SlideShare una empresa de Scribd logo

Hacker Halted 2016 - How to get into ICS security

•Descargar como PPTX, PDF•
•
Chris Sistrunk
Chris Sistrunk

This talk is about how to get into ICS security, whether you’re a control system engineer or an IT security analyst. It will cover the basic paths you can take to get involved, including some helpful resources and standards to help get you started. The ICS Security industry needs more people to help protect Critical Infrastructure!

Educación
1 de 46
How to get into ICS Security Chris Sistrunk, PE 1
About Me Chris Sistrunk, PE @chrissistrunk Electrical Engineer Sr. Consultant, FireEye • Control system security assessments • NSM and DFIR for ICS • ICS Village (DEF CON & RSA Conference) Entergy (11+ years) • SCADA Engineer (10 years) • Project Robus (ICS Protocol Fuzzing) • 30+ implementation vulnerabilities in DNP3 stacks • Substation Security Team BSidesJackson 2
How small mistakes lead to big disasters 3 FPL Blackout, February 26, 2008
Enormous possible consequences Quingdao, China Pipeline November 2013
Guadalajara, Mexico - 1992
San Bruno, California – September 2010 6 8 deaths, 58 injured PG&E fined $1.6 Billion
Enterprise ICS Security 7 OTIT
Some numbers https://www2.fireeye.com/industrial-control-systems-vulnerability-trend-report-2016.html 8
Some numbers Industrial Control System Humans MANY Engineers, Technicians Operators, Vendors, etc Security Humans ~189,000 ICS Security Humans <1000 0.5% of Security “LinkedIn data identified over 189,000 professionals in active information security positions worldwide as of June 2015.” - Cory Scott 9
Is 0.5% enough to protect Critical Infra? 10
So…what would you say you do here? • Why are you here? • What excites you about ICS security? • Is ICS or security in your job now? • Do you want it to be? 11
I’m recruiting you for ICS Security 12
OT Side > ICSsec 13
Operational Technology • You’ve got the engineering or technical background • You know how the plant or process works • You probably already work with: • ICS components like PLCs and RTUs • ICS protocols like Modbus, Ethernet/IP, DNP3, etc • Networking (ethernet, serial, including wireless) • NERC/CIP or CFATS requirements • But you don’t know IT systems, risks, threats, and security 14
Get familiar with security • Learn • Security Conferences! • Lots and lots of security material online (SecurityTube, etc) • ICS Security Training (ICS-CERT, SANS ICS, Red Tiger, SCADAhacker) • SamuraiSTFU, Kali, Security Onion Linux Distros • shodan.io • Make friends with the IT Security team 15
Make an ICS Security Lab • Many companies with control systems have labs • If not, you may have spare equipment laying around…get creative! 16
So…Stuxnet happened 17
What would be your Stuxnet? • Think like a bad guy…with a hard hat! • …like an attacker has your prints • Who knows…you might find a vulnerability “To make things work well, you must break them” “Find evil, or ways for evil to do evil things” 18
Red Team and Blue Team • Learn how to use Metasploit • Search shodan.io • Learn about Modbus Fuzzing • Write some Snort rules • Read up on Digital Forensics & Incident Response (DFIR) • Take the ICS-CERT RvB Course 19
Energy drinks 20
Get to know your IT Security gurus 21
22
IT Side > ICSsec 23
Information Technology • You’ve got the computer and networking skills • You know how business technology work • You probably already know: • Routers, switches, firewalls, domain controllers • Web, email, and business applications • Certifications like CCNA and CISSP • HIPAA or PCI DSS requirements • But you don’t know the engineering and physics behind the process 24
ICS Engineers 25 https://www.youtube.com/watch?v=RXJKdh1KZ0w
Google all the things • Modbus.org > modbus specification • Tons of code on github: opendnp3, modbus, etc • Wireshark • Pcaps online > Netresec has a library, SANS, S4 26
Videos • YouTube & Vimeo • “SCADA” • “Control Systems” • “PLC” • Conference Talks • “How It’s Made” Marathon! 27
Make an ICS network at home • Raspberry Pi • opendnp3, modbus, BACnet • Arduino • modbus • $15 HMI from eBay (got lucky) • ~$700 for a new Phoenix Contact PLC 28
You know security, but not ICS…yet • What I am about to tell you is the single greatest secret to go from IT Security into ICS… 29
Donuts 30
Get your hardhat dirty 31
Ask questions • What is it? • Why is it important? • How can we secure it? Example: Ladder logic on a PLC Understand the why… …then try to secure/monitor it 32
Take the opportunity to collaborate Problem: • ICS network is flat with the corporate network • ICS network has no logging or visibility • IT has security goals • OT has safety and uptime goals • Can you do some things that satisfy both? 33
ICS Security Resources 34
Connect! • SCADAsec email list at Infracritical • ICS Security Conferences • ICSJWG – FREE • DigitalBond’s S4 • SANS ICS Summit • 4SICS • EnergySec • Oil & Gas Security Summit • ICS Cyber Security Conference “Weisscon” 35
Information Sharing National Council of ISACs • Downstream Natural Gas www.dngisac.com • Electricity www.esisac.com • Oil & Natural Gas www.ongisac.org • Water www.waterisac.org ISAOs coming, knowledge sharing, ICS-ISAC, “BEER-ISAC” 36
Books • Robust Control System Networks, Ralph Langner • Industrial Network Security, 2nd Edition, Knapp & Langill • Cybersecurity for Industrial Control Systems, Macaulay & Singer • Countdown to Zero Day, Kim Zetter • Hacking Exposed Industrial Control Systems, Bodungen, et al • Handbook of SCADA/Control Systems, 2nd Ed., Radvanovsky & Brodsky 37
Intelligence Sources • ICS-CERT portal • ISAC portals • FBI Infragard • FireEye iSight (ICS intel) • Twitter #ICS #SCADA • Google 38
Standards • NIST SP800-82 Revision 2 • IEC 62443 • NERC/CIP • CFATS • …to name a few 39
Purdue Model - Reference Architecture L0L1L2L3L4 L0L1L2L3L4
Training • ICS-CERT • Free online training and resources • Free 5-day Red vs Blue ICS exercise • ICS Vendor Training • SANS ICS • ICS410 and ICS515 • Red Tiger Security • Lofty Perch • SCADAhacker 41
Certification • There isn’t a Professional Engineering license for Security... …but not everyone is an engineer. • GICSP is a new certification out to teach IT folks the basics of ICS and OT folks the basics of security. 42
Links • https://ics-cert.us-cert.gov/Standards-and-References • http://dx.doi.org/10.6028/NIST.SP.800-82r2 • https://scadahacker.com/library/index.html • http://www.dhs.gov/dhs-daily-open-source-infrastructure-report • http://news.infracritical.com/mailman/listinfo/scadasec • http://scadaperspective.com/ • http://pen-testing.sans.org/holiday-challenge/2013 • http://www.netresec.com/?page=PcapFiles • http://www.giac.org/certification/global-industrial-cyber-security-professional-gicsp • https://www.shodan.io/explore/category/industrial-control-systems • http://www.robertmlee.org/a-collection-of-resources-for-getting-started-in-icsscada- cybersecurity/ 43
You’re still here • What excites you about ICS security? • Do you want to join us in ICS security? 44
Apply What You Have Learned Today • Next week: • Identify critical components within your ICS network • Find out if they have any published security vulnerabilities, or if they are connected to the IT network, or even the Internet • In the next three months: • Understand who is accessing the ICS, from where, and why • Within six months: • Drive an implementation project to protect the most critical ICS devices • Develop a roadmap to enhance ICS security architecture • Capture some ICS network traffic and look for “evil” 45
Questions? chris.sistrunk@mandiant.com @chrissistrunk 46

