Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / OT Recovery: Proving a Safe Restart Beyond the Backup

Transcript

OT Recovery: Proving a Safe Restart Beyond the Backup · Cybersecurity Under Pressure. Real Attacks, Real Lessons

0:45
Welcome to cybersecurity under pressure, real attacks, real
0:48
lessons. Today is Monday, June 15th,
0:51
2026. This story starts with a routine
0:54
check and ends with someone losing their job and their
0:58
sleep. Yeah, a lot of sleep.
0:59
I mean, probably month of it honestly.
1:01
Exactly. So I want you to imagine, just
1:03
for a second, that you are holding a standard old fashioned
1:06
stopwatch. You click the button to start
1:08
it. One second passes.
1:10
You just lost $600.00. You blink.
1:12
Another second passes. That is $1200 gone.
1:15
You wait one single minute to go.
1:17
I don't know, pour yourself a cup of coffee.
1:19
You were down $36,000. Which is a pretty expensive cup
1:22
of coffee. Right.
1:23
And if you let that stopwatch run for exactly 1 hour, you have
1:26
effectively incinerated 2 point $3,000,000.
1:29
It's a genuinely staggering burn rate.
1:32
I mean, it sounds made-up. It does, but the terrifying part
1:34
is that this isn't some theoretical math exercise.
1:37
That's a real number affecting real people right now.
1:40
Yeah, it is that $2.3 million an hour is the exact calculated
1:44
cost of unplanned downtime for a modern automotive manufacturing
1:48
plant today. 2.3 million. An hour.
1:51
Every single hour. But here is the thing that
1:53
completely rewrites how we you know how we have to look at this
1:56
stuff? That massive factory doesn't
2:00
have to be hit by a Category 5 hurricane or suffer some like
2:05
catastrophic mechanical failure to stop running.
2:08
All it takes is the wrong piece of invisible code crossing a
2:11
digital boundary. Which is wild because usually
2:15
when we talk about this, and welcome to the deep dive, by the
2:17
way, we're looking at a massive paradigm.
2:20
Shift. Oh, absolutely.
2:21
For the last three decades, when the average person or even the
2:24
average executive talked about cybersecurity, they were almost
2:27
exclusively talking about information technology IT.
2:31
Yeah, the digital stuff. We were trained to think about
2:34
protecting data. You know, your personal emails,
2:37
your credit card numbers, a corporation's intellectual
2:39
property. The servers hosting a website,
2:42
cloud storage environments. Right.
2:43
The stuff that essentially lives trapped behind glass.
2:46
It's on a screen. And if it gets stolen, I mean,
2:48
it's a huge headache, It's a privacy violation.
2:50
It might cost a lot of money in lawsuits and fines, but it
2:54
remains a digital problem. It stays behind the glass.
2:58
But today, in this deep dive, we are stepping out from behind
3:01
that glass. We are crossing over into
3:04
operational technology OT. The physical world.
3:07
Exactly. This is the realm where computer
3:10
code reaches out and manipulates the physical world.
3:12
The actual kinetic movement. Yes, we are talking about the
3:16
microprocessors that physically open and close massive steel
3:20
valves in municipal water treatment plants.
3:23
We're talking about the systems that regulate the boiling
3:25
temperature of like volatile chemical vats, the controllers
3:30
that route high voltage electricity across the national
3:34
power grid. And those robotic arms on the
3:36
assembly lines? Right, the ones burning millions
3:39
of dollars an hour when they suddenly freeze up because of a
3:41
rogue command over a remote access portal.
3:43
The. Stakes are incredible, probably
3:45
high. I mean the invisible digital
3:46
borders, keeping our physical world safe or just quietly
3:49
collapsing. So today, our mission for this
3:52
deep dive into our source material is to look at exactly
3:55
how and why that has happened. We have to unpack it.
3:57
You're going to pull apart the mechanics of how adversaries are
4:00
evolving from just stealing data to actively targeting physical
4:05
machinery. We're going to break down the
4:07
anatomy of a real world hack that cost the global economy
4:12
nearly £2 billion. The JLR incident, yeah, it's
4:16
brutal. It's insane.
4:17
And most importantly, we're going to explore what it
4:20
actually takes to survive a digital attack that has real
4:24
world kinetic consequences. And to do that properly, we
4:28
really have to start by tearing down a lot of preconceived
4:30
notions. Because if you take the absolute
4:33
best, most rigorous IT security practices in the world.
4:37
Like the playbooks used by top banks?
4:39
Yeah, top banks, big tech companies.
4:41
If you take those playbooks and you simply drop them onto a
4:44
factory floor, you don't just fail to secure the factory, you
4:47
can actually cause a physical disaster yourself.
4:49
OK, wait, help me understand that.
4:51
Because on the surface, you know a computer is a computer.
4:54
Right, that's the trap. Why can't we just take the
4:56
firewalls, the antivirus software, the routine security
5:00
scans we use for our corporate laptops and just plug them into
5:03
the systems running a chemical plant?
5:05
Because it comes down to a fundamental clash and
5:07
philosophy. It's completely backward.
5:10
In the traditional IT security world, the absolute gold
5:14
standard guiding every single decision is known as the CIA
5:18
triad. Right confidentiality,
5:20
integrity, and availability. Exactly, and with
5:23
confidentiality sitting right at the absolute top of the pyramid.
5:26
Always. I mean, let's look at a major
5:28
bank. Their primary non negotiable
5:30
directive is to keep their customer's financial data
5:33
secret. Yes, if the bank's online portal
5:36
goes down for an hour, which is a loss of availability,
5:39
customers will definitely be annoyed.
5:41
They'll complain on social media for sure.
5:43
Right. But if the bank's database is
5:45
breached and millions of account numbers are published on the
5:47
dark web, which is a loss of confidentiality, that is an
5:50
existential crisis for the business.
5:52
It's game over. So therefore every IT system is
5:55
engineered to aggressively protect secrets.
5:58
So if a security program detects something suspicious on a
6:01
server, the immediate reflex is just to kill it.
6:04
Kill it instantly. The standard automated IT
6:07
playbook is rapid isolation. You quarantine the infected
6:11
machine, You sever its network connection.
6:13
You lock the remote access users out.
6:16
You protect the sensitive data at the expense of keeping the
6:19
machine running. OK, so that is the IT mindset,
6:22
CIA confidentiality first. What happens to that philosophy
6:26
when we step onto the factory floor, like into the OT space?
6:30
In operational technology, you have to take that entire
6:32
triangle and completely inverted the model becomes AIC.
6:36
Availability first, then integrity and confidentiality is
6:39
what last. It's a distant, almost
6:41
irrelevant third. Availability is the absolute,
6:45
unquestionable priority. Because the machines have to
6:47
keep moving. They have to because in OT we
6:49
are no longer dealing with spreadsheets, you know, we are
6:51
dealing with physics, chemistry, thermodynamics, momentum.
