ICS Gabe Electrical Engineer to Accidental Cybersecurity ICS Expert

ICS Gabe0:00

I mean, I'm an 18-year-old kid, right?

ICS Gabe0:02

Coming from Detroit into a very foreign environment. I mean, I got hit and I'm like, whoa, what is this?

ICS Gabe0:41

I was a mouthful, but that's what I do.

ICS Gabe0:46

My introduction to cybersecurity within a nuclear plant was that pretty much Stuxnet happened.

ICS Gabe1:03

It's just he made it so cryptic.

ICS Gabe1:26

I saw that I would gain a greater exposure to a lot more technologies within my field.

ICS Gabe1:57

By the way, I wrote a book.

ICS Gabe3:01

So my name is Gabriel Agboruchi, like Eamon. I'm a podcaster, but a baby podcaster. And I also work in the cybersecurity field as a senior consultant with Mandiant FireEye, but more specifically focusing in on industrial control system and operational technology cybersecurity. That was a mouthful, but that's what I do.

ICS Gabe3:33

Indeed. I think that as we walk outside, as we go into our places of work, pretty much everywhere, ICS is pretty much surrounding us.

ICS Gabe3:44

If you get into aerospace or in manufacturing of vehicles, electrical utilities, you can get into gas compressor stations. I mean, you name it, ICS is out there. And it looks a little bit different from the enterprise or traditional IT environments where you have servers, workstations, all types of virtual devices and even cloud now. Within ICS is mainly like these devices like PLCs, programmable logic controllers, OPC servers, API servers, data historians, all of these other wonderful industrial devices, which are existent within the industrial control system and manufacturing environments.

ICS Gabe4:31

So industries like oil and gas, that's the one very, has a lot of industrial control system type of assets. And even kind of with my background, I come from a nuclear background. So nuclear plants, a lot of ICS environments or automotive, right? Cool. So with my background, I even have for industrial control systems, you can get into nuclear.

ICS Gabe4:55

Right. Where you have different systems within a nuclear plant where there can be PLCs, of course, that exist. But you even have sensors and temperature transmitters and all these different actuators which have digital components to it. Right. Yeah. That are continually feeding that data back to some type of server or some type of workstation or another ICS work HMI, a human machine interface. So those are some of the environments or industries that you can find industrial control systems.

ICS Gabe5:35

Indeed. Yeah. So that's another huge component of industrial control systems. And that's actually one of the highest considerations within these environments is that of safety. So you have safety instrumented systems, SIS systems. So these particular things are very important because within these environments, you have huge assets, things like generators or some type of motors or some robots that are moving. And these things can be a big detriment if programmed or if something happens wrong, it can affect somebody's lives. So safety is a big component of ICS environments, for sure.

ICS Gabe6:22

Working as a nuclear cybersecurity engineer, it's almost like taking a step back in time. I don't know.

ICS Gabe6:31

Like that's probably the best way that I can describe it.

ICS Gabe6:34

It's a very regimented, almost military type of environment.

ICS Gabe6:41

Yeah, cubicles. But you know, like even that green shade. Oh, wow. I don't know if you're familiar with that. Like that's all inside the...

ICS Gabe6:50

Yeah, very hazy. I think those environments are very much so regimented because a lot of people come from the Navy, right? So Navy nuclear officers or Navy nukes, they pretty much come out the service and they transition directly into commercial nuclear plants. So they bring a lot of that kind of regimented experience into nuclear plant environments. So for me, graduating in the late 2000s from college and going clear eventually, it really was like taking a step back in time and almost like boot camp for engineering.

ICS Gabe7:38

So pretty much what happened is my introduction to cybersecurity within a nuclear plant was that pretty much Stuxnet happened, right, a couple of years before I joined that particular nuclear plant. So Stuxnet, right, it was a virus that happened or malware that was found within an Iranian nuclear facility.

ICS Gabe7:58

Which pretty much was like a one of a kind. It was something that was very new to the ICS and OT environment. And it pretty much caused shockwaves in the commercial nuclear plant environment within the U.S. And as a result, all types of guidance, regulation, standards, this, all of these thou shouts came down the line.

ICS Gabe8:17

To commercial nuclear. So as a result, I got introduced into a lot of cybersecurity through that experience because previously I was really working as like a nuclear INC engineer. So nuclear instrumentation and control engineer.

