So the idea for the webinar today is to give you a short introduction to industrial control systems and also to introduce you to the training that is offered at ZipCon and to do some live demonstration because I finished another private training for a customer yesterday,
so my setup is still installed, and I will use that to perform some demonstration.
So I would like to start with maybe a short introduction about myself.
So my name is Arnaud Soulier, I'm French.
I work, most of the time I work as a manager at WaveStone, WaveStone is a consulting company.
And in addition to that, I also teach ICS cybersecurity trainings.
I just wanted to make it very clear that it's a separate activity, so the trainings that I teach, it's my own company and it's different from WaveStone, which is a very large company from which I'm an employee.
So I joined WaveStone 11 years ago, so in 2010, I joined as a trainee in the pen testing team.
So for the past 11 years, I've been doing pen testing and I would say all kinds of security assessments.
And my first assessment on ICS was in 2012, so that's quite a long time ago.
And I really liked this topic, so after this first assessment, I did another one, then another one, and you know how it works at the companies, once you've done two or three, you're the expert and you do most of the assessment.
And so for quite a while, I was the one doing all the ICS and now we have, I would say, so many assignments in ICS that we have a large team, I have a large team of colleagues that help me on this matter.
So of course, I like ICS, I also like Active Directory Security, that's, I think, quite an interesting topic.
And it's also a topic that today is quite linked to ICS, so that's a good thing.
So I did speak at a few security conferences in the past, mostly, maybe not doing that much talks, but mostly doing workshops.
Workshops during which I explain how to pen test some part of the ICS.
So the first time was in 2014 at BlackHat Europe, and then I did the workshop with some of my colleagues at different conferences, like Brucon in Belgium a few times, it also gave me the idea to start doing my own trainings, because a four-hour workshop was just a bit too short for everything I wanted to share.
So I decided in 2015 to give my first ICS cybersecurity training, and after a short break, I started back in 2018 doing cybersecurity training for ICS.
So either at, I would say, generic
cybersecurity conferences like Hack in Paris, DeepSec, BlackHat Asia, but also at dedicated conferences like CS3 in Stockholm, which is a specific conference for ICS cybersecurity.
And I think that's all you need to know about me, and I can move on to the next topic, which is a short introduction to ICS.
So first of all, ICS, that stands for Industrial Control Systems.
And maybe the first question we can ask ourselves is, where do we find industrial control system?
What is it?
What is it used for?
So here I have a few pictures of places in which you can find industrial control systems.
So on the left side, the one on top, those are cooling towers, probably from a nuclear power plant.
On the left, on the bottom, you have what looks like some water treatment, maybe used water treatment plant.
In the top right side, you have some kind of large tanks or reactors.
Those look like what I've seen when I was doing assessment in pharmaceutical industry.
Maybe that's another type of chemical plant, but it really looks like the ones that I've seen in the pharmaceutical industry.
And on the middle, on the right, you have oil and gas.
Of course, a big sector for ICS, so refinery, for example, to transform, I would say, crude oil into the gasoline that you can put into your car or maybe your homeowner, things like that.
But also, I want to emphasize that industrial control systems can also be found maybe closer to your home.
And if you look on the right side, on the bottom, there's probably some kind of HVAC, so air conditioning and that type of things are also managed by industrial control systems.
Maybe when you go swimming in a pool nearby, there will be, of course, an industrial control system managing maybe the temperature of the pool if it's heated, maybe managing also the filtration, making sure that the water stays clean, etc.
So you will find industrial control systems pretty much everywhere, both in dedicated plants, but also, I would say, in things maybe more close to your home, swimming pools, heating systems, etc.
And of course, critical infrastructure such as transportation for the train, maybe, or maybe for the dams and everything around that.
Okay, so then let's try to discuss what is an industrial control system and what are the main components.
So, of course, this is a little bit simplified.
I will not discuss all the components because they are not all in this diagram.
But the most important thing to understand is that while the corporate IT handles data, so your laptop at your company or at home, it manages only data, while industrial control systems, their goal is to interface data with the physical world.
That's why sometimes you may encounter the term CPS, cyber physical systems.
So on one side, they take information and on the other side, they interact with the world around you, so the physical world.
So if I try to describe you the different components that you can have in an ICS, let me try to use the laser pointer here.
So I will start on the right side of the slide.
So on the right side of the slide, as you can see, it's something that I consider to be outside of the ICS network because those things are not really connected to a network.
Those things are the devices that are the closest to the physical world.
So you have two types of devices.
The first one are the sensors.
What is the role of a sensor?
