Getting Into Infosec, Episode 34: ICS Gabe - Electrical Engineer to Accidental Cybersecurity ICS Expert
Published October 11, 2020 · 59 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/icsgabe/

[0:00] ICS Gabe: I mean, I'm an 18-year-old kid, right?

[0:02] Ayman Elsawah: Exactly.

[0:02] ICS Gabe: Coming from Detroit into a very foreign environment. I mean, I got hit and I'm like, whoa, what is this?

[0:08] Ayman Elsawah: Right.

[0:26] Ayman Elsawah: Welcome to Getting Into Infosec. I'm your host, Eamon Ossawa. My guest this week is Gabriel Agboruchi, also known as ICS Gabe on Twitter. Gabriel is a senior ICS and OT security consultant, helping organizations solve their most challenging industrial control security problems.

[0:41] ICS Gabe: I was a mouthful, but that's what I do.

[0:43] Ayman Elsawah: Gabe's infosec journey is a unique one and almost didn't happen.

[0:46] ICS Gabe: My introduction to cybersecurity within a nuclear plant was that pretty much Stuxnet happened.

[0:51] Ayman Elsawah: A product of the Detroit public school system, he was a math was who loved video games. It seemed a career in programming was a natural choice. However, a horrible computer science teacher sent him in a different direction at first.

[1:03] ICS Gabe: It's just he made it so cryptic.

[1:06] Ayman Elsawah: Gabe is quite talented and ended up studying electrical engineering and industrial control systems in college. During that time, he shares some experiences unique to him as an African-American in a not so diverse college. Then in 2010, Stuxnet changed everything. Gabriel was the right person in the right place at the right time and became involved with the heavy lifting of securing critical infrastructure.

[1:26] ICS Gabe: I saw that I would gain a greater exposure to a lot more technologies within my field.

[1:31] Ayman Elsawah: In this conversation, Gabriel talks about the intricacies of that mammoth task and his advice for getting in. We hope you enjoy this episode. As usual, everything Getting Into Infosec is at gettingintoinfosec.com. There you'll find a preview of my practical guide into the field, a link to join my mailing list for previews and insights, and t-shirts and swag. If you like this podcast, please share your favorite quote or leave an awesome review. And please thank our guests for sharing their time and journey.

[1:57] ICS Gabe: By the way, I wrote a book.

[1:58] Ayman Elsawah: Here's a sample from the audiobook version. Would you trust a chain smoking doctor who tells you to quit smoking? Would you trust a dentist with bad teeth? Would you hire a school bus driver that has a bad driving record or doesn't wear a seatbelt? Let's cut to the chase. You need to be an example for yourself as well as for others. You need to eat your own dog food. Practice what you preach. Walk the walk. You get it, right? This is a mistake I see most often with people in information security, new or old. It tells me who is really serious about security and their work and who is not. In the infosec world, this is called OPSEC, operational security. Some people call it passions. Website for this podcast is gettingintoinfosec.com.

[2:43] Ayman Elsawah: Sign up to the email list if you want sneak previews of my episodes. All right, on to the show.

[2:50] Ayman Elsawah: Hey, Gabe, thanks for coming on the show. Hey, how's it going, Eamon? Thanks for having me. Absolutely, yeah. I've been looking forward to this conversation for quite some time. So for those out there that don't know you yet, can you tell us a little about what you do today?

[3:01] ICS Gabe: So my name is Gabriel Agboruchi, like Eamon. I'm a podcaster, but a baby podcaster. And I also work in the cybersecurity field as a senior consultant with Mandiant FireEye, but more specifically focusing in on industrial control system and operational technology cybersecurity. That was a mouthful, but that's what I do.

[3:22] Ayman Elsawah: Okay. And give us a rundown just briefly. So ICS or Industrial Control Systems, right, for short, OT for Operation Technology. Tell us what that involves. What systems does it involve for those out there that don't know?

[3:33] ICS Gabe: Indeed. I think that as we walk outside, as we go into our places of work, pretty much everywhere, ICS is pretty much surrounding us.

[3:43] Ayman Elsawah: Yeah. Yeah.

[3:44] ICS Gabe: If you get into aerospace or in manufacturing of vehicles, electrical utilities, you can get into gas compressor stations. I mean, you name it, ICS is out there. And it looks a little bit different from the enterprise or traditional IT environments where you have servers, workstations, all types of virtual devices and even cloud now. Within ICS is mainly like these devices like PLCs, programmable logic controllers, OPC servers, API servers, data historians, all of these other wonderful industrial devices, which are existent within the industrial control system and manufacturing environments.

[4:27] Ayman Elsawah: And where do you find this? Like what type of industries do you find these in?

[4:31] ICS Gabe: So industries like oil and gas, that's the one very, has a lot of industrial control system type of assets. And even kind of with my background, I come from a nuclear background. So nuclear plants, a lot of ICS environments or automotive, right? Cool. So with my background, I even have for industrial control systems, you can get into nuclear.