6:55
Real world forces, yeah. If you are managing a blast
6:58
furnace or a high pressure natural gas pipeline, the
7:01
continuous uninterrupted oeration of that system, its
7:04
availability, is very often the only thing keeping the physical
7:07
process from destroying itself. Man, I'm trying to picture the
7:11
real world consequence of this. Let's say we put that aggressive
7:15
banking IT security software onto the computer controlling a
7:19
chemical reactor. The outcome could literally be
7:23
lethal. Imagine a scenario where the
7:25
chemical reaction is exothermic. Meaning it generates its own
7:28
heat. Right, and the computer is
7:30
constantly adjusting a cooling valve to keep it from boiling
7:33
over if your aggressive IT security software suddenly
7:37
detects a strange network ping from, say, a vendor's remote
7:42
access tunnel, and it decides, hey, that looks like malware and
7:45
automatically quarantines that control.
7:47
You don't just get an error message on a screen.
7:49
No, the controller is locked out, which means it stops
7:51
adjusting the cooling valve. And the chemical reaction
7:54
doesn't care that your antivirus software is running a scan.
7:57
Exactly. It doesn't care.
7:58
The heat builds, the pressure rises, and because the
8:01
controller is isolated from the network, the human operators in
8:05
the control room might not even see the pressure spiking and IT
8:09
failure results in data loss and OT failure results in an
8:13
environmental disaster or loss of human life.
8:16
That makes perfect sense in those extreme scenarios, but I
8:19
want to push back a little here. Surely there are routine IT
8:23
maintenance tasks that factories like have to do.
8:28
You'd think so, yeah. What about just scanning the
8:30
network for vulnerabilities in a corporate office?
8:34
IT departments run automated scans constantly.
8:36
They ping every device, ask it what operating system it's
8:39
running, check to see if any weird digital doors are left
8:42
open. What is the harm in just looking
8:45
at the network? It sounds harmless, I know,
8:47
until you look at the actual hardware running a factory.
8:50
OT environments rely heavily on devices called Programmable
8:53
Logic Controllers or PLCS. These are not modern laptops
8:57
with multi core processors. They are essentially ruggedized
9:00
industrial pocket calculators. Pocket calculator?
9:03
Seriously. Yeah, basically they are
9:05
designed to do 1 highly specific physical task incredibly well,
9:09
like reading a temperature sensor thousands of times a
9:12
second. And they do it using hardware
9:14
that might be 20 years old. So they aren't exactly packing a
9:17
lot of processing power to handle extra tasks.
9:20
They have almost none to spare. Their entire CPU is dedicated to
9:24
maintaining the physics of their assigned task.
9:26
Their network communication stacks are notoriously fragile.
9:30
So if you ping them too much. If you hit a legacy TLC with a
9:33
standard IT network scan which sends, you know, thousands of
9:37
unexpected queries in a matter of seconds, you will completely
9:40
overwhelm its tiny processor. It just panicked.
9:43
It completely panicked, the processor gets flooded with
9:46
these, IT requests, it runs out of memory and it drops its
9:49
primary physical task to try and answer them.
9:51
The PLC crashes or it forces a fail safe physical shutdown.
9:55
Wow, so you have essentially D dos your own factory floor just
10:00
by trying to check its security posture?
10:02
Yeah, you took yourself offline. Good job it.
10:04
Okay so active scanning is out, but what about patching?
10:07
I mean, in the IT world, Patch Tuesday is a religion.
10:10
Yeah, it's mandatory. Microsoft or Apple finds a
10:13
security flaw, they push out a fix, and millions of computers
10:17
automatically update and reboot. I'm struggling to see how
10:20
running unpatched vulnerable software in a critical
10:23
infrastructure facility isn't just like, gross negligence.
10:27
How do compliance auditors even allow them to skip patches?
10:30
Well, they don't skip them entirely, but they have to
10:32
approach them with extreme caution because an OT system is
10:36
a finely tuned orchestra of timing.
10:39
You cannot auto deploy a Tuesday patch to a robotic arm moving
10:43
heavy car chassis on an assembly line.
10:45
Because of the reboot required. Not just the reboot, The patch
10:48
itself alters the code. Even a routine operating system
10:52
update can change how a processor handles timing by a
10:54
fraction of a millisecond. Wait, a millisecond matters.
10:57
In OT, absolutely. In an IT environment, if Excel
11:00
opens 2 milliseconds slower after an update, a human being
11:03
literally cannot perceive it. But if a robotic welding arm
11:07
receives its command 2 milliseconds late.
11:09
It misses its mark. It misses its mark.
11:11
It collides with the chassis and destroys $1,000,000 worth of
11:14
equipment. Oh man, it sounds like applying
11:17
IT security to OT is like trying to perform mandatory brain
11:21
surgery on a marathon runner while they are mid Sprint.
11:25
You can't just pause their heart to install a new driver.
11:28
That is a very, very accurate way to visualize it.
11:31
Patching requires scheduled downtime, immense engineering
11:35
analysis, and running the patch in a simulation environment for
11:38
weeks before it ever touches the live factory floor.
11:42
OK, I hear you. The internal OT systems are
11:44
incredibly fragile. They can't handle security
11:47
scans. They can't run modern antivirus
11:50
and they are incredibly difficult to patch.
11:52
If I'm listening to this and I'm running a manufacturing plant,
11:54
I'm screaming at my dashboard right now.
11:57
Just unplug the factory from the Internet.
11:59
The classic solution. If the systems are that
12:02
delicate, why on earth are they connected to the outside world
12:04
in the 1st place? I always hear about the air gap.
12:06
Keep the factory isolated and you solve the problem.
12:09
The air gap is the most dangerous, pervasive myth in
12:12
modern industrial security. It's a ghost.
12:15
A myth, but it used to be real, right?
12:17
It used to be reality. Sure, perhaps 30 years ago a
12:21
factory floor was a genuinely closed electrical loop.
12:24
But the global economic drive for extreme efficiency, data
12:27
analytics and what the industry calls Industry 4 Point O has
12:31
permanently demolished the air gap.
12:33
Industry 4 point O, meaning the digitization and networking of
12:38
manufacturing. Yes, the pressure to connect
12:41
everything is immense. Aceo, sitting in a boardroom in
12:44
New York, wants to pull out their iPad and see the real time
12:47
production metrics of a facility in Germany.
12:49
Which requires a data bridge. Exactly.
12:51
And then you have the vendor who sold the factory a multi
12:54
$1,000,000 turbine. They demand remote Internet
12:58
access to the machine so they can perform predictive
13:00
maintenance and monitor wear and tear from their own
13:02
headquarters. Oh, so this is a third party VPN
13:04
tunnel going straight into the factory?
13:06
Yes, that requires AVPN bridge. Supply chain chains are now so
13:10
deeply integrated that the moment a bin of screws gets low
13:13
on the factory floor, an automated signal is sent through
13:16
the cloud to a supplier to ship more.
13:18
So the plant's internal fragile systems are constantly talking
13:22
to the corporate IT networks, which are connected to the open
13:24
Internet. Inevitably, yes.
13:26
We see engineering workstations directly connected to enterprise
13:30
IT domains. We see SCATTA telemetry.
13:34
Scatta, meaning the massive software systems that human
13:37
operators use to visually monitor the plant.
13:40
We see those systems pushing raw data directly into third party
13:44
cloud analytics platforms. The bottom line is that the air
13:47
gap is gone. It's just Swiss cheese now.
