hello everyone thank you for tuning in
to our talk
it takes a village students performing
ics security assessments
my name is dennis scar i'm tenured
faculty here at everett community
college and i was also a member of the
national guard where we were performing
a handful of missions
in different critical infrastructure and
our unit even stood up training
and trained other cyber operators on how
to perform assessments
in an ics space i took that experience
and the lessons learned and rolled it
into the fabric of a five credit class
here at everett community college and
we're presenting on the first
class to actually go through this
experience and performing their
very own mock ics security assessment
special thanks to all the volunteers at
ics village
i know it takes a lot of work and effort
to get things off the ground for these
events and we appreciate the opportunity
to share our story
every year i would return to the defcon
and spend a lot of time at the ics
village
i really appreciated having access to
the technology
the talks culture and even the community
involved with everything
and when we had an opportunity to pursue
a grant
and you know possibly you know build up
an ics program
i immediately thought of those
experiences that i had
at defcon leading up to our pursuit
of this program
so when the grant opportunity kind of
came to our team we're exploring a lot
of different technologies and which we
could possibly invest in
and you know the typical stuff comes up
like should we go cloud server more
networking stuff
and you know obviously cyber security is
big and a lot of student interest is
there in that space
but it took a nudge from my team to say
hey you do a lot of cool missions you're
doing all this ics stuff like why don't
we go there
so you know we did and i reached out to
tom van norman who's the co-founder of
ics village
and you know i said tom like what you
guys have is extraordinary
what would it take to actually get that
here on our campus
and we came with a plan put in the
offering
and you know we were i was thrilled i
was actually blown away that we actually
had this opportunity and i'm very
thankful for the state of washington
to actually provide that to our students
when we created the assessing and
securing control systems class we wanted
to make sure
that we could have students from
information technology
operational technology and business
programs
all funnel up into this class so we can
have this
cross-cut of culture all within uh the
same class
in in my experience with these
assessments it really took those three
areas to come together to understand you
know not only how the business is
how businesses function but
how does the business processes map down
to the information technology
that technology supports those processes
and then i t how does that actually
relate to
all your different uh operational
technology down together and once you
have those dependencies mapped
and you understand how the whole system
truly works
that's when you can start looking at how
to effectively apply security controls
and find those crown jewels within an
organization that require
deeper layers of protection
all throughout the quarter students were
working as a team to actually prepare
briefings
to a a mock uh manufacturing
uh group you know where they had to
present different threats
uh that happened in real time so when
oldsmar happened
and the colonial pipeline we rolled that
into the fabric of the class they had to
actually kind of
take what information was available to
them and then present
to a group in terms that they actually
understand
so we built on those skill sets over the
quarter and during the last week
they were presented a company that
actually you know enjoyed their
presentations and hired them
to assess their company and the company
i created was
uh fantastic plastics it's a plastic
mold injection company
and they provide a product
to a aerospace manufacturer in the area
and they also have dod contracts
so students had seven primary tasks that
they had to deliver on
and in addition to you know working with
uh
the customer which was me through email
they had to
perform a physical assessment of this
environment
and then perform uh or give a
presentation
uh to the owner and the owner in this
exercise was tom van norman from ics
village
and they they knew that they had to
present to someone
knowledgeable they didn't know that they
had to present to
the creator of the wall
sharing their experience of this
assessment are two students
chris and alex who took a a
big interest in ics over the quarter
and have have a lot to offer to the
community
i'm proud of all of our students who are
choosing to get their education
on top of a pandemic right now
but i really want to take a moment to
have two
of uh my students share their story
hello my name is chris von rabiaton and
this is alex velgovsky and i am a
former student graduated uh
everett community college in winter of
2020
and uh i'm currently in north pole
alaska so
pardon the bad connection
i'm uh justin washington over here i'm
alex
i'm a recent graduate at everett
community college i closed out my time
taking dennis scars ics security class
with chris
and i came back to everett community
college just
for that class yep
the big uh capstone project that we did
for that class was a
mock security assessment that was
enabled by
an ics security wall
that we were able to acquire thanks to
tom van norman and grim
and what it is is it's a piece of
hardware that it's
an all-in-one kind of ics uh solution
including the hmi the plc and
the actual in-out process towards the
end which
i guess was a plastic making device
yeah well our our teacher dennis carhy
um
works with the air force national guard
and he created this capstone off of his
actual experiences in the field
and so he created this company
like the fantastic plastics
that has a dod
priority plastic mix and
and so we were sent in to assess
and secure the
the company and uh
the scope of our the scope of our
assessment was
having to do with the operational
technology part of the network
we did not um deal with the business
