so
everyone welcome this is jeopardy
industrial
control systems security style my name
is mary brooks and i am your host today
r.i.p trebek i will not be nearly as
good as you
so the rules of the game today are very
simple
they're pretty much the same as for a
normal game of jeopardy with
a few distinctions when the question
comes up on the screen you will have the
chance to buzz
in on your phone everyone show me your
phone and that you've got the buzzer
ready to go this is not a camera do not
look at the sticker
after three seconds of waiting the
buzzer is going to unlock
and you can shoot your shot by buzzing
in to answer the question
i will be reading the question out loud
but you can cut me off
if you decide that you know it faster
than i can finish speaking
um you'll have a further 10 seconds
after you buzz in
to answer the question before the whole
thing cuts off so
it's not a lot of time if you're not
good under pressure but it's plenty of
time for it to get
really awkward if you don't know the
answer to the question
when that's what we'll be waiting for
yeah
when you buzz in you have to finish
answering within five seconds
um no take backs if you start to say an
answer you got to continue with it
if someone answers incorrectly everyone
else gets a chance to buzz in
and there will be two rounds like in
regular jeopardy plus
a final jeopardy question there are
only three distinctions from regular
jeopardy
the first is that double jeopardy is
just an automatic doubling of points
awarded
i don't know i didn't make the system
and no one wanted to create a bespoke
jeopardy application for me so what
that's just what we're going to have to
do
the next thing is that there is no panel
of judges
so if you disagree with me on anything
the
only way um that you can get the points
back is by
fighting me for them so just really
angrily respond
you know present proof say i was there
in the room and you're wrong
angry angry angry tweet at her with yes
angry tweets um you guys have better
twitter followings than me
so i won't support it flip it can we
make twitter the jedis can we stand up a
live twitter poll
no because this is recorded
live for now not live for when they play
it christopher
also if you can get your other teammates
on the panel to
tell me that i'm wrong that's extra
points but obviously they have an
incentive
to tell you that you're wrong you're
always wrong yeah
yeah you get the point all right and
then again just a final reminder that
the third difference is i do not have to
finish reading the question before you
can buzz in
just go for it does that all make sense
yes yeah sure awesome okay
so let me start by introducing our
players today
please wave when i say your name the
first is chris cistrunk
a technical manager at mandiant's ics ot
security consulting team
chris is prolific on twitter where he
regular regularly posts
dad jokes as a service under hashtag
dj aas uh give him a follow he also
updates folks regularly on his sock
status chris do you have any socks for
us today
i'm wearing flip-flops right now so
that'd be no
deeply disappointing all right not off
to a good start there
then we have maggie morgante a product
security researcher at schneider
electric
it is a lesser known fact that maggie
was
actually raised by a clan of feral
engineers and
trained under chris this drunk in bad
jokes as a service
so give her a follow on twitter as well
as
chris goes back to his luddite days of
these scientific times
from 1819 was it chris 1890
1890 excellent last but not least
tatiana bolton
give us a wave or a hook as it were
she's the former cyber security policy
lead at
the department of homeland security's
sisa not sisa sissa
always sissa right tatiana that's
correct always sissa i'll fight you
about it
don't cross tatiana or the hook and a
policy director at the cyberspace
solarium commission um tatiana loves to
ballroom dance
and she has not one not two
not three but four children i think
that's one fewer than kris krebs
oh that's correct there you go that
could have been a question
could have been a question um and before
you ask
yes she is my boss and i did offer her a
copy of today's questions in exchange
for a raise
which she declined so you're all on the
same playing field
so finally last thing is the prizes so
behold here you have
first prize this is the joystick of
honor
moves in four directions you can set it
on your desk or something i don't know
what's chris's face right now the hard
hat
of mediocrity with a promise
and then finally the supply vest
of you know sadness
shame sadness
on it at the very end it says
so the hard head of mediocrity is
probably preferable don't be lost
all right any questions
no bonus points if we wear either of the
last two during a real life compliance
audit and take a picture
yes you will have to resend that um
you'll have to submit it retroactively
to twitter and then
i will automate automatically make you
win so it doesn't matter if it's like a
