- [Announcer] Please join me in welcoming Otis Alexander.
(audience clapping)
- So, I'm gonna really consider getting a wig for myself
for my next presentation.
Might help with my confidence.
(laughing)
Not this time.
Either way.
So, I'm gonna give a quick update about ATT&CK for ICS.
I'm gonna try to cover some of the typical things
that I get asked about.
So, why ATT&CK for ICS?
How does it fit into the other frameworks?
What are the use cases?
And of course, when is it gonna be available?
So, why ATT&CK for ICS?
So, we can think about it
from a couple of different perspectives.
ICS, Industrial Control Systems,
are behind some of the world's most critical infrastructure.
That's a reason, in and of itself.
To kind of look at how adversaries
are affecting new systems.
The other thing is ACID owners and defenders
really wanna have a deep knowledge about
how adversaries are affecting new systems,
they wanna know about their trade craft,
they wanna know about the technologies they use,
and they wanna use that to help inform their defenses.
Another thing is, adversaries have unique behaviors
in these environments.
Their environments are unique in and of themselves
and I'll go over a couple of the things
that we have to consider.
So, unique adversary goals.
So, one of the things that adversaries are trying to do
in this area, they're trying to disrupt
delivery of service in conjunction
with the industrial process.
They may also try to cause physical damage
to pieces of equipment, so that's important as well.
And some of the things we really don't want to happen are
the really catastrophic failures.
Things that affect property or human life.
Some other things that we have to consider are
the technological differences between ICS and maybe
traditional IT systems where IT is present in ICS.
We also have things like controllers
that are interfacing directly with big pieces of equipment
that run the process.
We also have specialized applications
and specialized protocols, and these things are
taking in account of the state of
the industrial control system at any point in time,
and they're allowing us to make changes to the system.
So these are all important things
that we have to take into consideration.
Then there's different ways of defending these systems,
so we're less mature in this area.
So one thing is, what are the data sources
that we need in order to defend these systems?
Where do we collect them from?
If we're dealing with low level and better controllers
they don't have the same interfaces to
collect post-face information.
We also have to think about the protocols.
And the last thing I wanna highlight is
if we're thinking about mitigations or security controls,
we don't want them to affect safety.
We really don't wanna be a part of the problem.
So these are a lot of unique considerations that we have
and I think this is kinda the why
we want ATT&CK for ICS.
So in general, when we're thinking about
industrial control systems, we have to think
kinda from the asset owner or operator's perspective,
and what their complete system looks like.
So this is just a representation of the functional levels
of an asset owner's system.
What this includes is what you would traditionally call
like a headquarters, or something like that.
Like enterprise systems.
High level operations management.
And then you get down into the OT,
or the operational technology,
or industrial control system
where you have supervisory control.
Some remote way of looking into the system,
controlling the system, and then some local control
that you may have that directly interfaces
with the pieces of equipment.
So looking at the traditional adversary behavior,
it kinda ranges along the whole model here.
So it's not like adversaries are always just getting into
supervisory control or the lower level system,
they're sometimes or most of the time
making their way through from the enterprise systems down.
So IT literally spans the whole model.
It spans from enterprise systems all the way down
to basic control sometimes, where you have
embedded windows and things like that.
So that's where enterprise attack really comes into play
because it explains the entry points for adversaries
coming in via IT or enterprise systems.
It also explains that IT conduit
that they leverage to get up into basic control
or to the area they need to be
in the industrial control systems.
But we can't forget about the special goals
that adversaries have at the low levels,
what they're really trying to accomplish.
We can't forget that there are protocols that are unique,
there's unique platforms at the bottom there,
embedded systems that are interfaced with the equipment.
And we can't forget that there's
specialized applications that operators use.
And that's really where ATT&CK for ICS comes into play.
So that's its focus, is to complete the story
of the adversary's behavior, from enterprise
all the way down to the low level systems.
So what we're doing is we're really trying to figure out
what the interface between the two models are
and we have some solutions but we're trying to refine that
so that you can get the full gamma
of the adversary behavior in these systems.
So what are some of our use cases?
So we have some current ones that we are working on now
that we're currently utilizing,
but we also have some future ones that we wanna look at.
So in general we utilize a lot of the same use cases as
enterprise, so one of the big ones
is standardized information reporting.
So we have so many reports for the same incident
that report in different ways.
And sometimes it's hard to get a sense of
what people missed and what's common.
So a standard language for looking at these reports
or if security practitioners use a standard language
to report, it may help the community.
