Vulnerability Discovery: Tips for Surviving
Shares practical survival tips and methodologies for researching and disclosing vulnerabilities in industrial systems.
Summary
Claroty security researchers Doli Yardeni and Lemley present defensive lessons learned from discovering and remediating critical vulnerabilities in industrial control systems and operational technology networks in the ICS Village [00:01, 00:03].
The researchers examine industrial data historian architectures, showing how proprietary industrial network protocols interface with corporate business networks through web-based supervisory applications [04:51]. Using a case study of vulnerabilities in OSIsoft PI Web API systems [10:43], they demonstrate cross-site scripting (XSS) and server-side request injection risks, emphasizing rigorous Content Security Policy (CSP) implementation [19:35] and coordinated vulnerability disclosure with industrial automation vendors [23:54].
(AI summary — Gemini Flash)
Related talks
ICS Village·58 min
Marina Krotofil
Reflects on years of offensive ICS research, physical process manipulation attacks, and defensive lessons learned.
Creator Stage·18 min
Dan Berte · Alexandru Lazar
Reveals critical vulnerabilities in solar inverter management platforms that could allow attackers to manipulate power grid infrastructure.
Creator Stage·14 min
Bryson Bort · Tom VanNorman
Introduces industrial control systems architecture, the Purdue model, attacker viewpoints, and steps to build a personal ICS research lab.