[4:54] Ayman Elsawah: Mm-hmm.

[4:55] ICS Gabe: Right. Where you have different systems within a nuclear plant where there can be PLCs, of course, that exist. But you even have sensors and temperature transmitters and all these different actuators which have digital components to it. Right. Yeah. That are continually feeding that data back to some type of server or some type of workstation or another ICS work HMI, a human machine interface. So those are some of the environments or industries that you can find industrial control systems.

[5:24] Ayman Elsawah: And let's break it down a little further. We're talking about safety mechanisms possibly, right? Like what do these PLCs do? Like what happens if they fail and if something goes wrong?

[5:35] ICS Gabe: Indeed. Yeah. So that's another huge component of industrial control systems. And that's actually one of the highest considerations within these environments is that of safety. So you have safety instrumented systems, SIS systems. So these particular things are very important because within these environments, you have huge assets, things like generators or some type of motors or some robots that are moving. And these things can be a big detriment if programmed or if something happens wrong, it can affect somebody's lives. So safety is a big component of ICS environments, for sure.

[6:15] Ayman Elsawah: Okay. And so you were a nuclear cybersecurity engineer before. Tell us about life during that time. How was that?

[6:22] ICS Gabe: Working as a nuclear cybersecurity engineer, it's almost like taking a step back in time. I don't know.

[6:29] Ayman Elsawah: Okay.

[6:31] ICS Gabe: Like that's probably the best way that I can describe it.

[6:33] Ayman Elsawah: I like that.

[6:34] ICS Gabe: It's a very regimented, almost military type of environment.

[6:40] Ayman Elsawah: With cubicles?

[6:41] ICS Gabe: Yeah, cubicles. But you know, like even that green shade. Oh, wow. I don't know if you're familiar with that. Like that's all inside the...

[6:49] Ayman Elsawah: Like a little hazy, right?

[6:50] ICS Gabe: Yeah, very hazy. I think those environments are very much so regimented because a lot of people come from the Navy, right? So Navy nuclear officers or Navy nukes, they pretty much come out the service and they transition directly into commercial nuclear plants. So they bring a lot of that kind of regimented experience into nuclear plant environments. So for me, graduating in the late 2000s from college and going clear eventually, it really was like taking a step back in time and almost like boot camp for engineering.

[7:26] Ayman Elsawah: Okay. And then as far as like your day-to-day cybersecurity work, what's the type of work that you did as a cybersecurity? Were you the only person? How big was the cybersecurity team? Like, was the concept new at that time or, you know?

[7:38] ICS Gabe: So pretty much what happened is my introduction to cybersecurity within a nuclear plant was that pretty much Stuxnet happened, right, a couple of years before I joined that particular nuclear plant. So Stuxnet, right, it was a virus that happened or malware that was found within an Iranian nuclear facility.

[7:57] Ayman Elsawah: Mm-hmm.

[7:58] ICS Gabe: Which pretty much was like a one of a kind. It was something that was very new to the ICS and OT environment. And it pretty much caused shockwaves in the commercial nuclear plant environment within the U.S. And as a result, all types of guidance, regulation, standards, this, all of these thou shouts came down the line.

[8:16] Ayman Elsawah: Gotcha.

[8:17] ICS Gabe: To commercial nuclear. So as a result, I got introduced into a lot of cybersecurity through that experience because previously I was really working as like a nuclear INC engineer. So nuclear instrumentation and control engineer.

[8:30] Ayman Elsawah: Oh, I see. Okay.

[8:31] ICS Gabe: Yeah. So back to your question as it concerns the day to day. So there might be some IT days and there might be some ICS days. My IT days was that of kind of really updating a lot of systems or understanding what vulnerability scanners that we have for the corporate side. We would do some of that in the day-to-day. But then on my ICS security days, I will be performing walk-downs of different systems. And that's another key term that we use a lot of times. You literally put on your boots, dress out, or putting on all of your, I guess, your... Radiation protection gear, and you go and walk down to the plant floor, evaluate different digital systems to make sure they are functioning correctly and in the manner that we intended.

[9:18] ICS Gabe: So it's like a plant health walk down activities. And now those are some of the things.

[9:23] Ayman Elsawah: Like visually check some of these devices.

[9:25] ICS Gabe: Yes. So visually or even collecting information like logs and different data from these devices. Yes.

[9:32] Ayman Elsawah: Manually.

[9:33] ICS Gabe: Yes.

[9:33] Ayman Elsawah: Okay.

[9:34] ICS Gabe: Or even updating some of the systems. I have a story, but I don't want to.

[9:39] Ayman Elsawah: Go ahead. No, I love stories. This is the place for stories. Yeah.

