Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / Legacy VPNs in OT: Remote Access and the Cost of Disruption

Transcript

Legacy VPNs in OT: Remote Access and the Cost of Disruption · Cybersecurity Under Pressure. Real Attacks, Real Lessons

• 0:47
  I got to tell you, imagine sitting in a sterile, brightly
• 0:50
  lit control room at like 2 in the morning.
• 0:53
  Oh, I've been there too many times.
• 0:56
  Right, so you're there and you're staring at this massive
• 0:58
  Bank of monitors and the screens are telling you that the city's
• 1:02
  water supply is perfectly fine. Everything is in the green.
• 1:04
  Exactly. The pressure is nominal, the
• 1:07
  chemical mix is balanced, the pumps are just humming along.
• 1:10
  But a mile away, out in the actual physical world, invisible
• 1:14
  lines of code are actively dumping amounts of sodium
• 1:18
  hydroxide basically lie directly into the drinking water and your
• 1:23
  screen. It's completely lying to you.
• 1:25
  I mean, it's feeding you this looped fake reality while the
• 1:29
  physical process is quietly manipulated toward a mass
• 1:32
  casualty event. This is not some Hollywood movie
• 1:34
  plot. That is the actual terrifying
• 1:37
  reality of modern industrial cyber warfare.
• 1:40
  Man, just just thinking about that scenario makes me need a
• 1:43
  very stiff drink. Or, you know, at the very least,
• 1:45
  a massive amount of caffeine. In coming, I got you the dark
• 1:48
  roast. Oh.
• 1:49
  Thank goodness. Extra shot too.
• 1:52
  You look like you absolutely need it today.
• 1:54
  How was the weekend? Oh man, thank you.
• 1:56
  The weekend was well. I basically spent my entire
• 1:58
  Saturday staring at a packet capture from a 20 year old
• 2:02
  compressor station. Wait A.
• 2:04
  Compressor station in the middle of nowhere.
• 2:06
  Yes, out in the absolute middle of nowhere, a device that is
• 2:09
  supposed to be, you know, completely isolated, right?
• 2:12
  And yet somehow it started trying to establish a connection
• 2:16
  to an external command and control server.
• 2:18
  You are kidding me. Nope, a server belonging to a
• 2:22
  known advanced persistent threat group.
• 2:24
  So you know, living the dream. I am running on fumes, stale
• 2:29
  Donuts, and sheer paranoia at this point.
• 2:32
  Good morning. Welcome to cybersecurity.
• 2:34
  Under pressure, real attacks, real lessons.
• 2:36
  Today is Monday, June 22nd, 2026.
• 2:40
  Shout out to our friends in the United States.
• 2:41
  You can't make this up. Well, you could, but nobody
• 2:43
  would believe you. I mean seriously, we are dealing
• 2:46
  with a reality where the physical world around us, the
• 2:51
  water we drink, the power grids keeping our lights on, the
• 2:54
  manufacturing plants producing, well, everything we consume.
• 2:57
  The literal pipelines moving fuel.
• 3:00
  Yes, all of it is actively under siege.
• 3:03
  And OK, let's unpack this, because what's wild to me as we
• 3:07
  dig into these sources today is that the traditional IT security
• 3:10
  methods we've relied on for decades are completely failing
• 3:14
  these industrial systems. Oh, entirely.
• 3:17
  They're basically useless. They aren't just inadequate.
• 3:20
  In some cases, as we'll see, they're actively breaking the
• 3:23
  systems they're supposed to protect.
• 3:24
  Which is the ultimate irony, really.
• 3:26
  So that is our mission for you today.
• 3:28
  We are taking a deep dive into a massive stack of security
• 3:31
  advisories, vendor white papers, Dragos and Malone, Secomia, and
• 3:36
  all these various regulatory frameworks.
• 3:38
  It's a lot of reading. It is a massive stack, but we
• 3:41
  are going to figure out why industrial networks are breaking
• 3:43
  down, how attackers are bypassing supposedly
• 3:46
  impenetrable defenses, and how we can actually fix this
• 3:49
  architecture before something goes boom.
• 3:51
  And we really need to emphasize that boom is not a metaphor
• 3:54
  here. We are talking about literal
• 3:56
  explosions, environmental disasters and direct loss of
• 3:59
  human life. Yeah, the stakes are
• 4:01
  fundamentally different than, say, a data breach.
• 4:03
  Exactly. It's not just a credit card
• 4:05
  getting stolen. Let's start by unpacking the
• 4:07
  original illusion of safety in industrial Control systems, or
• 4:11
  ICS. The Big Lie.
• 4:13
  Right, because for a long time the industry relied on this
• 4:16
  concept of absolute isolation. Right, the infamous air gap.
• 4:20
  The air gap. The idea that if a network isn't
• 4:23
  physically connected to the Internet, it just it can't be
• 4:26
  hacked. It is the biggest myth in modern
• 4:29
  cybersecurity, but you know, for decades it was absolute gospel.
• 4:33
  Because it made intuitive sense, right?
• 4:35
  Exactly. Historically, the entire concept
• 4:37
  of operational technology, or OT, was built on this foundation
• 4:41
  of implied trust. Decades ago, the engineers who
• 4:44
  built these systems, these massive turbines, chemical
• 4:47
  mixers, water pumps, designed them to be totally isolated from
• 4:51
  the outside world. No Internet.
• 4:53
  No Internet, no corporate network connection at all, just
• 4:56
  a closed physical loop. So their core assumption was
• 4:59
  that no malicious actor could ever enter bad commands.
• 5:02
  Because to do that, you'd have to physically break into the
• 5:05
  plant. Right.
• 5:06
  You'd have to walk past the armed guards, find the actual
• 5:09
  programmable logic controller on the factory floor and plug like
• 5:13
  a serial cable directly into the machine.
• 5:15
  Which obviously nobody was factoring into their network
• 5:18
  design. I mean, you don't build software
• 5:20
  firewalls to protect against physical commando raids, you
• 5:23
  build fences. Exactly.
• 5:25
  Fences and locked doors. They were designing for
• 5:27
  reliability, for physics, for continuous uptime.
• 5:30
  They were absolutely not designing to defend against
• 5:33
  state sponsored actors probing their networks from 10,000 miles
• 5:36
  away. Makes sense for the time.
• 5:38
  Yeah, but because of this design philosophy, ICS devices
• 5:41
  historically did not have any of the protections we take for
• 5:45
  granted in IT. There are no complex passwords,
• 5:48
  none at all. None.
• 5:49
  There is no tracking of who is logging in.
• 5:51
  The communications are completely unencrypted.
• 5:54
  OK, I want to try and synthesize what Drago's refers to in their
• 5:57
  white paper as the M&M model because I think it perfectly
• 6:01
  captures the terrifying reality of this legacy architecture.
• 6:06
  It's such a good analogy. If I'm understanding this right,
• 6:08
  the idea is that you build this incredibly hard, crunchy outer
• 6:12
  shell. That's your perimeter security.
• 6:14
  Right, your firewalls, your physical access.
• 6:16
  Exactly. Your badge readers all of that.
• 6:18
  Yeah, but once an attacker somehow bites through that shell
• 6:22
  or finds a tiny crack in it, the entire center of the network is
• 6:26
  just soft, gooey, defenseless chocolate.
• 6:29
  That is terrifyingly accurate. So once you are past the
• 6:33
  perimeter, there are 0 internal defenses like no segmentation,
• 6:37
  no multifactor authentication inside the plant floor itself. 0
• 6:42
  Nothing. Once you are inside the OT
• 6:44
  network, the systems implicitly trust you.