13:49
It really is. Every single efficiency tool,
13:52
every remote maintenance port, every cloud dashboard creates a
13:56
digital bridge between the relatively exposed corporate IT
13:59
network and the highly sensitive physical OT network.
14:03
Which means if an attacker compromises a board accountant's
14:06
laptop in the HR department or cracks A vendor's remote access
14:09
port portal, there might be an invisible pathway straight down
14:13
to the chemical reactors. And adversaries have spent the
14:15
last five years figuring out exactly how to map and exploit
14:19
those specific pathways. Which is terrifying.
14:21
Let's talk about those adversaries because Chapter 2 of
14:25
our deep dive here. The data on the current threat
14:28
landscape from the Drago's report is deeply unsettling.
14:32
It's a whole new world out there.
14:34
We are no longer talking about individuals in basements trying
14:36
to steal credit card databases to sell on the dark web.
14:40
The attackers targeting physical infrastructure have evolved into
14:43
highly coordinated, specialized ecosystems.
14:46
Yeah, we are tracting a maturation in the adversary
14:49
landscape that honestly mirrors the complexity of a Fortune 500
14:52
company. Like they have HR departments.
14:54
Basically, these are not isolated actors, they are
14:57
syndicates with distinct departments.
15:00
Threat intelligence analysts like the team at Drago's, track
15:03
these groups using specific naming conventions, often based
15:06
on minerals, to differentiate their unique tactics and goals.
15:10
OK. Help me understand how these
15:11
groups operate because you mentioned they are specialized.
15:13
Do we have different groups handling different parts of the
15:16
attack like contractors? We do.
15:19
It's a gig economy for cyber war.
15:20
Consider a group tracked under the designation Sylvanite.
15:24
Their specialty is the Vanguard Operation the Breach.
15:27
Right. They are experts at exploiting
15:29
standard IT vulnerabilities like an unpatched router or
15:33
exploiting a weak remote access VPN password to establish a
15:37
solid persistent foothold inside targets corporate network.
15:41
They kick the door open and hold it, but they don't necessarily
15:44
execute the final destructive attack on the physical machinery
15:47
themselves. Instead, they operate almost
15:49
like an initial access broker. They sell the access.
15:52
Yeah, they secure the IT foothold and then hand off that
15:56
access to a much more specialized group known as Volt
15:59
site. A literal handoff or relay race
16:02
for cyber warfare. And Volt Site is deeply
16:04
concerning because they possess what we call Stage 2
16:07
capabilities in the industrial control systems Kilchain.
16:10
Stage 2 meaning what? They are not interested in the
16:14
IT networks billing data. Once they get the baton from
16:17
Sylvanite, they push deep into the OT environment.
16:20
They actively manipulate engineering workstations.
16:23
Go for the throat. They do.
16:25
They silently dump configuration files to understand how the
16:28
factory is wired. They pull alarm data to see what
16:30
the human operators are currently monitoring.
16:33
So they are stealing the blueprints to the physical
16:35
processes. They are doing their homework on
16:37
the physics of the target. They are investigating what
16:40
specific digital commands will force a physical valve to stick
16:44
open, or what sequence of code will override a temperature
16:48
warning. That is a terrifying level of
16:50
reconnaissance. I mean, it's one thing to steal
16:52
a password, it's a completely different level of
16:55
sophistication to study engineering schematics so you
16:58
know exactly which valve to manipulate to build up lethal
17:01
pressure. And they are not alone.
17:04
Another group, Camasite, has been observed systematically
17:07
mapping control loops across vast swaths of US critical
17:12
infrastructure, performing massive, quiet reconnaissance,
17:16
just waiting, just mapping it out.
17:17
Meanwhile, groups like Pyroxyny have escalated to actual
17:21
destruction during region's conflicts, deploying custom
17:24
wiper malware. Wiper malware, meaning it
17:26
doesn't hold anything for ransom, it just destroys.
17:30
Its sole purpose is to permanently erase the logic on
17:32
the controllers and brick the systems, causing maximum
17:35
physical disruption and requiring total hardware
17:38
replacement. You have to buy new machines.
17:41
Wow. You mentioned ransom.
17:44
The statistics surrounding industrial ransomware are just
17:46
exploding. We are seeing a nearly 50%
17:49
increase in attacks year over year, impacting thousands of
17:53
industrial organizations globally.
17:55
It's everywhere. But there's something I'm
17:57
struggling with here. When I think of ransomware I
17:59
think of a pop up on a screen saying pay $1000 in Bitcoin or
18:03
we delete your file. Right, the classic IT
18:06
ransomware. Why is that such a massive
18:08
threat to a factory? Isn't ransomware just an IT
18:11
problem? If my e-mail server gets
18:13
encrypted, the robotic arm on the floor can still physically
18:17
Weld the car door. Right, you are echoing a very
18:20
common and very dangerous misconception held by a lot of
18:23
corporate executives right now. They assume that ransomware only
18:27
encrypts Windows files, spreadsheets and databases.
18:30
Which it does. It does.
18:31
Therefore, they think the physical plant which runs on
18:34
those specialized legacy PLCS we discussed should be perfectly
18:38
fine. Right.
18:38
The PLC is an industrial calculator.
18:41
It doesn't run Windows. It shouldn't care about Windows
18:43
ransomware. The PLC itself might not run
18:45
Windows, no, but we have to look at how human beings interact
18:49
with that PLC. You don't have engineers walking
18:52
around the factory floor plugging keyboards directly into
18:55
hundreds of tiny PLCS. That would be absurd.
18:58
It would all of those PLCS feed their data up to centralized
19:02
human machine interfaces, Hmis, and massive engineering
19:06
workstations in a comfortable air conditioned control room.
19:09
The big screens showing all the dials, gauges and pressure
19:12
levels. Exactly.
19:13
And those Hmis and engineering workstations almost exclusively
19:16
run on standard commercial Windows operating systems.
19:20
They are just as vulnerable to standard ransomware as an
19:23
accountant's laptop. Oh oh, I see where this is
19:26
going. If a ransomware group reaches
19:28
the network and encrypts the Windows based HMI, the
19:31
underlying PLC down on the floor might still be mechanically
19:35
running the robotic arm or pumping the chemical.
19:37
But the human operator sitting in the control room is now
19:40
completely blind. Yes, their screens are locked.
19:42
They cannot see the pressure levels.
19:43
They cannot see the core temperature.
19:45
They cannot send new commands to slow the process down.
19:48
The collateral damage immediately bleeds from the IT
19:51
software layer straight into the physical operations layer.
19:55
And we are seeing adversaries build custom tools specifically
19:58
for the scenario. There is a ransomware variant
20:01
known as Termite built using leaked source code.
20:04
Termite. Yeah, it has aggressive of
20:07
custom coded capabilities designed to specifically hunt
20:10
down and terminate industrial processes running on those
20:14
Windows machines before it encrypts them.
20:16
So it knows what an OT environment looks.
20:18
Like it knows exactly what it's looking at.
20:20
It ensures that the operator is totally disconnected from the
20:22
physical process before they even realize what's happening.