Recomendados

Dragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos, Inc.
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMEAlienVault
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Threat Hunting with Splunk
Threat Hunting with Splunk Threat Hunting with Splunk
Threat Hunting with Splunk Splunk
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 
DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSChris Sistrunk
 
OT Security - h-c0n 2020
OT Security - h-c0n 2020OT Security - h-c0n 2020
OT Security - h-c0n 2020Jose Palanco
 
Building a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsBuilding a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsShah Sheikh
 

Recomendados

Dragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos S4x20: How to Build an OT Security Operations Center
Dragos S4x20: How to Build an OT Security Operations CenterDragos, Inc.
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMEAlienVault
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Threat Hunting with Splunk
Threat Hunting with Splunk Threat Hunting with Splunk
Threat Hunting with Splunk Splunk
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 
DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSChris Sistrunk
 
OT Security - h-c0n 2020
OT Security - h-c0n 2020OT Security - h-c0n 2020
OT Security - h-c0n 2020Jose Palanco
 
Building a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsBuilding a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsShah Sheikh
 
CIS Security Benchmark
CIS Security BenchmarkCIS Security Benchmark
CIS Security BenchmarkRahul Khengare
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onJustin Henderson
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)Ahmad Haghighi
 
The CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for DefenseThe CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for DefenseEnclaveSecurity
 
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdf
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdfISC2 CC Course (Certified in Cybersecurity) - Part 2.pdf
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdfHaris Chughtai
 
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyWhat We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyPriyanka Aash
 
The ATT&CK Philharmonic
The ATT&CK PhilharmonicThe ATT&CK Philharmonic
The ATT&CK PhilharmonicMITRE ATT&CK
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh
 