• 6:47
  A programmable logic controller. APLC doesn't ask for a
• 6:51
  cryptographic token before it opens a high pressure gas valve,
• 6:54
  it just does it. It just doesn't.
• 6:55
  Many of these devices communicate using protocols like
• 6:57
  Modbus, which, by the way, it was invented in 1979.
• 7:01
  Wow, 1979. Yeah, Modbus literally does not
• 7:04
  have a field in its packet structure for a password.
• 7:06
  It just receives the command like function code 5 write
• 7:10
  single coil, turn the valve on and it says OK opening the
• 7:13
  valve. Because it assumes you belong.
• 7:15
  There exactly. It assumes you are an authorized
• 7:17
  operator because you made it past the hard shell.
• 7:20
  OK, so if they were theoretically air gapped and the
• 7:23
  hard shell was supposedly so secure, what actually changed?
• 7:27
  Money, right? Why are we suddenly panicking
• 7:30
  about the GUI center? If the systems aren't connected
• 7:33
  to the Internet, how are these state sponsored actors actually
• 7:36
  getting in? Well, what changed is that
• 7:38
  modern business realized data is money and convenience is money.
• 7:43
  You cannot run a hyper optimized, highly competitive
• 7:47
  21st century factory if your equipment is totally isolated in
• 7:50
  a silo. You need the data.
• 7:52
  The business demands remote monitoring.
• 7:55
  They demand predictive maintenance.
• 7:57
  Like having AI don't know a vibration sensor tell you a
• 8:00
  turbine bearing is going to fail three weeks before it actually
• 8:02
  snaps and destroys the machine. Precisely that is hugely
• 8:05
  valuable, but that requires data to leave the plant floor and go
• 8:09
  up to some cloud analytics engine.
• 8:11
  So you have the explosion of the Industrial Internet of Things,
• 8:14
  or IIOT. Which introduces connectivity.
• 8:16
  Right. And crucially, you have the
• 8:18
  vendors. Let's say you buy a $50 million
• 8:22
  robotics assembly line from a manufacturer halfway across the
• 8:25
  world. They will write into their
• 8:27
  service contract that they demand 24/7 remote access to
• 8:31
  troubleshoot it. So they don't have to fly an
• 8:33
  engineer out every time a robotic arm throws an error
• 8:35
  code. Exactly.
• 8:36
  It's an efficiency play. So ITOT convergence, we took the
• 8:40
  insulated OT environment and basically just smashed it
• 8:44
  together with the corporate IT network.
• 8:47
  Yes, that convergence completely destroyed the air gap.
• 8:50
  We punctured our own hard shell on purpose.
• 8:53
  We did it to ourselves. We.
• 8:54
  Drilled hundreds of tiny holes into it to get the telemetry
• 8:57
  data out and to let the remote workers and vendors in.
• 9:00
  And the data backs this up in a truly horrifying way.
• 9:03
  I was looking at the 2026 research from Palo Alto Networks
• 9:06
  we brought in. Oh, the exposure stats.
• 9:08
  Yeah, they analyzed 16,000,000 samples of network traffic and
• 9:11
  found a 332% increase and Internet exposed OT devices over
• 9:16
  the last few years. It's just absurd.
• 9:18
  Over 300%. Because everyone is just
• 9:20
  plugging things in without thinking about the architecture.
• 9:23
  An engineer buys a new smart sensor, realizes it has a Wi-Fi
• 9:27
  card and says great, let's connect it to the corporate
• 9:30
  network so the CFO can see the real time production dashboard
• 9:33
  on his iPad. And boom, the gap is bridged.
• 9:36
  They don't even realize they just bridged the gap.
• 9:38
  And that leads directly to the ultimate consequence.
• 9:41
  This is from TXO Networks, their latest finding and this stat
• 9:44
  blew my mind. I know exactly which one you're
• 9:47
  going to say. 96% of OT security incidents in 2025 originated
• 9:53
  from IT level compromises 96%. What's fascinating here is the
• 9:58
  attack path, the actual mechanics of the breach, because
• 10:00
  the attackers aren't usually executing some highly
• 10:03
  sophisticated 0 day exploit to hack a water pump directly from
• 10:07
  the public Internet. They don't need to.
• 10:09
  They don't need to. They are sending a basic boring
• 10:11
  phishing e-mail to someone in HR or accounting.
• 10:14
  Right? The HR Rep clicks the malicious
• 10:17
  link, the attacker drops a payload and compromises the
• 10:20
  corporate IT network. Standard IT ransomware playbook
• 10:23
  so far. Right, but because of this ITOT
• 10:26
  convergence, because the air gap is dead and the networks are
• 10:29
  linked, the attackers just scan the internal network and find a
• 10:34
  bridged connection. And just walk right through.
• 10:36
  They pivot from the IT environment, slide right through
• 10:39
  that punctured hard shell we talked about, and land directly
• 10:42
  in the GUI center of the OT network.
• 10:45
  And because of that implied trust, it is completely
• 10:49
  effortless. Wow, they harvest a credential
• 10:52
  from an IT admin and suddenly they have the power to shut down
• 10:55
  a pipeline. I want you listening to this to
• 10:58
  really imagine this scenario. Think about your home network
• 11:01
  for a second. You get your laptop, your smart
• 11:03
  TV, maybe a smart thermostat. Yeah, standard stuff.
• 11:06
  Now imagine that instead of a thermostat, you have a 25 year
• 11:09
  old industrial water treatment controller sitting on that exact
• 11:12
  same home Wi-Fi network. A terrifying thought.
• 11:15
  This controller has no antivirus.
• 11:17
  It cannot be patched. It has a default password like
• 11:20
  admin 123 that is literally printed in a public user manual
• 11:24
  from 2001 that anyone can download as APDF.
• 11:27
  Oh, I've seen exactly that manual.
• 11:29
  And it's connected to the web because your IT guy wanted the
• 11:32
  convenience of checking its status from his couch.
• 11:35
  And if a teenager sitting in a basement halfway around the
• 11:38
  world manages to guess your Wi-Fi password or fishes your
• 11:41
  laptop, they can pivot to that controller and turn off the
• 11:45
  chlorine pumps for an entire municipality.
• 11:48
  Just from a guest Wi-Fi password.
• 11:51
  That is the stark reality we are living.
• 11:53
  In OK, so if the hard shell is cracking, or rather if we've
• 11:57
  intentionally drilled 100 holes into it for convenience, how
• 12:01
  exactly are these networks supposed to be structured in the
• 12:03
  first place? Right, because doing it that way
• 12:05
  is insane. Because clearly putting the
• 12:08
  critical water pump on the exact same flat network as the HR
• 12:11
  e-mail server is a recipe for disaster.
• 12:14
  It's beyond a disaster, man. It's professional malpractice.
• 12:18
  Which brings us to the Holy Grail of industrial network
• 12:20
  architecture, the Purdue model. OK, stop right there.
• 12:23
  I have to push. Back on this, I knew you would.
• 12:26
  Because whenever I talk to modern cloud native security
• 12:29
  architects in Silicon Valley, they roll their eyes so hard at
• 12:32
  the Purdue model. Let them roll their eyes.
• 12:34
  They think it's a total dinosaur.
• 12:35
  It was literally invented in the early 1990s.
• 12:38
  We live in an era of cloud computing, edge AI, distributed
• 12:42
  ledgers, and 0 tress fire architectures.
• 12:45
  Sure, sure. Why are we still fiercely
• 12:48
  defending a rigid, blocky layered diagram from 1991 that
• 12:52
  relies on legacy perimeter firewalls?