year two years from now
you'll automatically win and what if you
never participate
in an on-site audit then what
then you got to go in front of sis's
headquarters with it oh god
that's equally bad fair fair i will
i will take one all right all right
without further ado
we begin um i don't know chris
maggie rock paper scissors for who
starts yeah
rock paper scissors shoot yeah
you guys oh this is terrible all right
did make us guess a number or something
okay okay guess the number between uh
one and three
what that's the worst three
mary one tatiana two
you have to oh it was two oh yeah all
right so tatiana you started off
i'll pick alphabet city
for 400 trebek
right adx
stands for what
[Music]
really good at this chris
analog digital converter not quite
dang it it's actually adc but
tatiana uh automated
detection settings no but you're a lot
closer
maggie anything
oh she's going to keep zero dollars
that's what she's that's fair
she's going to actually automation and
data exchange
oh telephone pbx adx gotcha
so i realized i did completely neglect
to introduce our categories my
significant apologies and we will
start with that so first category ics
and the middle east
give me the industrial patrol system
related vulnerability or event that
happened
somewhere in the region loosely defined
as the middle east by americans
two if only or that easy you will tell
me
the simple solution to fix all your isds
problems
third is alphabet city you're gonna give
me the full phrase of the abbreviation
or acronym
fourth is colonial pipeline in the usg
that may or may not be
tatiana's soul category depending on
nda restrictions by our other two
players
and finally the last is dune apparently
it's mandatory to read this book if you
care about
uh industrial control systems is that
true
never read it never read it i read it
oh all right all right well here it goes
tatiana why don't you say the next one
oh god why i picked so well on the first
one
all right well let's go colonial
pipeline on the usg for
200 trebek
the ransomware targeted colonials it is
believed
this trend in which business computers
are linked into control
systems that contributed to the pipeline
shutdown
it's really easy yeah i know
[Music]
um what is
i-t-o-t convergence
[Music]
i think she got the answers in advance
she got the answers in it no i told you
i held it hostage for a raise and she
didn't give it to me so i can't buy
shoes and she can't answer the questions
works out tatiana next to you i'll go
colonial pipeline of the usg for 300
please
new guidance was issued following the
colonial pipeline hack
to whom in the federal government are
pipeline operators required to report a
breach
maggie essay
wait do you have to do that
yeah oh mary i did this card
yeah sorry you missed this that's sad
that's that scratch
i was definitely gonna say scissor so if
you're
definitely gonna say it tatiana well why
don't you pick the next
to be fair if there's an error it goes
back to the previous person thinking i
will go colonial pipeline in the usg for
400 please
all right colonial pipeline had not
implemented this login verification
system for its accounts when it was
breached
leading some in congress to criticize it
harshly
for those with nda's reporting reports
that it had not done this tatiana uh
what is two-factor authentication
must remain silent
oh no okay what is
if only it were that easy for 200
trebek this term
is a measure of how quickly a system can
be brought back online
following an incident chris
[Music]
so is it a term or an abbreviation can i
ask that question
um it was a term but if it's the correct
abbreviation it's a
mean time between failure
mtbf god you're thinking way too
sophisticated
i i think you're right
but it's really simple can you can you
extend
i mean yeah i think
resilience just bringing it back all
night what
no one uses that term
that's fair chris's answer is correct
we're sicilian resilience would mean it
would never fail in the first place
that's true it's makes you feel better
when i saw
the adx for alphabet city i thought it
was supposed to be airports an air
airport code yeah i would say you're
like
all right negative 200. all right uh
let's uh let's do if only we're that
easy
for 500 all right
here goes don't look at me kaspersky or
this practice warns certain scanning
software to skip it
chris what is antivirus antivirus
exclusion list okay same thing well you
put that in the do not scan
folder yeah
all right um
if only we're that easy 400
nist has warned against this practice
explaining that system security should
not depend on the secrecy
of the implementation or its components
maggie
security by obscurity
to you maggie
i am going to do uh
we'll keep rolling if only were that
easy for 300
just blank it doesn't really work in ics
maggie um
[Music]
patch sorry i thought just blanket and i
clicked because i was like it can only
be
patch or air gap maggie
next question uh if only were that easy
for 100.
