SANS ICS & Dragos host webcast series to strengthen the Industrial Control Systems Community

Most industrial organizations are required to have incident response plans (IRP) and procedures for incident handling. Unfortunately, these plans often satisfy regulatory requirements but do little to prepare an organization, arm responders or identify root cause. 

This webinar will outline 5 recommendations to ensure IR efforts are successful, timely, and efficient resulting in safe return to stable state.

Managed Detection and Response and Managed Threat Hunting solutions have been available for the Enterprise IT networks for many years but have been lacking in ICS/OT. Until now. Dragos is launching the first MTH program for ICS/OT called Neighborhood Watch. Join Tim Conway and Robert M. Lee for a discussion about the value of MDR/MTH programs, considerations to keep in mind and how to evaluate offerings. 

For electric utilities in the United States and Canada, the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards provide baseline security requirements for power systems and their interconnected facilities and equipment. While there are technical and organizational challenges with ongoing compliance, many utilities have matured their security programs as a result of these requirements and improved their security posture. Changes however are coming. 

Cyber risk in the manufacturing sector is increasingly driven by disruptive attacks targeting industrial processes. Join Selena Larson, Senior Threat Analyst on the Dragos Threat Intelligence team as she provides a briefing of the manufacturing threat landscape as of October 2020. Shell discuss intrusions that enable information gathering and process information theft, and cover new adversary activity targeting Industrial Control Systems (ICS). 

Open source intelligence (OSINT) is a valuable resource for both attackers and defenders. In this webinar, Selena Larson and Casey Brooks will introduce an OSINT collection risk framework to help defenders better identify and restrict information most valuable to attackers aiming to disrupt critical infrastructure. 

MITRE released its new ATT&CK for Industrial Control Systems (ICS) as a community resource on the tactics and techniques of ICS threats and a common lexicon for the community. This framework is an important tool in developing an ICS cybersecurity program and threat detection strategy. Dragos contributed significantly to the framework with our threat intelligence on the 11 different ICS specific threats tracked. In this presentation, the Dragos team will conduct a technical demonstration of an ICS cyber attack from both the attacker and defender perspective. The attacker perspective will be orchestrated by a member of Dragos' red team and the defender perspective will be done leveraging the Dragos Platform.

Despite being one of the most widely deployed vulnerabilities in Industrial IoT creating significant exposure, the recently discovered Ripple20 is one of the most difficult to detect and address. Dragos Senior Vulnerability experts Reid Wightman and Kate Vajda will provide an update of their analysis in this August 4 webinar briefing. 

In ICS/OT, environments equipment is unique, high-value assets are different, and the cyber risk a company is willing to accept varies between organizations. Additionally, how companies respond to and mitigate vulnerabilities should be completely different from IT, yet the "just patch" mindset still remains widespread. Threat intelligence tailored to industrial organizations can help companies better understand the unique activity targeting industrial environments, prioritize defense activities, and better address vulnerability management. 

Our 2019 ICS Year In Review research revealed that adversaries are expanded their targeting and capabilities and increasingly focused on remote connectivity - a trend with particular relevance with the uptick in COVID-mandated remote work. As cyber threats like these continue to grow, it has become more important than ever for ICS owners and operators to have a clear, accurate picture of their OT/ICS environments.