ICS Gabe8:31

Yeah. So back to your question as it concerns the day to day. So there might be some IT days and there might be some ICS days. My IT days was that of kind of really updating a lot of systems or understanding what vulnerability scanners that we have for the corporate side. We would do some of that in the day-to-day. But then on my ICS security days, I will be performing walk-downs of different systems. And that's another key term that we use a lot of times. You literally put on your boots, dress out, or putting on all of your, I guess, your... Radiation protection gear, and you go and walk down to the plant floor, evaluate different digital systems to make sure they are functioning correctly and in the manner that we intended.

ICS Gabe9:25

Yes. So visually or even collecting information like logs and different data from these devices. Yes.

ICS Gabe9:33

Yes.

ICS Gabe9:34

Or even updating some of the systems. I have a story, but I don't want to.

ICS Gabe9:41

Okay. So there was one instance where it was a very like a one-off because this doesn't typically happen.

ICS Gabe9:48

So the nuclear plant is all of these different systems. There's so many different systems that pretty much work together, pretty much work together to produce electricity. Yeah. So this is the generation side. This is the generation of electricity.

ICS Gabe10:01

So what happens is that pretty much enriched fuel, uranium typically, is enriched to a point where it's turned into fuel. And then neutrons are blasted at uranium fuel. And what happens is that there's a chain reaction that happens called fission, right? Adam splitting, splitting, splitting, splitting, splitting. And that releases so much energy to the point where it boils water. That boiled water creates very high pressurized steam. And that steam is transmitted and utilized in order to spin or to create electricity.

ICS Gabe10:38

Spin a turbine, right? And then it creates electricity. I was trying to cut it a little bit.

ICS Gabe10:44

So part of that process, that fuel is used up over a certain period of time. And during that time where fuel is used up, you go into what you call an outage, where you're replacing old fuel with new fuel and you're moving it around. The place where this old fuel and new fuel is kept is in what you call a spit fuel pool. So this is a place, so there's like a solution. I don't know all the components of the solution because I haven't been in that environment in a while. But it's pretty much like, this is pretty much holding very heavily radiated material. Wow. Yeah, so... And it's literally a pool. It looks like a very blue color.

ICS Gabe11:24

So on top of the pool, there is a device called a crane, like it's a fuel crane. And this crane pretty much, it looks like a regular crane, like one of those cat cranes. But this crane is used to literally go down into the pool and to move fuel from one place to another place and also lift it and put it into the reactor vessel.

ICS Gabe11:50

Yes, absolutely. I don't think it has that claw that lets things go.

ICS Gabe11:55

But very similar, right? Yeah. So this particular crane is pretty much like a PLC or some very low-level type of digital device on it. And it's pretty much the only way that you access it or update it is when you're updating this firmware via a USB drive.

ICS Gabe12:12

So one of my walk downs was literally I had to what you call dress out. So I'm putting on all the white suit and I'm getting all my what you call dose symmetry, which is pretty much what is tracking my radiation exposure. I had to put on all of this stuff just to go down to the spent fuel pool to update the firmware of this digital crane device with a USB drive. Wow. So some days can look like that and some days can look like paperwork. So.

ICS Gabe12:52

So it's not boiling. So it's actually what keeps the fuel pretty much at a containable level, right? It's definitely radiating. It's not boiling, but it is keeping the fuel at a point where it's not exposing people at a high rate. But you do have to dress out so that it doesn't get into your body or get into you. So you have to climb up the crane to update this device.

ICS Gabe13:23

Air-gapped, right?

ICS Gabe13:30

So based upon who you talk to, the air gap doesn't exist.

ICS Gabe13:34

But typically air gapping means that the systems don't talk to the Internet or any outside network or system. That's typically what it means. So, yes, the answer to your question is yes. All these systems are air gapped by regulatory guidance. So the spit fuel pool devices, the reactor vessels, the sensors, the control room. I mean, even our computers that existed, the INC computers that existed within the plant, all of this was considered to be air gaps.

ICS Gabe14:10

So not only firewall, and it gets deep from the ICS architecture, right? Because there are firewalls, yes, but there's also a completely different Active Directory environment, right? And that is separated from that of the enterprise IT environment, like a unidirectional gateway or data diodes. So these are devices that are used to only allow data to flow in one direction and never in the opposite direction.

