This talk will draw on the path-of-least-resistance considering lessons from the Ukraine and similar types of attacks, discussing, from an introductory level, good practice secure architecture models and the challenges posed to their implementation by emerging technology and support requirements. Attention will be paid to the way real-world support & operations solutions can unintentionally, or invisibly bridge security enforcement zones, and what this means for your threat model.

1. Secure Architecture Challenges for Real Businesses
Industrial Control & Automation System
Security

2. 2PIUK
Post-lunch – DEMO to consider
Process - Milkshake Machine
Many architectural issues to consider:
Remote access
Business – OT
Site – site
Process – process
Onsite support from 3rd parties
Had to drill into one, chosen 3rd party
Img - https://homemcr.org/app/uploads/2014/06/Willy-Wonka-and-the-Chocolate-Factory-11.jpg
© 2017

3. 3PIUK
whoami
Sam Thom
Security Analyst with BAE Systems
Operational Technology Security
Hobbyist:
Programming
Making
Hacks
© 2017
Socials (new)
@blackf3ll
Linkedin – brownie points
if you find me
sam@blackfell.net
What does this mean? I’m not a real process engineer!

4. 4PIUK
whoami
Laura Tomkins
Security Analyst with BAE Systems
Operational Technology Security
Hobbyist:
Programming
OSINT
© 2017
Socials (new)
@laurajohnson88
laura.tomkins8430@gmail.com

5. 5PIUK
DEMO – Opportunistic Access?
DEMO
© 2017
Deciding to build milkshake
factory
Remembering process
automation is actually quite
difficult
Img - https://i.pinimg.com/736x/c5/ef/3a/c5ef3a3e8e02febb4f334a3f6d5f1ac4.jpg
- http://images4.fanpop.com/image/photos/17500000/Willy-Wonka-and-the-Chocolate-Factory-willy-wonka-and-the-chocolate-factory-17596131-500-375.jpg

6. 6PIUK
DEMO
© 2017
Deciding to build milkshake
factory
Remembering process
automation is actually quite
difficult

7. 7PIUK
DEMO
© 2017
Deciding to build milkshake
factory
Remembering process
automation is actually quite
difficult

8. 8PIUK
DEMO
© 2017
Deciding to build milkshake
factory
Remembering process
automation is actually quite
difficult

9. 9PIUK© 2017https://www.youtube.com/watch?v=O4VNzX17J2Y&feature=youtu.be
Remembering process
automation is actually quite
difficult

10. 10PIUK
This is all James Bond right? Well we know there are incidents.
Ukraine - 2015/2016
German Steel Mill – 2014
Cyber Reason honeypot – 2018
As industry develops technology will improve –
Need for support remains.
Ref - https://www.cybereason.com/blog/industrial-control-system-specialized-hackers
Img - http://news.bbcimg.co.uk/media/images/75207000/jpg/_75207026_bear2.jpg
© 2017

11. 11PIUK
What does this actually mean
Aren't we safe because very few attacks are from third parties?
Understanding your exposure helped by knowledge of patterns & best practice.
The path of least resistance may be buying access online – requires architectural consideration.
© 2017

12. 12PIUK
What can we learn?
Public reporting had positives and negatives - OT/IT not always
considered.
Attackers will take the easiest effective route
How attacks work & develop should inform our Risks
All examples hint at architecture related issues.
Img - http://weknowmemes.com/wp-content/uploads/2012/11/if-it-look-stupid-but-works-it-aint-stupid.jpg
© 2017

13. 13PIUK
What does good look like?
IEC & NIST focus on segregation, especially
from the OT to business
SANS ICS-410 offers a pragmatic model –
Purdue based.
Steel Mill report, OT is not expected to be
internet connected
Sensible - you wouldn’t allow level1/2 to
internet, would you?
© 2017

14. 14PIUK
Would you?
SHODAN / CENCYS
© 2017

15. 15PIUK
Would you?
SHODAN / CENCYS
© 2017

16. 16PIUK
Would you?
SHODAN / CENCYS
© 2017

17. 17PIUK
Would you?
SHODAN / CENCYS
© 2017

18. 18PIUK
So what is going on?
May be mistakes, but business drivers exist.
Balance risk vs business value (i.e. cost) – no
under/over treating
Consume figures with care – incidents not statistically
useful
Remember honeypot – actors can change part way
Img - https://streets.mn/wp-content/uploads/2014/11/SIDEWLAK-PILLLOW-MEME-500x500.jpg
© 2017

19. 19PIUK
What has architecture ever done for us?
Properly zoning, especially special category assets, can help
manage associated risk.
Layering your enforcement zones - defence in depth.
There are solutions – jump boxes, multiple DMZs, 2FA.
Hunting and detection enabled, aiding in IR.
Enabling a combined SOC visibility – pivot police!
© 2017

20. 20PIUK
Thank you
Questions
© 2017