Network security - Defense in Depth
Network security - Defense in DepthNetwork security - Defense in Depth
Network security - Defense in DepthDilum Bandara
 
Active Directory in ICS: Lessons Learned From The Field
Active Directory in ICS: Lessons Learned From The FieldActive Directory in ICS: Lessons Learned From The Field
Active Directory in ICS: Lessons Learned From The FieldDigital Bond
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations centerCMR WORLD TECH
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
SOC Cyber Security
SOC Cyber SecuritySOC Cyber Security
SOC Cyber SecuritySteppa Cyber Security
 
State of the ATT&CK
State of the ATT&CKState of the ATT&CK
State of the ATT&CKMITRE ATT&CK
 
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?NetEnrich, Inc.
 
Cyber security career development paths
Cyber security career development pathsCyber security career development paths
Cyber security career development pathsChelsea Jarvie
 
RSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityRSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityChris Sistrunk
 
BSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityBSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityChris Sistrunk
 

Más contenido relacionado

La actualidad más candente

CIS Security Benchmark
CIS Security BenchmarkCIS Security Benchmark
CIS Security BenchmarkRahul Khengare
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onJustin Henderson
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)Ahmad Haghighi
 
The CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for DefenseThe CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for DefenseEnclaveSecurity
 
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdf
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdfISC2 CC Course (Certified in Cybersecurity) - Part 2.pdf
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdfHaris Chughtai
 
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyWhat We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyPriyanka Aash
 
The ATT&CK Philharmonic
The ATT&CK PhilharmonicThe ATT&CK Philharmonic
The ATT&CK PhilharmonicMITRE ATT&CK
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh
 
Network security - Defense in Depth
Network security - Defense in DepthNetwork security - Defense in Depth
Network security - Defense in DepthDilum Bandara
 
Active Directory in ICS: Lessons Learned From The Field
Active Directory in ICS: Lessons Learned From The FieldActive Directory in ICS: Lessons Learned From The Field
Active Directory in ICS: Lessons Learned From The FieldDigital Bond
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations centerCMR WORLD TECH
 
State of the ATT&CK
State of the ATT&CKState of the ATT&CK
State of the ATT&CKMITRE ATT&CK
 
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?NetEnrich, Inc.
 
Cyber security career development paths
Cyber security career development pathsCyber security career development paths
Cyber security career development pathsChelsea Jarvie
 

La actualidad más candente (20)

CIS Security Benchmark
CIS Security BenchmarkCIS Security Benchmark
CIS Security Benchmark
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center Fundamental
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
 
The CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for DefenseThe CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for Defense
 
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdf
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdfISC2 CC Course (Certified in Cybersecurity) - Part 2.pdf
ISC2 CC Course (Certified in Cybersecurity) - Part 2.pdf
 
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyWhat We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
 
The ATT&CK Philharmonic
The ATT&CK PhilharmonicThe ATT&CK Philharmonic
The ATT&CK Philharmonic
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
 
Network security - Defense in Depth
Network security - Defense in DepthNetwork security - Defense in Depth
Network security - Defense in Depth
 
Active Directory in ICS: Lessons Learned From The Field
Active Directory in ICS: Lessons Learned From The FieldActive Directory in ICS: Lessons Learned From The Field
Active Directory in ICS: Lessons Learned From The Field
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 
SOC Cyber Security
SOC Cyber SecuritySOC Cyber Security
SOC Cyber Security
 
State of the ATT&CK
State of the ATT&CKState of the ATT&CK
State of the ATT&CK
 
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
To Build Or Not To Build: Can SOC-aaS Bridge Your Security Skills Gap?
 
Cyber security career development paths
Cyber security career development pathsCyber security career development paths
Cyber security career development paths
 

Similar a Hacker Halted 2016 - How to get into ICS security

RSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityRSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityChris Sistrunk
 
BSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityBSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityChris Sistrunk
 
Encryption in industrial control systems; Is the juice worth the squeeze?
Encryption in industrial control systems; Is the juice worth the squeeze?Encryption in industrial control systems; Is the juice worth the squeeze?
Encryption in industrial control systems; Is the juice worth the squeeze?Brian Proctor - GICSP, CISSP, CRISC
 
Hack one iot device, break them all!
Hack one iot device, break them all!Hack one iot device, break them all!
Hack one iot device, break them all!Justin Black
 
Infragard atlanta ulf mattsson - cloud security - regulations and data prot...
Infragard atlanta ulf mattsson - cloud security - regulations and data prot...Infragard atlanta ulf mattsson - cloud security - regulations and data prot...
Infragard atlanta ulf mattsson - cloud security - regulations and data prot...Ulf Mattsson
 
Why defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skillWhy defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skillOllie Whitehouse
 