ICS Gabe14:40

So all commercial nuclear plants have data diodes in them by regulatory guidance.

ICS Gabe14:45

So that's part of the air gapping architecture of these nuclear plants.

ICS Gabe15:13

Indeed. I think there were a lot like several different pieces of it that made it very pivotal. Right.

ICS Gabe15:18

One is that especially from an ICSOT perspective, this air gaps idea was thought to be the most secure of its time. If you segregate your devices and assets from that of the Internet, then you shouldn't have to worry about them becoming infected or penetrated by any external actors. Right. So that was the idea. And there was also another idea, which we used to have in ICS security was security by obscurity as it concerns our communication protocols. Right. Right. Because a lot of times you might have what HTTP, SNMB or. Or S&TP happening in the enterprise IT environment, but nobody really had a great understanding of like Modbus or DMP3 or Profinet. These are very specific to ICS protocols. But the thing about these protocols is that not many people knew about them, but they also didn't have any security mechanisms within them.

ICS Gabe16:29

But security by obscurity was a big thing that we took into account.

ICS Gabe16:34

So with Tuxnet, the air gap being violated, and typically we say that it was definitely through like a USB port. USB drive was the item zero or the initial attack vector that was able to compromise these centrifuges, right? Which made them spin out of control and... Cause issues to the industrial control system environment. And also, oh, I'm sorry, the nation state, right? Because it's been attributed to nation state cyber involvement. So that was also very pivotal in the Stuxnet malware.

ICS Gabe17:45

Absolutely, because one thing that we consider these protocols a lot of times or ICS environments, we consider them to be cushy, right? We consider them to pretty much be jelly in the middle. Might have a very strong outside right like a turtle right it has a very strong shell yeah but when you get to the middle of it i mean the protocols i mean if you can ping what you call like a plc master then you pretty much can own the entire system so oh boy and there's even like metasploit modules that are written for like mob bus exploitation where you can do some man-in-the-middle attacks and things so yeah it's just a very cushy center wow and even for i mean there's so much to talk about but like i

ICS Gabe18:35

Yes. I've recently done an assessment where part of the statement of work was my organization assessing devices that are Windows 95. Oh, boy. Windows XP. Oh, my God. These things still exist within the environment. These things are relics. How can you make something that's brand new exist on a Windows 95 machine?

ICS Gabe19:06

No. Wow. Patching is no. The only time that these systems are updated or patched is when they're decommissioned and then they update and patch a new version or a new machine and then they commission something. So that thing that's newly commissioned has all of the newest and latest updated things.

ICS Gabe19:25

Because the thing about it is that these devices aren't supposed to talk to anything else outside of that particular area. So this is like electrical substations, gas compressor stations, plant floors, you name it. A lot of times you have a lot of artifacts and relics that are just existing there. And even in aerospace, that's a biggie too. Yeah.

ICS Gabe20:23

So as I was growing up, so I grew up born and raised, went through school all in Detroit, Michigan.

ICS Gabe20:29

So I ran from Detroit, the west side of Detroit, as they say, so within the city. And as I was growing up, and this was like the 90s, right, early to mid 90s, I didn't have a whole lot of exposure to computers. And I'm sure that you know from Jen, there wasn't a wide proliferation of consumer computers, right, to the commercial use.

ICS Gabe20:50

So I was heavily into like Game Boys and Game Gear and PlayStation. So I really liked the game. I guess the consumer electronics there. But I didn't really have exposure to computers until kind of mid to late high school. And mid to late high school, I had a C programming class and my teacher was horrible. He was absolutely horrible and turned me off to much of programming.

ICS Gabe21:21

So it's just, he made it so cryptic. When now that I look back, it is so understandable, right? It's so logical in its conception. So again, kind of even a little bit more back through middle school and high school, I was a part of a summer math camp program called Wayne State Math Corps. So it was literally a summer math camp that I was a part of from sixth grade all the way to my senior year of high school. And in that program, we pretty much learned math for the next grade, but also made it fun and made it understandable and logical. We played all types of mathematical logic games. We learned chess. We were very much so involved in the process of math. So that was really the foundation of me getting into electrical engineering.

ICS Gabe22:32

Definitely not in college.

ICS Gabe22:34

Not at all.

ICS Gabe22:36

So college was pretty much theory, right?