maggie for double the points can you do
it
yes
and to you again
we'll do we'll do dune for 500
just because i like being completely
clueless
this one's actually really hard i don't
know i've never really done myself
all right oh good the first draft of
dune
actually came out of a non-fiction
magazine article
written by the author about what
[Music]
what is non-hierarchical hyperlinked
virtualized blockchain
that is a wild answer
the old college try
was she incorrect is definitely
incorrect
distinctly
it was about sand dunes he
learned about a sand dune experiment and
he thought let me write a whole book
about a sand dune
ah wow wow wow all right to you maggie
uh let's go ics in the middle east for
100. all right
do you guys have security clearances a
worm discovered in 2010 is believed to
have been targeted
this chris what is natan's
iranian richmond youth facility
and to you again okay so
let's do icsn
no no alphabet city 500.
what does match lab stand for
[Music]
chris i've never
known what it is but i'm going to guess
what is math
laboratory so close
[Music]
any other takers uh
i don't want to wear the vest of stream
yes
go baker
matrix laboratory who knew
so close reporting chris to his pe
his picture i never had to use it i used
mathcad
so i should have asked that one instead
all right back to you chris oh even
though i lost
yeah default all right fine alphabet
city for 300.
data i'm heaven
supervisory what is supervisory control
and data
acquisition
chris to you all right white on rice
let's see
oh i'm above board all right
um what is alphabet city 200 or
two dcs
chris what is distributed control system
and to you again alphabet city 100
[Music]
plc maybe you guys can get this
going as fast as i can go uh what is
programmable logic controller all right
it's coming for you max coming for you
max
i'm like hitting it as fast as i can i
know it's me so was i
yeah i have a gig a bit fine i'm over
here i have a pirate hook
hook impedes your you're hitting yeah
i'm just
yeah uh all right let's go for
ics and middle east 500 and i'm not even
sure i can answer this question
depending on what it is
[Music]
this product made by schneider electric
was the target attacked
what is triconics
damn we don't have any spider
representatives
yeah did you know it though
of course she knew it yeah i mean
they never let us forget
never forget never remember okay
um let's just keep going
down the road let's see ics in the
middle east 400.
2012 cyber attack against this company
reportedly
chris it is uh um
what is it was a ransomware attack
called
oh come on five seconds is up oh yeah my
brain just
my brain just lost maggie my brain is
saudi aramco
oh well that was the company that wasn't
the ransomware
yeah it was the company
i thought i was asking for the
ransomware name
maggie has no qualms about sliding and
taking that one
none i'm going to go with ics in the
middle east for 300.
2020 iranian hikers repeatedly breached
the hmi of several water facilities in
this middle eastern country
chris what is israel
and to you again all right ics in the
middle east 200.