side
though in this scenario there was
elements
of the business network as well that i
think were critical
as you know it's important to kind of
tie those two networks
uh together because you know the air gap
is not a reality in 2021 that's my kind
of
favorite quote now but what we did is we
we mapped out all the relevant network
devices
you know every every single critical
device and service and data on the on
the network and we
were able to scan for vulnerabilities
that were
had the potential to impact those uh
elements that are most critical to the
system
right yeah we um
had actual physical access to this wall
on
the campus and so come in
hook the laptop into the switch and have
access to the network
and uh took because it took me a little
bit till i figured i had to change the
ipa address to be on
the actual network but from there we
were using a
netdiscover and wireshark to do passive
scans
to like try to see what was out there on
the network
and uh since ot
really doesn't like in map we actually
got uh signed off to actually
be allowed to use nmap to
start pinging actively pinging and
actively scanning
for vulnerabilities and what was on the
network and then we used grass marlin to
just get a really good map
of everything and uh after we
had our map we were allowed to
take the next step in the assessment and
get a foothold
into the network and start
playing around with what was on the
network
yeah not so much trying to break
anything but just
see what was on there right it was
really
great fun uh seeing you uh run the
python script
that then made the water tank or start
to
go haywire that was yeah
that was pretty good good times yeah
what well using the the
pie modbus discovery script and so being
able to see the
registers for the plc's and everything
and like watching them
change i'm like oh that's what controls
this thing let me change
use a different script and change that
register like
put the the water output the maximum
and watching dennis being like what the
heck was that
and then other plc is like oh i'm gonna
change the register numbers on this and
having the entire wall
shut down well lucked out that i mean
this
this thing is well made so just a few
pres
button presses and it's back up and
running but just like realizing like
okay
this is something you could do to like
effectively like shut down a business if
this was
in real life and uh then doing
uh the ettercap dos attack on the hmi
and like locking out
the ability to change the
controls and like
this is like this is something we're
we're seeing nowadays
and like we can actually visually see
like and be right there when this kind
of stuff happens
and like okay now we see how these
people are getting in
and doing these attacks
yeah so there's there's a huge kind of
exploration
based um element to this exercise it's
something that you don't get with a
something like a sim or a vm
which is you know a lot of my previous
security classes were based around those
kinds of exercises
this was very much a you get to
go in and you and there's like the whole
network out there for you
to to explore and to to work with and
but but do you also do it in a very or
controlled and organized
manner this is based off of dennis's
time with the national guard and the air
force
he's been doing security assessments
with them
for 10 years i believe he was involved
with the 2016
elections he did some cyber security
assessments relating to that i believe
to voting
uh system hardening all right yep
and so he was able to bring a lot of his
experience into this exercise and
he was able to build a highly kind of
modular
um you know
project that it's it's it was all up to
kind of the students
to um to make with it what they will and
and one of the kind of big takeaways
that i personally got
out of it was having to deal with teams
and working with
um the time uh crunch element because
you know when you're doing a security
assessment uh professionally
you're not doing it by yourself you're
working as a part of a team and you have
to
you have to know how to divide roles up
and
how to kind of tackle the challenges
that you're
faced with in a logical manner and
that's kind of
what uh dennis helped us with but
there was no hand-holding involved it
was a very much kind of
sink or swim kind of situation which
and he always says this um you learn
you really learn the most when you're
going through something hard
like you that's when the best learning
happens right is when you're
struggling right because if you're no
pain no gain as they say
yeah and yeah and like
when you're you're you're actually doing
this assessment like we were an actual
like red team and
like you don't in those kind of
experiences you don't have
somebody behind you going oh oh you did
that right
or like this is how you get to that like
we actually had to troubleshoot and
figure this stuff out
and but also sting within scope
of our
like objectives objectives and their
sod and all that stuff
right you had to get authorization to be
able to do certain things i remember
when we wanted to um try using default
credentials to get into some of the
network devices that's something you had
to get authorization to do
which again is that's how would be in
in the real world you know a business
might not want you
accessing uh certain you know documents
um so it was highly effective as an
exercise
in that sense and again if you think
about it this is how
um security assessments go in in the
real world every network is going to be
different
um for me i'm actually
working with a an aerospace manufacturer
currently myself and so we're constantly
dealing with
these principles um almost all the data
that we work with
is highly controlled it's called cui uh
controlled
unclassified information department of
defense is one of our clients so
it's if we don't if we fail to protect
uh the data and the confidentiality of
that data
it's it could mean huge uh fines for us
or loss of face it
certainly we can lose customers because
of that um
with our assessment we were primarily
working with
you know all that i just mentioned that
was part of it