Well, it's quite simple.
The sensor will transform an information about the physical world into an electrical signal.
So to give you an example, maybe a temperature sensor that can be used, as I mentioned, in an air conditioning system.
The temperature sensor will get the information about the temperature of the air around the sensor and it will transform that into an electrical signal.
And one standard way of doing that is to send an electrical signal between 0 volt and 10 volts.
And depending on the configuration and the calibration of the sensor, you can get the temperature by measuring the voltage.
Then we have another type of devices, the actuators.
Well, it's simply the opposite of a sensor.
This device will receive an electrical signal.
So depending on what the actuator is, it can also be 0 to 10 volts.
Maybe it's going to be 0 or 24 volts.
Maybe it's going to be 4 to 20 milliamperes.
So really, the way it's used electrically, it might differ, but it's the same idea.
If it receives a certain electrical signal, it will perform an action and impact the physical world.
So here on the picture, it looks like an electrical valve, so electrovalve.
And so this allows you to remotely open or close a valve.
And so that will either block or allow the fluid to pass through a conduit.
So usually the actuators, they may be... the electrovalve, sorry, they may be open if they receive 0 volt.
And if they receive 24 volts signal, they will close.
So those devices, they are simply electrical.
They're not really connected to any network.
So since we want to automate something, we need to connect those sensors to some devices that can understand and communicate using electrical signals.
Those devices that we will use are what is called PLCs, programmable logic controller.
It's maybe I would say it's the heart of the automation of the ICS.
The most important component is probably the PLC.
What is a PLC?
Well, simply put, the PLC is a real-time computer.
It's usually quite small.
It's usually rugged.
That means it can endure very low or very high temperature, vibration, dust, electromagnetic signals or noise.
So it's really resistant.
And those devices, they have specific input and output cards on which you can plug the sensors and the actuators.
And what is the role of the PLC?
The role of the PLC is to have some kind of logic or use some code, if you want, that will automate some actions.
So to give you a very simple example, you can imagine a tank that will be filled with a liquid.
You can have a sensor that measures the level of the tank.
And you can have an actuator that is an electrovalve.
So for example, the PLC can be programmed so that the valve stays open, so the liquid is flowing, it's filling the tank, until the sensor says that the tank is full.
So this type of automation is programmed directly on the PLC.
Okay, so that's nice.
But then the PLC has just some small part of the automation, and you will have a lot of PLC in the plant or in the factory.
So then you can wonder, but if I want to control everything remotely, how do I do that?
Well, the PLC, they also have a connection to the network.
So it's really a small computer.
On one side, you have, for example, an RG45 plug, so it's plugged on Ethernet.
And on the other side, you have the electrical inputs and outputs.
So now, if we want to control remotely the PLC, what we will use is some kind of supervision.
So most of the time, it will be a SCADA.
So that's one type of supervision.
If we go into the details, you have DCS, which is an other type of supervision.
But let's say that for the moment, we use a SCADA system.
The role of the SCADA system is to centralize all the information and connect to all the PLCs in the plant.
So that means that from a single place, so usually in the plant or a factory, you have a control room with a lot of computers.
Well, from this central place, you can actually read information from the PLC.
So you can see all the information about the plant or the factory.
And you can also control the PLC by sending some specific commands to perform an action.
So those machines, they are not so specific.
PLC, it's a specific hardware.
Here, it's mostly Windows servers and Windows Workstation.
So operators HMI.
So this is a standard Windows Workstation running Windows 10, or maybe since we have a lot of obsolete devices in ICS running Windows 7 with a specific software, the software connects to the SCADA server and the SCADA server connects to the PLC.
So that allows you to centrally control everything in your ICS, which is interesting because it allows you to be more efficient, maybe to have less employees.
So let's say it's good for business.
As you can see, I consider that the ICS network is both the supervision and the production network on which you have the PLC.
And on this diagram, I also added the corporate network.
So it's not really part of the ICS network, but I think it's important to understand something.
Today, all ICS networks, they are somehow connected to a corporate network.
Why?
Not because people are lazy, but because it's required for the business.
Most of the time, you need to get some information from the corporate network.
For example, if you're working in manufacturing, maybe you need to get the orders from your client to know what to manufacture.
So you need to be connected to the ERP, for example, to get when a client performs a new order.
And maybe you also want to export some data from the ICS to the corporate network.
Maybe some data about the production to be analyzed and to allow you to be more efficient in the future.
So I want to emphasize that the corporate network is always somehow connected to the ICS network.
So of course, there are many ways of connecting the two.
