Top Cybersecurity Instructors and Best Offers of the Year Available Now - Learn More!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Defending the ICS Ahead of the Patch: WannaCry Lessons Learned

  • Friday, May 26, 2017 at 10:30 AM EDT (2017-05-26 14:30:00 UTC)
  • Joe Slowik, Mike Assante, Ben Miller

You can now attend the webcast using your mobile device!



The WannaCry ransomware event attracted significant headlines for its rapid, indiscriminate spread and impact to critical services. The UK's National Health Service received the most attention, but institutions as varied as automotive manufacturers, rail service providers, and some U.S. utilities faced crippling impacts. Now that ransomware has moved beyond standard phishing and exploit kits, ICS defenders must take notice to ensure critical networks are prepared for the next 'wormable' threat. We will provide an overview of why WannaCry's self-propagation method represents a 'game changer' for ICS defenders and what related threat vectors future adversaries may take. The presentation will cover examples of assets that bridge the enterprise with the ICS and leverage impacted protocols. Then we will outline strategies designed to improve the readiness of ICS networks to fight off the next campaign and how defenders can better position their assets for rapid recovery.

Speaker Bios

Mike Assante

Michael Assante is currently the SANS lead for Industrial Control System (ICS) and Supervisory Control and Data Acquisition (SCADA) security and Co-founder of NexDefense an Atlanta-based ICS security company. He served as Vice President and Chief Security Officer of the North American Electric Reliability (NERC) Corporation, where he oversaw industry-wide implementation of cyber security standards across the continent. Prior to joining NERC, Mr. Assante held a number of high-level positions at Idaho National Labs and served and as Vice President and Chief Security Officer for American Electric Power. Mr. Assante's work in ICS security has been widely recognized and was selected by his peers as the winner of Information Security Magazine's security leadership award for his efforts as a strategic thinker. The RSA 2005 Conference awarded him its outstanding achievement award in the practice of security within an organization.

He has testified before the US Senate and House and was an initial member of the member of the Commission on Cyber Security for the 44th Presidency. Before his career in security served in various naval intelligence and information warfare roles, he developed and gave presentations on the latest technology and security threats to the Chairman of the Joint Chiefs of Staff, Director of the National Security Agency, and other leading government officials. In 1997, he was honored as a Naval Intelligence Officer of the Year.

Joe Slowik

Joe Slowik, Senior Security Researcher at DomainTools, has over a decade of experience across multiple cyber disciplines. From work in the US Navy, to the US Department of Energy and Los Alamos National Laboratory, to industrial control security company Dragos, Joe has covered multiple facets of cyber intrusions and critical infrastructure defense. At DomainTools, Joe continues his work tracking state-sponsored and criminal threats to enterprises with an emphasis on critical infrastructure and related targets.

Ben Miller

Ben leads a team of analysts in performing active defense inside of ICS/SCADA networks. He is responsible for a range of services including threat hunting, incident response, penetration testing and assessments for the industrial community as well as advanced research and innovation within ICS security.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.