SAINTCON 2023 - Chad Walker - Securing Big Stupid Machines

Security

Learn how to secure industrial control systems with a focus on operational risk and recovery, debunking common myths and showcasing practical strategies for mitigating attacks and minimizing downtime at SAINTCON 2023.

Key takeaways

The CIA triad needs to be reconsidered for big stupid machines, focusing on operational risk and recovery.
The process layer is the most critical, as it’s where the machines do the work, and it’s often the most vulnerable.
It’s not about securing the machines, but about securing the relationships between them and the networks they’re connected to.
The data historian is a critical component, as it’s where data is stored and processed, and it’s often a single point of failure.
Network segmentation is key to securing big stupid machines, as it allows for isolation and containment of attacks.
Recovery is more important than prevention and detection, as it’s often the most effective way to mitigate the impact of an attack.
The Purdue model of ICS architecture is a useful framework for understanding the different layers of an industrial control system.
It’s important to consider the inventory of PLCs and HMIs, as well as their firmware and software versions, to identify potential vulnerabilities.
The Zigbee protocol is a common vulnerability in industrial control systems, as it’s often used for communication between devices.
It’s important to prioritize operational risk and recovery, as it’s often the most critical aspect of an industrial control system.
The big stupid machines are often the most vulnerable, as they’re often the most critical to the operation of the facility.
It’s important to consider the human factor, as human error is often a major contributor to industrial control system failures.
The data historian is a critical component, as it’s where data is stored and processed, and it’s often a single point of failure.
Network segmentation is key to securing big stupid machines, as it allows for isolation and containment of attacks.
Recovery is more important than prevention and detection, as it’s often the most effective way to mitigate the impact of an attack.
The Purdue model of ICS architecture is a useful framework for understanding the different layers of an industrial control system.
It’s important to consider the inventory of PLCs and HMIs, as well as their firmware and software versions, to identify potential vulnerabilities.
The Zigbee protocol is a common vulnerability in industrial control systems, as it’s often used for communication between devices.
It’s important to prioritize operational risk and recovery, as it’s often the most critical aspect of an industrial control system.

SAINTCON 2023 - Chad Walker - Securing Big Stupid Machines

More talks