ICS Gabe22:39

I mean, you go electrical engineering, it's pretty much a math degree.

ICS Gabe22:42

With electrical engineering on top of it. So you go through like your calc one, calc two, calc three. Right. Your different equations, your literature, algebra.

ICS Gabe22:51

But then you throw on a lot of science, right? You throw it on physics one, physics two. And then physics two is pretty much like introduction to electromagnetism.

ICS Gabe23:01

So then you take your electromagnetism class and you take digital signal processing. So a lot of this was just a lot of engineering theory with like electrical circuits. But I mainly focused therein on power systems. So I took a lot of power systems analysis classes. So these are your substations, your electrical lines and even get into some of your generations. That was my end to get into nuclear not too long after college. But so that was kind of like my end into nuclear. Although Detroit and Michigan in general is very much so that of automotive.

ICS Gabe23:31

So Detroit is the headquarter for Chrysler, GM and Ford. And I had an internship coming out of high school with Ford Motor Company. So that was my biggest introduction to engineering. And that math was an introduction into that of electrical engineers for college.

ICS Gabe23:48

A lot.

ICS Gabe24:00

So as it concerns computing resources in Detroit public schools.

ICS Gabe24:04

They were non-existent, really. Right.

ICS Gabe24:07

I mean, it was even bad to the point where I had graduated and I would come back and visit right as an alumni and talking to the students. And I would see the same books, like the history books, the math books that I was learning with while I was in high school, the middle school were the same books that the students were learning four or five, six, even 10 years after I had graduated. But as it concerns computing resources, I mean, we had some AutoCAD classes, but like AutoCAD 2010, I think they were still using the same stuff. Okay. So it was very antiquated.

ICS Gabe24:40

Right. Very much so like ICS.

ICS Gabe24:46

Yeah, indeed.

ICS Gabe24:58

Right. I think the job search wasn't too bad for me because as I was in college, that is when the economic downturn happened, right? So that was like 2008, 2009. Uh-huh. So I was still in college and learning, but I was also doing internships at the time. So while I was in college, I interned with Ford Motor Company, another company called CompuWare, which is a software development company in Detroit. I also interned with Caterpillar down in Peoria, Illinois. And then I did a, what you call like a SCEP program. I forget the name, what it stands for, but it's with the Department of Defense.

ICS Gabe25:35

So I worked as a government employee, co-op slash intern with the Department of Defense in engineering as I was going through college. So I was kind of coming out of college with a lot of, I guess, job experience.

ICS Gabe25:51

Yeah, I kind of OD'd it, man. It took me like six years to graduate from college. But I was working like every single summer, sometimes even during the semesters.

ICS Gabe26:16

Oh, yes. So when I was in college, I don't know if you know where Michigan Tech is, but it's way, way, way, way up north. So it's a very different environment than Detroit. Pretty much Detroit, Flint, Lansing, those are like the black places in Michigan. Everywhere else in Michigan is primarily white, right? Or even Finnish in the UP, in the Upper Peninsula. So when I was going to school at Michigan Tech, it was a very different place from Detroit. So in my Calc class... One thing that we had to do to get out of Calc 1 is to test out of it. So we had to take an exam on the first day of class, and we had to get 100% on all the questions. If you got 100% on all the questions the second day, the professor said that you can leave early.

ICS Gabe27:09

But then I was leaving the class. It was probably like four or five of us out of like 30 or 40 students. The professor looked at me. Right. We're all in like a group. The professor looked at me and said, you got 100 percent on the exam.

ICS Gabe27:20

Yeah. And the thing that I thought of is that what differentiates me, like your instructions weren't unclear and I wasn't like doing anything that made me stick out. So the only thing that I knew that differentiated me from all of my other peers was that I'm black. And everybody like I was the only black student in the entire class out of 30 or 40 people. Oh, my God. So I'm like, that had to be the only thing that stuck out to him. And he seemed to be surprised that I was able to score top within the class on this particular exam.

ICS Gabe27:52

Yeah, that happened freshman year.

ICS Gabe28:03

Like, Oh yeah. All the time.

ICS Gabe28:08

Yes.

ICS Gabe28:12

Yeah, I had a long conversation with my mom on the phone and really kind of going through things in my mind. And the thing that I came out and was realizing is that, you know, I'm here for my education. I'm going to get this education and not even necessarily prove this person wrong, but I'm going to be here and do what I have to do in order to get where I desire to be. And I'm not going to let anybody's presuppositions about me and how I look deter me from getting to the point where I desire to get.