• 12:55
  It feels like trying to secure a Tesla using the blueprints for a
• 12:59
  horse drawn carriage. OK, I will defend the Purdue
• 13:02
  model until my dying breath, and I will tell you exactly why
• 13:05
  those Silicon Valley architects are wrong when it comes to.
• 13:08
  OK, let's hear it. Yes, Theodore Jay Williams and
• 13:11
  the industry Purdue University Consortium developed it in the
• 13:15
  90s. And initially, you're right, it
• 13:16
  wasn't even about cybersecurity. It was about defining data flow
• 13:20
  and manufacturing. But the reason we still
• 13:22
  absolutely rely on the Purdue Enterprise Reference
• 13:25
  Architecture PERA, is because it aligns perfectly with the
• 13:28
  immutable physics of a plant floor.
• 13:31
  It gives us a hierarchy of trust that cloud architecture is
• 13:33
  completely ignore. OK.
• 13:35
  If I'm looking at this architectural diagram, breakdown
• 13:37
  these levels for us. Walk us through how this
• 13:40
  hierarchy of trust actually maps to a physical factory.
• 13:44
  It works from the raw physical world all the way up to the
• 13:46
  Internet, so level 0 is the physical process itself.
• 13:50
  The actual hardware. The literal mechanical world.
• 13:53
  The steel valves, the robotic arms, the electric motors, the
• 13:56
  temperature sensors bolted onto a high pressure pipeline.
• 14:00
  They don't run operating systems, they are pure physics.
• 14:03
  Then level 1 is basic control. These are the devices that
• 14:05
  interact with level 0 your PLC's and remote terminal units, the
• 14:09
  RTU. 'S what do they actually do?
• 14:11
  These devices run real time operating systems.
• 14:14
  Their only job is to read the sensor data from level 0,
• 14:17
  process a basic logic loop, and tell the level 0 valve to open
• 14:21
  or close in milliseconds. OK, so that's level 1.
• 14:23
  Right then, level 2 is supervisory control.
• 14:26
  This is where your human operators sit.
• 14:28
  It's the HMI's, human machine interfaces and the scatter
• 14:31
  systems. So the screens.
• 14:32
  Picture a control room with the banks of screens showing the
• 14:35
  graphical layout of the plant. The operators use level 2 to
• 14:39
  send the set points down to level 1.
• 14:41
  So level 01 and two are the real operational guts of the
• 14:45
  facility, the things that make the product or move the power.
• 14:47
  Exactly. We call that the cellar area
• 14:49
  zone. Then you move up the hierarchy.
• 14:51
  Level 3 is site operations. This is plant wide management.
• 14:55
  What lives there? It houses the data historians,
• 14:57
  which are massive databases that record all the telemetry coming
• 15:01
  up from the plant floor and the batch control servers.
• 15:04
  And then finally you hit level 4 and level 5.
• 15:07
  This is the enterprise network and the external IT network,
• 15:10
  corporate e-mail, the ERP systems handling billing, Active
• 15:14
  Directory, and the connection out to the public Internet.
• 15:17
  And the golden rule of the Purdue model is all about the
• 15:20
  pathways between these levels, right?
• 15:22
  The enforcement of data flow. The absolute non negotiable rule
• 15:26
  of Purdue is this. IT systems never query OT
• 15:29
  directly. Never.
• 15:31
  A corporate workstation at level 4 should never, ever be allowed
• 15:34
  to send a direct network packet to APLC sitting at level one,
• 15:39
  data must push upward. It's a waterfall.
• 15:42
  Level 1 talks to level 2, level 2 pushes telemetry up to Level
• 15:45
  3, and level 4 consumes the data from Level 3.
• 15:49
  But wait, if that's the strict model, how do we account for the
• 15:52
  ITOT convergence we just established is completely
• 15:54
  necessary now because we know the data isn't just pushing
• 15:57
  upward in a clean waterfall anymore?
• 15:59
  Right, the real world gets messy.
• 16:01
  The corporate executives want real time cloud analytics.
• 16:04
  The vendors demand remote access to level 1 to fix the robots.
• 16:07
  Right. And that is where the model had
• 16:09
  to evolve into what we call Purdue 2 point O.
• 16:12
  The biggest addition to the 90s architecture is level 3.5, the
• 16:15
  Industrial DMC or IDMC A. Demilitarized Zone.
• 16:18
  Exactly. This is the buffer the
• 16:20
  Department of Energy and CISA now absolutely mandated for
• 16:23
  critical infrastructure. How does it work?
• 16:25
  You put a layer of strict firewalls at the top of the DMZ,
• 16:28
  separating it from the level 4 IT network, and you put another
• 16:31
  layer of firewalls at the bottom, separating it from the
• 16:33
  Level 3 OT environment. So it's a sandbox in the middle.
• 16:35
  Exactly. If an IT application patient
• 16:37
  wants plant data, it doesn't query the plant floor.
• 16:41
  It queries A proxy server or a replica historians sitting
• 16:45
  inside the DMZ. The IT packet never crosses the
• 16:48
  boundary into the operational environment.
• 16:51
  I see the logic, but here is where the theory completely
• 16:55
  falls apart in the real world. Let's look at the data from
• 16:58
  Sentinelone and CSA. The implementation failure.
• 17:01
  Yes, they highlight the single most common implementation
• 17:05
  failure in this whole architecture.
• 17:07
  Organizations think they are doing Purdue.
• 17:09
  They tell their auditors they're segmented.
• 17:11
  But what they actually do is deploy VLAN's virtual local area
• 17:15
  networks to separate IT and scatter traffic on the same
• 17:18
  physical switches. They assign them different
• 17:20
  subnets and call it a day. Oh this drives me absolutely
• 17:23
  insane. It is the bane of my existence.
• 17:25
  Right, because the VLAN is a layer 2 construct.
• 17:28
  VLAN tags organize traffic. They do not restrict it if you
• 17:31
  don't put actual enforced layer 3 or layer 4 firewall rules
• 17:36
  between those VLAN subnets. A compromised IT laptop can just
• 17:40
  route its traffic straight over to the scat of VLAN.
• 17:43
  It's like putting up a velvet rope at a nightclub and assuming
• 17:46
  it will stop a runaway tank. And that velvet rope mentality,
• 17:49
  that illusion of segmentation leads to what I think is the
• 17:52
  most terrifying phrase in our industry right now, the shadow
• 17:55
  corridor. OK, let's unpack this.
• 17:57
  So if it sets up a basic VPN for a vendor, they aren't just
• 18:00
  opening a door, they're basically digging a tunnel
• 18:03
  straight past the firewalls directly into the PLC.
• 18:06
  Straight to the heart of it. It's like a shadow quarter that
• 18:08
  security can't even see. Is that how these breaches are
• 18:11
  actually happening? Let me share a chilling anecdote
• 18:13
  that perfectly illustrates this. I got a text snippet recently
• 18:17
  from an incident response buddy. He was doing a compromise
• 18:20
  assessment at a mid sized manufacturing plant.
• 18:22
  He's digging through the logs and he finds out that last month
• 18:26
  a maintenance tech for a third party vendor needed to fix a
• 18:30
  sensor calibration issue. The tech didn't want to drive 3
• 18:34
  hours to the plant in the middle of the night.
• 18:35
  So the IT department trying to be helpful set him up with a
• 18:38
  standard corporate VPN. Naturally, because IT is
• 18:41
  measured on resolving tickets quickly.
• 18:43
  Exactly, they want to close the ticket but the VPN didn't drop
• 18:47
  him into a jump host in the level 3.5 DMZ like it's supposed
• 18:51
  to because they used a flat VLAN architecture without proper
• 18:55
  firewall rules. The VPN connected his remote
• 18:58
  laptop directly to the Level 1 PLC on the plant floor.
