Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / Industrial Identity Security: The Risk in Software-Defined Factories

Transcript

Industrial Identity Security: The Risk in Software-Defined Factories · Cybersecurity Under Pressure. Real Attacks, Real Lessons

• 0:47
  Welcome to cybersecurity under pressure, real attacks, real
• 0:50
  lessons. Today is Monday, June 29th,
• 0:54
  2026. I have been thinking about this
• 0:56
  story all week. It starts with a breach and ends
• 0:59
  with a question every CISO should be asking about
• 1:02
  ransomware and industrial control systems.
• 1:04
  And honestly man, I can practically hear the nervous
• 1:07
  energy radiating off of you today.
• 1:09
  Oh yeah. You definitely have that
• 1:10
  distinct tone of someone who just spent their entire Sunday
• 1:13
  triaging, you know, critical alerts while the rest of the
• 1:17
  world was outside having a BBQ. Are you just running entirely on
• 1:20
  caffeine at this point? Yeah, I'm definitely on my 4th
• 1:22
  mug of coffee and yes, it is completely cold at this point.
• 1:25
  Yikes. Yeah, try 48 hours of just
• 1:27
  staring at raw packet captures and firewall logs.
• 1:31
  Because, you know, third party vendor decided Friday at 5:00 PM
• 1:34
  was the absolute perfect time to push an entirely undocumented
• 1:38
  firmware update. Oh, to a critical network
• 1:40
  segment, I bet. Exactly.
• 1:41
  But I mean, that is just the reality of the operational
• 1:44
  technology world, right? If you are listening to this
• 1:47
  right now and you actually manage an OT network, you know
• 1:50
  exactly what I mean. Yeah.
• 1:51
  Totally. We are essentially the digital
• 1:53
  janitors trying to keep the physical world from just
• 1:55
  spinning off its axis. Yeah, and right now our brooms
• 1:59
  are completely on fire. Well, grab another cup from that
• 2:02
  pot, because our mission for this deep dive is going to
• 2:05
  require honestly all the mental bandwidth we can muster.
• 2:08
  Today we're tearing apart a massive stack of sources.
• 2:12
  Today we're looking at the latest frontline threat
• 2:15
  intelligence, the impending regulatory mandates, dropping on
• 2:19
  our heads from the EU. Don't even get me started on the
• 2:21
  EU regulation. Right.
• 2:23
  And the architectural blueprints that dictate exactly how we keep
• 2:27
  industrial plants running when the network itself is just
• 2:30
  compromised. We're looking at a fundamentally
• 2:33
  crumbling perimeter, deeply vulnerable headless legacy
• 2:36
  devices and this sort of desperate industry pivot toward
• 2:41
  zero trust and software defined factories.
• 2:44
  We basically need to figure out how to operate when we can no
• 2:47
  longer trust the wires connecting our machines.
• 2:49
  It is a staggering operational shift.
• 2:52
  I mean, we are moving from treating the factory floor like
• 2:55
  this secure, isolated walled garden to simply assuming the
• 2:59
  walls are already breached. Because they usually are.
• 3:02
  Because, let's be brutally honest, they always are.
• 3:04
  Air gaps are they're basically a myth we tell ourselves so we can
• 3:08
  sleep at night. Exactly.
• 3:09
  Which means we have to start by confronting the really hostile
• 3:12
  reality of this Monday morning. So over the weekend I was
• 3:16
  reading up on the Scattered Spider hackers.
• 3:18
  Oh, right, the kids. Yeah, we were talking about two
• 3:20
  guys here, Thala Jubair, who's 20 years old, and Owen Flowers,
• 3:24
  who is literally just 18. They just pleaded guilty in the
• 3:27
  UK for the massive Transport for London attack and you know these
• 3:32
  are the exact same kids who allegedly dismantled The MGM and
• 3:36
  Caesars casinos in Las Vegas back in 202318 and 20 years old,
• 3:41
  taking down massive infrastructure.
• 3:43
  I have to laugh, but it's a really dark, painful laugh.
• 3:46
  Yeah, I feel that. I mean, you have multinational
• 3:49
  organizations spending 10s of millions of dollars on next
• 3:52
  generation firewalls, endpoint detection and response agents.
• 3:56
  You know, military grade encryption overlays.
• 3:58
  All the shiny toys. All of it.
• 4:00
  And they get entirely dismantled by two teenagers running a
• 4:03
  Telegram channel called Star Chat.
• 4:05
  It just shows you that the perimeter doesn't exist where we
• 4:07
  think it does. Right, because this was
• 4:09
  essentially just a massive SIM swapping service.
• 4:11
  But explain the mechanics of that to me for the listeners who
• 4:13
  might be a bit fuzzy. Why is a SIM swapping service so
• 4:17
  devastating to an enterprise environment?
• 4:19
  Well, because, you know, we hear about SIM swapping when someone
• 4:22
  gets their personal cryptocurrency wallet stolen,
• 4:25
  but how does that translate to taking down the entire IT
• 4:28
  infrastructure of Transport for London?
• 4:30
  It translates because enterprise security has, for better or
• 4:34
  worse, fundamentally tied its entire identity trust to the
• 4:38
  cellular network, which is arguably the weakest link in the
• 4:41
  chain. Really.
• 4:42
  Oh absolutely. It's almost poetic in its
• 4:45
  simplicity. These teenagers did not burn a
• 4:48
  complex 0 day exploit to break into a mainframe like it's some
• 4:51
  Hollywood movie. Right, no matrix text scrolling
• 4:55
  on the screen. Exactly.
• 4:56
  They used voice and SMS phishing.
• 4:59
  They tricked human employees at major wireless telecom
• 5:02
  providers. They stole their credentials,
• 5:05
  logged into the telecom providers internal portal and
• 5:07
  physically reassigned the victim's phone number to a SIM
• 5:10
  card that the attackers actually controlled.
