Intelligence Sharing for Critical Infrastructure Resiliency
summary
OT/IT convergence drives real-world failures: examples include a 2014 German steel mill outage, a 2012 wiper that wiped 30,000 workstations, Ukraine grid attacks that cut power to >200,000 homes, and a ransomware hit that forces a two‑day U.S. gas‑plant shutdown. MITRE attributes ~94 APT groups. Resilience uses the C2M2 maturity model across 10 domains, active sharing via GRF’s OT‑ISAC (Singapore, since 1 Oct 2019) with vetted, anonymized alerts and TLP red/amber/green/white; a shared IOC (beacon to C2 over 80/443) was blocked and contained.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:35Critical Infrastructure (CI) Cls' defined according to a nation's needs, resources and development.
- 4:21Industrial Control Systems (ICS) are more exposed Legacy ICs are air-gapped. Is today are increasingly con the Internet for efficiency and remote monitoring.
- 5:57Notable ICS Attacks (non exhaustive) Cyber Attacks on ICS are increasing
- 9:45Cyber Security Maturity Model developed by DOE Current state of maturity vs Desired future state = Gap to be addressed
- 13:03Maturity Assessment
- 14:37Common ICS Vulnerabilities
- 18:04Industrial Network Architecture (Purdue Model)
- 21:59F3EAD Framework complementary to Intelligence Focus on the tactical and aspects of Intelligence requir
- 26:33OT-ISAC Incident Sharing Process
- 29:05Case: "Beacon Detection"
- 31:17Summary
related talks
50mHarmonizing IT and OT Security in the Era of Convergence
50mBuilding Cyber Resilience - Considerations for CISOs
01h 05mCritical Information Infrastructure (CII) Protection: Challenges & Opportunities
01h 27mOpen-source Tools and CSIRT Success Stories
41mThe Art of Threat-Informed Sharing: Real-life Use Cases from NSA
40mAs Worlds Collide: Responding to Cyber Events in a Converged IT/OT Universe
51mPreparing for and Defending OT Systems from Ransomware
20mConnecting the Dots in a Cyber Pandemic Era