and then the really exciting stuff was
actually disrupting
the uh the the hardware itself
which but that would be on the
operational technology side
um yeah and like for me this
class really like being able to be
working with the first ics
wall in higher education in the country
or even in the world really like
it so solidified like okay cyber
security's the way i want to go
so i'm like currently enrolled in sans
so i can get that bachelor's degree in
cyber security
and like looking at
pathways that i can take in
cyber security now and it's like icgs is
one of them and it's like i wouldn't
even think of doing that without this
class
and so being able to just work with this
actual thing instead of
like oh here let me do the point a to
point b
like follow the instructions and the
simulation
it's like having this actual
physical thing that you know see
how the little things you do
affect everything and being like okay
i can do these things now how do i
protect against these things
yeah what you're saying really um really
hits home for me because
i was very new to i.t even when i
started the program here so i had to
learn the hardware and the networking
principles like from
from the ground up and then it was only
when i started getting comfortable with
that
that i started even getting interested
in security
and again those earlier classes they
were all dealing with
just very rigid simulations very kind of
clunky
vms and i never had a chance to really
like stroke that fire
to to really become invested and
interested
i mean i wanted to but what really did
it was
be this exercise with the wall like
that's what
that's when it clicked like you actually
have to do the thing
to know you know if you enjoy doing the
thing
or you know maybe you don't but we both
do yeah
yeah i i i've done
ics village uh hack the plant
plant planet uh ctf and gotten
third and i was like oh cool i i know my
stuff and then i get
a chance to work with like there is so
much
to learn and it's like it's
it's just mind-boggling and so cool that
we got to have this chance to be like
the first ones
on the doorstep of this expanding
field of like because ics is just
so in the news right now and exploding
and
like we get a chance to actually work
with this stuff
so it totally like
sets us up for like our future and doing
these
doing assessments and doing red team
blue teaming and
all that stuff and we we need to build
the workforce when it comes to um
security experts
and here in washington especially i mean
there's we have such a big aerospace
industry
which is you know like what i described
with what i do it's
it's extremely important to be able to
have these skills and to know how to
um prioritize security from the from the
ground up
so it's it's not only is everett
community college the first place to
kind of
do an exercise like this and have um the
wall
that type of hardware we're also in a
state that really
it's the best place to um to kind of
begin to build that workforce up because
we need we need people who understand
this stuff
and who've experienced it you know for
real not just
not you can get a lot from a book you
know but there's no substitute for
experience
yeah so uh that's looking like our time
so
want to thank defcon the ics village i
want to thank
dennis for being an awesome teacher and
tom van norman for
getting us the wall to mess with and
thank you everyone thank you alex
thank you alex and chris for sharing
your experience it's been a pleasure
having me in class and i hope to see you
in the control system security community
in the future maybe you will be
presenting by yourself at def con in a
couple years
so with that you know you know that was
what we were able to do
with our initial investment but we were
even more fortunate to get
another round of funding from washington
state
uh to get even more products to expand
this to the even the next level
and now we have you know individual
trainers with a plc
where they can perform a handful of
exercises whether they're programming or
just network
uh exploitation traffic analysis you
kind of name it we're kind of building
this stuff as we go
you know the newest version of grimm's
uh
advanced trainers where they have their
own firewall switch plc
and an esxi server under the hood you
know we have
you know these will be part of our
competitions as well as workshops
and our classes you know here at everett
we teach you know uh
servers networking help desk traditional
i.t stuff
and we're going to be working to
actually incorporate these into all of
our classes
so you know students aren't just getting
like an ics class
like they're getting exposure to it as
throughout the entire program and
they're getting away from the
traditional i.t stuff
cisco is great but how about you do
those same kind of concepts on a
fortinet and see how that kind of works
out
and you know moving right along our 15
foot wall here uh the latest addition
is a building automation system here
with the latest and greatest alan
bradley plc
some some kind of newer equipment you
know we got
rf rfid uh
a new hmi and a very very sweet
uh wrapped uh server that's hosting our
ctf server
in here so what this
element adds to our program is you know
obviously there's new technology new
network protocols that we get to
interact with here
but you know this is also built into our
college level capture the flag
competition it was also developed by
grimm
so what this round of funding provided
us is a high school level
and college level ctf
um where students are actually you know
interacting with all of our technologies
to
uh unlock different challenges here um
and kind of stay tuned for nets in the
works
so thank you for tuning in to our talk
thank you to all the volunteers at the
ics village
and if you're interested in knowing more
or getting involved we're always looking
for industry support
mentors feedback speakers you know you
kind of name it i love having that loop
of industry built into our classes and
make sure that what i'm
teaching isn't out of date obsolete
or out of step with industry best
practices are
thank you very much and have a great
defcon
you