A lot of our use cases center around the analysts as well,
so enabling the analysts to do their job better.
This is still kind of a new area,
when we talk about OTSox, they're having a hard time
finding people who have the expertise in this area.
So ATT&CK for ICS can help them in their job.
So one thing is time and incidence response playbooks.
Analytic development, analyst training.
Also we utilize adversary emulation
or threat-based red teaming,
and test bet environments to better understand
what the artifacts are that are left behind by adversaries.
To understand how well our defenses are doing,
and things like that.
Another use is criticality analysis.
So when we're looking at an industrial control system,
we can better understand how assets and functions
link up to the mission.
And how an adversary utilizing certain tactics,
techniques and procedures can interrupt that,
those functions and those assets.
So we can better get a sense of what we need to focus on
in the environment that affects the mission.
So a future use case that we're really interested in
is threat modeling at the design phase,
so we've been talking to device manufacturers and
one of their critical needs and one of the things
that they've been using ATT&CK for ICS for
is to help untrained engineers
understand what the ramifications are of
adding features at the design process
for low level embedded controllers.
So they can understand what attack vectors
are opening up, where the TTP is associated with that,
and then what mitigations and security controls
they can use to kind of address those things.
So, challenges.
We've had a lot of challenges in terms of
working with this framework, building this framework,
and one of them is just a general lack of real world data.
There is some really good stuff out there.
There's some detailed information
that we're able to capitalize on for this framework.
But in general, I mean, our lights are on,
we don't have problems with water.
You know, in general, things seem stable.
So it doesn't seem like there's a lot going on.
And that could be for a number of reasons.
Maybe nothing's happening.
Maybe we have no visibility
and we don't know what's happening.
Maybe we're really bad at root cause analysis.
So what is actually an attack we chop up
to a fault or human error?
Or maybe we're just really bad at information sharing.
Or we don't have any incentive to share information.
So we hope the ATT&CK model for ICS will help
with some of this to get people talking more
about what they're seeing in their environments.
And also to start to think about visibility
in these environments so that we do catch what's going on.
Also a big thing is what's the proper level of abstraction
when you're dealing with multiple domains.
We look at electric power, we look at water systems,
oil and gas, what level should the techniques be at
to best explain adversary behavior
over a broad set of domains?
And then, diverse set of protocols and vendors.
How do we find the proper abstraction layer,
and we've been getting feedback about that to help out.
And then scope, so...
Do we just focus on
adversaries and what they've done to certain domains?
Do we expand that out to think about how
these TTP affect different domains?
Do we look a the whole
cyberphysical system domain in general?
Any cyber element that affects the physical world,
is that how far we wanna go?
Or do we kinda scope it and be more refined?
These are all challenges that we have thought about
that we're addressing with the framework.
So we've gotten a lot of good feedback
and that's helped us in terms of our tactic development.
So we've included some new tactic categories that
we think are really important
to describing adversary behavior.
Initial access is one.
We wanna know how the adversaries
are making their way into the OT environments.
We wanna know how they're inhibiting response functions
so that deals with safety, protection,
quality assurance and the like.
'Cause these are all protection mechanisms that
should be in place to stop bad things from happening.
And then, how adversaries impair process control,
so how do they disable, manipulate physical processes
to cause some ultimate impact,
like loss of control, loss of view,
or loss of revenue or productivity.
So these are all things that we are considering.
We've updated the attack matrix
to reflect some of these new tactics,
and we've added techniques to address how
adversaries are accomplishing these goals.
So some things that people asked me first,
I'm gonna address now.
So what's the status of ATT&CK for ICS?
Well, we're currently in our third major revision
and I was trying to kinda highlight
some of the changes that we've made in this last revision.
We actually have 84 individuals from 29 organizations,
we got a new person yesterday,
who have early reviewer access, you know,
just to give us initial feedback
about the model before we go through with public release.
So these organizations range over
private and public entities.
So we're getting a lot of different use cases and feedback
from a lot of different people.
So we're planning for release December of this year,
so it's available to the larger community
so we can collect feedback.
We wanna do an independent release
where we're not on attack.mitre.org right now
just to help facilitate rapid response to feedback
that we anticipate getting.
And if you want access before that time,
we are currently allowing that via NDA,
so if you have any questions about that, please let me know.
We're really excited to get this out to the public
so that you can start using it,
so that you can start providing your feedback
and we can mature and refine it.
So, think I have time for questions?
- [Announcer] Well, I'll push questions into break.
- Okay, cool.
- Please join me in thanking Otis Alexander.
(audience clapping)