• 5:13
  Wait, so they just completely hijacked the phone number?
• 5:15
  Exactly. And once you control the phone
• 5:17
  number, you intercept the multi factor authentication codes.
• 5:20
  Yeah, when the victim's enterprise VPN prompts them for
• 5:23
  a login, it sends that one time passcode via SMS to the phone
• 5:27
  number on file. The attacker gets the code, not
• 5:30
  the employee. Pass the front door completely.
• 5:32
  Completely. They breached over 130 massive
• 5:36
  organizations, companies like LastPass, DoorDash, MailChimp
• 5:39
  just by weaponizing customer service protocols at
• 5:42
  telecommunications companies. It completely invalidates the
• 5:45
  millions spent on network perimeter defense.
• 5:48
  OK, but let me push back here just a bit.
• 5:49
  SIM swapping is terrifying, obviously, but it is essentially
• 5:52
  a social engineering attack against the IT perimeter.
• 5:56
  We've known about MFA fatigue and SMS vulnerabilities for
• 5:59
  years now. Is this it's just the same old
• 6:03
  IT ransomware story sort of creeping into the headlines
• 6:05
  again? No, it is definitely not the
• 6:07
  same old story because the professional cybercrime economy
• 6:11
  has evolved into a highly optimized, hyper aggressive
• 6:14
  corporate structure. Look at the data on the
• 6:17
  Gentleman ransomware group. This is the group led by an
• 6:20
  administrator going by the handle Zeta 88 on Russian dark
• 6:23
  web forums. OK, they are completely
• 6:26
  disrupting the entire ransomware as a service market by offering
• 6:29
  a 90 to 10 affiliate split. Wait, meaning 90% of the ransom
• 6:33
  payout goes to the hacker who actually deploys the malware and
• 6:36
  the core developers only take 10%?
• 6:38
  Exactly. That is a staggering profit
• 6:41
  margin for the affiliate. That's huge.
• 6:42
  It really is. The criminal industry standard
• 6:45
  has always been an 8020 split. By bumping it to 90%, Zeta 88 is
• 6:51
  essentially creating a massive brain drain from other
• 6:53
  ransomware cartels. Oh.
• 6:55
  So they're poaching talent. Exactly.
• 6:57
  They are recruiting the absolute best, most aggressive
• 7:01
  penetration testers in the criminal underground and
• 7:04
  checkpoint. Research shows they are
• 7:06
  incredibly fast. Fast how?
• 7:08
  Well, they're already the second most active ransomware group
• 7:12
  this year. They specifically target
• 7:14
  Internet facing edge devices, your VPN appliances, your edge
• 7:18
  firewalls. Once they exploit A
• 7:20
  vulnerability there, they're inside and they encryt the
• 7:22
  entire network in a matter of hours, not days.
• 7:26
  And according to the latest Kaspersky ICS CERT data, the
• 7:30
  manufacturing sector is taking the absolute brunt of this
• 7:32
  accelerated aggression. Oh yeah, manufacturing's a
• 7:35
  massive target. Right, in the first quarter of
• 7:37
  2026, the percentage of attacked industrial computers in
• 7:41
  manufacturing jumped across 10 different global regions.
• 7:44
  Yeah, it's bad. So the attacks are getting
• 7:46
  faster, the affiliates are getting paid more, and they're
• 7:49
  aiming squarely at industrial control systems.
• 7:53
  But if we're talking about how these threat actors are getting
• 7:55
  in, we have to talk about the catastrophic failures happening
• 7:59
  on the defense side. Oh please tell me we are going
• 8:01
  to talk about the seasick Gov Cloud leak.
• 8:04
  We absolutely are. Good, because we want to talk
• 8:06
  about how trust is broken. That is literally the ultimate
• 8:10
  example. Yeah, and calling it a leak is
• 8:12
  almost too polite. Honestly, it was a complete
• 8:14
  breakdown of fundamental security hygiene at the
• 8:17
  Cybersecurity and Infrastructure Security Agency, the very
• 8:21
  federal body that writes the guidelines on how you and I are
• 8:24
  supposed to defend critical infrastructure.
• 8:26
  It's mind boggling. I mean, let's breakdown exactly
• 8:28
  what happened here. A contractor and administrator
• 8:31
  for CSS secure code development environment was using GitHub.
• 8:35
  OK, pretty standard. Right now, GitHub has built in
• 8:38
  automated features specifically designed to scan your code and
• 8:42
  block you from accidentally publishing sensitive secrets
• 8:45
  like API keys or passwords. Yeah, the secret scanning tools.
• 8:48
  Exactly this administrator literally went into the
• 8:51
  settings, disabled those secret blocking features manually, and
• 8:54
  then pushed plaintext AWS keys and internal passwords to a
• 8:58
  public repository. And the name of the public
• 9:01
  repository was literally private CISA.
• 9:03
  I mean, you could not write a script this absurd if you try.
• 9:06
  Furiously. Guillaume Valadon, a security
• 9:09
  researcher from Git Guardian, found it.
• 9:12
  He found a file literally called Important OS Tokens just sitting
• 9:16
  out in the open. Unbelievable.
• 9:17
  And this wasn't just a low level access key.
• 9:20
  This file granted high level administrative access to three
• 9:24
  Amazon AWS Gov cloud servers. And it gets worse, obviously.
• 9:28
  Of course it does. There was a CSV file containing
• 9:31
  dozens of plain text usernames and passwords for internal
• 9:34
  slices systems, including their landing zone, dev SEC OPS
• 9:37
  environment. Wait, the dev SEC OPS
• 9:39
  environment, meaning the exact tools and pipelines they use to
• 9:43
  build, test and deploy their own internal software.