Bad ways from a security perspective, but also good way, good secure way to exchange the data.
So that is, I would say, maybe the legacy vision of ICS.
Today, I also want to emphasize that we have new things that you have to take into account.
The first one being connected sensors.
So I've not encountered that a lot, but it's a new trend and it's coming quite quick to the ICS world.
The fact that you will have some sensors, instead of being connected to a PLC and the PLC connected to the SCADA, some sensors will be directly with some electronic inside and directly connected to the cloud using some protocols like LTE or maybe some specific protocols for the IoT like Sigfox or LoRa that you may have heard.
And so one of the use cases that I hear a lot about is vibration sensors.
So they are used to detect when something is wrong with the process.
So maybe if the vibration starts to be more important than usual, that means I have to perform some maintenance to make sure that my industrial gear does not break.
So to do that, a lot of companies start deploying connected sensors directly connected to the cloud.
And then the information is gathered directly here from the cloud.
So you bypass the production network.
So that's one big trend.
The other one is the use of cloud analytics.
So exporting all the data from the production network, from the supervision network to the cloud to perform some data analytics using deep learning, machine learning, artificial intelligence, whatever you want.
Well, the idea is that a lot of companies provide that service to, again, to help you be more efficient and so get more money, simply put.
And also, of course, the internet that was not on the previous diagram.
But of course, today, all corporate networks are connected to the internet.
And also a lot of ICS networks are actually connected to the internet, maybe for providers to connect remotely, maybe for remote maintenance.
With WaveStone, we recently did a study, a benchmark of the last 40 industrial site assessment.
And 90% of the sites we assessed had a remote connection in the supervision network.
So again, I'm not saying it's a bad thing.
I'm saying it's a thing that you need to worry about and to secure, to make sure that it's not an entry point for the attackers.
So that's the very high-level presentation of the ICS.
Of course, in the training, we'll go into the detail of each component to learn a bit more about it.
But I think that here, I will just give you this high-level overview.
Just a reminder, if you have any questions, feel free to ask.
And I will try to, from time to time, check if you ask any questions.
So I also wanted to share two slides that I showcased at the RSA conference in San Francisco last year with my company, WaveStone.
So there are two ways, in my opinion, to look at ICS cybersecurity.
There is the tired way, the old way, which is, oh, ICS cybersecurity is really bad compared to IT security.
They do not know how to do security.
They have very old components.
They care about availability, but not confidentiality.
They have all those proprietary protocols.
And it was not designed to be connected.
Now it's connected.
That's why it's bad.
And all of this is true.
I'm not arguing against that.
I'm just saying that perhaps having this type of speech about ICS is not a good thing.
We should not consider ICS to be lagging behind corporate IT cybersecurity.
What I like to think about is how can we leverage the specificities of ICS to improve cybersecurity?
So, and you can take almost the same topics as before, but think of it in a positive way.
The first one, yes, the lifetime of the system, and it's not the lifetime, it's more the lifespan of the systems is very large.
When you install an industrial control systems, it might stay like it is for 10, 15, 20 years.
During my assessment, I've even encountered PLCs that were I think 35 or 40 years old.
They were still working.
So why change them?
So yes, that means that you have a lot of legacy systems that are difficult to secure, but it also means that if today you do your job correctly to secure the ICS, it doesn't change that much.
So if you secure it today, it will stay secure for 10 or 15 years.
So contrary to corporate IT cybersecurity, it's really easier, I would say, to do that correctly, because once you've done it correctly, it stays secure for a long time.
Second point, yes, confidentiality is not important, but it's actually a good thing, because there is very, very little confidential information in industrial control systems.
The confidential information, like the recipes, if you work in the food and beverage, is stored somewhere else.
In the ICS, you will just have some raw data, like, okay, I'm going to read the register 23 and write 55 to register 38, but that doesn't help you understand the ICS.
So it's not necessary to encrypt everything in ICS, because the data is just not confidential.
What is important is, of course, availability and integrity.
The two, they come together, because if you have availability but no integrity, it means that you have a physical process that's running, but you cannot be sure that you produce the right thing, so it's useless.
So it's always availability and integrity at the same time.
It doesn't make sense to have availability if you do not have integrity.
Also, what is very good on the ICS side, based on my experience, is a strong culture of quality.
So people really try to do their job correctly and do the best they can, and there is a strong culture of change management.
So usually, when you go to an ICS, to an industrial site, it will be easy for you to check the last modification, the last changes they made, because everything will be registered, which is really a good thing for cybersecurity.
