hi
my name is tim yardling i'm here to talk
about beetlejuice and the lessons that
we should have learned for ics
cybersecurity
so who am i well i'm a principal
research scientist at the university of
illinois urbana champaign
been in academia for about 14 years and
before that
i was in industry my focus is on ics
cybersecurity research
in a variety of different ways so this
presentation is going to be a bit
different than many that i give
and it's inspired and leverages content
from a website called screenrant.com
that highlighted the greatest lines from
beetlejuice
i'm going to take those top 15 lines and
relate those to the lessons that we
should have learned in ics cyber
security
but frankly haven't
so let's start off with uh with an oldie
but a goodie i know
just as much about the supernatural as i
do about interior design
well experts from other fields are
always willing to help us
they're always willing to come into
industrial control system security
but they need to be willing to
understand the domain that they're
operating in not just the domain that
they came from
the consequences in it systems
as an example are much different than
those in the industrial control system
space
so for instance in i.t systems where
business operations may be impacted
in ics well all of civilization could be
impacted by a particular attack or
outage
therefore the mindset that's used by the
people that operate in cyber security
and that are offering solutions
they have to approach the problem
differently frankly
we don't need people showing off we
don't need the best and brightest from
all over the place
what we need are people that are ready
to listen and understand the problem
space
roll up their sleeves and get to work
let's turn on the juice and see what
shakes loose
well here i'm going to relate this to
safety versus security
an industrial control system safety is a
number one priority
security however to many is really an
afterthought
well you know in some ways this could be
just that it's a realized danger with
safety
for instance blood people dying etc
versus the apparent danger in security
where well an attacker may compromise
something they may do something bad
but uh we're probably not going to lose
life we're probably not going to have
any real
problems overall there's also this
mindset that's conjured up of
well if it isn't broken then why bother
fixing it
well sorry to break this to you but it
is broken
just haven't realized it yet so let's
not wait for the cyber pearl harbor
let's get ahead of it by moving forward
now
it's show time one of my favorite quotes
from beetlejuice
well as you uh may recall from the movie
when you summoned beetlejuice he uh
frankly caused more harm than good
so for years industry has been calling
on the government to help
well sort of right so the government's
here now
they have piles of money but guess what
they expect some fast action is that
what we
really wanted in industrial control
systems did we want to move
fast did we need to move fast
it's unclear is the government there to
help
yes are we getting more help than we
need more regulation
more spotlights more attention maybe
maybe that's causing more harm than good
maybe that's a distraction
i'm trying to cut down myself well
let's talk about trying to change too
late right
the need for increased cyber security
has been pressing for a number of years
right this isn't a problem that just
suddenly appeared and popped up and and
were like caught off guard and have
nothing
uh to say for it or do right let's use
the electric sector as an example
we've been working in that space for a
long time
trying to focus on and build out the the
cyber security provisions
the frameworks the regulations etc
to really truly enforce and improve the
cyber security posture of that sector
some sectors like nuclear and the
electric sector are quite advanced
already in their
in their security uh awareness in their
security
posture etc why are the other domains so
far behind
many of them are not trying to really do
anything in security yet
are they trying to change too late it's
not that the problem's any different for
them
it's not like water isn't important it's
not like
uh manufacturing isn't being targeted
so why are they waiting i've seen the
exorcist about 167 times and it keeps
getting funnier
every single time i see it well
let's continue that quote a little bit
more now
what do you think you think i'm
qualified this is beetlejuice talking to
to him being summoned as an exorcist to
help in
in this scenario well guess what the ics
sector already has what it takes to
succeed
what they need to to increase their
cyber security posture
to defend their systems those people
exist
people that are there already need it
yeah there's training that's needed
yeah change is also needed right
we have to change how we approach the
problem we have to change how we address
things we have to change how we think
about it but
frankly you can do this the people in
the sector
can solve these problems they just have
to put their mind to it
and maybe get a little help on the side
too
i'm the ghost with the most babe well
let's talk about that right anyone that
shows up and spouts buzzwords makes
claims and pitches their solutions as
the one all be
all silver bullet that you have to have
guess what
don't buy into that there are a lot of
steps that you need to do
there is no single silva silver bullet
there is no