• 9:45
  Right. And Dylan Airy, you know, the
• 9:47
  security researcher who created the secret scanning tool Truffle
• 9:50
  log? Yeah, Yeah.
• 9:51
  He analyzed the leak and pointed out that one of the exposed RSA
• 9:55
  private keys gave an attacker full access to all code
• 9:59
  repositories within the entire Sisa IT organization.
• 10:03
  So what does that actually mean in practice?
• 10:05
  If I'm a threat actor and I have that RSA private key, what can I
• 10:09
  realistically do? You can register a rogue runner
• 10:12
  on their continuous integration pipeline.
• 10:14
  You can hijack the automated build process entirely.
• 10:18
  You can secretly inject a back door into the software packages
• 10:22
  Sisa is building before they are ever even deployed.
• 10:25
  You can theoretically poison the well at the absolute source.
• 10:28
  That's terrifying. It is If the top federal
• 10:31
  cybersecurity agency in the United States has contractors
• 10:34
  essentially taping the master override keys to the front gate
• 10:37
  of the facility, what hope does a local, underfunded municipal
• 10:41
  water utility have? But wait, stop right there for a
• 10:43
  second. I get the analogy of taping the
• 10:45
  keys to the front gate, but let's connect this to the
• 10:47
  listener who is managing an actual factory floor right now.
• 10:50
  The sicilique is a human error. It's a contractor making a
• 10:54
  spectacularly bad decision on GitHub.
• 10:57
  How does human error and cloud environments directly connect to
• 11:00
  the failure of operational technology on the ground?
• 11:03
  It connects, yeah, because it proves that you just cannot rely
• 11:08
  on administrative policy or perimeter hygiene to keep the
• 11:12
  attacker out of the network. The attack is going to get
• 11:14
  inside, period. Whether through a SIM swap and
• 11:17
  affiliated ransomware operator exploding a firewall or a leaked
• 11:21
  key on GitHub, they will breach the perimeter.
• 11:23
  And once they're inside, your last line of defense isn't a
• 11:27
  firewall. Right.
• 11:28
  What is? It it's the internal network
• 11:29
  architecture itself. Specifically, the network
• 11:32
  switches that route traffic between your engineering
• 11:35
  workstations and your critical safety systems.
• 11:38
  Which leads us directly into the heart of the problem today.
• 11:41
  If patching the humans and securing the perimeter is
• 11:43
  failing, we have to look at the devices that actually enforce
• 11:46
  the trust inside the building. I want to look at the June 2020
• 11:50
  sixth CISA advisory regarding Schneider Electric's Modicon and
• 11:53
  Connexium managed switches. And look, I am not going to ask
• 11:57
  what a switch does. We know it routes packets.
• 12:00
  My question is far more pointed. I get that the managed switch is
• 12:03
  the ultimate trust boundary on the factory floor, but if we
• 12:06
  know MD5 cryptography is completely broken, why in the
• 12:09
  world are we still relying on RADIUS implementations that
• 12:12
  allow packet forgery in 2026? That is exactly the right
• 12:16
  question to ask, and honestly the answer is rooted in the
• 12:19
  terrifying technical debt of operational technology.
• 12:22
  I figured we really have to unpack the mechanism of this
• 12:25
  vulnerability. CVE 20243596A managed switch in
• 12:30
  an industrial environment is literally the physical
• 12:32
  manifestation of the plants trust model.
• 12:34
  OK, break that down for. Me.
• 12:35
  You have programmable logic controllers, human machine
• 12:38
  interfaces, and robotic arms, and they're all depending on
• 12:41
  these switches to enforce who is allowed to talk to whom.
• 12:44
  The standard way we enforce this is through eight O 2.1 X port
• 12:47
  based network access control which is backed by a RADIUS
• 12:50
  server. Right remote authentication,
• 12:52
  dial in user service. It has been around forever.
• 12:55
  Exactly. It relies on UDP, usually on
• 12:58
  ports 1812 and 1645, and the problem is how it handles the
• 13:03
  integrity of the authentication packets.
• 13:06
  In many of these legacy Schneider Electric setups, the
• 13:09
  RADIUS protocol uses MD5 hashing to verify that the packets
• 13:12
  haven't been tampered with in transit.
• 13:14
  MD5. Yeah, but as you just pointed
• 13:17
  out, MD5 has been highly vulnerable to collision attacks
• 13:21
  for over 2 decades. Right, For the listener who
• 13:23
  hasn't looked at cryptographic hash functions recently, explain
• 13:26
  the mechanism of a collision attack here.
• 13:28
  How does a weakness in MD5 allow an attacker to actually bypass a
• 13:32
  locked switch port? So an MD5 collision happens when
• 13:35
  2 completely different pieces of input data produce the exact
• 13:39
  same cryptographic hash output. Which shouldn't happen.
• 13:41
  Which should never happen, right?
• 13:43
  Because the RADIUS protocol uses a shared secret that doesn't
• 13:46
  change, an attacker who is sitting on the local network
• 13:49
  segment can actually predict how the hash will be calculated.
• 13:52
  When a legitimate device tries to connect to the switch, the
• 13:55
  switch sends a RADIUS access request packet to the
• 13:58
  authentication server. And the attacker intercepts that
• 14:00
  packet. They intercept it, and because
• 14:02
  of the MD5 weakness, they can forge a malicious radius access
• 14:06
  accept packet. They inject carefully crafted
• 14:09
  garbage data into the packet so that when the switch hashes it,
• 14:12
  it produces the exact same MD5 hash as a legitimate response
• 14:16
  from the real server. So the switch calculates the
• 14:19
  hash, sees that it matches what it expected, and just blindly
• 14:23
  assumes the authenticating server just to prove the
• 14:25
  connection. That's insane.