ICS Gabe28:36

So I really had to, but I had to train, like I had to train my partner to do that. Right. It's not easy. It definitely was not an easy experience.

ICS Gabe29:19

It's not. And even to this day, I kind of think sometimes that I probably should have questioned it more or really addressed it, right? Because there's somebody that was coming behind me that was coming from Detroit because they recruited heavily from Detroit that I wouldn't have wanted to go through the same experience.

ICS Gabe29:36

At times I think back about it. I'm like, I should have like faced that thing. Right. Rather than saying, I'm going to let that go. I think that if I faced it, many people coming behind me in the same program might have benefited from it. Right. I don't have any way of knowing. Right. But I kind of question myself on some of those things.

ICS Gabe30:46

Yeah. Yeah.

ICS Gabe31:02

Yeah.

ICS Gabe31:05

Yeah.

ICS Gabe31:13

Absolutely.

ICS Gabe31:16

And that's a growth, right? Yeah. I mean, I'm an eight-year-old kid, right?

ICS Gabe31:20

Coming from Detroit into a very foreign environment. I mean, I got hit and I'm like, whoa, what is this?

ICS Gabe31:26

So, you know, growing from those situations, I mean, I think your advice is very pointed and very appropriate for those types of things, right? If you say something, right?

ICS Gabe31:35

See something, say something. Experience something, say something. So.

ICS Gabe31:50

Yeah. That was actually the light one, man.

ICS Gabe31:55

Yeah, I have a heavier one.

ICS Gabe31:58

Do you want me to cover the heavier one?

ICS Gabe32:01

Okay. I know of another experience that I had while I was in college. I had a very close roommate of mine. And he was actually from what you call like the UP or the Upper Peninsula of Michigan.

ICS Gabe32:12

And he had never really had exposure. And that was a time where, you know, there wasn't a whole lot of exposure to people outside of your culture beyond those people who lived around you.

ICS Gabe32:23

So geographically. So he told me like the first day he saw me, like we became roommates. He's like, wow, you're the first black guy that I have ever seen in person.

ICS Gabe32:32

All the other ones have been on television. I'm like, oh, this is going to be an uphill battle here. But we ended up, let me tell you, like we ended up getting along grandly. Like this was my buddy.

ICS Gabe32:43

I almost rushed with him for one of the frats. Oh boy. I didn't know anything about frats. They were just pulling me into frat houses. Like I don't drink or anything. Okay. Nothing wrong with that. But that was never like, I knew that I was coming from, from Detroit. I'm like, I have to remove all possibilities of me failing.

ICS Gabe33:00

Yeah. It would have been a lot.

ICS Gabe33:05

I'm sure. But we were the best buddies. We were very close. But there was times where and I don't know if you experienced this while you were in college, being very in a very small area, but just little tick tacky things. Right. You're leaving your socks on the floor. You leave the window open during this particular time and it's too cold or too hot. You know, little microaggressions that kind of we started to argue. Right. OK. And it got to the point where when we were arguing, other students will hear the arguments. And so there was times where he would get mad. He would start to mock the way that I talked, because, again, coming from Detroit, we have a certain vernacular. We talk kind of different and especially from the U.P.

ICS Gabe33:50

And like one time I said, you lucky that is me, because if there were other black students on campus that heard you saying things like that, they would probably have a problem.

ICS Gabe33:58

And he said, oh, are you threatening me? I'm like, no, I'm not threatening you at all. So at that point, he just stopped talking to me completely.

ICS Gabe34:07

I was just really like kind of strongly and kind of angrily giving him some pointed advice. And, you know, like I didn't curse or anything.

ICS Gabe34:16

But he took that and went to the dean of students.

ICS Gabe34:19

It was telling the dean of students that I was threatening him. And so this is the heavy part. So during the time of this counseling meeting between myself, my roommate and my then roommate and the dean of students, the dean of students was hearing both of our sides. That's what they do. They have to hear both.

ICS Gabe34:37

And I explained what I had said in that instance and he explained how he took it. And then she was saying, OK, I understand. It didn't sound like he threatened you. And then at the time, my roommate had got extremely angry. OK. And then he started to spew out certain things.

