Consider the Data Source: Building Resilient ICS Telemetry
Dan Gunter challenges assumptions about ICS security data sources, showing how to cross-correlate process data, network packets, and host logs for true visibility.
Summary
The Constraints of Industrial Monitoring Environments
Protecting industrial control systems requires balancing zero tolerance for operational downtime with limited compute resources on legacy controllers.
Evaluating the Limitations of Single Telemetry Sources
Dan Gunter analyzes common industrial data sources (network taps, host logs, PLC engineering logs), demonstrating how each source can be blinded or spoofed individually.
Cross-Correlating Process Data and Network Telemetry
By synthesizing network packet captures with actual physical process telemetry (SCADA historian logs), defenders achieve high-fidelity situational awareness.
Designing Resilient OT Detection Architectures
Gunter provides practical blueprints for deploying multi-source telemetry pipelines that resist adversary evasion and data tampering.
Related talks
Creator Stage·20 min
Emma Stewart
Separates cyberattacks from physical power dynamics, analyzing grid oscillations, transformer fires, and blackstart scenarios to diagnose grid disturbances.
Creator Stage·14 min
Michael Frank
Breaks down how the US Department of Defense MOSAICS Block 1 framework provides real-time OT monitoring and behavioral threat detection on Naval vessels.
Packet Hacking Village·1 hr 4 min
Ezz Tahoun
LLM-free alert contextualization and modular correlation pipeline to uncover root causes and attack flows in noisy IoT environments.