Who needs iot security?
Who needs iot security?Who needs iot security?
Who needs iot security?Justin Black
 
IoT Workshop Nashville
IoT Workshop NashvilleIoT Workshop Nashville
IoT Workshop NashvilleMike Branstein
 
SOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITY
SOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITYSOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITY
SOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITYDialogueScience
 
Practical IoT Security in the Enterprise
Practical IoT Security in the EnterprisePractical IoT Security in the Enterprise
Practical IoT Security in the EnterpriseDaniel Miessler
 
Stream Data into the Cloud with Raspberry Pi and Windows 10 IoT Core
Stream Data into the Cloud with Raspberry Pi and Windows 10 IoT CoreStream Data into the Cloud with Raspberry Pi and Windows 10 IoT Core
Stream Data into the Cloud with Raspberry Pi and Windows 10 IoT CoreMike Branstein
 
The New Security Practitioner
The New Security PractitionerThe New Security Practitioner
The New Security PractitionerAdrian Sanabria
 
How to create a secure IoT device
How to create a secure IoT deviceHow to create a secure IoT device
How to create a secure IoT deviceAbhijeet Rane
 
APrIGF 2015: Security and the Internet of Things
APrIGF 2015: Security and the Internet of ThingsAPrIGF 2015: Security and the Internet of Things
APrIGF 2015: Security and the Internet of ThingsAPNIC
 
Industrial Cybersecurity and Critical Infrastructure Protection in Europe
Industrial Cybersecurity and Critical Infrastructure Protection in EuropeIndustrial Cybersecurity and Critical Infrastructure Protection in Europe
Industrial Cybersecurity and Critical Infrastructure Protection in EuropePositive Hack Days
 
IoT Workshop Indianapolis
IoT Workshop IndianapolisIoT Workshop Indianapolis
IoT Workshop IndianapolisMike Branstein
 
Defcon 18 "Hacking Electronic Door Access Controllers"
Defcon 18 "Hacking Electronic Door Access Controllers" Defcon 18 "Hacking Electronic Door Access Controllers"
Defcon 18 "Hacking Electronic Door Access Controllers" shawn_merdinger
 
KiZAN IoT Workshop - Memphis
KiZAN IoT Workshop - MemphisKiZAN IoT Workshop - Memphis
KiZAN IoT Workshop - MemphisMike Branstein
 
IoT Workshop - Waukesha
IoT Workshop - WaukeshaIoT Workshop - Waukesha
IoT Workshop - WaukeshaMike Branstein
 

Similar a Hacker Halted 2016 - How to get into ICS security (20)

RSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityRSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS Security
 
BSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityBSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS security
 
Encryption in industrial control systems; Is the juice worth the squeeze?
Encryption in industrial control systems; Is the juice worth the squeeze?Encryption in industrial control systems; Is the juice worth the squeeze?
Encryption in industrial control systems; Is the juice worth the squeeze?
 
Hack one iot device, break them all!
Hack one iot device, break them all!Hack one iot device, break them all!
Hack one iot device, break them all!
 
Infragard atlanta ulf mattsson - cloud security - regulations and data prot...
Infragard atlanta ulf mattsson - cloud security - regulations and data prot...Infragard atlanta ulf mattsson - cloud security - regulations and data prot...
Infragard atlanta ulf mattsson - cloud security - regulations and data prot...
 
Why defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skillWhy defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skill
 
Who needs iot security?
Who needs iot security?Who needs iot security?
Who needs iot security?
 
IoT Workshop Nashville
IoT Workshop NashvilleIoT Workshop Nashville
IoT Workshop Nashville
 
Cybersecurity Roadmap for Beginners
Cybersecurity Roadmap for BeginnersCybersecurity Roadmap for Beginners
Cybersecurity Roadmap for Beginners
 
SOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITY
SOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITYSOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITY
SOMETHING INTANGIBLE, BUT REAL ABOUT CYBERSECURITY
 
Practical IoT Security in the Enterprise
Practical IoT Security in the EnterprisePractical IoT Security in the Enterprise
Practical IoT Security in the Enterprise
 
Stream Data into the Cloud with Raspberry Pi and Windows 10 IoT Core
Stream Data into the Cloud with Raspberry Pi and Windows 10 IoT CoreStream Data into the Cloud with Raspberry Pi and Windows 10 IoT Core
Stream Data into the Cloud with Raspberry Pi and Windows 10 IoT Core
 
The New Security Practitioner
The New Security PractitionerThe New Security Practitioner
The New Security Practitioner
 
How to create a secure IoT device
How to create a secure IoT deviceHow to create a secure IoT device
How to create a secure IoT device
 