20:25
I want to ground this in reality because talking about
20:29
theoretical malware variants can feel, you know, abstract.
20:33
Let's look at how this actually manifests in the wild.
20:36
I want to talk about the Colonial Pipeline incident from
20:38
2021 A. Classic.
20:40
This feels like the textbook case study of how an IT problem
20:43
physically paralyzed half the United States.
20:46
Colonial Pipeline perfectly illustrates the danger of the
20:49
ITOT convergence we've been discussing.
20:52
To understand what happened, we have to look at the access
20:54
point. How they got in?
20:56
Right, the attackers didn't use some impossibly complex 0 day
21:00
exploit. They found a single compromise
21:03
pass word for a legacy VPN account.
21:05
A virtual private network, basically a remote access
21:09
digital tunnel into the companies internal network.
21:12
A tunnel that was meant for employees to access the
21:16
corporate IT systems from home. The attackers walked right
21:19
through that remote access tunnel and deployed ransomware
21:22
strictly on the IT side of the house.
21:24
They encrypted the corporate billing systems, the ticketing
21:26
systems, the business operations data.
21:29
Yep, but they didn't actually hack the pipeline itself.
21:32
They didn't touch the OT network or the pumps moving the fuel.
21:35
Wait. They didn't.
21:36
No, they didn't need to think about what a pipeline billing
21:39
system actually does. It isn't just generating
21:42
invoices at the end of the month.
21:43
It is a highly complex metering system.
21:46
It tracks the exact volume of liquid, passes through specific
21:49
physical checkpoints in real time, assigning financial value
21:52
based on fluctuating commodity markets and determining exactly
21:56
whose fuel is going where. So without the IT billing
21:58
system, Colonial Pipeline was flying blind commercially.
22:01
Totally blind, they didn't know who they were pumping fuel to,
22:04
how much was going where, or how to legally bill for the
22:07
transfer. Furthermore, there was massive
22:10
internal panic. The executive and the security
22:13
teams did not have total confidence that the ITNOT
22:16
networks were perfectly segregated.
22:18
They. Didn't know if the air gap was
22:19
real. Exactly.
22:21
They feel the ransomware might discover one of those invisible
22:23
bridges and crossover into the physical control systems.
22:26
So they made a choice. Out of an abundance of caution,
22:30
Colonial proactively ordered the physical shutdown of the
22:33
pipeline operations themselves. They stopped the pumps.
22:35
Wow, a purely IT compromise. A hacked billing network via a
22:41
remote access VPN caused a massive physical fuel shortage
22:45
across the entire US East Coast. Leading to panic buying, gas
22:49
stations running dry and grounded airplanes.
22:51
That is a staggering, cascading effect from a single stolen
22:55
password. But as bad as Colonial was, you
22:57
know the attackers were just after money.
22:59
They weren't trying to blow the pipeline.
23:00
Up. No, they were just greedy.
23:02
Right, I want to look at a darker escalation.
23:04
Let's talk about the Triton attack in Saudi Arabia in 2017.
23:08
Triton Triton represents A fundamental crossing of the
23:11
Rubicon in industrial cybersecurity.
23:14
This was an attack on a major petrochemical facility and the
23:18
adversaries were not looking for a ransom.
23:20
They wanted to break. Things they wanted to kill
23:22
people. They were not targeting the IT
23:24
network and they weren't even targeting the primary OT systems
23:27
running the daily chemical process.
23:30
They specifically targeted the safety instrumented system
23:33
thesis. OK, how many visualize the
23:35
architecture here? What is a safety instrumented
23:38
system and how does it relate to the rest of the plant?
23:41
So in any hazardous environment, a petrochemical plant, an oil
23:45
refinery, a nuclear facility, you have your primary
23:48
distributed control systems. These are the PLCS and computers
23:51
actively mixing chemicals, managing heat, and moving
23:54
fluids. The day-to-day workers.
23:56
Right, but engineering acknowledges that primary
23:58
systems can fail, valves can stick, sensors can break.
24:02
So completely independent of the primary controls, you install an
24:05
SIS. An independent backup.
24:07
More than a backup, it is the absolute last line, a physical
24:10
defense. It has its own dedicated
24:12
sensors, its own wiring, and its own specialized controllers.
24:16
Its only job is to sit quietly and monitor for critical safety
24:19
thresholds. Like a silent guardian.
24:21
Exactly. If the primary systems fail and
24:25
a chemical VAT starts building pressure toward an explosive
24:28
limit, Thesis detects the anomaly and automatically
24:32
triggers an emergency physical shutdown.
24:34
It overrides everything to prevent a catastrophe.
24:37
It is the physical emergency brake, or like the airbags in a
24:41
car, you never use them to drive, but if you crash, they're
24:44
the only thing that saves you. A perfect analogy.
24:47
Now consider the Triton malware. The attackers managed to
24:49
infiltrate the plants network, likely through a remote access
24:53
point, and locate the specific engineering workstations that
24:56
interact with the safety systems.
24:58
The facility used proprietary safety controllers manufactured
25:01
by Schneider Electric called Triconex.
25:03
Proprietary, meaning the code is an open source, you can't just
25:07
Google how it works. No, you cannot.
25:10
The attackers had to acquire a Triconics controller, take it
25:13
into a lab, and painstakingly reverse engineer it's
25:17
specialized, undocumented communication protocol.
25:20
That takes serious funding and time.
25:21
State level funding. They then wrote custom malware
25:25
Triton specifically designed to inject malicious logic directly
25:29
into the safety controllers. Wait, hold on.
25:31
Why attack the safety system? If you want to cause an
25:34
explosion, wouldn't you attack the primary system that controls
25:37
the pressure? Think about it.
25:39
If you attack the primary system and cause a pressure spike, the
25:42
independent safety system will simply detect it and shut the
25:45
plant down safely. Your attack fails.
25:48
Oh wow. The Triton adversaries
25:50
understood this. Their goal was to secretly alter
25:52
the logic of the safety system first, essentially disabling the
25:55
airbags so that when they subsequently triggered a
25:58
catastrophic failure in the primary process, the fail safes
26:01
would be blind to the danger and would not trigger.
26:04
They were systematically dismantling the safety Nets to
26:07
ensure kinetic destruction. That is absolutely terrifying.
26:10
It is a direct, premeditated attempt to cause massive kinetic
26:13
damage, environmental devastation, and massive loss of
26:17
human life. The only reason it failed was a
26:20
slight error in the attacker's custom code, which accidentally
26:23
tripped an alarm and alerted the plant engineers before they
26:26
could execute the second stage. A typo.
26:28
Save the plant. Literally a coating bug saved
26:31
lives. We've talked about a stolen VPN
26:34
password at Colonial and reverse engineered proprietary hardware
26:38
with Triton. I want to look at one more
26:40
historical precedent before we get to the present day, because
26:43
it highlights just how trivial the access point can be,
26:46
especially when we talk about remote access.
26:48
Yeah, let's hear it. Let's look at the water
26:50
treatment facility in Oldsmar, FL in 2021.