one product that's going to save you
there is no one
thing that you can do and all of a
sudden you're better
right you need a broad and comprehensive
approach to security
you need solutions that are
complementary of each other that
integrate together that work together to
have
that visibility that you need that
response that you need the detection
that you need etc
and then most importantly you need to
use those tools in the way that they
were intended to be used once you have
them it's not just oh install this and
everything is better if i never look at
it again
right you have to be able to use and
dedicate
staff and people to being uh to taking
these tools
and leveraging them to to your benefit
never trust the living well
let's talk about trust right consultants
guess what
they can help the vendors they can help
the government they can help but
remember you run the show
it's not that they are going to dictate
what you should do
you need to prioritize things you need
to understand what the implications are
you need to convey to them
what your priorities are what your needs
are what the business risks are etc
help yourself commit to doing what
you're willing to keep
doing not just what they tell you to do
right you need to be sustainable in what
you implement you can't just set it and
forget it
but you have to trust them too they're
not necessarily going to give you
perfectly sound advice they're not going
to to
as an example a vendor is not going to
try
to sell you some other vendors product
right they're going to pitch their stuff
they're going to
to respond in the way that their
capabilities are
are addressing right so look broader
understand what that is
take that as input and then decide from
there what you want to do with it
are you the knight of the living dead
under there well
let's talk about regulation and
compliance right many people hide behind
this regulation of compliance but
frankly
there's the argument that says oh
compliance isn't security
and security isn't compliance etc right
regulation and compliance doesn't really
help you
it does enforcing or
forcing you to do something but
it's not really the the end goal
right it's a it's a stopping point along
the way
and let's talk a little bit about
attackers right the bad guys don't
care if you are compliant with xyz
standard whatever that may be
right they don't get scared by that it
doesn't deter
them it actually gives them a bit of a
road map they know what you're required
to
implement and well they can work around
that they can use that to their
advantage in some way shape or form
well the other thing is look even if you
are compliant let's use the electric
sector again as an example
the electric sector has regulation
called nerc sip
right and that that's great but
that doesn't mean that just because you
are sip compliant
you are impenetrable by an attacker or
that
you're not going to be compromised in
some way shape or form
it doesn't mean that you are secure it
means that you've done some of the best
practices you've done the minimum
recommendations to
uh that are enforced upon you for
regulation but
everything underneath well that could
still be quite ugly
i'd rather talk about day o
day right so let's let's talk about this
and flip it a bit
let's talk about odays instead of day o
right
so the push for finding zero days is
well interesting right i'm all for the
efforts that explore and remediate
vulnerabilities in systems right
be that products be that platforms etc
but does it really move the needle
well let's talk about ics gear right so
it has long patch and service lifetimes
right
it's out there in the field for a long
time they don't patch regularly
they can't because it affects the
operations of the systems
not all things either that we discover
are fixable industrial control systems
sometimes the the hardware is just
physically not
capable of being able to implement
something
more comprehensive than what it does um
to fix fundamental problems that that
are inherent in
the firmware or the boot loader or the
architecture itself
and sometimes these things well they
can't be fixed
so if we find them and publish about
them
what impact is there from that well it
identifies a vulnerability but if that
vulnerability can't be fixed in the
products are we really moving forward
or are we actually hurting ourselves a
bit more
in my opinion our energy should probably
be more focused on layered defenses
on closing attack vectors on making it
so the attacker can't get into the
system in the first place
to hit those end device targets that
you're identifying zero days in
right the other thing is well decreasing
the time to detection across the
organization right
so attackers can be on your system
forever
poking around prodding looking for any
potential misstep that that you may have
what if you could detect them sooner
what if you could stop them
way early on and know that they're there
and eliminate that from happening
to prevent their pivoting from further
down into the system so that they don't
get to the point where they can exploit
those zero days that that are being
found on systems
now i'm not saying that finding zero
days is worthless finding zero days is
very valuable
it's great to have those things fixed in
in the systems
it's great to identify detection and
prevention
techniques and and filters and and uh
and
other um mechanisms by which you can
identify these happening in your network
right