And finally, they have dedicated systems to prevent any major events, what we call sometimes SIS, safety instrumented systems.
So those are designed to prevent any explosion, incident, people being harmed.
So you have dedicated systems to prevent most events, so that's also something quite good.
That's why this is the way I see ICS.
I see a lot of specificities that I can leverage to improve cybersecurity, instead of saying, oh, ICS cybersecurity is bad, blah, blah, blah.
That's really what I'm trying to teach.
Then, I also want to share with you a few ICS vulnerabilities that I found most of the time when I do assessments.
Again, I'm not going to go into all the details, because that would take quite some time, but I want to give a few words about each of those topics.
The first topic is the organization of the security and awareness.
So yes, cybersecurity awareness is quite low at the moment on most industrial sites, and a lot of times they do not have the right organization for cybersecurity.
In our benchmark, we mentioned that only half of the sites we assessed have somebody identified as in charge of cybersecurity for ICS.
So in most sites, you will find nobody's in charge of ICS cybersecurity, and sometimes you will also find that nobody's really in charge of IT.
So if you need to buy a new switch or a new router or a new computer, maybe they just go to the nearest store and install it and plug it.
There will be no hardening, no configuration.
They just replace it as a device, and of course that's quite an issue.
The second topic I want to discuss is a very, very big topic for ICS.
It's the network segmentation, which means having two different networks, one for the corporate network and one for industrial operations.
Of course, it's difficult because over time, from a cost perspective or maybe it was easier, so people just... when the ICS got more and more computerized, they just installed the computer on the corporate network.
And so today we are in a situation in which it's not so easy to separate the two of them, because as I mentioned, there are more and more exchanges between the ICS world and the corporate world or the cloud.
So it's really important to focus on network segmentation, and for network segmentation, the real question is not how can I segment the network, it's how can I securely allow data exchange while preventing attackers from going from corporate to ICS.
That's really the question, because segmenting the network is easy.
You put a firewall with the right rules, the network will be segmented, but nothing will work, because some data is required on the ICS, and this data comes from the corporate network, maybe from the cloud, maybe from the ERP, maybe from a third-party vendor,
I do not know.
So it's really about designing an architecture that allows you to securely exchange data without allowing a compromise.
Of course, we will discuss the security in the protocols.
Specific ICS protocols are still used quite a lot, those protocols are quite old, and most of the time they offer very little security features.
They will have no encryption, which again is not really a problem, but they will also have no integrity and no authentication, and that's the big issue.
There are a lot of protocols in ICS without any kind of authentication, which means if you are able to access the ICS network at some point , you will be able to send some data, change the way the process works, or maybe reprogram some of the PLC.
So that's really, I would say, a serious topic.
Third-party management is also quite important, because most of the industrial sites that I've assessed, really a large chunk of them, they rely a lot on third parties, vendors for example, because the asset owner, so the company running the industrial sites,
they do not have all the specific knowledge about all the different processes.
They need some external help, maybe for a specific software that's used to ensure the quality.
Maybe that specific software will be in charge of putting a secret serial number to prevent counterfeiting.
So you have all those different vendors installing their own systems, and sometimes the asset owner doesn't know about the system, it doesn't have admin access, so you cannot really secure it.
You just have a vendor coming in, plugging something on your network.
Sometimes in this device there will be a 4G card that allows the vendor to remotely connect.
So those are real issues, and again, you cannot simply say, do not connect it, because it's required for the site to work, so you have to try to do your best to secure it.
Vulnerability management, of course, is a big topic.
When you want to install security patches, for example, on Windows, well, for the corporate network, it might seem easy because maybe you can do that during the weekend, maybe you can do that during the night.
But a lot of ICS networks, they run 24-7, and so it's difficult to have the right time frame to install the updates.
Moreover, if you install an update, well, you need to test it.
And in ICS, you do not have an acceptance test facility, you are directly installing into the production most of the time, so you also need time to perform some tests and make sure that the update doesn't break the software.
So that takes time.
And some of the vendors, they are still reluctant to provide support if you install the updates.
So in some cases, the asset owner, they are faced with a choice.
They either install the updates and lose the support from the vendor, or they do not install the updates, and they can call the vendor when there's a problem.
And let me tell you, the logical choice is the second one.
You cannot afford to lose the vendor support.
So yes, you have machines that are not updated on a regular basis.
And that's something that's also to take into account when you try to secure the devices.
But again, it's not about being lazy, it's really just about the fact of applying security patches is a bit more complex in ICS than it is in the standard world.