26:53
Oldsmar is a chilling example of the visibility crisis we face in
26:57
municipal infrastructure. Water treatment plants are
27:00
critical, but they are often severely underfunded and
27:03
understaffed. Which means they take shortcuts.
27:05
To manage the workload, engineers frequently rely on
27:07
remote access tools. In Oldsmar, an attacker gained
27:10
access to the plants internal systems using seemingly dormant
27:14
commercial remote desktop software.
27:17
Like Teamviewer, the stuff IT support uses to fix your laptop
27:21
screen remotely. Exactly Commercial off the shelf
27:24
remote access software team 4. The attacker breached the IT
27:29
environment, found the remote access tool, and pivoted
27:32
directly onto the OT control interface.
27:34
Just bypassed everything. Yep, and an actual human
27:38
operator sitting in the water plant suddenly noticed their
27:41
mouse cursor moving across the screen on its own.
27:44
It's like a ghost in the machine.
27:45
That's so creepy. The operator sat there and
27:47
watched the cursor navigate the chemical control software.
27:50
The attacker opened the controls for sodium hydroxide.
27:53
Which is Lye, right? Yes, Lye is used in tiny amounts
27:57
to control water acidity and prevent lead from leaching out
28:00
of the pipes. So in large amounts, Lye causes
28:02
severe chemical burns to human tissue.
28:04
It's poison. The attacker attempted to change
28:07
the sodium hydroxide levels in the municipal water supply from
28:10
a safe 100 parts per million to 11,100 parts per million, a
28:14
lethal, highly corrosive dose. Just by typing numbers into a
28:17
text box on a remote screen over Teamviewer.
28:20
Yes, thankfully the human operator was physically present,
28:24
saw it happening, and immediately reverse the change.
28:27
There were also downstream physical chemical alarms that
28:29
likely would have caught the spike before it reached homes.
28:32
Thank goodness. But Oldsmar proves A terrifying
28:34
point. An attacker crossed from a basic
28:37
commercial IT remote access tool directly into the real time
28:41
manipulation of a life safety process.
28:44
Which brings us perfectly to the core of our deep dive today,
28:47
Chapter 3. We've talked about the theory.
28:50
We've talked about the historical evolution of these
28:52
attacks. Now I want to look at what
28:54
happens when this reality collides with the global economy
28:58
right now. It gets expensive.
28:59
It gets devastating. Let's walk through the anatomy
29:02
of an absolute economic disaster, the Jaguar Land Rover
29:06
hack of late 2025. The Jaguar Land Rover incident
29:10
JLR is already being studied as a watershed moment in industrial
29:14
cybersecurity. It is the ultimate manifestation
29:16
of the ITOT convergence risk we've been outlining.
29:19
I mean, we opened this whole discussion with the statistic of
29:22
a plant costing $2.3 million an hour in downtime.
29:26
The JLR attack is that statistic brought to life on a massive
29:30
global scale. What started as an intrusion on
29:33
the IT network forced a total synchronized shutdown of vehicle
29:38
production worldwide for over a month.
29:40
And to truly grasp the scale of the devastation, we have to look
29:43
beyond the company itself. Economic analysis estimates that
29:47
this single cyber attack cost the British economy roughly £1.9
29:52
billion. That is nearly 2.5 billion U.S.
29:55
dollars. It is officially the most
29:57
economically damaging cyber event in the history of the
30:00
United Kingdom. OK, let's break down exactly how
30:02
this happened. We just talked about Triton
30:04
reverse engineering safety controllers.
30:05
Did the attackers write some incredibly sophisticated 0 day
30:08
exploit to hack the robotic welding arms of the JLR assembly
30:12
line? They didn't touch the robotic
30:14
arms. They didn't need to write a
30:15
single line of custom OT code. Wait, really?
30:18
Nope. The attackers are linked to a
30:20
syndicate known as Shiny Hunters, specifically a
30:22
notorious subgroup tracked as Scattered Spider.
30:26
I've heard of them, they target IT mostly.
30:28
Their primary weapon is not complex programming, It is
30:31
aggressive, highly sophisticated social engineering.
30:34
Social engineering? Yeah.
30:36
Hacking the human. Specifically, a technique called
30:39
fishing Voice fishing. Scattered Spider operators are
30:43
incredibly fluent in corporate culture.
30:45
They research employees on LinkedIn.
30:47
They figure out who works in the IT help desk.
30:50
Then they pick up the phone and call the help desk, perfectly
30:54
impersonating an employee who claims to be locked out of their
30:57
remote access account. Wow.
30:58
They. Just call them.
31:00
They understand the internal jargon, they use psychological
31:02
pressure, and they manipulate the support staff into resetting
31:06
passwords or bypassing multi factor authentication protocols
31:09
for their remote VPN. So they just talked their way
31:12
through the front door. They convinced a human being to
31:15
hand over the keys to the IT network.
31:16
Precisely, they established a massive privileged presence
31:20
inside the corporate IT environment.
31:22
But the critical question is why an IT breach forced a global
31:26
manufacturing shutdown. Right, because if they are just
31:29
in the e-mail servers or the HR database, why stop building
31:32
cars? This goes back to industry 4
31:34
point O. Modern automotive production is
31:37
a marvel of integration. JLR does not just build cars,
31:41
They operate a tightly wound synchronized logistics network.
31:45
They utilize complex manufacturing execution systems
31:49
and Just in Time supplier portals.
31:51
Just in time, meaning they don't keep thousands of steering
31:54
wheels in a warehouse somewhere. The parts arrive exactly when
31:57
they are needed. Exactly.
31:58
You cannot build a modern, highly customized vehicle if the
32:01
IT system cannot. It needs to be bolted into which
32:09
specific chassis at exactly 2.14 PM.
32:13
It's a continuous stream of data.
32:14
The entire production sequence relies on a continuous,
32:17
uninterrupted flow of data from the corporate IT layer down to
32:21
the PLCS. So it isn't just a bridge
32:23
between IT and OT, it's a completely interwoven nervous
32:26
system. If the IT brain stops sending
32:28
signals, the OT body can't move. That is the vulnerability.
32:32
When JLR security teams detected the Scattered Spider intrusion
32:35
on their enterprise remote access networks, they were
32:38
forced into a brutal calculation.
32:40
Yes, they knew the threat actor. They knew Scattered Spider
32:44
routinely deploys highly destructive ransomware.
32:47
And they knew that if the infection utilized that deeply
32:50
interwoven nervous system to cross from the IT servers onto
32:54
the factory floor OT networks, the physical damage to the
32:57
machinery and the required recovery time would be
33:00
catastrophic. So GLR had to make a choice.
33:03
They chose to amputate to contain the blast radius and
33:06
protect the physical factories from being encrypted.
33:09
JLR proactively severed the connections and shut down their
33:13
own IT systems. They pulled the plug on
33:15
themselves to save the patient. Yes, and that decision meant the
33:19
just in time data stopped flowing, which meant the parts
33:22
stopped arriving, which meant sales, registration and global
33:26
profession lines were brought to an absolute, immediate
33:29
standstill. And the ripple effect was
33:30
staggering. It wasn't just JLR taking the
33:33
hit. Reports indicate that over 5000
33:36
different supply chain organizations were impacted.