but ultimately you have to be able to
stop them you have to be able to patch
them you have to be able to remediate
there's all sorts of different
approaches to this right but
first step is well being able to detect
right you can't stop something you don't
know that's happening you can't stop
somebody that you don't know is there
i myself am strange and unusual
well let's talk about that a little bit
right everyone always says that well
we're special we're different people
don't understand what it is
right they don't uh they don't get the
domain
or their i.t we're ot right
well guess what you have what it takes
to see through the craft
and solve the problems you don't need to
get wrapped around an axle
arguing about it versus ot or
whose system is more important or whose
policy should be applied right
and there's a lot of experts out there
pushing their views
pushing their opinions some of those are
well merited some of those are very well
respected some of those are well
grounded
but others are not right there are also
gaps
in knowledge in understanding and in
skills in
every sector on both sides of the fence
attacker methodologies are always
changing defender methodologies are
always changing
what is possible is always changing
but guess what we can still solve the
problem we can still take steps forward
we can still work on the things that we
need to work on
it's okay right so you take that input
from those experts you ask the questions
that you need to ask that you're afraid
to ask
you ask those questions you get them to
clarify you
explain what your requirements are what
your risks are the things that you're
worried about
the things that keep you up at night the
things you want to protect against in
your sector
the threats that you feel you have and
use them as a sounding board
they may come up with novel things they
may not
but then whatever input they provide you
you need to decide what that means to
you how you want to take that input
how you want to apply it and how you
want to leverage it and use it moving
forward
ah don't mind her she's still upset that
somebody dropped a house on her sister
well guess what
holding on to the past instead of
embracing the future
is all throughout industrial control
systems
across the board every domain is digging
in their heels in some way shape or form
and trying to prevent change right
change is
hard but guess what it's inevitable the
sectors themselves are changing
digitization modernization demands
changing from users
let's rego to the electric sector 50
years ago
there was no real things such as
distributed energy resources people
didn't have solar cells on their house
and wind turbines
uh deployed across the country and
generators that were
firing up uh in all sorts of residential
neighbors to
neighborhoods to provide power back to
the grid
right it was you had large generation
and it was what it was
but we're seeing that distributed energy
resources are changing the composition
of the grid and the grid has to adapt
plugable hybrids electric vehicles uh
modern electronics all sorts of things
are causing
changes even the mix of what generation
is it used to be
big spinning wheels with all sorts of
momentum and energy built up into that
but now you have peaker plants and you
have nuclear power and you have
you have coal and you have natural gas
and you have wind turbines and you have
solar and you have
all sorts of different mixes of
generation sources that are all doing
different things
the grid the domain the operating
paradigm
how close you operate towards uh the
the peak of efficiency all of that
is changing the ability to have
real-time communications
the the um quality
or complexity of of the system
itself right let's stop pushing against
that change let's stop pushing so hard
wasting so much energy
on trying to change what's coming to us
trying to push it away right and instead
we need to embrace it
we need to look at what it can do for us
we need to understand
how we need to adjust our mindset the
way we do business the way we operate
to accommodate it because that change is
coming we're not going to stop it
right and then we have to simplify the
approach that we take
we have to take what we look at as this
extremely complex and hard
problem and break it down into chunks
simplify the approach
go towards what we can improve work on
the things that we can do
and then go do it right don't just talk
about it do it
take a step do that one thing that you
know
will help you the one thing that you
know will move you forward
and start there and then go to the next
and then go to the next and keep doing
that
thanks i've been feeling a little flat
well
you know what he was run over by a semi
right he has the right to feel
flat but guess what we're getting run
over by semis every day right you've
seen in the media you've seen
uh all sorts of of reports
and and federal spotlights being shined
on
and on problems and the discussions
about increased regulation etc
none of these are really helping you
they're distractions right you know what
you need to do
you know you need your systems to be
more secure you know
that there are problems you know where
those problems are
right you've run these systems for years
stay true to that
understand what can impact those systems
and work towards solving that
and guess what it's okay not to be
perfect
but we have to move forward we can't
just sit there stagnant we can't dig