• 14:26
  So a threat actor can walk onto a factory floor, plug a rogue
• 14:30
  laptop into a random wall Jack, forge the access accept packet,
• 14:34
  and completely bypass the eight O 2 point 1X authentication.
• 14:37
  Boom, the unauthorized device is now fully authenticated on a
• 14:40
  critical production virtual local area network.
• 14:43
  The switch literally just lied to the entire security
• 14:46
  architecture. You know, I was reading a piece
• 14:48
  of analysis about this specific vulnerability, and it made a
• 14:51
  really chilling point. It noted that an OT switch
• 14:55
  rarely appears in an executive board report until the plant
• 14:59
  starts behaving strangely. That analysis is spot on because
• 15:03
  when an attacker uses this radius forgery to compromise the
• 15:07
  management plan of a switch, they almost never hit the
• 15:10
  emergency stop button and shut down the plant immediately.
• 15:13
  Why not? That is way too noisy.
• 15:15
  The security operation center would see the shutdown
• 15:17
  instantly. So what do they do instead?
• 15:19
  What is the actual operational impact once they are sitting
• 15:23
  comfortably on that trusted V Lim?
• 15:25
  They change a traffic path. They manipulate the switch's
• 15:28
  routing table so that your intrusion detection sister and
• 15:31
  your network monitoring tools go entirely blind.
• 15:34
  Extremely. They stop mirroring the
• 15:36
  malicious traffic to your security sensors.
• 15:39
  Or even worse, they open a hidden conduit through the
• 15:42
  Switch so that a compromised engineering workstation can
• 15:45
  reach a safety instrumented system that it has absolutely no
• 15:49
  business touching. But the operators don't see it.
• 15:51
  No. The plant operators in the
• 15:54
  control room still see packets moving.
• 15:56
  The green lights on the dashboard are still on.
• 15:59
  But the cybersecurity team has completely lost confidence that
• 16:02
  the physical plant is behaving as designed.
• 16:04
  The attacker is essentially flying the plane from the
• 16:07
  shadows. So hold on, let me challenge
• 16:08
  this entire scenario for a second.
• 16:10
  Every industrial network architect I speak to preaches
• 16:14
  the gospel of the IEC 62443 standard.
• 16:17
  Oh, here we go. They waive the Purdue Enterprise
• 16:21
  Reference Architecture model and my face talking about rigid
• 16:24
  zones and conduits. We are supposed to have physical
• 16:27
  and logical segmentation preventing an attacker from
• 16:29
  jumping from a low level workstation directly to a
• 16:32
  critical safety system. Why doesn't that heavily
• 16:35
  regulated segmentation stop this radius attack?
• 16:38
  Well, welcome to the reality of the factory floor, where the
• 16:41
  beautiful architectural spreadsheets absolutely do not
• 16:44
  survive contact with a 15 year old microcontroller.
• 16:46
  Fairpoint. The IEC 62443 standard is
• 16:50
  fantastic. In theory, it dictates that you
• 16:52
  group your assets based on strict security requirements,
• 16:55
  assigning them security levels from 1:00 to 4:00.
• 16:58
  But then you have external consultants coming in trying to
• 17:00
  slap security level 4 controls which demand heavy cryptography,
• 17:05
  mutual authentication and deep packet inspection onto bottom
• 17:08
  tier embedded devices at level 1 of the Purdue model.
• 17:12
  And these are the actual programmable logic controllers,
• 17:15
  right? The device is physically opening
• 17:17
  the valves and moving the robotic arms.
• 17:19
  Exactly. These PLCS and remote terminal
• 17:22
  units are running embedded microcontrollers with almost 0
• 17:26
  compute headroom. So they can't handle it.
• 17:28
  Not at all. Their entire processor is
• 17:30
  dedicated to maintaining a deterministic cycle time,
• 17:34
  reading a sensor, and flipping a relay in five milliseconds flat.
• 17:37
  If you try to force complex transport layer security or
• 17:40
  heavy authentication protocols onto them natively, you break
• 17:43
  the device. They literally cannot process
• 17:46
  the cryptographic overhead and the entire process crashes.
• 17:49
  So because the endpoints themselves are too weak to
• 17:51
  defend themselves, you have to rely entirely on the network
• 17:54
  switch to act as the enforcer. The switch becomes the conduit.
• 17:58
  It is the only thing enforcing the boundary between the zones.
• 18:01
  And if that switch is lying to you because of a 2 decade old
• 18:04
  radius forgery vulnerability, your zone is instantly
• 18:08
  compromised. The attacker just bypassed the
• 18:10
  conduit at that moment. You're highly touted expensive.
• 18:14
  Network segmentation is nothing more than a slide and a
• 18:17
  PowerPoint deck. It is not a real operational
• 18:21
  control. That is a brutal reality.
• 18:23
  The perimeter is compromised by SIM swapping, the internal
• 18:27
  conduits are bypassed by legacy cryptography, and the endpoints
• 18:31
  physically cannot support modern security protocols.
• 18:34
  Yep, welcome to my Monday. Which is exactly why the
• 18:36
  regulators are completely losing patience.
• 18:39
  They're no longer just issuing polite guidelines and best
• 18:41
  practice documents. They are stepping in to force a
• 18:44
  fundamental change. If you're managing compliance
• 18:47
  right now, September 2026 is circling on your calendar like a
• 18:50
  bird of prey. Oh, you were talking about the
• 18:52
  year Union Cyber Resilience Act, the CRA?
• 18:55
  Exactly. It is going to fundamentally,
• 18:56
  aggressively change how we build, deploy and maintain
• 19:00
  industrial hardware across the globe.
• 19:02
  Right, because as of September 11th, 2026, the CRA mandates a
• 19:06
  terrifyingly tight window for disclosure.