ICS Gabe34:52

I don't know if you remember at that time, affirmative action was a big issue.

ICS Gabe34:56

In the time. And he said, quote unquote, I know that these people have been getting all types of affirmative action.

ICS Gabe35:02

This is ridiculous that you're taking his side. At that point, the dean of students said, you are completely out of line. We're going to end this and you're going to have to move to another room. I think the administration took the right action. But I mean, I lost a friend. Yeah I lost a close friend and years later he apologized and everything oh wow yeah wow yeah but I mean those years yeah it was a heavy situation and this was like finals and everything during this yeah and you could get kicked out if they didn't believe you know Absolutely. And many have.

ICS Gabe35:36

Yeah, many have. So it's like their word over your word at whatever party that is.

ICS Gabe35:51

Right. Wow. Right. So that happened. And I think I learned from it. There have been times in my life where I've been more distrustful of people who aren't from my culture because of that. Right. Because this was my roommate. I mean, like anytime he would get sick and he was throwing up or something, I let him use my trash can.

ICS Gabe36:12

And I clean that out so that he didn't have to smell that in the morning. Like that was my buddy.

ICS Gabe36:17

But, you know, that's how that kind of ended.

ICS Gabe36:23

Super silly. On both sides. Uh-huh. On both sides.

ICS Gabe36:40

Yeah. Our faults, our changes, our differences.

ICS Gabe36:44

Yeah.

ICS Gabe37:31

Absolutely.

ICS Gabe37:39

So I was really brought in to be kind of tailored to become the program manager.

ICS Gabe37:45

Of that. So the cybersecurity program manager for the nuclear plant. And at the time, because my current manager at the time, he was very close to retirement. So with my engineering background and my experience doing the INC, the electrical INC work, the nuclear INC work, I was being kind of pushed into being the manager type of roles. But I didn't want to do that. And just like you mentioned, so many roles were open. And I really wanted to get my hands in there because there are these, what you call these assessments. That the NRC, the Nuclear Regulatory Commission, does with these commercial nuclear plants. And they need, in a lot of organizations, contracting organizations, or even plants themselves, they hire people called assessors.

ICS Gabe38:36

One is that I saw that I would gain a greater exposure to a lot more technologies within my field. I get to see different plants. I get to touch different areas. And two, money. I mean, at the plant, I was making good money, right, for engineering. But when you start contracting for these assessor roles.

ICS Gabe38:57

I pretty much tripled my salary or almost tripled my salary at the time. And I was very much so determined to pay off my student loans. And so those two were motivations. One is I really wanted to get exposure to a lot of different areas rather than just being a program manager in one place. Yeah. And two, I did want to get compensated better. Yeah.

ICS Gabe39:19

Indeed. Indeed. So those are the two factors.

ICS Gabe39:28

Yes.

ICS Gabe39:53

Absolutely. Yes. Awesome. I love Darknet Diaries.

ICS Gabe40:12

Mm-hmm.

ICS Gabe40:28

There are so many different ways. I think that for me, as I've kind of explained, it's more like happenstance, right? Where Stuxnet happened, a lot of my role changed. And, you know, I typically coined the phrase Stuxnet changed my life. It really did. Yeah. Yeah, I'm going to have to write a book or something about that.

ICS Gabe40:47

But anyway, like pretty much Stuxnet happened. And as I was in engineering, I transitioned into cybersecurity slash engineering.

ICS Gabe40:55

And I think that it's very important for ICS. I think it's very important to kind of really have those baseline understandings of technologies and systems. Right.

ICS Gabe41:06

Really, like you were mentioned, networking. So kind of a lot of times I aligned my necessary understanding with certifications. So while I was there at the plant, I was able to obtain one of the SANS certifications. They did that one. But I recognized that I had a gap in networking. So I just self-studied for the CCNA. To really gain an understanding of TCP, IP, switches and routers, because these were all in the ICS environment, firewalls and all of these different devices. And then I needed to have a better understanding of attack techniques. And I don't know how people feel about the certification, but the CEH, the Certified Ethical Hacker certification, I found it to be very valuable because it gave me a great understanding of foundational offensive security methods, right where you get into your career.

ICS Gabe42:44

But then there's also, as I mentioned before, with the SANS certifications, they have ICS specific certifications. So I was able to obtain the GICSP. That's the GIAC Industrial Control Systems Certified Professional, something like that.