in our heels we have to be willing to
fix the problem
and so don't worry about what everyone
is yelling at you
right they're not telling you anything
that you don't already know
you just have to react you have to move
forward
you have to work on those problems
so stay on course work towards those
goals that you have
evaluate and assess the goals you've set
and make sure they're set correctly
right it's the worst thing in the world
to be heading towards
a destination and that destination isn't
even there when you get there
right so stay on course but evaluate
where you're going
understand that the world is changing
and make sure that you are working
towards addressing that right
and if you're not on course guess what
adapt and
adjust based on your priorities on your
needs
on your plans on where your domain your
sector
is going
so what about the government right
they're dumping a bunch of money into
this
well guess what they want to remodel
right
they want to change things a little
gasoline a blow torch
got it no problem right so big spending
is coming to quickly solve the problem
but
is that what we need do we need big
spending do we need a ton of money
well yes cyber security isn't cheap
some of these changes are not cheap
right
but we don't need to tear the whole
system down to be more secure
we can't just adopt all these brand new
shiny objects that are out there that
are
going to solve all of our problems right
just adopting that isn't going to be
secure we're not going to fix the
problem by that
we'll just change the understanding of
the problem more than likely
right so improvement does come with time
right and while there is a time and a
place
where we tear things out and we say look
i'm putting in this whiz-bang new gadget
and it's going to solve all my problems
critical infrastructure really isn't
that right we have to make incremental
improvement we have to use
layered defenses we have to move forward
in a variety of ways
and it's not rip and replace right rip
and replace is not the solution here
we're not going to knock down all the
walls we're not going to change
everything right
we're going to build upon what we have
and we're going to do it in a smart
and intelligent and deliberate way
what's the good of being a ghost if you
can't frighten people
away well guess what the hackers don't
care about your military grade
encryption your compliance with xyz
standards etc
right using those big buzzwords putting
out press releases about all the cyber
security work you've done
etc isn't going to help you it's not
going to scare them away
either right some may take it as a
challenge be like oh you think you're
hot
well guess what i took you down right
so let's talk about what people use for
reasoning right cyber security
frameworks are a good example
they're useful right but they're only
useful when they're used in the way they
were
intended they aren't solutions
and really what they are is just
scaffolding
right it helps you decide what you want
to build
how you want to go about it but you
still have to do it
same thing with with other frameworks
out there that we
use to reason about what attackers are
doing or how we respond to them
things like you know miters attack
framework etc look if you protect
against
everything in mitre's attack framework
are you going to be in a good position
probably right but there's all sorts of
things that aren't captured there yet
there are all sorts of things that could
affect you etc
and is it the best way to go about
saying oh well let's reason about what
uh what an attacker can do and
prevent it maybe right you could also
look at inl cce
you could look at at all hazards uh
approaches you could look at eppery's
approach you can look at all sorts of
different approaches to the problem
but really what matters in the end is
what are you scared of
what impacts your business what impacts
your domain the most
what is your worst nightmare right and
how do you make sure that that worst
nightmare doesn't happen
and then once you know that that one
won't happen let's move on to what's the
next worst thing
right logic will prevail
right we don't need to just invest in
whiz-bang gadgets to invest in
whispering gadgets
we need to understand what our risks are
we need to reason about those risks and
that's where the frameworks help
right they allow you to think about this
in a scaffolding
miter attack is a framework right it is
not a solution
cyber security framework is a framework
not a solution
62
oh you know i don't know 800-53
all the different standards that are out
there isa 99
etc they're going to help you be
in a better position but they're not
your solutions
you have to do that you have to build it
the other thing well guess what go ahead
make my millennium
come after me right bragging about how
secure you are
and you weren't affected by x etc that's
only encouraging those
that want to target you i guarantee
you are vulnerable you will
be taken down you will be compromised if
you are properly targeted
the question is in the end how do you
respond when you're on the ground when
you get punched in the face and you're
down
do you get back up do you improve
or do you well sulk off and hide right
or ask somebody to help you or beg for
for assistance right so go ahead
make my millennium move forward
thank you if you want to reach out again
i'm tim yardley yardley illinois.edu
and uh let's summon some beetlejuice
beetlejuice beetlejuice
thanks
you