• 19:09
  Any manufacturer or operator must report actively exploited
• 19:13
  vulnerabilities and severe security incidents to the
• 19:15
  European Union Agency for Cybersecurity in ISA within 24
• 19:20
  hours of becoming aware of them. 24 hours, it's crazy.
• 19:23
  And to even know if you are vulnerable to a new exploit, the
• 19:25
  CRA is forcing the mandatory adoption of Machine Readable
• 19:29
  Software Bill of materials or S bombs for all digital products.
• 19:33
  Just saying the acronym S BOM makes my blood pressure spike.
• 19:36
  Honestly, do you have any idea what it actually means to
• 19:40
  generate a machine readable, fully accurate S BOM for a
• 19:44
  legacy device that has been bolted to a factory floor for 15
• 19:47
  years? Probably a headache.
• 19:49
  It is an administrative nightmare of epic proportions.
• 19:52
  We have massive to fleets of legacy PLCS and RT US running
• 19:55
  critical infrastructure where the original vendor doesn't even
• 19:57
  exist anymore. The company went bankrupt or got
• 20:00
  acquired 3 times over, or the firmware was custom compiled by
• 20:03
  some brilliant engineer who retired a decade ago and left
• 20:06
  exactly 0 documentation. You know, this sounds exactly
• 20:10
  like what they covered in the wire transfer deep dive
• 20:12
  regarding new compliance rules creating cascading financial
• 20:16
  risks through the entire global supply chain.
• 20:19
  If you are a component manufacturer and you cannot
• 20:21
  produce that machine readable S bomb, you cannot prove
• 20:25
  compliance. And if you can't prove
• 20:26
  compliance, you're suddenly facing massive regulatory fines.
• 20:30
  Or worse, you get completely locked out of selling into the
• 20:33
  European markets. The financial contagion is.
• 20:37
  Huge. It is an existential threat to
• 20:39
  vendors. I mean, the S bomb is
• 20:41
  essentially a highly detailed restaurant allergy warning for
• 20:44
  software. That's a good way to put it.
• 20:46
  Think about it. If a zero day exploit drops on a
• 20:48
  Friday night and you find out a specific obscure open source
• 20:52
  library have a critical remote code execution vulnerability,
• 20:56
  say another catastrophic log 4 J situation, you need to know
• 21:00
  exactly which embedded devices on your manufacturing floor are
• 21:03
  silently running that specific library deep in their firmware.
• 21:06
  Right, because if you don't know it's there.
• 21:08
  You cannot recall a tainted ingredient if you have
• 21:10
  absolutely no idea it is floating in the soup.
• 21:13
  And the CRA doesn't just want you to know you're vulnerable,
• 21:16
  they demand that you fix it. Which forces us to look at the
• 21:19
  mechanism of patching these massive distributed
• 21:22
  environments. Which brings up the massive
• 21:24
  double edged sword of over the air or OTA updates.
• 21:27
  OTA updates. Are quite literally the only way
• 21:31
  you can realistically comply with these 24 hour reporting and
• 21:34
  patching windows across thousands of distributed
• 21:37
  industrial Internet of Things devices.
• 21:39
  Because you can't do it manually.
• 21:41
  Exactly. If you manage a municipal water
• 21:43
  network, you cannot send a technician in a physical truck
• 21:46
  to drive around and manually. We plug a USB drive into every
• 21:50
  single water pump controller across 100 square miles.
• 21:53
  It's logistically impossible. You have to push the patch over
• 21:56
  the network. But if your OTA implementation
• 21:59
  architecture is weak. It ceases to be a patching
• 22:01
  mechanism and becomes the ultimate highly efficient attack
• 22:04
  vector for a threat actor. Exactly.
• 22:07
  Let's breakdown the mechanics of a secure OTA update.
• 22:10
  If the firmware payload isn't encrypted in transit with AES
• 22:12
  256, If it doesn't use asymmetric cartography like RSA
• 22:17
  or elliptic curve cryptography for deeply integrated digital
• 22:20
  signatures, right? And most importantly, if the
• 22:24
  receiving device does not have a physical hardware root of trust
• 22:27
  enforcing secure boot, you aren't patching A vulnerability
• 22:32
  at all. You're just handing the
• 22:33
  ransomware affiliate an automated, highly efficient
• 22:36
  delivery mechanism to inject malicious code directly into the
• 22:41
  memory of your critical infrastructure.
• 22:43
  You're doing their job for them. If the device cannot
• 22:46
  cryptographically verify that the firmware update came
• 22:49
  exclusively from the original equipment manufacturer, an
• 22:52
  attacker who compromises your update server can push a
• 22:56
  malicious firmware image to every single PLC on your network
• 23:00
  simultaneously. That's a night you brick the
• 23:02
  entire factory in one keystroke. So we are essentially caught in
• 23:05
  an impossible paradox here. The European regulators are
• 23:08
  basically demanding a zero trust posture in environments that
• 23:11
  were entirely fundamentally built on implicit trust.
• 23:14
  Exactly. They want 24 hour reporting,
• 23:17
  cryptographic over the air updates, and machine readable
• 23:19
  dependency trees for devices that were designed back when
• 23:22
  dial up Internet was still a cutting edge technology.
• 23:25
  How do you actually bridge that gap?
• 23:27
  Well, you cannot fix the old devices natively.
• 23:30
  We already established they lack the compute power, so you have
• 23:33
  to build a fortress around them. You have to wrap the legacy
• 23:35
  architecture in a modern security overlay.
• 23:38
  Which leads us directly to Kiran Upadrasta's V4 Point O doctrine
• 23:43
  on Zero Trust for industrial control system.