• 19:02
  Oh, no. Bypassing the DMZ, bypassing the
• 19:05
  supervisory control, bypassing. Completely bypassing the entire
• 19:09
  Purdue segmentation, that IT admin essentially drilled a
• 19:13
  digital wormhole from the public hostile Internet straight into
• 19:16
  the gooey center of the OT network.
• 19:18
  And he didn't even know he had just opened the only door an
• 19:21
  attacker needed. So that direct VPN creates the
• 19:23
  shadow corridor. Exactly.
• 19:26
  Rogue devices and lateral movement by attackers can hide
• 19:29
  inside those perfectly normal looking VPN traffic patterns.
• 19:32
  Your intrusion detection system won't flag it because the
• 19:35
  traffic is encrypted and looks like authorized vendor access.
• 19:38
  It looks legitimate. Your firewall won't see it as
• 19:40
  malicious because the rule explicitly allows it.
• 19:43
  It is a dark, unmonitored tunnel straight to your most critical
• 19:47
  life safety assets. In the wire transfer they would
• 19:50
  kill me for saying this, but relying on legacy VPNs for
• 19:54
  industrial sites is basically handing the keys to the Kingdom
• 19:58
  to anyone with a fish password. It is stunningly reckless.
• 20:02
  I completely agree with you. It's archaic and it's not just a
• 20:05
  technical faux pas anymore. The legal escape is shifting
• 20:08
  aggressively. Look at the regulatory panic
• 20:10
  happening globally right now. Yeah, the rules are changing.
• 20:12
  Under the European Union's NIS 2 directive and specific national
• 20:16
  laws like Portugal's Decree Law 1252025, critical infrastructure
• 20:20
  operators are facing intense, unprecedented scrutiny.
• 20:24
  Yeah, if I recall from the notes we reviewed that Portuguese law
• 20:27
  demands incident reporting within 24 hours of a confirmed
• 20:30
  breach. 24 hours. Think about the logistics of
• 20:33
  that. If you have a breach, you have
• 20:35
  to discover it. Analyze the scope, contain it,
• 20:38
  and file a formal report to the government in one day.
• 20:42
  Which is impossible if you don't even know what's happening.
• 20:45
  Right. If your network is full of
• 20:46
  shadow corridors because you handed out direct VPN access to
• 20:50
  every HVAC repairman, elevator technician, and robotics vendor,
• 20:55
  you have a 0 visibility. You won't even know you've been
• 20:57
  breached for six months. And the regulators won't care
• 21:00
  about your excuses. Having the shadow corridors
• 21:02
  isn't just technical debt anymore, it is board level
• 21:05
  negligence. If you get breached through one
• 21:07
  of those unmonitored tunnels, the regulators will absolutely
• 21:11
  eviscerate your company. So if these shadow corridors
• 21:14
  bypass the firewalls, the attackers are bypassing the
• 21:17
  physical controls and landing right in the lap of the human
• 21:19
  operators. Yeah, what happens when the
• 21:21
  attacker takes over the operator's actual monitor?
• 21:25
  Which brings us to the most terrifying part of this whole
• 21:27
  equation, when the screens lie. Yeah, this is where things
• 21:31
  transition from a data problem to a physical safety problem,
• 21:36
  because when an attacker is inside and they have access to
• 21:39
  the HMI, the literal laws of physics are suddenly at their
• 21:42
  mercy. Let's clearly define the crown
• 21:45
  jewels here, the HMI, the human machine interface.
• 21:48
  For you listening, I want you to imagine the dashboard of your
• 21:51
  car. That's a good way to put it.
• 21:53
  It tells you how fast you're going, how much gas you have, if
• 21:55
  your engine is overheating. The HMI is the exact same thing,
• 21:59
  but it's the dashboard for a nuclear power plant or a
• 22:02
  chemical refinery. It is the only window the human
• 22:05
  operator has into the physical process.
• 22:07
  You are sitting in a centralized control room.
• 22:09
  You cannot see the actual chemical mixing tank.
• 22:12
  It's a quarter mile away behind 2 feet of reinforced concrete.
• 22:16
  You just have to trust the screen.
• 22:17
  You rely 100% on that HMI screen to tell you the pressure, the
• 22:22
  temperature, the flow weight. Here's where it gets really
• 22:24
  interesting and completely unsettling.
• 22:27
  According to research from SIGA and other ICS security firms we
• 22:30
  reviewed, the greatest threat to industrial resilience isn't just
• 22:34
  a system crashing and going offline because a crash is bad,
• 22:38
  but it triggers fail safes. The true threat is uncertainty.
• 22:43
  Yes, the nightmare scenario is HMI hijacking.
• 22:46
  Because if the system just goes black, you hit the emergency
• 22:49
  stop button. But what happens when the chief
• 22:52
  information security officer, the CISO and the plant operators
• 22:56
  look at their screens and realize they can no longer trust
• 22:59
  the data? In IT, if you get hacked with
• 23:01
  ransomware, your screen locks up and a red skull pops up
• 23:05
  demanding Bitcoin. It's loud.
• 23:07
  You know you're hacked. It announces itself.
• 23:09
  In OTA, sophisticated attacker doesn't lock your screen.
• 23:13
  They hijacked the communication protocol between the PLC and the
• 23:16
  HMI. They execute a man in the middle
• 23:18
  attack, so the HMI feeds you a looped pre recorded visual of
• 23:21
  normal operations. The screen says the tank
• 23:24
  pressure is 50 PSI, completely fine.
• 23:26
  It says the cooling valves are open and functioning, but in
• 23:29
  reality the physical process in the background is being
• 23:31
  maliciously manipulated. Because they've intercepted the
• 23:34
  real data. The attacker has closed the
• 23:36
  cooling valves, the pressure is building to 500 PSI, the
• 23:39
  temperature is spiking, and the operator sitting in the control
• 23:42
  room has absolutely no idea until the physical safety valves
• 23:46
  blow or the roof of the building explodes.
• 23:48
  It's literally the digital equivalent of Ocean's 11 looping
• 23:53
  the security camera footage so the guards see an empty hallway
• 23:56
  while they rob the vault. That is exactly what it is.
• 23:59
  Let's look at the history of this chaos, because we need to
• 24:02
  understand that these aren't hypothetical theoretical
• 24:05
  academic exercises. These are real attacks.
• 24:08
  Let's go all the way back to the year 2000, the Marushi Shire
• 24:12
  incident in Australia. Oh, the sewage spill.
• 24:15
  The classic insider threat. Literally a massive sewage
• 24:18
  spill, A disgruntled former contractor who would actually
• 24:21
  help build the system used a two way radio and stolen control
• 24:25
  software to hijack the pumping stations.
• 24:27
  From his car, right? Yeah, from his car.
• 24:30
  Because the system lacked robust authentication, the HMI controls
• 24:34
  were completely subverted. He sent false data to the
• 24:37
  central computers and commanded the pumps to ignore alarms.
• 24:41
  He caused millions of ladders of raw, untreated sewage to spill
• 24:45
  into local parks, rivers and hotel grounds over several
• 24:48
  months. Just incredibly destructive.
• 24:50
  All because of inadequate access control and blind trust in the
• 24:53
  telemetry. And as bad as that was, it was
• 24:55
  rudimentary. Fast forward a decade to 2010.
• 24:59
  Stuxnet. The absolute granddaddy of them
• 25:02
  all, the Rubicon moment for industrial security.
• 25:04
  Stuxnet was a class in HMI manipulation and process
• 25:08
  destruction. It targeted the Iranian nuclear
• 25:11
  enrichment facility at Natan. Which was totally air gapped
• 25:14
  supposedly. Supposedly it specifically
• 25:17
  infected the Siemens PLC's controlling the centrifuge
• 25:19
  arrays. Now a centrifuge spins at
• 25:22
  supersonic speeds to separate uranium isotopes.
