Most widely-read author in the industrial security space | VP Industrial Security | Podcast Host | Author | Speaker | MS, CISSP, ISP, ITCP
Lessons Learned From Incident Response | Industrial Security Podcast How did they get in? How did we find them when they got in? What can we do in future to clean up the mess faster? Chris Sistrunk, PE reflects on a decades' industrial cyber incident response experience at Mandiant (Google). "If you didn’t listen to a single thing I said, you can listen to these three things: collaborate, plan, and practice" Listen here or find Waterfall Security Solutions' Industrial Security Podcast everywhere you listen to podcasts ➡️ https://bit.ly/3J9ZsHx ---------- What I took away from our conversation, especially earlier in the interview, was essentially... do the basics. Some people call it basic hygiene. In short, do as much on your OT network as you can of what you would normally do on an IT network. Put a little antivirus in on the systems that tolerate it. Get some backups. Get some off-site backups so that if the bad guys get in they can’t encrypt the off-site backups. Look for the vendors leaving behind Internet connections, get rid of them. When it comes to “living off the land,” Chris gave some very practical advice I hadn’t heard before Attackers often come in as legitimate users, so enable two-factor authentication. It goes a long way toward breaking up those types of attacks. And in your intrusion detection systems, look closely at what your remote users are doing. If it seems at all unusual, that’s a clue that you’re being attacked. In terms of “collaborate, plan, and practice”, I really liked the fire warden analogy. If you have an industrial site that is flammable, your fire warden doesn’t just sit on their hands until the place bursts into flames. The fire warden is someone who’s active.... raising the alarm when they see dangerous practices in this flammable plant. It’s not just a reactive position, it’s also a proactive one. And we need that for cybersecurity, because basically every site is, in a sense, a flammable cybersecurity situation. So it’s not just that they sit on their hands until there’s an incident and then they’re in charge. They are actively looking around, just like a fire warden would, saying, “We shouldn’t be doing this. My job is not just to put the fire out when it occurs or coordinate putting it out, my job is to help prevent these things."
You are awesome Sistrunk. Glad you are on our team!
Technical Leader at Mandiant, Google Cloud Security
1wThank you again Andrew Ginter. cc: Google Cloud Mandiant (part of Google Cloud)