And lastly, security monitoring, which is, well, on this one, I would say that it's really lagging behind what we see in corporate IT.
Very few clients are able to send the logs from the SCADA servers, for example, into the SOC, into the CM for the SOC team to analyze.
So yes, there's still a lot of work to do in security monitoring.
Most of the time, ICS is just a black box and the security teams, they have no specific vision about what's going on in here.
So yes, quite a problem.
Okay, let me just have a bit of water because I'm talking fast.
And I thought, yeah, it might be a good idea also to discuss very briefly two recent real-life ICS attacks, because there are not a lot of ICS attacks, really, that happen on a regular basis.
So I want to highlight two of them that were mentioned quite a lot, I would say, in the media.
Let's start with the first one on the left.
So it's the most recent one.
It's still ongoing.
It's the Colonial Pipeline.
So I didn't know about that, but apparently Colonial, it's a company that operates a pipeline going from New Jersey to Houston, Texas, which is 5,000 miles.
So that's a very, very long distance, especially for us in Europe.
It's quite difficult to imagine, but it's very, very long.
What happened?
Is it a very specific ICS attack?
Well, first of all, we do not know all the details yet.
The attack is still ongoing, but what I've been able to understand is that the company was the victim of a ransomware.
So that means, apparently, the computer in the corporate network were infected with a ransomware.
So that encrypted all the files and asked for ransom to provide the encryption key.
And apparently, and this is, I would say that the part that's not so clear yet, apparently the ransomware also impacted the industrial control systems.
So in an ideal world, yes, the two would be separate.
But as I was telling you before, network segmentation is not so easy.
You need data exchange.
And so if you do not do it correctly, it might be possible that some of the computers necessary to run the control system and the pipeline were also infected.
So the company decided to shut down the operations.
And I think they just restored the operation today, a few hours ago.
So this is not an ICS specific attack.
It's a ransomware attack on the corporate network, but that has an impact on the ICS.
And that's something I really emphasize in the training and that I take into account when I designed the training content.
At the moment, the first thing you should worry about is not advanced Stuxnet-like attacks.
It's making sure that if for some reason the company is the victim of ransomware, you will still be able to run your process and I would say do your most basic work.
So that's something quite important.
On the other side, you have the old small water treatment plant.
So I think that this attack was made public in January.
So this is very different because the attack was apparently targeted at the ICS.
What happened is that somebody was able to connect remotely to a computer, apparently using TeamViewer, but I'm not really sure about that.
That had some weak password and from what I've been able to learn, but again it's not an official statement, apparently this password may have been found in a leaked password database.
So that's of course a problem.
And the attacker connected to the SCADA and was able to change the quantity of detergent.
It's not really detergent, but let's say of some kind of cleaning product that is put into the water to make sure the water is drinkable.
And this was hired a hundred times, so it was quite dangerous.
But somebody noticed this modification and just set it back to normal.
So there was no impact on the population.
And I think that's quite important.
And so this is a very different type of attack.
It's not very sophisticated, but it doesn't matter because somebody was able to directly attack the ICS and change a value in the process, which is very, very bad.
And that's also something that we'll discuss in the training.
I want to make sure that you understand that it's not because you change a value in the SCADA that it will directly happen on the process, because there are a lot of different barriers that prevent any catastrophic event and also to prevent any human errors,
because that happens sometimes.
Okay, so yeah, that was it for the introduction to ICS.
So it was quite short, quite fast, but just to give you an overview.
And now we will switch to the second part of the webinar in which I will tell you a bit more about the training that I'm giving at ZipCon at the end of June.
So the training is called Build, Break and Secure.
So the idea is really to allow you, to allow people without any kind of knowledge about ICS to discover the world of industrial control systems.
And to have this approach, it's a very hands-on approach.
We do a lot of exercises and we have this approach with three words in mind.
First, build.
How does it work?
I strongly believe that if you want to attack something or if you want to defend something, first you have to understand how it works.
So that's why, and I'm going to give you some details after, I spend quite a lot of time on doing some exercises on how does ICS work.
Second point, break.
What are the weaknesses and how can we exploit it to gain access to the ICS, to compromise it?
And finally, secure.
What can we do to fix it?
So we will try to have those three words in mind throughout all of the training.
And so we will start with a small process, automation, then we connect the PLC, then we connect the SCADA, then we connect an active directory.
And the idea is that we cover most of the topic of ICS.
So as mentioned, this training will be taught over five days, but it's five half days.
So it's during the afternoons.
I think it's from two to seven, I think, something like that.
So it's the afternoon.