[9:41] ICS Gabe: Okay. So there was one instance where it was a very like a one-off because this doesn't typically happen.

[9:48] Ayman Elsawah: Okay.

[9:48] ICS Gabe: So the nuclear plant is all of these different systems. There's so many different systems that pretty much work together, pretty much work together to produce electricity. Yeah. So this is the generation side. This is the generation of electricity.

[10:00] Ayman Elsawah: Mm-hmm.

[10:01] ICS Gabe: So what happens is that pretty much enriched fuel, uranium typically, is enriched to a point where it's turned into fuel. And then neutrons are blasted at uranium fuel. And what happens is that there's a chain reaction that happens called fission, right? Adam splitting, splitting, splitting, splitting, splitting. And that releases so much energy to the point where it boils water. That boiled water creates very high pressurized steam. And that steam is transmitted and utilized in order to spin or to create electricity.

[10:37] Ayman Elsawah: To spin a turbine or something.

[10:38] ICS Gabe: Spin a turbine, right? And then it creates electricity. I was trying to cut it a little bit.

[10:43] Ayman Elsawah: No worries, no worries.

[10:44] ICS Gabe: So part of that process, that fuel is used up over a certain period of time. And during that time where fuel is used up, you go into what you call an outage, where you're replacing old fuel with new fuel and you're moving it around. The place where this old fuel and new fuel is kept is in what you call a spit fuel pool. So this is a place, so there's like a solution. I don't know all the components of the solution because I haven't been in that environment in a while. But it's pretty much like, this is pretty much holding very heavily radiated material. Wow. Yeah, so... And it's literally a pool. It looks like a very blue color.

[11:23] Ayman Elsawah: Wow.

[11:24] ICS Gabe: So on top of the pool, there is a device called a crane, like it's a fuel crane. And this crane pretty much, it looks like a regular crane, like one of those cat cranes. But this crane is used to literally go down into the pool and to move fuel from one place to another place and also lift it and put it into the reactor vessel.

[11:47] Ayman Elsawah: Oh, kind of like those games you play in arcades, right?

[11:50] ICS Gabe: Yes, absolutely. I don't think it has that claw that lets things go.

[11:54] Ayman Elsawah: Right, but similar.

[11:55] ICS Gabe: But very similar, right? Yeah. So this particular crane is pretty much like a PLC or some very low-level type of digital device on it. And it's pretty much the only way that you access it or update it is when you're updating this firmware via a USB drive.

[12:12] Ayman Elsawah: Oh, boy.

[12:12] ICS Gabe: So one of my walk downs was literally I had to what you call dress out. So I'm putting on all the white suit and I'm getting all my what you call dose symmetry, which is pretty much what is tracking my radiation exposure. I had to put on all of this stuff just to go down to the spent fuel pool to update the firmware of this digital crane device with a USB drive. Wow. So some days can look like that and some days can look like paperwork. So.

[12:41] Ayman Elsawah: Wow. Actually, so you have to get to this device and upgrade it via USB. How do you reach it with this heavy, boiling, radioactive water underneath you? Is that what I understand?

[12:52] ICS Gabe: So it's not boiling. So it's actually what keeps the fuel pretty much at a containable level, right? It's definitely radiating. It's not boiling, but it is keeping the fuel at a point where it's not exposing people at a high rate. But you do have to dress out so that it doesn't get into your body or get into you. So you have to climb up the crane to update this device.

[13:18] Ayman Elsawah: So now are these devices air-gapped or are they networked?

[13:23] ICS Gabe: Air-gapped, right?

[13:24] Ayman Elsawah: I know, right? And for those that don't know air-gapped, feel free to explain what that is supposed to mean.

[13:30] ICS Gabe: So based upon who you talk to, the air gap doesn't exist.

[13:33] Ayman Elsawah: OK.

[13:34] ICS Gabe: But typically air gapping means that the systems don't talk to the Internet or any outside network or system. That's typically what it means. So, yes, the answer to your question is yes. All these systems are air gapped by regulatory guidance. So the spit fuel pool devices, the reactor vessels, the sensors, the control room. I mean, even our computers that existed, the INC computers that existed within the plant, all of this was considered to be air gaps.

[14:03] Ayman Elsawah: But they're not air gaps from each other. No. Okay, so they're just firewall. They're not truly air gap. They're still in the network.

[14:10] ICS Gabe: So not only firewall, and it gets deep from the ICS architecture, right? Because there are firewalls, yes, but there's also a completely different Active Directory environment, right? And that is separated from that of the enterprise IT environment, like a unidirectional gateway or data diodes. So these are devices that are used to only allow data to flow in one direction and never in the opposite direction.

[14:39] Ayman Elsawah: Oh, okay.

[14:40] ICS Gabe: So all commercial nuclear plants have data diodes in them by regulatory guidance.

[14:45] Ayman Elsawah: Oh, that's cool.