APrIGF 2015: Security and the Internet of Things
APrIGF 2015: Security and the Internet of ThingsAPrIGF 2015: Security and the Internet of Things
APrIGF 2015: Security and the Internet of Things
 
Industrial Cybersecurity and Critical Infrastructure Protection in Europe
Industrial Cybersecurity and Critical Infrastructure Protection in EuropeIndustrial Cybersecurity and Critical Infrastructure Protection in Europe
Industrial Cybersecurity and Critical Infrastructure Protection in Europe
 
IoT Workshop Indianapolis
IoT Workshop IndianapolisIoT Workshop Indianapolis
IoT Workshop Indianapolis
 
Defcon 18 "Hacking Electronic Door Access Controllers"
Defcon 18 "Hacking Electronic Door Access Controllers" Defcon 18 "Hacking Electronic Door Access Controllers"
Defcon 18 "Hacking Electronic Door Access Controllers"
 
KiZAN IoT Workshop - Memphis
KiZAN IoT Workshop - MemphisKiZAN IoT Workshop - Memphis
KiZAN IoT Workshop - Memphis
 
IoT Workshop - Waukesha
IoT Workshop - WaukeshaIoT Workshop - Waukesha
IoT Workshop - Waukesha
 

Más de Chris Sistrunk

Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023Chris Sistrunk
 
BSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security PlaybookBSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security PlaybookChris Sistrunk
 
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs BlueBlack Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs BlueChris Sistrunk
 
BSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeBSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeChris Sistrunk
 
S4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management ApproachS4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management ApproachChris Sistrunk
 
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the GridDerbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the GridChris Sistrunk
 
BSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - KeynoteBSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - KeynoteChris Sistrunk
 
Advanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat AnalysisAdvanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat AnalysisChris Sistrunk
 
Blackhat USA 2016 - What's the DFIRence for ICS?
Blackhat USA 2016 - What's the DFIRence for ICS?Blackhat USA 2016 - What's the DFIRence for ICS?
Blackhat USA 2016 - What's the DFIRence for ICS?Chris Sistrunk
 
BSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA DefenseBSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA DefenseChris Sistrunk
 
Master Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS VillageMaster Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS VillageChris Sistrunk
 
Protecting Your DNP3 Networks
Protecting Your DNP3 NetworksProtecting Your DNP3 Networks
Protecting Your DNP3 NetworksChris Sistrunk
 

Más de Chris Sistrunk (13)

Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023
 
BSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security PlaybookBSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security Playbook
 
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs BlueBlack Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
 
BSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeBSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next Decade
 
S4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management ApproachS4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
 
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the GridDerbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
 
BSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - KeynoteBSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - Keynote
 
Advanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat AnalysisAdvanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat Analysis
 
Blackhat USA 2016 - What's the DFIRence for ICS?
Blackhat USA 2016 - What's the DFIRence for ICS?Blackhat USA 2016 - What's the DFIRence for ICS?
Blackhat USA 2016 - What's the DFIRence for ICS?
 
Dolla Dolla Bump Key
Dolla Dolla Bump KeyDolla Dolla Bump Key
Dolla Dolla Bump Key
 
BSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA DefenseBSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA Defense
 
Master Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS VillageMaster Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS Village
 
Protecting Your DNP3 Networks
Protecting Your DNP3 NetworksProtecting Your DNP3 Networks
Protecting Your DNP3 Networks
 

Último

Introduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsIntroduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsTechSoup
 
Class 11th Physics NEET formula sheet pdf
Class 11th Physics NEET formula sheet pdfClass 11th Physics NEET formula sheet pdf
Class 11th Physics NEET formula sheet pdfAyushMahapatra5
 
Seal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptxSeal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptxnegromaestrong
 
Making and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdfMaking and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdfChris Hunter
 
Grant Readiness 101 TechSoup and Remy Consulting
Grant Readiness 101 TechSoup and Remy ConsultingGrant Readiness 101 TechSoup and Remy Consulting
Grant Readiness 101 TechSoup and Remy ConsultingTechSoup
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactPECB
 
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptxSOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptxiammrhaywood
 
Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17Celine George
 
psychiatric nursing HISTORY COLLECTION .docx
psychiatric nursing HISTORY COLLECTION .docxpsychiatric nursing HISTORY COLLECTION .docx
psychiatric nursing HISTORY COLLECTION .docxPoojaSen20
 
Unit-V; Pricing (Pharma Marketing Management).pptx
Unit-V; Pricing (Pharma Marketing Management).pptxUnit-V; Pricing (Pharma Marketing Management).pptx
Unit-V; Pricing (Pharma Marketing Management).pptxVishalSingh1417
 
Paris 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activityParis 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activityGeoBlogs
 