33:38
It's an ecosystem collapse. Because if JLR isn't assembling
33:41
cars, they aren't buying alternators or microchips or
33:44
windshield wiper motors. The suppliers, many of which are
33:48
smaller companies operating on thin margins, stop making money
33:52
the very same day. The cascading economic failure
33:55
was so severe and so rapid that it triggered emergency
33:59
government intervention. The government had to step in.
34:01
The UK government had to step in and underwrite loans.
34:04
JLR themselves had to launch a massive emergency financing
34:08
scheme just to inject upfront cash into their supply chain so
34:12
those smaller businesses wouldn't go bankrupt while the
34:14
main factories sat idle. It's an incredible scenario.
34:17
The attackers use a phone call to steal a remote access
34:20
password. They never touched a piece of
34:22
factory machinery and they effectively crippled an entire
34:25
national manufacturing sector. This highlights a crucial
34:28
concept outlined in the Mitre ATTNCK for ICS framework.
34:32
In traditional IT security, we are obsessed with data theft or
34:36
data encryption. In OT security, we focus on a
34:39
tactic known as loss of view or denial of control.
34:42
Loss of view, meaning the operators literally cannot see
34:45
what the machinery is doing. Exactly as we discussed earlier
34:49
with the Termite ransomware, the attacker doesn't necessarily
34:52
have to break the physical machine or alter the logic
34:54
inside the PLC. If they simply encrypt the
34:57
screens of the engineering workstations, or if they sever
35:00
the network connection between the control room in the factory
35:03
floor, as JLR was forced to do, the plant manager suffers a loss
35:07
of you. They are flying completely
35:10
blind. They have no idea if the boiler
35:12
is operating at a normal pressure or if it is 5 minutes
35:16
away from exploding. And in industrial safety,
35:19
operating a high risk physical process without visibility is
35:22
unacceptable. If you suffer a loss of you,
35:25
your safety protocols mandate that you must hit the emergency
35:28
stop button. The attacker doesn't shut down
35:31
your plan, they create a condition where you are forced
35:33
to shut it down yourself. I'm struggling with the detail
35:36
here though. Let's move into chapter 4, the
35:38
visibility crisis. When JLR discovered the hackers
35:41
in the IT network, why couldn't they just hunt them down?
35:44
What do you mean? Why couldn't they look at the
35:46
internal network traffic, see exactly which specific machines
35:50
the hackers were touching via that remote access, and isolate
35:54
just those machines instead of shutting down the entire global
35:57
company? You are hitting on the core
35:59
systemic vulnerability that plagues almost every the
36:02
industrial sector right now. It is the massive industry wide
36:06
visibility crisis. If you look at the forensic data
36:09
from Dragos, the statistics are incredibly jarring.
36:13
I have right here. According to the reporting, 88%
36:16
of OT networks struggle with basic detection and response
36:20
capabilities. Even more critically, 56% of
36:23
organizations cannot see anything happening below the
36:26
ITOT boundary. That 56% figure is the root
36:30
cause of why these attacks succeed.
36:32
More than half are. Total blind Completely blind.
36:34
To understand what below the boundary means, we need to look
36:37
at how modern industrial networks are structurally
36:39
designed. The global industry standard for
36:42
architectural security is called the Purdue Enterprise Reference
36:45
Architecture, commonly known as the Purdue.
36:47
Model OK, let's unpack the Purdue model.
36:49
Help me visualize this structure.
36:51
Think of a manufacturing plant as a massive multi story
36:54
building. The Purdue model organizes the
36:56
network into hierarchical floors, or levels.
37:00
Level 0 is the basement. This is the actual physical
37:03
process, the steel pipe, the electric motor, the mechanical
37:06
valve and dumb metal, right. Level 1 is the ground floor
37:09
occupied by the basic controllers, the PLCS we talked
37:12
about that directly send electrical voltages to the
37:15
valves in the basement. OK, that's level 1.
37:17
Level 2 is the supervisor level, the local control rooms with the
37:20
HMI screens where human operators watch the PLCS.
37:24
Level 3 is site wide operations, managing the entire facility's
37:27
workflow. Still mostly on the factory
37:29
side. Exactly.
37:31
Finally, levels four and five are the top floors, the
37:33
corporate enterprise, IT network, e-mail servers, remote
37:37
access, VPNs and the Cloud O. It's a structural hierarchy.
37:42
Physical machines in the basement.
37:43
Corporate executives in the penthouse.
37:45
Exactly. And the critical boundary we
37:48
were talking about sits right between Level 3, the top of the
37:51
OT factory floor, and level 4, the bottom of the corporate IT
37:54
network. International Security standards
37:56
dictate that you must create a strict Demilitarized Zone ADMZ
38:01
sitting at level 3.5. Level 3.5.
38:04
It's the security checkpoint between the penthouse and the
38:06
factory floor. An organization might have
38:14
state-of-the-art security visibility on their corporate
38:17
laptops. At level 4, they can see every
38:19
file being opened, every website visited.
38:21
But once a piece of data crosses down through the DMZ into the
38:25
PLC's at level 1, it becomes a complete black box.
38:28
They are blind. Wait, earlier we established why
38:31
they are blind. You told me we cannot install
38:34
standard IT security software like an antivirus agent onto a
38:37
level 1 PLC because it will crash the fragile processor and
38:41
shut down the plant. That remains true.
38:42
You cannot put active IT security agents on OT hardware.
38:45
It's too brittle. So if they can't patch them and
38:47
they can't scan them and they can't install antivirus on them,
38:51
how on earth is a security team supposed to know if an attacker
38:54
like Volt CIT is inside the factory network?
38:58
The answer is entirely different from IT.
39:00
You rely on passive network monitoring and deep packet
39:03
inspection. Passive monitoring, meaning you
39:05
don't interact with the devices at all.
39:07
You don't ask the devices questions.
39:09
Instead, you sit quietly on the network switches and you listen
39:12
to every single piece of data flowing between the machines.
39:15
Like wiretapping your own factory.
39:17
Yes, but here is the challenge. OT systems do not speak the same
39:21
language as IT systems. They use highly specialized
39:25
legacy industrial protocols languages like Modbus, DNP 3,
39:29
Profinet, or OPC UA. So standard IT security software
39:34
wouldn't even understand the traffic if it saw.
39:36
Standard IT tools are completely protocol blind.
39:38
If an IT firewall sees a packet of Modbus data, it just sees a
39:41
string of numbers. It doesn't know the difference
39:44
between a routine automated command checking a boiler's
39:47
temperature and a malicious command sent by a hacker
39:50
instructing the boiler to turn off its cooling pump.
39:52
OK, I think I have an analogy for this.
39:54
Tell me if this works instead of having an active security guard
39:58
in every single room checking ID badges, which would be like an
40:02
IT antivirus agent. You essentially need a highly
40:05
trained linguist sitting quietly inside the factory's air ducts.
40:10
Oh, I like that. They just listen to the raw
40:12
native language of the factory, humming along, waiting to notice
40:16
if someone suddenly starts speaking with a malicious accent
40:18
or issuing strange commands. That is a brilliant way to
40:21
conceptualize it. The linguists in the air ducts
40:24
needs to be perfectly fluent in Modbus.