ICS Gabe43:01

But that is very ICS focused, and it gives you an understanding of the architecture, the environment, and all the security considerations and past events. So I would say certifications and understanding those base fundamentals of cybersecurity.

ICS Gabe43:35

Sure. No, just like the certification route and understanding the base knowledge of networking and security, but even getting into that of getting that hands-on experience, seeing where you currently are and seeing if you can transition to one of those organizations.

ICS Gabe43:56

Absolutely.

ICS Gabe43:58

Sometimes it's just pretty much ICS, but with the same systems, right? So there is what you call like an industrial control system firewall. It's called like a Tofino firewall. So this firewall specifically does all of what firewalls do, right? Access control, Yeah. Control lists and whatnot. But this one also does deep packet inspection and is able to recognize Modbus, Profinet, DMP. So it's able to recognize those ICS protocols.

ICS Gabe44:28

And there's also like these large vendors like a Siemens or, and there's also like a Stratix switch. A Stratix switches are pretty much industrial switches that can talk what you call like serial ports. So serial communications. Uh-huh. Over TCP, but they are actually just a Cisco switch. So you get to the command line and it's just a Cisco ISO.

ICS Gabe44:53

Yep. So a lot of the information is translatable. And a lot of organizations, they're still using like Cisco ASAs.

ICS Gabe45:01

Yeah. A lot of the stuff is very, in IT and in ICS or OT, it's the same type of technology.

ICS Gabe45:21

So one, the Department of Homeland Security, they have a division. Forget the current name, but I believe it used to be called ICS cert.

ICS Gabe45:29

And they have a number of online free modules that kind of go over a lot of the basics as it concerns industrial control systems. So it'll get into what is a PLC? What are RJ45s? What are serial like RS232s or RS485s? Or what are these communication protocols or network architecture and firewalls? So that's free.

ICS Gabe45:53

That's a free resource. But then as it concerns a simulator, right, they have Modbus simulators, which you call like RTUs. Okay. These are used in the electrical utility environment, remote terminal units. They have simulators that you can run as virtual appliances. So you can set up your own little home network where you're able to generate traffic that looks similar to that of an ICS environment.

ICS Gabe46:18

Yep. And also, if you guys Google like ICS protocols, PCAPs, ICS protocol PCAPs, there are several repositories that are online that you can find and that you can pretty much pull up Wireshark and start to evaluate what some of these protocols look like on the wire.

ICS Gabe46:39

A couple of different things.

ICS Gabe46:51

Absolutely.

ICS Gabe47:20

Yes, it definitely does. I think that one thing that we're seeing heavily within this environment, and it's been happening over the last several years, is that organizations aren't taking advantage of the security that comes from air gapping, right? A lot of organizations are literally attaching their ICS devices to the internet, right? For remote access and remote management, or even to collect logs, right? Because in order to get logs, you need to be able to get to whatever your SIM solution is. And a lot of times that same solution exists within the enterprise IT environment. So there needs to be some type of communication back and forth or just even home management, right? Say, for instance, a generator goes down.

ICS Gabe48:12

Or even third-party vendors having access to be able to maintenance their GE transformer. They need access. So that is one area that is increasing. But that squishy middle is still there in many cases. It's definitely still there. So I've been involved in several assessments where they're like internal pen tests where we're looking at the ability to go from an enterprise IT environment into OT assets. So a lot of times we have an assumed breach perspective, right? Phishing emails happen all the time.

ICS Gabe48:42

So if that corporate environment gets infected, what is the probability and the likelihood that this will propagate to an OT environment? Because it can cause some real issues there.

ICS Gabe48:59

So I've responded to an incident in an ICS environment. So the setup is pretty much like, so what happens is that you have the technicians who are programming these PLCs, programmable logic controllers. And companies like Siemens or Rockwell or AB, Allen Bradley, they produce these PLCs that are a lot of times, they're able to be managed by RJ45. So you can SSH into these devices. They have some type of remote connection. Anyway,

ICS Gabe49:30

Hey, you see Telnet too? Clear text protocols, you can see everything. So the technician with his laptop was able to program this PLC and his PLC was responsible for controlling a bridge going up and down. So you get into the safety of these different systems. That is the criticality of this particular device. What happened is that this particular individual, they connected this machine, this Windows laptop to the Internet and it being connected to the Internet to download some firmware, some software, left it connected overnight. And what happened was that it Oh, boy. It came back to the machine. It had all types of pop ups and evidence of a compromise. Yeah. I mean, literally. And so it was very interesting to investigate that because I was getting it on that side and was able to attribute it to some commodity malware from a very popular APT.