• 23:45
  Yes, brilliant paper. I was analyzing this specific
• 23:48
  white paper and it tackles the exact paradox you just
• 23:51
  described, but I want you to explain the mechanics of it.
• 23:53
  How do you theoretically enforce 0 trust on APLC from 1995 that
• 23:58
  has absolutely no concept of human identity 0 cryptography
• 24:03
  and lacks any concept of a network session model?
• 24:06
  You use identity aware overlays and protocol proxies.
• 24:09
  Look, the fundamental problem what you've addressed formally
• 24:11
  defines is the headless device authentication.
• 24:13
  Problem is the devices at level 0 and level one of the Purdue
• 24:17
  model cannot authenticate users. Period.
• 24:19
  Right. They just don't have the brains
• 24:21
  for it. Exactly.
• 24:22
  They speak unencrypted leg and protocols like Modbus, DMP 3 or
• 24:26
  Basic Common Industrial Protocol.
• 24:28
  These protocols were built for serial cables.
• 24:30
  They have zero native security. The PLC does not know and does
• 24:35
  not care who is sending the command to open a relief valve
• 24:38
  just sees the packet arrive on the wire, reads the function
• 24:41
  code and executes it. So if an attacker like our
• 24:44
  affiliated ransomware operators we talked about earlier, gets
• 24:47
  onto the internal network and simply runs a scan to learn the
• 24:50
  IP address of the PLC, they can just format a standard Modbus
• 24:54
  packet, send a command to halt the process, and the PLC will
• 24:57
  happily, obediently oblige A. 100% it will shut down without a
• 25:01
  second thought. So instead of trying to force
• 25:03
  the legacy PLC to authenticate the user, which we know will
• 25:06
  break the device you interpose is a proxy, you build an
• 25:10
  intelligent network layer that physically wraps the headless
• 25:13
  device. OK, walk me through a packet's
• 25:15
  journey in this architecture. Let's say a legitimate engineer
• 25:18
  on a laptop needs to connect to the PLC to run a diagnostic.
• 25:22
  In the UPI Drosta Dr., the engineer does not connect to the
• 25:24
  PLC. OK, where do they go?
• 25:25
  They connect directly to the identity aware property sitting
• 25:28
  in front of it. The proxy intercepts the
• 25:30
  connection and acts as an absolute bouncer at the door.
• 25:34
  It forces the engineer's laptop to negotiate a modern TLS
• 25:37
  encrypted session. Got it.
• 25:39
  It demands multifactor authentication.
• 25:41
  It checks the device posture to ensure the laptop isn't running
• 25:44
  malicious processes. It confirms their specific
• 25:47
  identity, context and role based access permissions.
• 25:51
  And only if the proxy fully trusts the engineer, what
• 25:53
  happens to the packet. Only then does the proxy
• 25:56
  translate that secure authenticated connection into
• 25:59
  the legacy Modbus protocol. It strips off the modern
• 26:02
  encryption, encapsulates the commanders of the raw legacy
• 26:05
  protocol, and passes it down the short trusted physical wire to
• 26:09
  the PLC. Oh, that's clever.
• 26:10
  Right, you are injecting TLS encryption and identity
• 26:13
  verification into legacy protocols by acting as a highly
• 26:16
  intelligent middleman. The PLC still thinks it is just
• 26:19
  talking on a flat trusted network, but the proxy ensures
• 26:23
  that only explicitly authorized commands ever reach it.
• 26:26
  I am looking at the empirical data from Upadrosta's paper
• 26:29
  right now, and I have to stop you to highlight this.
• 26:31
  It states that implementing the specific proxy architecture
• 26:35
  reduces successful lateral movement from compromised
• 26:38
  engineering workstations by an astonishing 87 to 94%.
• 26:43
  That is a massive, almost unbelievable drop in successful
• 26:46
  attacks. It sounds unbelievable until you
• 26:48
  look at the mechanics, but it is based on real data from
• 26:51
  independent red team testing across 14 different advisory
• 26:55
  engagements. By enforcing minimum trust
• 26:57
  access strictly at the protocol layer rather than trying and
• 27:00
  failing to fix the device layer, you stop compromise workstations
• 27:03
  did in their tracks. How does that look in practice?
• 27:06
  Think back to the scenario we discussed earlier.
• 27:08
  The Scattered Spider attacker uses SIM swapping to bypass the
• 27:11
  VPN and compromise an engineering workstation in a
• 27:15
  traditional legacy network. They are now inside the Trusted
• 27:18
  zone. They can freely scan the
• 27:19
  network, find the PLCS, and start firing off malicious
• 27:23
  Modbus function codes. But with the identity overlay
• 27:26
  proxy in place. With the overlay, the compromise
• 27:29
  workstation tries to scan the network and the proxy simply
• 27:32
  drops the traffic silently. The attacker tries to blindly
• 27:36
  send a Modbus command and the proxy intercepts it, demanding A
• 27:39
  valid cryptographic session token tied to a specific human
• 27:43
  identity and an approved behavioral baseline.
• 27:45
  Which they don't. Have they don't have it, The
• 27:47
  lateral movement fails completely because the network
• 27:50
  itself refuses to route unauthenticated protocol
• 27:53
  commands to the endpoints. It neutralizes the compromise
• 27:56
  workstation entirely. OK, I hear the theory and the
• 27:59
  mechanism is definitely sound. The 94% reduction is incredible
• 28:03
  on paper. But let me push back with a
• 28:05
  hard, ugly operational scenario. Laid on me.
• 28:08
  We know proxies introduce latency and rely on external
• 28:11
  identity providers. It is 2:00 AM on a Sunday.
• 28:14
  A highly pressurized pipe is actively bursting in a remote
• 28:18
  municipal pumping station. Bad situation.
