Ralph Langner presented at ICSage: ICS Cyber Weapons during S4x15 Week. As always Ralph is introducing new thoughts to push the industry forward, but this session is more on how to orient and organize the ICS communities’ thinking on attack / defense on ICS.
There is entirely too much attention paid to 0days and compromising an ICS computer or application. This is still trivial to do based on code quality and is almost always unnecessary. A more useful line of thinking is what would or could an attacker do with this access, what would be the intended result, and what can we do to defend against it.
- At the 9 minute mark, Ralph discusses different types of ICS cyber-physical attacks.
- At the 22 minute mark, he breaks down impact categories of cyber-physical attacks.
- At the 29 minute mark, he discusses examples of how to identify the defensive controls to prevent catastrophic results.
The pull quote, in my opinion, was “is there any combination of bits and bytes that if I throw that at this plant will result in harmful physical effects? This is a question that can be answered through engineering methodology”.