So on the first day, we'll have a longer introduction to ICS, so way more detail than what I did today.
Then we will learn how to program a PLC and what are the basics of automation.
And we'll also discuss the specificities of ICS protocols.
On the second half day, we'll discuss some, I would say, very specific topic about hacking the process.
How can we impact a process?
What are the possible impacts?
And that's in this module that we'll discuss also the MITRE ATT&CK framework.
Then we'll focus on the PLCs.
So as I told you in the introduction, the PLCs, they're really the key component, I think, in ICS.
So we learn how to attack the PLC, what are the specificities of some of the PLC proprietary protocols.
And also we'll discuss safety.
Safety, which is in charge, as I mentioned in the introduction, safety is designed to prevent any catastrophic event on an industrial site.
Okay, so on the third day, we'll continue by understanding the difference between SCADA and DCS.
We'll discuss what is the role of the SCADA.
We'll discuss how to connect that to the corporate environment.
So Windows Active Directory security.
So Windows security is not specific to ICS, but you cannot do ICS security correctly if you do not know anything about Windows and Active Directory today.
So that's why I'm taking some time to discuss that.
Of course, we'll also discuss some specificities of the SCADA software.
And we'll also discuss Industry 4.0 and IIoT and what that means for ICS.
On the fourth half day, we'll do the capture the flag event.
And I'm going to show you a bit more about that later.
So it's no slides, only doing a pen test on my setup installed in my home.
And I will show you the setup later.
And finally, on the last half day, we'll discuss how to secure ICS.
So we'll discuss about some international standards like IEC 62443.
We'll discuss network architecture and we'll discuss how to perform ICS security assessment.
Okay, so it's quite a packed program, a lot of things to learn .
So what will you get if you subscribe to the training?
Well, you will get several virtual machines that are specifically designed and configured for the training.
One is a Kali Linux VM with specific tools and scripts.
The other one is a Windows VM, Windows 10 VM, with a specific SCADA software, with a specific PLC programming software.
And I choose to have real software.
So the software that I use, it's provided by Schneider.
So it's used on real systems.
It's not something that's just for education purposes.
It's really the same one as you will find in real factories.
I also give you a Windows XP machine just to perform some pen testing and learn how to use Metasploit, for example.
And then two specific resources.
One, it's what I call the WSKX virtual training kit.
So it's something that I designed to help you learn about ICS, how it works to program your own little ICS, and something that you can reuse after the training to perform some additional research or maybe to sharpen your skills after the training.
And finally, a very important point is that after the training, you will get a 30-day access to my e-learning platform.
On this e-learning platform, you will find all the same content as in the training.
And so for 30 days, you can re-watch the video if there is something that you missed or if you want to perform additional exercises.
There's a lot of content on this e-learning platform that allows you to maybe get, yeah, maybe a reminder after the training to make sure that you have understood and you have the right skills.
So I want to discuss a bit and show you what the training kit looks like, okay?
So I wanted to choose a fun process.
So I chose the whiskey making process.
So of course, you have some cereals, you harvest the cereals, you grind the cereals, you put some water, some yeast, it ferments, and then you have two or three distillations for the whiskey, depending on if you're in Scotland or Ireland, and then you put that in some barrels for aging,
and then you put that into bottles, ship to the customers, and everyone's happy.
In our process, we will have a simplified version of the distillation, okay?
And let me switch to my VM so I can show you what it looks like.
Okay, so now you should see my VM.
I'm just going to close this small window here.
So this is the training kit that I designed.
And actually, I want to show you maybe another slide before, just to make sure.
Okay, it's this one.
So I spent a lot of time on trying to find a way to have a virtual training kit.
So the way it works, everything is in the Windows 10 VM that I will provide.
On this VM, I designed a specific application, an HTML JavaScript application, a Python application, and this will simulate the process of distillation.
So it will simulate the fact that if you turn the heater on, the temperature will rise, etc.
This simulated process we'll discuss using Modbus with a PLC simulator.
This PLC simulator is one that is provided by Schneider.
So it's a real one.
It's not a toy software.
And we also use Modbus to connect the PLC to a real SCADA software.
This SCADA software is called IGSS, and it's also a commercial SCADA software from Schneider.
So there is a free version.
And so you will have your own little ICS with the physical process, the PLC, and the SCADA.
And of course, during the training, we'll use the Kali machine to use different tools to connect to this setup and try to hack it.
So let's go back here.
So here I have my distillation process, and at the moment, it says connection to PLC lost.
Why?
Because I didn't start my PLC simulation.