ICS Gabe50:32

I mean, going through this whole process of scoping this thing out. And really the thing that I found the most fulfillment in was really like calming the nerves and really giving sound advice and next steps to that individual who was responsible for that compromise. Right. Yeah. The person is like, I don't know what to do. And I got all these pop-ups and I don't know what's happening here and what I need to do next. And I think that was the thing that brought the most fulfillment. It wasn't It wasn't necessarily just doing the research and finding the responsible party, what the malware was, but it was actually calming and quelling the nerves of the person that was involved or the customer that was involved in the compromise.

ICS Gabe51:46

I don't get a lot into the firmware side. I'm actually trying to transition more and more into that area. But I saw a recent talk. I don't know if you've ever heard of this conference called S4. Hmm. It happens every year. It's pretty much like the ICSOT Securities DEF CON. Oh, cool. So it happens every year, typically in January, typically in Miami. And this is like the most cutting edge ICSOT security research and presentations. Mm-hmm. I saw a presentation about firmware signing in the state's firmware within the ICS security environment. And there is signing, right? There is signing that occurs. But I don't believe that there are many mechanisms out there right now that are checking for that.

ICS Gabe52:52

Yeah. So then it continues to evaluate and sense the current in that particular line, and it'll reclose by itself, which stops the utility from having to send out a truck or an individual. Okay.

ICS Gabe53:05

Then somebody will have to come out and service that particular line or it can cause an overcurrent and destroy. Right. Yeah, it can destroy. Like, I don't know. It could be connected to a factory, right, that controls robots that makes baby food.

ICS Gabe53:22

Yep. The surge of fire or spark. Yep. Okay. Absolutely. So this particular system, so that sits on, so the sensing mechanism or the sensing, I guess, device sits at the top of the line, but at the bottom, there is a little IoT, like communications gateway. Okay. That sits at the bottom that communicates back to the utility, I guess, like the utility version of a data center. Okay. Which pretty much is saying where our faults with devices or where the system's faults are or what's happening there if we need to send somebody out. So I remember as I was penetration testing this particular gateway, I would try to upload some faulty firmware. And what happens a lot of times is that it just bricks the system.

ICS Gabe54:48

So from experience, I know that it can break systems, but it's current research and security. I'm not 100% informed, but I know that there is an S4 presentation.

ICS Gabe55:01

So definitely there is S4, happens in January. The ICS Summit, right? That is something that I spoke at earlier this year, right before COVID-19, that we pretty much were going over a lot of different information, introductory and kind of latest ICS security research. I did it on packet capture analysis for industrial control system, ICS environments.

ICS Gabe55:23

So this one was the one in Orlando. So it's called the ICS summit. If you just Google ICS summit 2020, SANS ICS summit 2020, then you'll be able to find it.

ICS Gabe55:34

Yeah, SANS. Sorry. Yeah. And then there's another one that's coming up, a SANS summit, the oil and gas summit that's happening in October. And I believe that one is virtual. Okay. And I believe it's free. Okay. I don't want to be so quick, but I believe it is free.

ICS Gabe55:48

Yep.

ICS Gabe55:49

That's another resource for sure.

ICS Gabe55:56

Yeah. One thing I would like to mention is for those who are career transitionists, I know this is like, you know, breaking in and getting into cybersecurity. I would say a lot of times one of my issues was that I was thinking about or I'm trying to do everything at once. Right. I was studying for my CCNA at one time. I was involved in all these different assessments and in work. I was also trying to study for my OSCP.

ICS Gabe56:21

Really try to kill that in a year. All of these different things. And one thing that I found success in is focusing on one thing and accomplishing that and then going on to the next thing rather than trying to do so many things at once. And I think that was something that I really would like people who are transitioning, who are finding it maybe a little difficult right now, focus on one thing, accomplish that, and then go on to the next thing. There's so much information available for you to learn and so many different resources for you to transition.

ICS Gabe57:31

Indeed. Thanks for having me, Amy. All right. Thank you.