reportedly hackers who reached iran's
nuclear facilities in 2009 and 10 glared
the thumb
the song thunderstruck by this
australian rock band maggie
ac dc any other australian rock band
worth mentioning
i didn't read the question i thought you
were australian i mean
all right you've got the board
got the board i've also got a lead
hmm nurture that wow so i can
like nurture this we're coming for you
megs
i'm gonna go and pray with colonial
pipeline for one hundred
surveys since 2002
this sub agency of the department of
homeland security
tatiana what is the tsa that one's tsa
so smart so smart to you pirate hook
boss
not me but the plan sorry so
what is uh colonial pipeline the usg for
500 trebek
this entity in the department of the
treasury forbids ransomware payments to
any entities sanctioned
chris this entity and
oh it's in the department of department
treasury i don't know i just lost points
ah
who says you can't send money to
terrorists that's
a lot of points to lose i'm not gonna
guess i don't care
these are internet points
one of us is going to have to wear the
best chris
ofac oh yeah
never heard of it it's okay most people
try to stay clear a bit uh so i think
tatiana you're guessing uh what is dune
for 400
trebek please we're publishing the dune
series
author frank herbert spent time working
in this role on several political
campaigns
[Music]
tatiana what is speechwriter
yes whoa this don't have anything to do
with control systems
no but they have everything to do with
dune no you know who we blame for this
this whole category right is things we
can blame
john hulk list for yeah that's true
we're blaming jon
well continue to ask questions and
perhaps that will become
increasingly pertinent to the categories
uh dune for 300 trebek
[Music]
in december 2015 the apt sand worm
maggie black energy
which oh it's not just black energy
i know but i knew that's what they had
going for basic here okay you want extra
points maggie
come on extra points we're going to sit
phillis and chris
what others like energy three oh
well that would we would accepted that
too all right dude for 200 trebek this
one's maggie
that's maggie yeah easy
june for 200 trebek
arguably the most iconic creatures from
the series are the sand worms
sand worm is the colloquial name chris
apt-28
which is oh russia and russian
government yeah seven portfolio yeah
i had the book right there uh dune 100
it's the only choice
in the dune series this is the
universe's most valuable commodity chris
the spice must flow you haven't read the
book
i've seen the movie i've seen the memes
i was gonna say water so we have a
first half winner is maggie
and we will now be copying these over
because the date the game does not allow
you to do two at once
oh so we
call this our commercial break all right
so i've
now re-entered your points so right now
in the first half of the game
maggie is winning with 1800 fictional
points
chris following and a decent lag behind
her with 700
and tatiana with a royal 200 points
cruising
for the best of
oh she's on shame beach she's a pirate
already
this might be what we call cashing it in
um
all right we'll allow the person with
the fewest amount of points to lead off
tatiana what would you like to pick
oh sorry i should um announce them
actually yes please
so today we've got the og the aurora
project which fun fact has been
declassified
no worries there team number two going
boom
i take i tell you the victim and you
tell me the type of attack
and if it was malware i'm going to need
the specific
type of malware then we've got whose
country
is it anyway top level domain version
the cyber apocalypse
in which rich wealthy men tend to tell
us about all the disasters that new
technologies will bring
and framework potpourri in case anyone's
a lawyer and just
really really likes government
frameworks so tatiana it's to you
i will go with the cyber apocalypse
for 200.
[Music]
former nsa director michael hayden has
blamed this
infamous leaker of classified
information
for lighting the fuse of the destruction
of the modern internet tatiana
who is edward snowden yeah
see you again the cyber apocalypse for
300 please
when elon musk warned that scientists
were summoning the demon and said he
feared human extinction
tatiana was ai yeah
you've got the machine learning
right am i the only one um okay
cyber apocalypse for 400 please it's
gonna be my only categories
this phenomenon was described by albert
einstein as spooky action
at a distance
[Music]
not touching it quantum entanglement
oh quantum entanglement i should know
that
all right to you tatiana
cyber apocalypse for
500 please
this nasa scientist warned that space
pollution could trigger a cascading
series of collisions in low earth orbit
rendering satellites unusable for
generations
the effect is named after him
kessler it's the kessler effect
and to you again tatiana and go for same
category 100.
this individual claimed to get hacked
you need someone with 197 iq and he
needs
maggie donald trump
yeah i remember that because that was
the day i learned i was smart
always good to have one of those days
all right you've got control of the
board okay
uh let's go whose country is it anyways
for 100.