• 25:25
  It is an incredibly delicate piece of physics.
• 25:27
  Stuxnet would subtly alter the drive frequencies, spinning the
• 25:31
  centrifuges fast enough to destabilize and tear themselves
• 25:34
  apart, but then slowing them down to normal speeds so it
• 25:38
  looked like standard random mechanical failure.
• 25:41
  But the genius, the truly evil genius of the payload, was the
• 25:45
  intercept mechanism. Explain how it blinded the
• 25:48
  operators, because this is wild. The malware essentially executes
• 25:53
  a replay attack. It recorded 21 seconds of normal
• 25:56
  operational data from the plant floor.
• 25:58
  Wow. When it began to execute its
• 26:00
  destructive frequency changes, it intercepted the real
• 26:03
  telemetry data coming up from the sensors and replaced it with
• 26:07
  that pre recorded loop. So the operators just saw the
• 26:09
  loop. The operator screens in the
• 26:11
  control room showed that every single centrifuge was operating
• 26:14
  a perfect optimal parameters. They had no idea the facility
• 26:17
  was physically destroying itself until they walked onto the floor
• 26:20
  and saw the broken machinery. And the operators just sat
• 26:23
  there, trusting the lying screens.
• 26:25
  Then we see this evolve. We have the Ukraine power grid
• 26:27
  hack in 2015. That one was incredibly brazen.
• 26:31
  State sponsored attackers gained remote access through phished IT
• 26:34
  credentials, pivoted through a shadow corridor VPN into the OT
• 26:38
  network and seized direct control of the Scatta HMIS.
• 26:42
  That they just took over the mouse.
• 26:44
  Literally, the operators sitting in the utility control rooms had
• 26:47
  to take their hands off their keyboards and watch helplessly
• 26:50
  as the mouse cursor moved across their screens on its own,
• 26:53
  clicking Breakers and intentionally plunging 225,000
• 26:57
  people into the freezing darkness of winter.
• 26:59
  That is nightmare fuel. And to add to the chaos, the
• 27:02
  attackers ran a destructive wiper malware called Kill Disk
• 27:06
  to permanently destroy the workstations and launched A
• 27:09
  coordinated denial of service attack against the utilities
• 27:11
  call centers so panicked customers couldn't even report
• 27:14
  the outages. So they blinded the operators,
• 27:17
  destroyed the equipment, and deafened the response teams.
• 27:20
  But if we're talking about the ultimate escalation in this
• 27:22
  timeline, it has to be 2017 Triton, also known as Tricus.
• 27:27
  Triton changed everything. It sent a shockwave through the
• 27:30
  entire their OT security community because Trident didn't
• 27:34
  just target the process control PLCS, it specifically targeted
• 27:37
  the safety instrumented systems. The SIS right?
• 27:40
  The safety net. Specifically, the Schneider
• 27:42
  Electric Triconics controllers. For the listener who isn't an
• 27:45
  engineer, explain why targeting thesis is a massive, terrifying
• 27:50
  escalation. Yeah, what exactly is a safety
• 27:52
  controller? Thesis is the absolute last line
• 27:56
  of defense in a physical plan. If the primary control system,
• 27:59
  the normal PLCS, goes crazy or gets hacked, or a valve simply
• 28:03
  breaks and the system tries to over pressurize a highly
• 28:06
  volatile pipeline. Thesis is a completely separate,
• 28:09
  redundant, hardwired safety system.
• 28:11
  It's watching the physics independently.
• 28:13
  It watches the physics if the pressure exceeds the absolute
• 28:16
  safety limit, thesis physically trips the Breakers, cuts the
• 28:19
  power and shuts everything down to prevent a catastrophic
• 28:22
  explosion. It is the fail safe.
• 28:24
  Triton was a highly sophisticated malware framework
• 28:26
  deployed at a petrochemical facility in Saudi Arabia, and
• 28:29
  its entire purpose was to reprogram and disable those
• 28:32
  safety systems. So the attackers were trying to
• 28:34
  blind the safety net, presumably so they could then launch a
• 28:37
  secondary attack to cause a catastrophic physical event, and
• 28:41
  the fail safes wouldn't kick in. They wanted an explosion.
• 28:44
  Exactly, to reprogram a Triconix controller, there is a physical
• 28:48
  key switch on the hardware that must be turned to program mode.
• 28:51
  Like a literal physical. Key.
• 28:53
  A literal key. The attackers either waited for
• 28:56
  human error, an engineer leaving the key in the wrong position,
• 28:59
  or they found a way to manipulate the memory remotely.
• 29:02
  The only reason it was caught was because a minor bug in the
• 29:05
  attacker's card triggered an accidental fault that shut down
• 29:08
  the plant. So it's just dumb luck.
• 29:10
  Your luck? A process control engineer
• 29:12
  noticed unusual behavior on the safety system before security
• 29:16
  analysts did, but the intent was crystal clear.
• 29:19
  Disable the safety, manipulate the chemical process and cause
• 29:23
  massive loss of human life. And we almost saw a mass
• 29:26
  casualty event in the United States in 2021, the Oldsmar
• 29:29
  Water plant in Florida. Oh yeah, through a remote access
• 29:32
  software Teamviewer if I recall correctly.
• 29:34
  Another classic shadow corridor. Right, an attacker gained access
• 29:39
  to an Internet exposed computer that was connected to the
• 29:41
  plant's control system. They hijacked the HMI and an
• 29:45
  operator physically watched their mouse move across the
• 29:47
  screen to open the chemical dosing valves, changing the
• 29:50
  sodium hydroxide, which is lie used in tiny amounts to control
• 29:54
  water acidity, from a safe 100 parts per million to a highly
• 29:58
  toxic 11,100 parts per million. They actively tried to poison
• 30:03
  the drinking water supply of an entire city.
• 30:05
  Just unconscionable. Thankfully, the operator was
• 30:07
  paying attention, saw the mouse moving, and immediately reversed
• 30:11
  the command before the poisoned water left the plant.
• 30:14
  But it highlights the extreme fragility of trusting these
• 30:17
  interfaces. So synthesizing all of this,
• 30:20
  what does this mean for the fundamental economics of OT
• 30:22
  security? I mean, in the IT world, the
• 30:25
  cost of a data breach is usually calculated by regulatory fines,
• 30:28
  providing identity theft protection for your customers,
• 30:31
  paying for incident response consultants, maybe some lost
• 30:34
  revenue from your e-commerce website being down for a day.
• 30:37
  It's. Just numbers on a spreadsheet.
• 30:38
  Right, but what is the actual tangible cost of an OT breach?
• 30:42
  It is an entirely different different financial and moral
• 30:45
  universe. I was reading a piece in the
• 30:48
  Industrial Cyber source material quoting Jacob Marzloff and a
• 30:51
  security expert named Ostrink. They articulated it perfectly in
• 30:56
  OTA. Breach doesn't just expose
• 30:58
  credit card records. It halts production, triggers
• 31:00
  safety system failures, damages physical equipment, or endangers
• 31:04
  lives. Marzloff emphasized that
• 31:06
  securing OT is a fundamental business risk decision, not just
• 31:10
  an IT compliance exercise. Right Ostring pointed out that
• 31:14
  there there is no universal price tag for an OT breach
• 31:17
  because context is everything. If you hack a retail bank, you
• 31:20
  steal money. It's a spreadsheet problem.