40:26
You need specialized out of band monitoring solutions.
40:30
There are systems designed specifically for this, utilizing
40:33
deep packet inspection to decode the industrial languages.
40:37
So they translated on the fly. Exactly.
40:39
Some advanced solutions even bypass the network entirely and
40:42
monitor the raw electrical signals coming directly from the
40:46
physical sensors. That's smart because by
40:48
monitoring the physical electrical signals, the attacker
40:51
can't hide their tracks. Even if they alter the software
40:54
logs on the network to cover their tracks, they can't fake
40:56
the raw voltage coming off of physical pressure gauge.
40:59
Precisely. You spend months passively
41:02
baselining the normal, healthy communication patterns of the
41:05
factory. You learn exactly what the
41:07
facility is supposed to sound like.
41:09
Then your system instantly flags any behavioral anomaly.
41:13
APLC talking to a machine it has never spoken to before or a
41:17
controller receiving a firmware update command at 3:00 AM on a
41:20
Sunday over a remote vendor portal.
41:23
But to even set up that kind of passive monitoring, you need an
41:26
incredible understanding of your own infrastructure.
41:29
You need to know where all the cable.
41:31
Which is why Incident Response Frameworks hammer home the
41:34
absolute necessity of a Collection Management Framework,
41:36
or CMFACMF, is a rigorous, painstakingly detailed inventory
41:42
of every single data log and network switch in your OT
41:46
environment. Every single one.
41:47
Every single one. You have to know exactly how
41:49
long logs are kept, who has access to them, and what
41:52
specific forensic questions they can answer.
41:54
Because if you suffer an attack and you don't have ACMF, your
41:56
incident responders will waste the 1st crucial 48 hours just
41:59
trying to figure out if security data even exists in the factory,
42:02
let alone what it says. OK, so we have our structural
42:05
Purdue model, we have our DMZ at level 3.5, we have our passive
42:09
linguist in the air ducts decoding Modbus, and we have a
42:12
rigorous CMF that is the ideal defense playbook.
42:16
But what happens when all of that fails?
42:19
It often does. Right.
42:20
What happens when Scattered Spider gets through the DMZ via
42:23
some compromised remote access, decrypts the engineering
42:26
workstations, the operator loses view and the plant manager is
42:29
forced to hit the emergency stop?
42:31
You transition from defense to incident response, and as the
42:34
data clearly shows in Chapter 5, recovering a physical OT plant
42:38
is a completely different universe from rebooting an IT
42:41
server. And this brings us to what I
42:42
find the most fascinating psychological component of this
42:45
entire deep dive. The Macrium report refers to it
42:47
as the backup paradox. It is a phenomenal phrase that
42:51
captures the exact dilemma plant managers face.
42:54
Macrium surveyed the state of backup and recovery in the
42:57
manufacturing sector. What they found is that
42:59
manufacturers have actually invested heavily in backup
43:02
technology. 75% of organizations are utilizing complex hybrid
43:08
backups combining local on premise hardware with redundant
43:11
cloud storage. So the technology's there, they
43:14
have the data saved, it's protected.
43:16
They have the data, but the paradox lies in the actual
43:19
performance during a crisis. Despite all of that investment
43:23
in hybrid technology, only 18% of manufacturers can actually
43:27
meet their recovery time objectives during a simulated
43:29
test. 18% I hear that, but I'm struggling with the logic.
43:34
If you have a clean protected backup of your systems,
43:37
shouldn't you just wipe the infected machines, click restore
43:39
and get the assembly line back to work?
43:41
Why is the failure rate so high? Because you are thinking like an
43:45
IT professional. In an IT environment, restoring
43:48
a server is a predictable linear process.
43:51
If your e-mail server is encrypted with ransomware, you
43:55
wipe the hard drives, you pull the clean image from the cloud
43:58
backup, you reinstall it, and the server is back in business.
44:02
The restoration of the data is the recovery.
44:05
You got your files back, You're good.
44:06
Right, but in OT, restoring the data isn't the end of the story.
44:11
Not even. Close.
44:11
Not even close. In OT, restoring a PLC's logic
44:15
file from a cloud backup is not enough to restart a massive
44:18
physical plant. The limiting factor is a concept
44:21
called operational confidence. Operational confidence.
44:24
Let's put you in the shoes of a plant manager.
44:26
You run a massive facility producing volatile industrial
44:30
chemicals. Your remote access networks were
44:32
breached, the screens went dark, and the safety systems
44:35
automatically triggered a massive screeching halt to the
44:38
entire facility. OK, I'm stressed already.
44:40
You should be. The pipes are full of half
44:43
reacted chemicals cooling down. 24 hours later your IT security
44:48
team walks into your office. They say great news, we wipe the
44:51
servers, we restored the control logic from Tuesday's backup and
44:55
the network is clean. We are ready to restart the
44:58
reaction. As the plant manager, my first
45:00
reaction is relief. Let's fire it up.
45:04
Time is money. But then you stop and think.
45:06
The question you have to ask isn't just do we have a backup?
45:09
The critical life or death question is why is it safe to
45:12
hit the start button right now? How do you definitively know
45:17
that the attacker wasn't silently inside your network for
45:19
a month before they triggered the final shutdown?
45:22
Oh man, and we know from the reports that adversaries love to
45:26
linger. The average dwell time for a
45:28
threat actor inside an OT network before they detected is
45:31
42 days. Exactly.
45:33
So if you blindly restore a backup from Tuesday or last week
45:36
or even last month, you have a very high probability of simply
45:39
restoring the attackers hidden back doors.
45:41
You're just inviting them back in.
45:42
But it gets worse. What if three weeks ago, Volt CD
45:47
subtly manipulated the chemical recipe logic inside the PLC
45:50
backup itself? What if they changed the cooling
45:53
threshold from 100° to 200°, but they didn't execute the final
45:57
ransomware payload until today? So if I restore that backup, the
46:01
IT security software says the file is clean from malware, but
46:05
the engineering logic inside the file is physically poisoned.
46:08
If you do not have an unbroken mathematically proven evidence
46:12
change showing that the engineering logic in that
46:15
restored backup is perfectly pristine, restarting that
46:18
physical process could cause a catastrophic chemical spill.
46:21
It could trigger an explosion. The quote from the Macrium
46:23
report summarizes this perfectly.
46:26
In IT, restoring service is often the visible milestone.
46:29
In OT, the real milestone is operational confidence.
46:33
You cannot just cross your fingers, hit, start on a blast
46:36
furnace and hope for the best. You cannot.
46:37
And yet the psychological pressure on that plant manager
46:40
is immense. As we established, downtime in
46:43
automotive is $2.3 million an hour.
46:45
The executive board is probably screaming on a conference call
46:48
for production to resume. The pressure to simply hit the
46:50
start button can easily become stronger than the engineering
46:53
confidence required to do it safely, and that is exactly the
46:57
moment when lethal mistakes happen.
