2019 ICS Cyber Security Conference | USA

Industrial Control System (ICS) devices were initially designed for closed-network or non-networked environments inside of facilities that were thought to be secure. These early systems did not consider cyber threats to be of consequence due to their closed off environment. However, these environments have evolved into technical distributed systems that may be connected to the Internet. These systems are high value targets that are also often infrequently patched or updated, leaving them vulnerable to common exploits. This, in tandem with the rise in threats from state actors willing to invest a large amount of time and money to compromise these high value targets, makes hardening ICS systems a necessity.

During this session, we will look at three fallacies that impact the security postures of industrial control systems and propose some ways to address them. In summary these misconceptions are:

1. Programming languages don’t matter.
2. Keeping the adversary out is all that matters.
3. There is no way the adversary knows enough about my system.

This session will demonstrate some of the concepts talked about above in a Linux 5.2 environment with Fieldbus support. We will demonstrate methods for inhibiting a ”root” shell from accessing a protected file, a encrypted storage and executable vault limiting the potential for RE, and finally a rootkit is unable to be loaded into the kernel.