• 28:20
  Very The pressure is building toward a catastrophic kinetic
• 28:23
  explosion and the local proxy server has just crashed or the
• 28:27
  Internet connection back to the cloud identity provider is
• 28:30
  completely down. Do I seriously have to stand
• 28:33
  there and wait for a multi factor authenticity vacation
• 28:35
  pushed to my phone to time out before I can open the emergency
• 28:38
  relief valve? Because if I do, that pipe is
• 28:40
  going to take out the entire facility.
• 28:42
  I love that you ask that because every single seasoned plant
• 28:46
  manager asks that exact terrifying question.
• 28:50
  You cannot let digital security cause a catastrophic physical
• 28:53
  safety failure. The doctrine accounts for this
• 28:55
  with edge case engineering. The solution is the physical
• 28:58
  break glass safe. You mean a literal physical
• 29:01
  metal safe A. Heavy physical lock box bolted
• 29:04
  to the wall in inside the control room.
• 29:06
  Inside that safe there are pre authenticated hard coded
• 29:08
  emergency tokens, usually specific USB hardware keys that
• 29:12
  are cryptographically designed to instantly bypass the identity
• 29:16
  proxy and allow immediate localized access to the critical
• 29:19
  safety PLCS. That sounds like a massive
• 29:22
  backdoor. It is, but here is the critical
• 29:24
  catch. They are strictly one time use.
• 29:27
  The absolute millisecond you plug that emergency hardware
• 29:31
  token into the terminal, it triggers a massive, unignorable
• 29:34
  logging event. So you can't hide it.
• 29:36
  Exactly. It fires off high priority
• 29:39
  paging alerts to the security operation center, sounding
• 29:42
  alarms across the organization, and it automatically mandates a
• 29:46
  formal executive level post incident review.
• 29:49
  You can bypass the proxy, you can stop the bursting pipe
• 29:52
  immediately to save the plant, but you're going to have to
• 29:55
  stand in front of the CI so the next morning and explain exactly
• 29:58
  mathematically why you broke the glass.
• 30:00
  That is a brilliant, pragmatic balance of physical safety and
• 30:04
  digital security. But listening to the sheer
• 30:06
  complexity of this, the identity overlays, the proxies, the PLS
• 30:10
  translation, the physical break glass safes, makes me wonder if
• 30:14
  this is how much money, effort, and architectural gymnastics it
• 30:17
  takes just to fix the old factories.
• 30:19
  What does it look like when we build a new one entirely from
• 30:21
  scratch? Oh, you throw the old
• 30:23
  architecture completely out the window, you abandon the legacy
• 30:26
  hardware and you build a purely software defined factory.
• 30:29
  Which brings us to the bleeding edge of the industry.
• 30:32
  I want to dive deep into Audi's Edge Cloud for Production, or
• 30:35
  EC4P. Audi is collaborating heavily
• 30:38
  with Siemens and Cisco to do something that sounds almost
• 30:40
  like pure heresy in traditional operational technology circles.
• 30:44
  It really does. They are entirely virtualizing
• 30:47
  legacy hardware and moving critical, highly time sensitive
• 30:51
  manufacturing applications off the factory floor and into off
• 30:54
  premise data centers. It is a total ground up paradigm
• 30:58
  shift. Instead of having a physical
• 31:00
  industrial PC or a metal PLC bolted inside a dusty vibrating
• 31:05
  electrical cabinet right next to the robotic arm on the shop
• 31:08
  floor, they are running a virtual PLC of VPLC on a server
• 31:12
  in a climate controlled data center up to 13 kilometers away
• 31:15
  from the physical factory. Wait, I have to stop you there
• 31:17
  and challenge the physics of this off premise data Centers
• 31:20
  for a live automated manufacturing floor.
• 31:23
  I thought the absolute golden rule, the unbreakable law of
• 31:26
  operational technology, was deterministic latency.
• 31:29
  Doesn't a single millisecond of latency or a single dropped
• 31:32
  Ethernet packet ruin an entire automated production?
• 31:35
  Line. Traditionally, yes.
• 31:37
  Right. If that robotic arm we talked
• 31:39
  about at the beginning doesn't get the stop command from the
• 31:42
  virtual PLC in exactly 5 milliseconds, it crashes a
• 31:45
  chassis into a wall. How does 13 kilometers of fiber
• 31:49
  optics not introduce catastrophic latency?
• 31:52
  You are absolutely right to challenge the physics.
• 31:55
  In traditional standard Ethernet routing, a dropped packet means
• 31:59
  the system has to realize it was dropped, request a
• 32:01
  retransmission, and wait for the packet to arrive again.
• 32:04
  Right, which takes time. Exactly.
• 32:06
  That retransmission cycle introduces unacceptable latency,
• 32:09
  which means a physical collision on the factory floor.
• 32:12
  But they aren't using traditional Ethernet routing for
• 32:14
  this, they're using PRP, the pair RLO redundancy protocol.
• 32:19
  Breakdown the mechanism of PRP. How does it bend the physics of
• 32:22
  network latency? PRP is an absolutely brilliant
• 32:25
  piece of network engineering. It takes every single critical
• 32:29
  Ethernet frame generated by the virtual PLC and duplicates it at
• 32:33
  the source. It sends the original packet
• 32:35
  down network A, and it simultaneously sends the exact
• 32:38
  duplicate packet down network B. These are parallel, physically
• 32:41
  independent network fabrics built on advanced Cisco
• 32:44
  industrial switches. They share no common
• 32:46
  infrastructure. So they are essentially racing
• 32:49
  each other to the destination robotic.
• 32:51
  Arm exactly. Frame A goes down the left side
• 32:53
  of the factory, Frame B goes down the right side, the
• 32:56
  receiver at the other end. The controller on the robotic
• 32:59
  arm accepts whichever packet arrives 1st and silently
• 33:03
  discards the duplicate based on sequence numbers.