PROCESS RECORDING FORMAT.docx
PROCESS RECORDING FORMAT.docxPROCESS RECORDING FORMAT.docx
PROCESS RECORDING FORMAT.docxPoojaSen20
 
Measures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SDMeasures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SDThiyagu K
 
Key note speaker Neum_Admir Softic_ENG.pdf
Key note speaker Neum_Admir Softic_ENG.pdfKey note speaker Neum_Admir Softic_ENG.pdf
Key note speaker Neum_Admir Softic_ENG.pdfAdmir Softic
 
fourth grading exam for kindergarten in writing
fourth grading exam for kindergarten in writingfourth grading exam for kindergarten in writing
fourth grading exam for kindergarten in writingTeacherCyreneCayanan
 

Último (20)

Mattingly "AI & Prompt Design: The Basics of Prompt Design"
Mattingly "AI & Prompt Design: The Basics of Prompt Design"Mattingly "AI & Prompt Design: The Basics of Prompt Design"
Mattingly "AI & Prompt Design: The Basics of Prompt Design"
 
Introduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsIntroduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The Basics
 
Código Creativo y Arte de Software | Unidad 1
Código Creativo y Arte de Software | Unidad 1Código Creativo y Arte de Software | Unidad 1
Código Creativo y Arte de Software | Unidad 1
 
Advance Mobile Application Development class 07
Advance Mobile Application Development class 07Advance Mobile Application Development class 07
Advance Mobile Application Development class 07
 
Class 11th Physics NEET formula sheet pdf
Class 11th Physics NEET formula sheet pdfClass 11th Physics NEET formula sheet pdf
Class 11th Physics NEET formula sheet pdf
 
Seal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptxSeal of Good Local Governance (SGLG) 2024Final.pptx
Seal of Good Local Governance (SGLG) 2024Final.pptx
 
Making and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdfMaking and Justifying Mathematical Decisions.pdf
Making and Justifying Mathematical Decisions.pdf
 
Grant Readiness 101 TechSoup and Remy Consulting
Grant Readiness 101 TechSoup and Remy ConsultingGrant Readiness 101 TechSoup and Remy Consulting
Grant Readiness 101 TechSoup and Remy Consulting
 
Mehran University Newsletter Vol-X, Issue-I, 2024
Mehran University Newsletter Vol-X, Issue-I, 2024Mehran University Newsletter Vol-X, Issue-I, 2024
Mehran University Newsletter Vol-X, Issue-I, 2024
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
 
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptxSOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
 
Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17
 
psychiatric nursing HISTORY COLLECTION .docx
psychiatric nursing HISTORY COLLECTION .docxpsychiatric nursing HISTORY COLLECTION .docx
psychiatric nursing HISTORY COLLECTION .docx
 
Unit-V; Pricing (Pharma Marketing Management).pptx
Unit-V; Pricing (Pharma Marketing Management).pptxUnit-V; Pricing (Pharma Marketing Management).pptx
Unit-V; Pricing (Pharma Marketing Management).pptx
 
Paris 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activityParis 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activity
 
PROCESS RECORDING FORMAT.docx
PROCESS RECORDING FORMAT.docxPROCESS RECORDING FORMAT.docx
PROCESS RECORDING FORMAT.docx
 
Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"
Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"
Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"
 
Measures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SDMeasures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SD
 
Key note speaker Neum_Admir Softic_ENG.pdf
Key note speaker Neum_Admir Softic_ENG.pdfKey note speaker Neum_Admir Softic_ENG.pdf
Key note speaker Neum_Admir Softic_ENG.pdf
 
fourth grading exam for kindergarten in writing
fourth grading exam for kindergarten in writingfourth grading exam for kindergarten in writing
fourth grading exam for kindergarten in writing
 