• 31:22
  You can insure against that. If you hack an oil and gas
• 31:25
  refinery, as Ustring says, the cost could be measured in
• 31:27
  explosions, environmental leaks, and direct harm to human life.
• 31:31
  If you hack a pharmaceutical manufacturing plant, it's about
• 31:33
  ruined batches of life saving drugs, severe FDA regulatory
• 31:37
  penalties, and total loss of operational compliance.
• 31:40
  The scale is just massive. You might have to scrap $50
• 31:43
  million of vaccines because you can no longer legally prove the
• 31:46
  temperature controls weren't tampered with.
• 31:49
  The cost is never a simple IT repair bill.
• 31:52
  It is existential business ruin. OK, let's unpack this deeply,
• 31:55
  because this is where the friction really happens.
• 31:58
  If the stakes are literally explosions, poison water
• 32:01
  supplies and ruin drug batches. If the risk is that
• 32:05
  exceptionally high, why don't we just run standard proven IT
• 32:09
  security tools on all these industrial machines to fix them?
• 32:12
  Oh boy. Like, why not just install a
• 32:15
  modern endpoint detection agent like Crowd Strike or set him
• 32:18
  alone on the PLCS? Why not run automated
• 32:20
  vulnerability scanners every night?
• 32:22
  Man, if only it were that easy. This is the great ITOT clash.
• 32:25
  If you bring an enthusiastic IT security engineer onto a plant
• 32:29
  floor and let him run his standard automated toolkit, he
• 32:33
  will accidentally shut down the plant faster than any external
• 32:35
  threat actor ever could. Wait, really?
• 32:37
  We need to explain this mechanism clearly?
• 32:39
  Why do it tools break OT environments?
• 32:42
  What is the actual physics behind this clash?
• 32:45
  Let's talk about the extreme danger of active scanning in the
• 32:49
  IT world. To find out what devices are on
• 32:52
  your network and what vulnerabilities they have, you
• 32:54
  run an active scanner like nmap or Nessus, right?
• 32:57
  The scanner sends out millions of probing packets, TCP
• 33:00
  handshakes, ICMP echo requests to every IP address it can find.
• 33:05
  It's basically knocking violently on every door and
• 33:07
  asking who are you? What operating system are you
• 33:10
  running? What ports do you have open?
• 33:12
  Standard network discovery. It happens 1000 times a day in a
• 33:15
  corporate office. Exactly.
• 33:16
  In ITA, modern Windows Server or a Mac book has gigabytes of RAM
• 33:20
  and multicore processors. Yeah, it can easily handle a few
• 33:24
  thousand ping requests a second. It processes the interrupt,
• 33:27
  drops the unwanted packets and moves on without breaking a
• 33:29
  sweat. It doesn't even notice.
• 33:31
  In OT, I want you to remember that some of these legacy PLCS
• 33:35
  and RT us have less processing power than the microchip inside
• 33:39
  your microwave oven. That's wild to think about.
• 33:41
  They were built in 1995. Their network interface cards
• 33:45
  were designed to handle maybe 10 packets a second.
• 33:47
  They were built to do exactly one thing, read a sensor and
• 33:51
  open a valve in a strict real time deterministic loop.
• 33:54
  So what happens when the IT scanner knocks on their door
• 33:58
  with 10,000 packets a second? The PLC's fragile network stack
• 34:02
  gets completely overwhelmed. The CPU spikes to 100% trying to
• 34:06
  process all these weird IT packets it doesn't understand.
• 34:09
  It creates A buffer overflow. Oh wow.
• 34:12
  The shield work source material we reviewed is incredibly
• 34:14
  explicit about this. Never run active scanning tools
• 34:17
  on live OT networks. It is a literal safety hazard.
• 34:21
  I have personally seen active IT standards corrupt the memory on
• 34:24
  legacy RT US, forcing them to require a hard manual reset.
• 34:28
  I've seen them trigger spurious trips in compressor stations.
• 34:31
  What's a spurious trip? It means the machine panics
• 34:34
  because it's CPU is pegged at 100% dealing with the IT
• 34:36
  scanner. It misses its real time
• 34:39
  processing window to check the safety sensors.
• 34:41
  It defaults to safe mode. Exactly.
• 34:44
  The internal logic says I haven't heard from the pressure
• 34:47
  sensor in 50 milliseconds. Something is catastrophically
• 34:50
  wrong. Shut everything down.
• 34:53
  It physically trips the Breakers and takes the multi $1,000,000
• 34:56
  process offline. So the IT security guy literally
• 35:00
  causes a self-inflicted denial of service attack.
• 35:03
  Exactly. You caused the exact operational
• 35:06
  downtime you are hired to prevent.
• 35:08
  You become the threat actor. OK, so if you cannot actively
• 35:12
  scan the network, how do you even know what's on it?
• 35:16
  Because as we established earlier, you can't protect what
• 35:18
  you don't know exists. How do you find the
• 35:20
  vulnerabilities? You have to fundamentally change
• 35:22
  your approach. You use passive asset discovery.
• 35:25
  Meaning you just listen. Exactly.
• 35:27
  Instead of sending out aggressive probes, you deploy
• 35:29
  network TAP pees or you configure SPAN ports on your
• 35:32
  industrial switches to mirror the traffic.
• 35:34
  You just connect a listening device, sit there and quietly
• 35:37
  record the network traffic that is already naturally flowing.
• 35:41
  How does that identify the devices?
• 35:42
  Protocol aware OT visibility tools like Drag or Clarity can
• 35:47
  fingerprint the devices based purely on how they talk.
• 35:51
  The software analyzes the packet payloads and says oh I see
• 35:54
  Modbus traffic coming from this IP and based on the specific
• 35:58
  byte structure of the response. That's a Schneider Electric
• 36:01
  controller running firmware version 2.1.
• 36:03
  It's like standing in a crowded room and figuring out who
• 36:06
  everyone is just by listening to their accents without ever
• 36:09
  introducing yourself. No packets injected, no machines
• 36:12
  crashing. Right.
• 36:14
  And you absolutely must deploy these passive tools, because
• 36:18
  relying on manual asset registers, the Excel
• 36:20
  spreadsheets that plant managers typically use to track their
• 36:23
  gear, is a fool's errand. They're almost always hopelessly
• 36:26
  wrong. Yeah, the field notes from the
• 36:27
  Shieldworks report are wild. They state that in typical oil
• 36:31
  and gas security assessments, passive discovery reveals that
• 36:34
  46 to 78% of devices are completely missing from the
• 36:38
  manual register. Think about that.
• 36:39
  Over half the network is totally invisible to the security team.
• 36:42
  That's. Terrifying.
• 36:43
  When you plug in a passive listener, you find horrifying
• 36:46
  things. You find forgotten 4G modems
• 36:49
  strapped to the side of analyzer cabinets by vendors.
• 36:53
  You find undocumented consumer Wi-Fi routers plugged into the
• 36:57
  wall by operators who wanted better Internet reception on the
• 37:00
  night shift. A router just hanging off aplc.
• 37:02
  Yes, you find ancient serial to Ethernet converters that haven't
• 37:06
  been patched since the Obama administration.
• 37:09
  Every single one of them is an unmonitored attack vector.
• 37:12
  OK, so you listen passively, you find the invisible devices, you
• 37:16
  map the network safely. But then how do you manage the
• 37:19
  actual security governance? Because looking at the
• 37:21
  literature, there seems to be a massive clash between different
• 37:24
  regulatory and engineering frameworks.
• 37:26
  Oh, the framework Wars. Yeah, why do organizations have
• 37:29
  to use both the IEC 62443 standard and the NIST SP-882
• 37:34
  guidelines? It isn't one massive binder
• 37:36
  rules enough. This raises an important
• 37:38
  question about how we bridge the communication gap between the
• 37:41
  engineering floor and the corporate boardroom.
