson, if you've got anything for me or anyone else?
1858640	1860840	No, I think you're good. Thank you.
1864610	1869770	Stop the share and I will let the program move on. I'll be hanging around within the
1869770	1873950	Discord and elsewhere if anyone has thoughts that came up after the fact. But otherwise,
1873950	1877150	I hope everyone enjoys the ICS Village, as I know I always do. Thank you.