So I should be in my VM.
Let's start SoMachineBasic.
So that is a real software from Schneider that you can use to program some PLCs.
So I will simply launch it.
It takes a few seconds to load.
And then I will open my program.
Just so you know, here I prepared the program, but during the training, we developed the program together.
So you learn how to use the specific programming languages for PLC.
So we learn how to use ladder logic, and we'll also learn how to use SFC, which is another type of programming language for PLC.
Okay, so let me open my project.
Perfect.
So here you can see that's the type of PLC I have.
Here it is already programmed.
So as you can see, that is ladder logic.
So it's really different from C or from Python or Perl or any type of programming software.
It's very graphical.
And now I will simply start my PLC by launching the simulator.
Let's hope this works, because with this software, maybe one out of two times it crashes.
But it seems to work.
Okay, perfect.
And now I start the controller.
Okay, let's go back here.
As you can see, now it's written distillation in progress, so it can connect to the PLC.
And so let's just reset everything, all the values to zero.
So what happens here?
As you can see, this valve is open, and the pot still is being filled.
And we can watch it in real time, if we go here, in the programming of the PLC.
So with this training kit, you can see exactly the code.
So as you can see, it's being filled.
And here we can see that the valve is open.
Now it's going to reach 2000 liters.
And now the valve is closed.
So if I go back here, I can see that my valve has been closed.
So now the heater is on, and it's going to heat the liquid in order to distillate it.
So what I can do in addition to that, I can also connect my SCADA software, IGSS.
Let's launch that.
Perfect.
And as you can see here, on my SCADA, I can see that the wash intake valve is closed, because it's red.
And I can see that the level of the steel is 1934.
Okay, so it's decreasing.
But as you can see, I can monitor in real time my physical process using the SCADA.
And this is also something that we do together during the training.
So you have the right skills to modify the training kit as you want to be able to do your own research later.
So I really think that's something that's really interesting about the training is doing it yourself, learning how it works to be better at attacking it, but also at securing it.
Okay, I also want to say a few words about the e-learning platform that I just mentioned.
So let me just quickly go to the right slide.
Yes, here.
So once you're connected to this platform, as I mentioned, you have all the content of the training, for example, administration protocols for the PLC.
Oh, I was disconnected.
Okay, let me just connect again.
And here the interface is in French, it will be in English if you want.
Okay, so let's see here.
Okay, PLCs.
And this is the one I wanted to show you.
So basically you have some text and a lot of the content is actually videos of me teaching the class.
So every exercise, every slide that we go through during the training will be available for you in video for one month after the training.
So that will help you, again, as mentioned, be able to do everything again at your own pace, etc.
So I think it's quite interesting.
Now I have some examples of training content, but I'm watching the time as well.
I think I will go very quickly because I want to show you a few things about the CTF.
So of course in the training we discussed the PLCs, how to program the PLCs, and as I mentioned, together we will do a bit of ladder diagram or ladder logic programming and some SFC programming.
We'll discuss some of the ICS protocols, not all of them, because there are quite a lot of specific ICS protocols.
What we will discuss is Modbus, of course, because it's one of the we'll discuss S7, which is a specific protocol for Siemens PLCs, and we'll discuss OPC-UA, because OPC-UA is a modern protocol with a lot of security features.
So I think it's really important to understand how to use it and how to secure it.
I mentioned that we will discuss the safety.
I have a whole module on safety.
It's quite important to understand that here, for example, the SCADA and the PLC, it's only one layer of safety.
So to prevent an explosion, to prevent any catastrophic event, you have other layers like safety instrumented systems, physical systems, as well as disaster prevention.
I mentioned SIS, so we will discuss how to integrate or how to separate safety from the basic process control.
I'm not going into the detail.
We'll discuss how to perform, how to integrate cybersecurity and safety, which is not so easy.
We learn how to program the SCADA.
I already mentioned that.
Some specific attacks on the SCADA.
We'll discuss Industry 4.0.
So warning, this is a buzzword, but I will try to explain what are the concepts behind Industry 4.0 and what are the projects that I see at my clients.
And we'll discuss also something that may be less fun, but I think it's quite important to know the basics about the standards for securing ICS.
So for example, here you have a high level presentation of ISA or IEC 60 to 443 standard, which is really one of the leading standards for ICS cybersecurity.
And of course, we'll discuss different network architectures.
So those diagrams, they come from another international standard that's called NIST SP 882 R2.
So again, not a fun name, but it's not very surprising for an international standard.
But well, we'll discuss the different architecture, how they protect, what are their weaknesses.