all right so remember this is a
top-level domain version but
so this will all have to do with tlds
this american nonprofit coordinates and
manages the domain name
system
[Music]
tatiana what is something blockchain
black changed the answer to everything
right i knew it was
uh i knew the abbreviation i just
couldn't yeah but we'll accept
abbreviations
that's okay it's okay
we accept them because honestly whoever
knows what the full word is anyways
oh wow that's uh well in the uh last
round we had to know that that's true
i reserve the right to change my opinion
at a moment's notice rest in peace dan
kaminsky
he was one of the key holders yeah
um maggie back to you we'll do
uh going boom for 100
200 the 2018 winter olympics in south
korea
[Music]
name the malware
[Music]
oh don't think too hard
uh same for 200. riviera beach water
utility
the type of hack we'll do here you don't
have to get specific
[Music]
ransomware
see you again same for 300.
bowman avenue dam in rye new york
chris it's just uh scanning i think
yeah basically reconnaissance
chris you all right uh going boom for
400.
please if you get this one right maggie
won't be twice as far ahead as you
the ukrainian power grid
chris this is uh known by two names
crash override or in destroyer either
would have done it
into you again 500 please same category
okay marucci water services
and tahama calusa canal chris uh
insider threat or disgruntled employee
all right i'm just here i should have a
drink
you should have a drink there's no
reason you can't have drinks i only have
a cup
although maybe there's alcohol out there
somewhere
i have water we'll have to save the uh
the other beverages for later it's not
five o'clock yet
it's five o'clock somewhere hear that
all right aurora aurora project for 100
please
researchers at this location famously
blew up the 27 tonne
maggie idaho national lab did you work
there or something
no i worked at oak ridge
tennessee right yeah okay board's yours
uh same for 200.
this is the year that the aurora project
occurred
chris 2007.
roar project for 300 please
in 2014 aurora was accidentally
declassified
chris freedom of information act
yes boy a mix-up yeah great times
quite a bit quite the mix-up three times
we enjoyed reading the results so
thank you mike asante rest in peace
aurora project for number 400 yeah all
right 400.
the number of lines of code that were
used in aurora to blow up the generator
chris i think it was 19
dang it maggie 27 nope
tatiana i'm not losing 400 points
it was none
what that's
how's that possible uh
well you might find me on this one but
keep going ask the next one
they had to reprogram the switch
engineering labs
relay to fix it right
to to make it go bad anyway
they had to use anyway all right 500 uh
aurora
type of vulnerability that was
weaponized in aurora chris well
there could be two answers it had
default passwords in the relay
or also the uh the vulnerabilities
was being able to change
the settings with no authentication
i mean dave default
credentials or a password
i actually don't know if that was an
additional one i was looking for
something slightly different um if you
can google it and show me that i will
okay well um the other vulnerability was
is uh it was had to do with electrical
engineering
um so it was closing a breaker out of
out of sync for that reason
we said it had no lines of code because
it was just closing it out of sync
oh yeah they had to change the code in
the
okay so we'll give you guys both points
back for that
she's such a benevolent dictator no i'm
just not going to fight with people who
may have investigated it
oh we just saw at the time i was at the
power company we had to go change all of
our passwords
oh and yank all remote access it's
probably a good thing
so long ago um what country is it anyway
for 200
tld for this country is abbreviated.cn
maggie no chris sorry what is china
extra points i decided that that's a
real that was
that was really good by the way it was
great it was really good
yeah uh what what whose country is it
anyway for 300
the tld for the british indian ocean
territory is this abbreviation
[Music]
very very popular with boutique
companies tatiana
dot io
it does not stand for input output
to you pirate hook whose country is it
anyway
for 400 the tld-aq covers the region
south of latitude 60 degrees south
there's like only one thing south of
60.