Hacker Halted 2016 - How to get into ICS security

  • 1. How to get into ICS Security Chris Sistrunk, PE 1
  • 2. About Me Chris Sistrunk, PE @chrissistrunk Electrical Engineer Sr. Consultant, FireEye • Control system security assessments • NSM and DFIR for ICS • ICS Village (DEF CON & RSA Conference) Entergy (11+ years) • SCADA Engineer (10 years) • Project Robus (ICS Protocol Fuzzing) • 30+ implementation vulnerabilities in DNP3 stacks • Substation Security Team BSidesJackson 2
  • 3. How small mistakes lead to big disasters 3 FPL Blackout, February 26, 2008
  • 4. Enormous possible consequences Quingdao, China Pipeline November 2013
  • 6. San Bruno, California – September 2010 6 8 deaths, 58 injured PG&E fined $1.6 Billion
  • 9. Some numbers Industrial Control System Humans MANY Engineers, Technicians Operators, Vendors, etc Security Humans ~189,000 ICS Security Humans <1000 0.5% of Security “LinkedIn data identified over 189,000 professionals in active information security positions worldwide as of June 2015.” - Cory Scott 9
  • 10. Is 0.5% enough to protect Critical Infra? 10
  • 11. So…what would you say you do here? • Why are you here? • What excites you about ICS security? • Is ICS or security in your job now? • Do you want it to be? 11
  • 12. I’m recruiting you for ICS Security 12
  • 13. OT Side > ICSsec 13
  • 14. Operational Technology • You’ve got the engineering or technical background • You know how the plant or process works • You probably already work with: • ICS components like PLCs and RTUs • ICS protocols like Modbus, Ethernet/IP, DNP3, etc • Networking (ethernet, serial, including wireless) • NERC/CIP or CFATS requirements • But you don’t know IT systems, risks, threats, and security 14
  • 15. Get familiar with security • Learn • Security Conferences! • Lots and lots of security material online (SecurityTube, etc) • ICS Security Training (ICS-CERT, SANS ICS, Red Tiger, SCADAhacker) • SamuraiSTFU, Kali, Security Onion Linux Distros • shodan.io • Make friends with the IT Security team 15
  • 16. Make an ICS Security Lab • Many companies with control systems have labs • If not, you may have spare equipment laying around…get creative! 16
  • 18. What would be your Stuxnet? • Think like a bad guy…with a hard hat! • …like an attacker has your prints • Who knows…you might find a vulnerability “To make things work well, you must break them” “Find evil, or ways for evil to do evil things” 18
  • 19. Red Team and Blue Team • Learn how to use Metasploit • Search shodan.io • Learn about Modbus Fuzzing • Write some Snort rules • Read up on Digital Forensics & Incident Response (DFIR) • Take the ICS-CERT RvB Course 19
  • 21. Get to know your IT Security gurus 21
  • 22. 22
  • 23. IT Side > ICSsec 23
  • 24. Information Technology • You’ve got the computer and networking skills • You know how business technology work • You probably already know: • Routers, switches, firewalls, domain controllers • Web, email, and business applications • Certifications like CCNA and CISSP • HIPAA or PCI DSS requirements • But you don’t know the engineering and physics behind the process 24
  • 26. Google all the things • Modbus.org > modbus specification • Tons of code on github: opendnp3, modbus, etc • Wireshark • Pcaps online > Netresec has a library, SANS, S4 26
  • 27. Videos • YouTube & Vimeo • “SCADA” • “Control Systems” • “PLC” • Conference Talks • “How It’s Made” Marathon! 27
  • 28. Make an ICS network at home • Raspberry Pi • opendnp3, modbus, BACnet • Arduino • modbus • $15 HMI from eBay (got lucky) • ~$700 for a new Phoenix Contact PLC 28
  • 29. You know security, but not ICS…yet • What I am about to tell you is the single greatest secret to go from IT Security into ICS… 29
  • 31. Get your hardhat dirty 31
  • 32. Ask questions • What is it? • Why is it important? • How can we secure it? Example: Ladder logic on a PLC Understand the why… …then try to secure/monitor it 32
  • 33. Take the opportunity to collaborate Problem: • ICS network is flat with the corporate network • ICS network has no logging or visibility • IT has security goals • OT has safety and uptime goals • Can you do some things that satisfy both? 33
  • 35. Connect! • SCADAsec email list at Infracritical • ICS Security Conferences • ICSJWG – FREE • DigitalBond’s S4 • SANS ICS Summit • 4SICS • EnergySec • Oil & Gas Security Summit • ICS Cyber Security Conference “Weisscon” 35
  • 36. Information Sharing National Council of ISACs • Downstream Natural Gas www.dngisac.com • Electricity www.esisac.com • Oil & Natural Gas www.ongisac.org • Water www.waterisac.org ISAOs coming, knowledge sharing, ICS-ISAC, “BEER-ISAC” 36
  • 37. Books • Robust Control System Networks, Ralph Langner • Industrial Network Security, 2nd Edition, Knapp & Langill • Cybersecurity for Industrial Control Systems, Macaulay & Singer • Countdown to Zero Day, Kim Zetter • Hacking Exposed Industrial Control Systems, Bodungen, et al • Handbook of SCADA/Control Systems, 2nd Ed., Radvanovsky & Brodsky 37
  • 38. Intelligence Sources • ICS-CERT portal • ISAC portals • FBI Infragard • FireEye iSight (ICS intel) • Twitter #ICS #SCADA • Google 38
  • 39. Standards • NIST SP800-82 Revision 2 • IEC 62443 • NERC/CIP • CFATS • …to name a few 39
  • 40. Purdue Model - Reference Architecture L0L1L2L3L4 L0L1L2L3L4
  • 41. Training • ICS-CERT • Free online training and resources • Free 5-day Red vs Blue ICS exercise • ICS Vendor Training • SANS ICS • ICS410 and ICS515 • Red Tiger Security • Lofty Perch • SCADAhacker 41
  • 42. Certification • There isn’t a Professional Engineering license for Security... …but not everyone is an engineer. • GICSP is a new certification out to teach IT folks the basics of ICS and OT folks the basics of security. 42
  • 43. Links • https://ics-cert.us-cert.gov/Standards-and-References • http://dx.doi.org/10.6028/NIST.SP.800-82r2 • https://scadahacker.com/library/index.html • http://www.dhs.gov/dhs-daily-open-source-infrastructure-report • http://news.infracritical.com/mailman/listinfo/scadasec • http://scadaperspective.com/ • http://pen-testing.sans.org/holiday-challenge/2013 • http://www.netresec.com/?page=PcapFiles • http://www.giac.org/certification/global-industrial-cyber-security-professional-gicsp • https://www.shodan.io/explore/category/industrial-control-systems • http://www.robertmlee.org/a-collection-of-resources-for-getting-started-in-icsscada- cybersecurity/ 43
  • 44. You’re still here • What excites you about ICS security? • Do you want to join us in ICS security? 44
  • 45. Apply What You Have Learned Today • Next week: • Identify critical components within your ICS network • Find out if they have any published security vulnerabilities, or if they are connected to the IT network, or even the Internet • In the next three months: • Understand who is accessing the ICS, from where, and why • Within six months: • Drive an implementation project to protect the most critical ICS devices • Develop a roadmap to enhance ICS security architecture • Capture some ICS network traffic and look for “evil” 45