• 37:43
  It loves NIST frameworks, OT loves engineering standards.
• 37:47
  If you pick just one, your security program will inevitably
• 37:50
  fail. Breakdown the distinction for
• 37:52
  us. Why do we need both?
• 37:53
  Think of securing a facility like building a massive
• 37:56
  skyscraper. IEC 62443 is the Prescriptive
• 38:00
  Structural Engineering Standard. It was written by the
• 38:03
  International Electrotechnical Commission by actual control
• 38:07
  systems engineers who walk plant floors and argue with DCS
• 38:10
  vendors. It was very technical.
• 38:12
  Extremely. It defines the absolute physics
• 38:14
  of your security. It tells tells you exactly how
• 38:16
  to build your zones and conduits.
• 38:18
  It requires specific, deeply technical benchmarks categorized
• 38:22
  into security levels one through 4.
• 38:24
  It's the blueprint for the concrete, the steel and the fire
• 38:27
  doors. And what about NIST?
• 38:29
  NIST SP-882-ON the other hand is the Descriptive Governance
• 38:33
  Overlay. It maps industrial security to
• 38:36
  the broader NIST Cybersecurity Framework.
• 38:38
  The five pillars identify, protect, detect, respond,
• 38:41
  recover. It tells executive management
• 38:43
  how to run the security program, how to evaluate enterprise risk,
• 38:46
  how to budget and how to train staff.
• 38:48
  So Dist is the project management manual in the
• 38:50
  building code, while IEC 62443 is the actual structural
• 38:55
  engineering math required to ensure the building doesn't
• 38:58
  collapse. Exactly.
• 38:59
  You need IEC 62443 to make sure the plan doesn't blow up, and
• 39:03
  you need NIST to survive an external audit and explain to
• 39:06
  the board of directors exactly where their security budget
• 39:09
  went. They are complimentary, not
• 39:10
  competitive. OK, but even with the best
• 39:13
  frameworks perfectly aligned, we eventually run into the patch
• 39:16
  management nightmare. This is another massive ITOT
• 39:20
  clash that just blows my mind. In the IT world, Microsoft
• 39:24
  releases patch Tuesday. Every 30 days.
• 39:27
  Your laptop downloads an update, reboots in the middle of the
• 39:29
  night, and installs the security fixes.
• 39:32
  Why not just patch the OT systems on a 30 day automated
• 39:35
  cycle? Oh man, try walking into a
• 39:38
  control room and telling a plant manager you need to take down a
• 39:40
  power generation turbine, halting millions of dollars of
• 39:44
  electricity production so you can install a Windows security
• 39:46
  update on a Tuesday afternoon. I'm guessing that conversation
• 39:50
  ends with security being escorted off the premises.
• 39:52
  You'd be thrown out of the building in OT, uptime is king.
• 39:56
  Availability is the absolute highest priority.
• 39:59
  Maintenance windows, which are the planned turnaround outages
• 40:02
  where you were actually legally and operationally allowed to
• 40:05
  turn machines off, might be 12 to 24 months apart.
• 40:08
  Wait two years between security patches.
• 40:13
  Because patching a DCS, a distributed control system isn't
• 40:16
  just clicking update and hoping for the best.
• 40:19
  The patch has to be rigorously validated by the OT vendor
• 40:23
  first. To make sure it doesn't break
• 40:24
  anything. It has to be tested in an
• 40:25
  offline physical staging environment to ensure it doesn't
• 40:29
  change the execution timing of the real time operating system,
• 40:33
  because if a patch delays a sensor reading by 50
• 40:36
  milliseconds, the physical process might fail.
• 40:38
  So you test it for months and then you wait for the annual
• 40:41
  turn around outage to carefully install it.
• 40:43
  OK, let's summarize the sheer terror of where we are right
• 40:45
  now. We have a punctured perimeter
• 40:48
  full of undocumented shadow corridors.
• 40:50
  We have fragile legacy gear that will physically crash if we
• 40:53
  actively scan it to find vulnerabilities.
• 40:56
  We have critical software flaws that we cannot patch for up to
• 40:58
  two years, and these systems are controlling highly explosive,
• 41:03
  dangerous real world processes where uptime is completely non
• 41:07
  negotiable. That is the terrifying everyday
• 41:09
  reality for an OT security engineer.
• 41:12
  So how do we actually secure remote access for the vendors
• 41:15
  who must connect to keep the plant running?
• 41:17
  How do we fix this broken architecture?
• 41:19
  Which brings us to the core solution, applying zero trust in
• 41:22
  the legacy world. If we connect this to the bigger
• 41:25
  picture, the answer to implicit trust, the answer to the M&M
• 41:29
  model where the inside that is gooey and defenseless, is zero
• 41:32
  trust architecture. Let's define zero trust
• 41:35
  carefully here. The concept originally comes
• 41:37
  from IT right Google's Beyond Corp initiative back in 2009.
• 41:40
  Yes, the philosophy is beautifully simple.
• 41:43
  Never trust, always verify. You completely abandoned the
• 41:46
  concept of perimeter security. The hard shell is gone.
• 41:49
  Exactly. You don't care if a user is
• 41:51
  physically inside the corporate firewall or outside a coffee
• 41:54
  shop. Every single request to access a
• 41:56
  resource must be strongly authenticated and dynamically
• 41:59
  authorized based on identity, device posture, and context
• 42:04
  every single time a connection is attempted.
• 42:06
  Oh wait, we just spent 20 minutes explaining in agonizing
• 42:10
  detail why modern IT concepts break fragile OT environments.
• 42:15
  And this is no exception. Right and seizes April 2020.
• 42:18
  Sixth guidance says exactly that.
• 42:20
  Blanket application of IT0 trust to OT is neither reasonable nor
• 42:25
  feasible. You just told me a 1995 PLC
• 42:28
  running Modbus doesn't even have a password.
• 42:30
  You can't put a modern cryptographic authentication
• 42:33
  agent on a device that communicates in serial
• 42:34
  protocols. You are exactly right, the PLC
• 42:37
  doesn't know what an identity token is, so you absolutely
• 42:39
  cannot do pure end to end zero trust down to level 1.
• 42:43
  So what's the alternative? But what you can do and what the
• 42:45
  modern frameworks mandate is apply zero trust network access
• 42:48
  ZTNA at the boundary, specifically in the IDMZ.
• 42:51
  OK, let's do a showdown of the access tools here.
• 42:54
  Based on the second media source material we reviewed, we have
• 42:56
  three main contenders for remote access VPN's, SAS and ZTNA.
• 43:03
  Well, we already know VPN's are disastrous.
• 43:05
  They offer implicit trust. You authenticate once at the
• 43:08
  gateway and you are granted broad sweeping access to the
• 43:11
  entire subnet. It creates the shadow corridor.
• 43:14
  It allows lateral movement. VPN's are dead for OT and.
• 43:17
  What about SAS? SAS, which is Secure Access
• 43:20
  Service Edge. This is the darling of Silicon
• 43:22
  Valley right now. SAS is incredible for IT.
• 43:25
  It combines SD-1 and cloud delivered security, but it is
• 43:29
  entirely too cloud heavy for OT. Why is that a problem?
• 43:32
  SAS assumes your workloads are sitting in AWS or Azure, and it
• 43:36
  assumes you have constant high bandwidth Internet connectivity
• 43:39
  to run the cryptographic agents. OT environments are often
• 43:42
  physically air gapped offline or located at the end of a terrible
• 43:46
  low bandwidth satellite link in the middle of the ocean.
• 43:49
  SAS breaks down when connectivity drops.
