Alice in ICSLand with Lesley Carhart & Mark Stacey | CypherCon 3.0

### Overview In this CypherCon 3.0 presentation, Lesley Carhart and Mark Stacey from Dragos provide an introductory crash course on Industrial Control Systems (ICS) and Operational Technology (OT) security, targeted at IT security practitioners seeking to transition into the field. The session breaks down core ics concepts, the Purdue Model architecture, historical threat landscape evolution, misconceptions comparing IT and OT security, and practical pathways to learn ICS forensics and analysis on a budget.

### Key Topics - **Terminology and Scopes**: Clarification of the distinctions between IoT (broad internetworked non-PC devices), OT (physical cyber-physical systems driving kinetic operations), ICS (specific control hardware like PLCs and actuators), and SCADA (the supervisory monitoring and administrative interface rather than the direct control equipment). - **The Purdue Model Architecture**: Layer 0 comprises physical sensors and motors; Layer 1 includes controllers like PLCs, RTUs, and relays; Layer 2 and 3 cover supervisory workstations, alarms, logging, and historical reporting; Layer 3.5 establishes an essential DMZ separating operational systems from the Layer 4 corporate IT network. - **Failure Modes in Operational Technology**: Abstracting physical operational failures down to four fundamental states: something activating when it should not, failing to activate when it should, operating for the incorrect duration, or operating at the wrong time. - **Historical ics Threat Landscape**: Key milestones in ICS attacks including the Idaho National Laboratories Aurora generator test (demonstrating physical damage via remote relay switching), Stuxnet, Dragonfly 1.0 (OPC protocol-based espionage), BlackEnergy 2 and 3 (HMI targeting, living-off-the-land techniques, KillDisk deployment, serial-to-Ethernet adapter bricking in the Ukraine power grid), CrashOverride, Dragonfly 2.0, and TRISIS (the first malware explicitly targeting Safety Instrumented Systems / SIS). - **IT vs. OT Security Realities**: Refuting common misconceptions—such as ICS networks being inherently simpler, entirely defenseless, or vulnerable to single-tool takedowns via Nmap/Shodan—while addressing operational realities including strict uptime requirements, proprietary protocols, long technology lifecycles, and safety protocols.

### Technical Details - **Protocols Across Purdue Levels**: Layer 0 utilizes simple serial fieldbus networks (DeviceNet, HART); Layer 1 introduces control and telemetry protocols such as Modbus; Layer 2 leverages higher-level, complex monitoring protocols like OPC and Ethernet-based communication, frequently encapsulated across modern IP networks. - **Operational Challenges**: Real-world field layouts (such as geographically dispersed wind farms using ring networks) introduce NAT aggregation challenges, make full packet capture (1U/2U racks) impractical at scale, and create unintended network bridging through direct third-party vendor wireless or cellular connections needed to maintain equipment warranties. - **Triad of Knowledge**: Effective ICS analysis demands proficiency in host forensics (analyzing flash memory or custom firmware without standard agent-based EDR), network forensics (evaluating protocol schematics and packet captures like Modbus, DNP3, and BACnet), and file/firmware reverse engineering (analyzing custom `.bin` and configuration files using disassemblers like IDA Pro), framed by domain knowledge of industrial processes and regulatory constraints (e.g., NERC CIP).

### Takeaways Aspiring ICS practitioners should cultivate the ability to "learn to learn quickly" rather than memorizing isolated tools or devices. Hands-on skills can be established using free virtualization platforms (VirtualBox, VMware Player), freely available VMs (Kali, Parrot, SIFT, REMnux, and 90-day Windows developer VMs), public firmware downloads from vendor portals, packet captures, and low-cost consumer hardware (like SOHO routers) to practice hardware analysis and firmware extraction. Formal training programs are also available through SANS, Dragos, and free government-sponsored offerings (such as the joint DHS/INL/ICS-CERT red/blue team exercise for asset owners and federal staff).