Notas del editor

  1. WHAT WENT WRONG 1. Engineer investigating faulty voltage-control switch disabled two protective devices. 2. Short circuit occurred. 3. Because protection systems were disabled, they could not contain the short circuit.
  2. Quingdao china, oil pipeline explosion, killed 62 people 22 November 2013
  3. 252 people were killed, nearly 500 injured and 15,000 were left homeless New water pipes, made of zinc-coated iron, were built too close to an existing steel gas pipeline Galvanic corrosion between dissimmilar metals caused the gas pipeline to leak into the water line
  4. Replacement of power supply Breaker removed from service Control panel looses power Erroneous Low pressure signal Valves open Valves cannot be controlled with power out Line overpressured Weld breaks Ignition, explosion, fire 8 deaths, 58 injured
  5. Talk briefly about what IT and OT are and how they work together in an enterprise “Enterprise-wide security” doesn’t mean just the IT side
  6. 2001 – 2010 = The Lost Decade 2010 – Present = The Age of Stuxnet
  7. Audience participation
  8. But you may lack the IT security know how
  9. But you don’t understand the engineering or how the process works Electrical engineering Chemical engineering Mechanical engineering etc
  10. Segmenting the network keeps commodity malware from spreading either direction It also keeps the Operators from surfing ebay from the Compressor Station Visibility helps the SOC watch the ingress/egress points Visibility helps the ICS engineers keep a better inventory and find PLC misconfigurations
  11. Explain This is a reference architecture produced by academics at Purdue University, and adopted by the International Society of Automation (ISA) The entire purpose of industrial automation and control systems is to remove humans from the loop. Program the logic into the machines so people don’t have to be at each location taking measurements and making adjustments. Sensors and actuators operate at Level 0. Sensors measure things in the physical world; such as flow, temperature, pressure, level. Actuators move. Things like valves and connect/disconnect switches for motors They are wired into the controller They are generally not TCP/IP enabled, but this is changing Controllers are programmable devices found at Level 1 The programming specifies how the actuators move when the sensors provide certain readings. They can also include Variable Frequency Drives and Protective Relays Many of these are TCP/IP enabled Level 2 includes more standard computing and networking technology The SCADA stands for supervisory control and data acquisition. Supervisory means that it allows a human operator, normally seated at a human-machine interface screen to identify abnormalities (normally by viewing alarms that pop up on the screen), and step in and issue remote commands to the system. If a process loses SCADA, nothing is going to happen, at least for a while. The logic exists in the controllers themselves to regulate the process. The job of process operators has been described as 90% intense boredom, and 10% sheer panic. The engineering workstation is used to program the control logic. You can think of this as a software development environment. Instead of languages such as python, C, and VisualBasic, the languages used are called “ladder logic”, “Fuction block” and “structured text”. This machine would normally have the ability to talk to any PLC on the network to push new logic This layer also includes database technology called a process historian. The historian catalogs readings from the sensors and positions of the actuators to make available in other applications, such as predictive maintenance and process optimization efforts. The historian records data that is not displayed to the operator. Ideally the SCADA network is segmented from the business network by a dual firewall DMZ. This facilitates firewall management, while limiting ingress and egress.