• 43:51
  So that leaves ZTNA Zero trust network access.
• 43:54
  Yes, but it must be ZTNA purpose built specifically for
• 43:57
  operational technology. You replace the broad VPN tunnel
• 44:02
  with granular session based access.
• 44:04
  What is the ideal architecture look like for that third party
• 44:07
  vendor who needs to remotely fix the robotics line?
• 44:09
  Instead of AVPN dropping them straight onto the plant floor to
• 44:13
  talk to the PLC, the vendor connects to a dedicated hardened
• 44:17
  Jump host sitting in level 3.5, the IDMZ.
• 44:21
  The buffer zone. Right, they must use strictly
• 44:24
  enforced multi factor authentication to even see the
• 44:27
  jump host. Once there, the ZTNA policy
• 44:29
  evaluates evaluates them. It says OK, John from Robotics
• 44:33
  Co is locking in. He is authorized to talk to
• 44:35
  exactly 1 specific IP address on the plant floor over exactly 1
• 44:39
  protocol like port 443 for exactly 2 hours and only because
• 44:44
  there is an open maintenance ticket matching his request.
• 44:46
  That's micro segmentation at its finest.
• 44:48
  You've shrunk the blast radius to a single IP.
• 44:50
  Address exactly. But here's the most crucial part
• 44:52
  for OT. You implement full audit logs
• 44:55
  and forensic session recordings on that jump post.
• 44:57
  Like a video recording. Literally like a video file.
• 45:00
  Every single click, every keystroke, every command John
• 45:04
  sends to the robot is recorded. If something breaks on the
• 45:07
  assembly line, you don't just guess what happened or rely on
• 45:10
  his word, you watch the tape. It turns a risky remote fix into
• 45:15
  an auditable, rebukeable, least privileged transaction.
• 45:18
  That makes so much sense. It acts as a robust compensating
• 45:21
  control for the legacy gear that physically cannot protect
• 45:24
  itself. Let's pull this all together by
• 45:27
  detailing Seize's five priorities for applying zero
• 45:30
  trust in OT. Let's explain how and why these
• 45:33
  actually work. Priority one, Comprehensive
• 45:36
  asset visibility. As we discussed, this means
• 45:39
  passive discovery. You deploy network TFs, you
• 45:42
  mirror the switch ports to analyze the byte structures of
• 45:44
  the traffic without injecting packets.
• 45:46
  You can't apply zero trust policies if you don't even know
• 45:48
  the device exists. Priority two zones and conduits.
• 45:51
  This is the practical application of the Purdue model
• 45:54
  and IEC 62443A Zone is a logical or physical grouping of assets
• 45:58
  that share the same security requirements, like all the
• 46:01
  safety controllers in one zone and the conduit.
• 46:03
  The conduit is the strict firewalled pathway between
• 46:06
  zones. Zero trust.
• 46:08
  This means inspecting every packet that traverses A conduit
• 46:11
  and denying everything by default.
• 46:13
  Priority three, Identity and access controls.
• 46:15
  Specifically, the literature talks heavily about decoupling
• 46:18
  Active Directory. Why is that so critical?
• 46:21
  Because Active Directory is the master key to the Kingdom, if
• 46:24
  your IT and OT environments share the same AD domain, an
• 46:28
  attacker who compromises IT via a phishing e-mail can forge a
• 46:32
  Cabarrus golden ticket and instantly grant themselves
• 46:35
  domain admin privileges over the OT environment.
• 46:38
  It's game over. Decoupling means building a
• 46:40
  completely separate standalone AD forest for the plant floor.
• 46:44
  If IT gets hit with a ransomware, the OT network
• 46:46
  survives because the credentials don't crossover.
• 46:49
  Combine that with enforcing MFA at the jump posts and you kill
• 46:52
  the always on VPN threat. Priority for supply chain risk
• 46:55
  management. This involves demanding software
• 46:57
  bills of materials or S bombs. How exactly does an S BOM help
• 47:02
  an OT engineer? An S BOM is basically a
• 47:05
  nutritional ingredients list for software.
• 47:08
  Many OT vendors buy third party code libraries to build their
• 47:11
  firmware. For example, the Ripple 20
• 47:13
  vulnerabilities a few years ago involved a tiny TCP IP stack
• 47:17
  from the 1990s that was embedded into millions of industrial
• 47:21
  devices. They didn't even know it was in
• 47:23
  there. Right, the end users, and
• 47:25
  sometimes even the vendors themselves had no idea the
• 47:27
  vulnerable code was inside their hardware and S bomb forces
• 47:31
  transparency. It tells the defender this PLC
• 47:35
  contains this specific version of Open SSL, so when a
• 47:39
  vulnerability is announced you immediately know if you were
• 47:41
  exposed without having to wait for the vendor to figure it out.
• 47:44
  And finally, priority five, continuous monitoring and
• 47:47
  detection. Using those passive protocol
• 47:49
  aware OT tools to establish a behavioral baseline.
• 47:53
  OT traffic is highly deterministic.
• 47:55
  It's machines talking to machines on a regular schedule,
• 47:57
  so deviations are incredibly obvious.
• 48:00
  So if a temperature sensor suddenly tries to reprogram a
• 48:03
  safety controller. Exactly.
• 48:05
  The continuous monitoring system needs to instantly flag it,
• 48:08
  scream for human intervention, and potentially sever the
• 48:11
  conduit. OK, pulling this all together
• 48:13
  for you listening, the critical through line of this entire deep
• 48:16
  dive is that cyber risk in your operations is no longer just an
• 48:21
  IT problem for the basement server room.
• 48:24
  It is a fundamental existential business risk. 100%.
• 48:28
  We are talking about protecting the physical world, the water
• 48:32
  chemistry, the power grid stability, the safety of human
• 48:35
  lives on a factory floor from the digital world.
• 48:38
  The air gap is completely gone. The M&M model of implicit trust
• 48:42
  has catastrophically failed us. We have to adapt to an
• 48:45
  architecture of continuous verification.
• 48:47
  And I want to leave you with a final somewhat chilling thought
• 48:50
  to Mull over as you look at your own networks.
• 48:52
  If we reach a point where sophisticated state sponsored
• 48:55
  malware like Stuxnet or Triton can completely spoof the network
• 48:59
  traffic. If you can no longer trust the
• 49:01
  packets on your network, and you can no longer trust the data on
• 49:04
  the HMI screen sitting right in front of your face, who do you
• 49:08
  trust? That is the truly terrifying
• 49:10
  question. How do you defend against a lie
• 49:13
  you can't see? I genuinely think that maybe the
• 49:15
  future of cybersecurity for highly critical industrial
• 49:18
  systems isn't in the digital code at all.
• 49:21
  Maybe when everything else is compromised and the screens are
• 49:24
  lying, it means going back to trusting the raw physical
• 49:27
  process itself. Wait, like analog?
• 49:29
  Yes, using independent analog sensors.
• 49:32
  Installing physical out of band pressure gauges that aren't
• 49:35
  connected to a microchip or a network at all because physics,
• 49:39
  unlike a Windows workstation, cannot be hacked.
• 49:42
  Now there is a thought to keep you up at night.
• 49:44
  Trust the physics, not the software.
• 49:47
  That's all for this episode of cybersecurity Under pressure,
• 49:49
  Real attacks, real lessons. We went deep today and honestly,
• 49:53
  untangling the mess of shadow corridors, legacy gear and lying
• 49:57
  screens is enough to make anyone want to go entirely off grid.
• 50:00
  See you the next chapter. Stay paranoid.
• 50:03
  It's not paranoia if they're actually out to get your OT
• 50:05
  network.