Behavior-Based Defense in ICS

Dragos Adversary Hunter Joe Slowik presents on Behavior-Based Defense in ICS at the 13th annual API conference in Houston, TX. This presentation discusses how identifying adversary behaviors and their common requirements and behaviors can help network defenders prepare for future events--exemplifying how network defense for sensitive environments is strengthened through continuous improvement from prior events.

Visit www.dragos.com to learn more.

1. Behavior-Based Defense in ICS
Joe Slowik
Dragos Inc

2. Place Your Header Here in Arial 22pt
Place Subtitle Here
WHOAMI
Joe Slowik, Adversary Hunter at Dragos
•Threat intelligence and threat hunting for ICS evil
•Former:
•Incident Response at Los Alamos National Laboratory
•US Navy Information Warfare Officer

3. Place Your Header Here in Arial 22pt
Place Subtitle Here
ICS-Focused
Malware
•STUXNET
•HAVEX
•BLACKENERGY2
•CRASHOVERRIDE
•TRISIS
ICS Disruptive Events
•2005-2010 (?):
STUXNET
•2014: German Steel
Mill Attack
•2015: Ukraine
BLACKENERGY3
•2016: Ukraine
CRASHOVERRIDE
•2017: Saudi Arabia
TRISIS
Disruptive/Destructive
Malware
•STUXNET
•CRASHOVERRIDE
•TRISIS

4. Place Your Header Here in Arial 22pt
Place Subtitle Here
More
Aggressive
Attacks
Greater
Risk
Tolerance
Pursuit of
Physical
PCN
Attacks
Heightened
Danger to
Companies

5. Place Your Header Here in Arial 22pt
Place Subtitle Here
•Overall interest increasing
•Number of “major”, disruptive events remains small
Number of
Events
•Increasing severity of attacks as more disruptive events discovered
•Majority of attacks are “minor” in nature and amount of access and
info gathering
Attack Severity
•Major events are finely-tuned to target environment
•Little scope to apply direct observables to other environments
Attack
Specificity
•Defense is traditionally reactive, focus on learning from past events
•But if number of events is small, few items to learn from
Scope for
Learning

6. Place Your Header Here in Arial 22pt
Place Subtitle Here
PHASE 1 -IT PHASE 2 -ICS

7. Place Your Header Here in Arial 22pt
Place Subtitle Here
PHASE 1 -IT PHASE 2 -ICS

8. Place Your Header Here in Arial 22pt
Past Activity
Required to
Inform Defense
•Baseline for
defense
•Need to learn
from something
Insufficient ICS-
Specific Events
to Build Robust
Defense
•ICS-disruptive
events rare
•Scope for
learning remains
small
Identify
Alternative
Scenarios
Applicable to ICS
•Focus on entire kill
chain
•Mine other
intrusion data to
identify ICS trends

9. Place Your Header Here in Arial 22pt
WormableMalware
Credential Theft & Re-use
“Living off the Land”
Wipers

10. Place Your Header Here in Arial 22pt
Place Subtitle Here
PHASE 1 -IT PHASE 2 -ICS

11. Place Your Header Here in Arial 22pt
IT
Attack
Trends
ICS
Threat
Surface
Items for
Analysis

12. Place Your Header Here in Arial 22pt
Identify
Behaviors of
Interest
Determine
Adversary
Means to
Achieve
Objectives
Determine
Visibility on
Adversary
Actions
Build
Detections
around Results

13. Place Your Header Here in Arial 22pt
•Attacker actions and objectives guide defense
•Orient defense towards offensive action
Adversary-Focused
•Indicators are specific examples of behavior
•Indicators are “brittle”
•Behaviors are fundamental means of operating
Behaviors over
Indicators
•Targeting behaviors ensures robust defense
•IOCs may change, but fundamental behaviors are
requirements
Behavior-Targeting
•What tools and telemetry are required to grasp adversary
behaviors?
•Guide procurement and investment toward these tools
Design Tools and
Visibility toward
Defense

14. Place Your Header Here in Arial 22pt
Place Subtitle Here
Identify Required
Adversary
Behaviors
Determine
Necessary Visibility
to Detect
Adversary Actions
Align Defense and
Monitoring to
Requirements
Train and Educate
Security Personnel
on Threat
Environment
Emphasize Root
Cause Analysis
when System Fail

15. Place Your Header Here in Arial 22pt
Place Subtitle Here
Implement Alerts and
Responses
Build Detection and
Visibility on Behavior
Implementations
Identify Common
Requirements and
Behaviors

16. Place Your Header Here in Arial 22pt
QUESTIONS?
Contact Information:
•[email protected] / [email protected]
•@jfslowik