Behavior-Based Defense in ICS
•
0 gefällt mir•403 views
Dragos Adversary Hunter Joe Slowik presents on Behavior-Based Defense in ICS at the 13th annual API conference in Houston, TX. This presentation discusses how identifying adversary behaviors and their common requirements and behaviors can help network defenders prepare for future events--exemplifying how network defense for sensitive environments is strengthened through continuous improvement from prior events. Visit www.dragos.com to learn more.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Behavior-Based Defense in ICS
Ähnlich wie Behavior-Based Defense in ICS (20)
Mehr von Dragos, Inc.
Mehr von Dragos, Inc. (18)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Behavior-Based Defense in ICS
- 1. Behavior-Based Defense in ICS Joe Slowik Dragos Inc
- 2. Place Your Header Here in Arial 22pt Place Subtitle Here WHOAMI Joe Slowik, Adversary Hunter at Dragos • Threat intelligence and threat hunting for ICS evil • Former: • Incident Response at Los Alamos National Laboratory • US Navy Information Warfare Officer
- 3. Place Your Header Here in Arial 22pt Place Subtitle Here ICS-Focused Malware • STUXNET • HAVEX • BLACKENERGY2 • CRASHOVERRIDE • TRISIS ICS Disruptive Events • 2005-2010 (?): STUXNET • 2014: German Steel Mill Attack • 2015: Ukraine BLACKENERGY3 • 2016: Ukraine CRASHOVERRIDE • 2017: Saudi Arabia TRISIS Disruptive/Destructive Malware • STUXNET • CRASHOVERRIDE • TRISIS
- 4. Place Your Header Here in Arial 22pt Place Subtitle Here More Aggressive Attacks Greater Risk Tolerance Pursuit of Physical PCN Attacks Heightened Danger to Companies
- 5. Place Your Header Here in Arial 22pt Place Subtitle Here • Overall interest increasing • Number of “major”, disruptive events remains small Number of Events • Increasing severity of attacks as more disruptive events discovered • Majority of attacks are “minor” in nature and amount of access and info gathering Attack Severity • Major events are finely-tuned to target environment • Little scope to apply direct observables to other environments Attack Specificity • Defense is traditionally reactive, focus on learning from past events • But if number of events is small, few items to learn from Scope for Learning
- 6. Place Your Header Here in Arial 22pt Place Subtitle Here PHASE 1 - IT PHASE 2 - ICS
- 7. Place Your Header Here in Arial 22pt Place Subtitle Here PHASE 1 - IT PHASE 2 - ICS
- 8. Place Your Header Here in Arial 22pt Past Activity Required to Inform Defense •Baseline for defense •Need to learn from something Insufficient ICS- Specific Events to Build Robust Defense •ICS-disruptive events rare •Scope for learning remains small Identify Alternative Scenarios Applicable to ICS •Focus on entire kill chain •Mine other intrusion data to identify ICS trends
- 9. Place Your Header Here in Arial 22pt Wormable Malware Credential Theft & Re-use “Living off the Land” Wipers
- 10. Place Your Header Here in Arial 22pt Place Subtitle Here PHASE 1 - IT PHASE 2 - ICS
- 11. Place Your Header Here in Arial 22pt IT Attack Trends ICS Threat Surface Items for Analysis
- 12. Place Your Header Here in Arial 22pt Identify Behaviors of Interest Determine Adversary Means to Achieve Objectives Determine Visibility on Adversary Actions Build Detections around Results
- 13. Place Your Header Here in Arial 22pt • Attacker actions and objectives guide defense • Orient defense towards offensive actionAdversary-Focused • Indicators are specific examples of behavior • Indicators are “brittle” • Behaviors are fundamental means of operating Behaviors over Indicators • Targeting behaviors ensures robust defense • IOCs may change, but fundamental behaviors are requirements Behavior-Targeting •What tools and telemetry are required to grasp adversary behaviors? • Guide procurement and investment toward these tools Design Tools and Visibility toward Defense
- 14. Place Your Header Here in Arial 22pt Place Subtitle Here Identify Required Adversary Behaviors Determine Necessary Visibility to Detect Adversary Actions Align Defense and Monitoring to Requirements Train and Educate Security Personnel on Threat Environment Emphasize Root Cause Analysis when System Fail
- 15. Place Your Header Here in Arial 22pt Place Subtitle Here Implement Alerts and Responses Build Detection and Visibility on Behavior Implementations Identify Common Requirements and Behaviors
- 16. Place Your Header Here in Arial 22pt QUESTIONS? Contact Information: • jslowik@dragos.com / intel@dragos.com • @jfslowik