• 33:05
  That's genius. Right.
• 33:07
  If Network A suffers A catastrophic hardware failure if
• 33:10
  a switch reboots, or if a forklift literally drives over
• 33:13
  the fiber optic cable and severs it, it doesn't matter.
• 33:15
  System doesn't even blink. Because the duplicate packet on
• 33:18
  network B is already arriving at the exact same millisecond.
• 33:21
  Precisely. There is 0 recovery time, no
• 33:25
  single point of failure, no packet loss requiring
• 33:28
  retransmission. It mathematically guarantees the
• 33:31
  strict latency requirements those five millisecond windows
• 33:35
  even when communicating with a centralized data center miles
• 33:38
  away. So if you virtualize the
• 33:39
  hardware into a data center and you mathematically secure the
• 33:43
  latency with parallel redundancy network, you fundamentally
• 33:47
  change how you operate and defend the factory.
• 33:50
  The Siemens architectural document points out that in a
• 33:52
  software defined factory, the first step to fixing a broken
• 33:55
  production line is picking up a mouse and keyboard to spin up a
• 33:59
  new virtual instance, rather than grabbing a physical key to
• 34:02
  open a metal electrical cabinet. The benefits are staggering.
• 34:07
  It drastically lowers physical hardware procurement costs.
• 34:10
  It eliminates time consuming shop floor firmware updates
• 34:13
  because you patched the server, not the endpoints, and it allows
• 34:16
  you to bake deep cybersecurity in from the ground up.
• 34:19
  You can spin up a new virtual controller, deploy an
• 34:22
  experimental patch, test it against a digital twin of the
• 34:25
  factory floor, and verify it works without ever stepping onto
• 34:28
  the actual manufacturing floor. But let me tell you, the hardest
• 34:30
  part of this transformation isn't the PRP networks or the
• 34:34
  virtualized hardware. It is the human organizational
• 34:37
  challenge. You mean merging the
• 34:38
  traditionally siloed IT and OT? Yes, the cultural clash is
• 34:43
  massive. You can no longer have the IT
• 34:45
  guys sitting in carpeted offices who don't understand the kinetic
• 34:49
  physics of a spinning motor operating an entirely separate
• 34:52
  from the OT guys on the concrete floor who think IP addresses and
• 34:56
  TLS certificates are dark magic. Yeah, that's a recipe for
• 34:59
  disaster. To make EC4P work, Audi had to
• 35:02
  create a unified 24/7 operational team possessing
• 35:06
  deeply integrated IT and OT skill sets.
• 35:09
  They had completely merged the cultures.
• 35:11
  And when you have that unified software defined architecture,
• 35:14
  you open the door for defensive tools that were literally
• 35:17
  impossible to deploy in legacy environments.
• 35:20
  Look at what Dragos is doing with their Ember AI platform.
• 35:23
  Oh Amber AI is incredible. Yeah, they trained a highly
• 35:26
  specialized artificial intelligence on a decade of
• 35:28
  specific operational technology, expertise, hardware behaviors,
• 35:32
  and frontline threat intelligence.
• 35:34
  When your entire factory is software defined and centrally
• 35:37
  routed, an AI can monitor the health of production assets
• 35:40
  continuously at the packet level.
• 35:42
  It is the absolute Holy Grail of industrial security.
• 35:46
  It can hunt for vulnerabilities in real time.
• 35:48
  It can analyze the vibration data of a virtualized pump and
• 35:52
  predict when a physical bearing is going to fail before it
• 35:54
  actually breaks. That's amazing.
• 35:56
  And from a cybersecurity perspective, it can detect the
• 35:58
  behavioral anomalies of a compromised network segment and
• 36:02
  isolate it automatically before a ransomware payload like a
• 36:04
  gentleman even has a chance to detonate.
• 36:07
  You move from reacting to the breach to proactively predicting
• 36:10
  the failure. You eliminate the entire
• 36:13
  headless device problem by virtualizing the device's brain
• 36:17
  inside a highly secure, deeply monitored data center.
• 36:21
  It is a massive leap forward and it completely reframes how we
• 36:24
  think about industrial resilience.
• 36:25
  But listening to all of this, from teenagers bypassing MFA, to
• 36:29
  the death of legacy cryptography to the rise of AI monitored
• 36:33
  virtual PLCS, it leaves me pondering a rather provocative
• 36:37
  thought for the future of this industry.
• 36:38
  Oh yeah. What's that?
• 36:39
  We are actively virtualizing the very hardware that defines
• 36:43
  industrial control. We are running physical kinetic
• 36:47
  factories from off site servers using parallel redundancy
• 36:51
  networks. We are wrapping every legacy
• 36:53
  device in complex 0 pressed cryptographic overlays and
• 36:57
  deploying artificial intelligence to hunt for
• 36:59
  threats. If we project this out 10 years,
• 37:03
  will the traditional OT engineer even exist?
• 37:06
  Or are we all just going to be IT network engineers who happen
• 37:10
  to wear steel toe boots to the office?
• 37:12
  I have to admit that is a terrifying but incredibly
• 37:15
  exciting thought. The lines are blurring so fast
• 37:17
  that makes your head spin. I think the steel toe boots will
• 37:20
  definitely stay. You still have to respect the
• 37:22
  kinetic energy of the factory floor, but the traditional
• 37:24
  wrench that is definitely getting replaced by a Python
• 37:27
  script and a Cloud Console. That's all for this episode of
• 37:30
  Cybersecurity Under Pressure. Real attacks, real lessons.
• 37:33
  I think I finally earned a fresh hot cup of coffee and you should
• 37:36
  probably get some sleep before your pager goes off again.
• 37:38
  See you in the next chapter.