And of course, finally, the last step, I wanted to introduce you to the CTF.
So if you remember, I said that on the fourth day, we will perform a full day, a full half day on the CTF.
So what is the CTF?
After learning about how to protect and how to attack ICS, I want you to have an end-to-end exercise.
So the idea is that during this exercise, you will connect remotely using a VPN to my home.
And I have a specific setup at home on which there is a corporate network, an ICS network, and a physical process.
So here I'm going to switch to another window, which is this one.
I'm going to put that in full screen.
So I hope the quality is sufficient.
So since you will be remotely and not near the process, I installed some setup with webcams so you can see what you're doing when you're performing attacks.
So let me just remove that.
So as you can see here, on the top left, I have a small train circuit in my home with a train here and two robotic arms.
And so the idea for this training would be to take control of the train and the robotic arms.
And on the left, you can see the screens for the SCADA for the train and the SCADA for the robot.
So let me start the train.
And okay, so let's start the train and let's see if you can see it on the video.
Okay, so here I'm stopping the train.
As you can see, there's a SCADA that allows the operator to... Oh, it's now rebooting.
Too bad.
Well, so you have this SCADA that allows you to control the train and also to control the rail switch to change on which track the train is running.
And you also have another SCADA that allows you to control the robotic arms.
Okay, so now I will quickly try to put the two things side by side.
Okay, let's see if my VM is coming up.
It takes a few minutes.
I think it doesn't like when I change the resolution, but it should work.
Okay, here I am.
So now I'm connected to the setup and I also want to show you what you will do during the training.
So let's say I want to scan, for example, yeah, let's say I want to scan the network.
So I'm just going to do, for example, a quick scan.
So let's do a pseudo Nmap.
And maybe I'm just going to do, I think it's SP.
I never know which one is lowercase, which one is uppercase.
I want to do a ping scan on the right.
Let's see how it works.
Okay.
And of course,
it's not the easiest thing to see, but some of the machines are up.
You can see this one is up.
It says from the MAC address, it's a Siemens one.
And I should have, yes, here we have telemechanic.
So it's a brand from Schneider Electric.
So for example, this one is also up.
So now I'm going to quickly scan this one.
And actually, I'm just going to cheat because I know it's a Schneider PLC.
So I actually know that Modbus should be open on this one.
So let's just scan this one.
Of course, it doesn't work because I didn't input sudo.
And now it should work.
Yes, it's open.
So I know that there is Modbus enabled on one of the Schneider PLC.
So now I'm going to use a software that I will teach you to use during the training.
Let's read some of the values.
So it's mbtget.
It's a Modbus client.
Okay, so here I'm reading some values.
I'm reading eight values starting at address zero on the PLC that I identify on the network.
Okay, everything is set to zero.
So now what happens if I start writing some data?
So of course, I do not know what data to write.
So I'm just going to try random.
Okay, have you seen the robot arm move?
Do you see it moving?
Okay, and so the idea during the training will be to understand which of the values I have to write to to make it move the way I want to.
So for example, here, let me show you something else.
No, that's not the one.
Okay, and so the idea is really by using all the techniques that I will show you during the training to be able to take control of the robotic arm.
And actually, the idea would be to stop the train and to be able to capture the flag that is on the train.
So I'm just going to move a camera.
So you see, because yesterday, my students, they were able to capture the flag with the robot.
And so I'm just going to move a camera so you can see.
Okay, so that's the idea.
The whole goal of the CTF is to be able to actually, as the name suggests, capture the flag on the train.
And so to do that, you have to do a full end-to-end exercise, because you will first have to compromise an active directory environment, pivot to the ICS, understand what are the PLC, what are the SCADA software, how to attack it, and finally, try to understand the process to be able to compromise it.
So that's really the goal of the training, to prepare you for this specific exercise that is very realistic.
And just so you know, because I'm not sure you can see quite well, but this setup is actually composed of PLC.
So the gray ones that you see on top, those are Siemens PLCs.
And the one on the bottom, those are Schneider PLCs.
So it's really the real hardware that you will find in ICS at your clients, for example.
Of course, it's not the largest PLC, it's the small ones, but they use the same protocols, and they have the same weakness as their big brothers.
And there is also an ESX hypervisor that runs the corporate network, and there are some SCADA software, etc.
So it's really, I think, a good exercise that allows you to have a good overview and understanding on how ICS works, how you can attack it, but also I'm trying to give you all the information I have on how to secure it.
But I really think that it's important to be able to understand how it works if you want to secure it.