Simulating Attacks Against Hydroelectric Power Plants
Demonstrates full-chain adversary emulation against a hydroelectric power plant firing range and details the resulting incident response analysis.
Summary
Value of ICS Firing Ranges
Evaluating critical infrastructure cybersecurity requires realistic simulation environments. An ICS firing range was constructed to model the physical processes and network architecture of a hydroelectric power station.
Firing Range Architecture and Flooding Scenario
The testbed simulates a catastrophic flooding scenario, integrating Active Directory domains, industrial controllers, virtualized networks, and intentionally placed vulnerabilities.
Executing Red Team Adversary Emulation
Red team operators established command-and-control infrastructure and executed a multi-stage attack kill chain across the environment, directly impacting simulated hydroelectric turbines.
Blue Team DFIR Analysis and Training
Defenders from the power utility analyzed forensic artifacts left during the exercise, inspecting network PCAPs, memory dumps, and Windows event logs to validate detection capabilities.
Related talks
Creator Stage·23 min
Shishir Gupta
Shares tactical insights and attack vectors from a decade of offensive red team simulations inside large-scale industrial control environments.
Creator Stage·25 min
Randi Tinney
Demonstrates how man-in-the-middle attacks on ground infrastructure validate SPARTA framework techniques against space systems.
Main Stage·21 min
Dimitry Snezhkov
Dimitry Snezhkov introduces Racketeer, a modular adversary emulation framework designed to safely simulate end-to-end ransomware operations and test SOC response.