[Music]
there's one thing south chris
what is antarctica
good job all right uh that was i was
thinking that but i didn't want to risk
my 400 points
i risked it all right whose country is
it anyway
for 500. how well do you know the
question there's a i hope there's a
third
round
popular ai programmers the tld.ai
belongs to this territory
this is one i have to answer nah you
don't have to answer it but no one else
you get first dues uh does he first have
to pick how many points
no it's for it's for a thousand if you
read the screen
oh sorry
that's why i'm at 900 chris
i can't read or answer questions
can we get a pet cameo
ah oh it's a baby good boy
all right no takers on this one do i get
extra points for the pet cameo
yeah i think so i think so too there you
go
turns out it's anguilla sure it is
popular
yeah we all knew that right
we all knew that yeah yeah
he was cried at the tip of my tongue if
i saw my controls just
trying to talk to that tld i'd be
worried
yeah unless you were an angela what's an
angela
probably like a beach right something
nice they probably got substations
maybe somebody's on vacation and they're
remoting in
it's not you know china i mean how many
times though have you logged onto a site
that's got the dot ai extension
i don't know never oh
i see them all the time oh they're
getting increasingly popular it's like a
little boutique stamp of
might be hacked mary i
don't run the companies she might be a
uh she might not even be real this might
be all it might be a boss it's a deep
fake
i just saved into our street dot ai with
my oh so i get to
let's see as i guess it's still my turn
it's your turn this is gonna be a super
fun one if you like framework potpourri
for 100.
arguably the most popular security
framework this government driven setup
has a framework core
chris cyber security framework
hi nist nist
christie uh framer potpourri for 200.
this proprietary framework models the
behavior of cyber adversaries
chris the miter attack
framework um
framework ready for 300.
this 2002 act updated in 2014 gives dhs
official authority over the federal
government's i.t practices
titanic isn't this your like job
i want to guess but i'm not going to hit
the button i mean i don't want to
no sure go for it
um the
i don't know the dhs act that's not that
was in 2003 the
cyber security
i don't know fisma
security management act
all right christie framework potpourri
for 400.
a set of standards focused on protecting
the bulk power grid
chris yeah it's going to be a nerf ship
and the last one 500.
the international series of standards
for industrial control systems
chris isa 62443
well deserved 500 points
all right so it is the final jeopardy
time
aka final factor because apparently they
don't have the rights to jeopardy
so you can either enter your wager on
your own device or you can tell me and i
will enter it myself
chris we're waiting on you i i know i'm
doing some math here
go ahead
schneider would say all right
all right you have 30 seconds for this
question
this security model which happens to be
a homophone with a major chicken
processing company
includes one or more demilitarized zones
in its architecture and defines
different levels of critical
[Music]
infrastructure
[Music]
all right tatiana i start with
you i think that's just said blockchain
just tell me what you said i have to
reveal it oh
uh i just said that you got it right
well you have to hit click see answer is
tyson we'll fix that in a minute
all right maggie what did you say purdue
model
that is correct you wagered 2300
and chris purdue model as well
the winner is team chris
so overcoming the adversity of the nda's
come back
impressive impressive cheers to you sir
really heroic
doesn't even read that dune book i might
have to read it
there's supposed to be a new doom movie
maybe just watch the movies zendaya's in
it movies
yeah yeah that's all you have to do all
right so chris
wins with 7 200 magic points
maggie with 46 and tatiana i will hand
deliver you
the vest that's sound i'm actually
i'm actually very excited for this hat
yeah because you talked about blockchain
in your research
and i have to wear the vest of sadness
and
infuriating i i need that controller
what do i get to control with it though
usually you won't it's actually fully
functional
um so you bought it out of china though
so i'm probably controlling something
around the world
check it before you plug it into your
industrial
control system somewhere but uh barbecue
pit
what i'm gonna hook it up to my barbecue
pit there's a
you could turn them you flip the ribs
using it
are we invited sure come on down
little barbecue session there's a direct
flight from dc to to jackson
i will come for barbecue there's no good
barbecue in dc
none ooh for you
they've got barbecue there you go
you have to drive up to personalville
it's called monk's bbq
and it is amazing mugs with two g's
no monks like oh like m-o-n-k-s okay
super good super super good
all right well this concludes our
industrial control systems
jeopardy that kind of turned into
regular i.t jeopardy
um and thank you again to our players
chris maggie and tatiana stay safe out
there y'all
and have a great day
you