46:59
This friction between downtime and recovery connects directly
47:02
to a truly wild paradox highlighted in the Siemens True
47:06
Cost of Downtime report. Siemens points out that the
47:09
industries massive push toward predictive maintenance, using
47:13
thousands of IoT sensors and AI algorithms to predict when a
47:17
physical machine is going to break before it actually fails
47:20
has been incredibly successful. It has.
47:22
It's reduced the sheer volume of downtime incidents
47:24
significantly. 5 years ago, plants averaged 42 unplanned
47:28
incidents a month. Today, they average only 25.
47:32
The predictive technology is undeniably working.
47:34
It is catching the degrading pump bearings and the
47:36
overheating motors early. Right.
47:38
But here is the paradox. Even though plants are breaking
47:41
down less frequently, when they do go down today, it takes them
47:44
significantly longer to recover. Right.
47:46
The average recovery time per incident jumped from 49 minutes
47:49
five years ago to 81 minutes today.
47:52
It's a fascinating statistical inversion, and it perfectly
47:55
illustrates the compounding complexity of the modern OT
47:58
environment. Because as predictive
48:00
maintenance has solved all the easy problems, the worn out
48:03
conveyor belts, the simple mechanical faults, the only
48:06
problems that remain, the ones that actually managed to cause
48:09
downtime now are the incredibly complex systemic disasters.
48:13
The deep software integration failures.
48:16
Catastrophic cyber attacks spanning IT and OT.
48:19
Global supply chain shortages for highly specialized silicon
48:22
parts. The easy fixes are gone.
48:24
When a plant stops today, it's a structural nightmare.
48:27
And as the incident response data points out, the human
48:30
beings who actually know how to untangle these structural
48:32
nightmares are disappearing. Right.
48:34
We are facing a massive skilled labor shortage in manufacturing.
48:38
The demographic shift is severe. The master electricians and
48:41
veteran Mechanical Engineers who built these plants 30 years ago
48:44
are retiring. Which brings us to the most
48:46
critical realization about recovering from an industrial
48:49
cyberattack. OT incident response cannot
48:52
under any circumstances rely on an IT playbook.
48:55
It's not a guy in a hoodie sitting at a laptop looking at
48:57
code. Not at all.
48:59
The ISA Global Cybersecurity Alliance, the Isai SEA, has
49:03
developed a specialized program for this exact scenario called
49:07
ICS. For ICS, it stands for Incident
49:11
Command System for Industrial Control Systems.
49:13
That sounds heavily inspired by government disaster response
49:16
like FEMA. It is directly based on the
49:19
National Incident Management System used by firefighters,
49:22
paramedics, and 1st responders during physical disasters.
49:25
Because responding to an OT cyberattack looks much more like
49:28
fighting a complex multi story structural fire than it does
49:31
traditional digital forensics. Walk me through what that
49:34
actually looks like on the ground.
49:36
It involves establishing a rigid physical command structure.
49:39
You aren't just coordinating software engineers, you are
49:41
coordinating Mechanical Engineers, chemical engineers,
49:44
and plant safety officers. The.
49:45
Whole multidisciplinary team. Before anyone can even look at a
49:50
computer screen, you have to secure physical safety.
49:53
You have to ensure the environment is stable.
49:55
You have to make sure the incident responders are wearing
49:57
steel toed boots, high visibility vests, hard hats and
50:00
personal protective equipment before they step onto the
50:02
factory floor to inspect a compromised PLC.
50:05
That is so far removed from an IT server room.
50:08
You might be coordinating with local environmental agencies to
50:11
manage hazardous material spills caused by the attack.
50:15
You are managing a violent physical crisis that just
50:18
happens to have a digital root cause.
50:20
Wow. OK, We have covered an immense
50:22
amount of ground today and we've gone incredibly deep into the
50:25
mechanics of this invisible war. We started with the staggering
50:29
financial reality of the stopwatch, $2.3 million an hour
50:33
in automotive downtime. Yeah, that stopwatch is still
50:36
ticking. It is, we unpacked A fundamental
50:39
philosophical clash between IT's confidentiality, first CIA triad
50:43
and OT's availability, first AIC triad.
50:46
And why running a standard security scan can crash a
50:49
factory? And why the air gap is a myth,
50:51
especially with all these remote access tunnels.
50:53
Exactly. We look at how adversaries like
50:56
Voltsite are evolving from data thieves into industrial
50:59
saboteurs, studying blueprints to reverse engineer safety
51:03
systems like in the Triton attack.
51:05
It is an incredibly complex, rapidly evolving battlefield.
51:08
We walked through the economic devastation of the Jaguar Land
51:11
Rover attack where a single phone call to an IT help desk to
51:15
steal AVPN password forced a multi billion dollar global
51:18
shutdown because of the tightly wound nature of just in time
51:22
manufacturing. The butterfly effect of a single
51:24
vision call. We explored the Purdue model,
51:27
The absolute necessity of the passive linguist in the air
51:30
ducts, coding Modbus, and finally the agonizing backup
51:34
paradox where restoring the data means absolute nothing without
51:37
the operational confidence to safely restart the physical
51:40
machinery. And every single one of these
51:42
elements is compounding on the others.
51:44
It's a battlefield that remains completely invisible to the vast
51:47
majority of us, yet it's silently underpins every single
51:52
aspect of our modern lives. The clean water coming out of
51:55
your kitchen tap, the steady electricity keeping your
51:58
refrigerator cold, the car you drive to work, all of it relies
52:02
on the uninterrupted, highly delicate balance of these
52:06
industrial control systems. It really does.
52:08
Understanding this vulnerability isn't just a niche topic for
52:11
cybersecurity professionals. It is fundamentally about the
52:14
resilience of modern human civilization.
52:17
If we are going to leave the listener with one final
52:19
provocative thought to chew on, I think it connects directly
52:22
back to that recovery time statistic and the demographic
52:25
shift we discussed. As these cyber attacks get more
52:28
sophisticated and as our factories become more deeply
52:31
interwoven with the cloud and remote access portals, we are
52:34
slowly realizing that our ultimate defense isn't a magical
52:37
piece of AI software or a new firewall.
52:40
The ultimate defense is the institutional knowledge of the
52:43
human operators. The people on the floor.
52:45
The men and women who intuitively know what the
52:47
factory floor is supposed to sound like.
52:49
The veteran engineers who can place a hand on a metal casing
52:52
and know the exact healthy vibration of a turbine, or who
52:56
can look at a chemical reaction through a reinforced window and
52:59
know if the pressure gauge is lying to them.
53:02
But with that skilled manufacturing workforce rapidly
53:05
aging out. Right, With them aging out and
53:07
tech focused remote IT security personnel increasingly taking
53:12
over the operational controls from hundreds of miles away, we
53:16
have to ask a very difficult question.
53:18
As an industry, are we losing the physical human intuition
53:22
required to save our most critical infrastructure when the
53:25
digital screens inevitably go dark?
53:27
If the linguist in the air ducts doesn't understand the language
53:30
anymore and the engineer who knows the sound of the machine
53:33
is retired, we are in deep trouble.
53:35
That is a heavy critical thought to leave on.
53:38
That's all for this episode of Cybersecurity Under Pressure.
53:41
Real attacks, real lessons. It makes you look twice at every
53:44
switching valve out there. See you in the next chapter.