Preparing for and Defending OT Systems from Ransomware
summary
Ransomware hits OT because uptime matters: examples include Colonial Pipeline, JBS and Rackspace and Trend Micro shows Microsoft, VMware, Fortinet and Adobe are top exploited. Root causes are admin:admin default credentials, exposed VPNs and living‑off‑the‑land tooling; mitigation is a risk‑based crown‑jewels inventory, network segmentation via the Purdue Model, monitored external access with MFA and jump hosts, and deployable detection like Security Onion plus SANS/CISA playbooks and tested incident response with pre‑decided ransom thresholds.
AI-written summary · about
chapters (7)
- 0:00Start
- 9:22How did threat actors gain access?
- 13:50Where do I start?
- 20:39Purdue Model
- 29:15If you need remote access, do it RIGHT.
- 32:03RISK-BASED Vulnerability Management
- 35:27Apply what you've learned today
related talks
26mFrom Existential to Reality: 3 Experts on the Evolution of ICS Threats
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
52mRansomware; The Real Pandemic
21mRansomware Attack: Lessons Learned
27mRansomware in ICS: Impacting Critical Infrastructure and Operations
38mRansomware and Backups: A Multi-Layered Defense Strategy
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
45mNavigating Third-Party Risk in OT Environments