[14:45] ICS Gabe: So that's part of the air gapping architecture of these nuclear plants.

[14:50] Ayman Elsawah: Gotcha. Okay. And why was Stuxnet such a pivotal moment in ICS history or even cybersecurity history? Just real brief. I mean, I think it might be the first time we're talking about on the podcast, but I would guess a lot of our listeners might not know what Stuxnet is. And I definitely encourage Googling or reading it. But for those out there real quick, like why was it important in your words and, you know, pivotal in our history?

[15:13] ICS Gabe: Indeed. I think there were a lot like several different pieces of it that made it very pivotal. Right.

[15:18] Ayman Elsawah: Yeah.

[15:18] ICS Gabe: One is that especially from an ICSOT perspective, this air gaps idea was thought to be the most secure of its time. If you segregate your devices and assets from that of the Internet, then you shouldn't have to worry about them becoming infected or penetrated by any external actors. Right. So that was the idea. And there was also another idea, which we used to have in ICS security was security by obscurity as it concerns our communication protocols. Right. Right. Because a lot of times you might have what HTTP, SNMB or. Or S&TP happening in the enterprise IT environment, but nobody really had a great understanding of like Modbus or DMP3 or Profinet. These are very specific to ICS protocols. But the thing about these protocols is that not many people knew about them, but they also didn't have any security mechanisms within them.

[16:18] ICS Gabe: Right. Because SNMP version, I think three has encryption or something. But Modbus and DMP3, they're just now coming out with more and more security mechanisms.

[16:28] Ayman Elsawah: Right.

[16:29] ICS Gabe: But security by obscurity was a big thing that we took into account.

[16:33] Ayman Elsawah: Gotcha.

[16:34] ICS Gabe: So with Tuxnet, the air gap being violated, and typically we say that it was definitely through like a USB port. USB drive was the item zero or the initial attack vector that was able to compromise these centrifuges, right? Which made them spin out of control and... Cause issues to the industrial control system environment. And also, oh, I'm sorry, the nation state, right? Because it's been attributed to nation state cyber involvement. So that was also very pivotal in the Stuxnet malware.

[17:10] Ayman Elsawah: Gotcha. Yeah. So lots of things there, definitely. But like when you talk about security through obscurity, so you're saying the protocol itself didn't have security options built in at all. Like it's kind of like the internet, maybe in the 70s or the 80s, right? Where it was just like expected that because no one had access, then they can just by default, then no one can access it and get security. But all you need is one kid war dialing and getting accidentally into a system. That doesn't even have a login or password, right? So similar to that, I would say, is that right?

[17:45] ICS Gabe: Absolutely, because one thing that we consider these protocols a lot of times or ICS environments, we consider them to be cushy, right? We consider them to pretty much be jelly in the middle. Might have a very strong outside right like a turtle right it has a very strong shell yeah but when you get to the middle of it i mean the protocols i mean if you can ping what you call like a plc master then you pretty much can own the entire system so oh boy and there's even like metasploit modules that are written for like mob bus exploitation where you can do some man-in-the-middle attacks and things so yeah it's just a very cushy center wow and even for i mean there's so much to talk about but like i

[18:25] Ayman Elsawah: You know, I think vendors are scared of updating these protocols because they might break these systems that are generally never supposed to be rebooted, if I understand correctly, right?

[18:35] ICS Gabe: Yes. I've recently done an assessment where part of the statement of work was my organization assessing devices that are Windows 95. Oh, boy. Windows XP. Oh, my God. These things still exist within the environment. These things are relics. How can you make something that's brand new exist on a Windows 95 machine?

[19:01] Ayman Elsawah: The whole concept of patching just is at another level here. Yeah.

[19:06] ICS Gabe: No. Wow. Patching is no. The only time that these systems are updated or patched is when they're decommissioned and then they update and patch a new version or a new machine and then they commission something. So that thing that's newly commissioned has all of the newest and latest updated things.

[19:23] Ayman Elsawah: Oh, wow. I see.

[19:25] ICS Gabe: Because the thing about it is that these devices aren't supposed to talk to anything else outside of that particular area. So this is like electrical substations, gas compressor stations, plant floors, you name it. A lot of times you have a lot of artifacts and relics that are just existing there. And even in aerospace, that's a biggie too. Yeah.

[19:44] Ayman Elsawah: Okay. This is great. So let's rewind a little bit to maybe the younger Gabe. Were you exposed to computers when you were younger? Tell us about your technical... I noticed you did have an electrical engineering degree. You talk about this in your podcast, which by the way is great. I'm really thankful that you have a podcast that talks about ICS because it's one of those fields that I think is still not so clear as to how does one get into the industry. And I think we'll talk about that in a little bit. But if you could rewind for us, like, are we always exposed to computers? Like, did you have a knack for computers? Tell us about your early childhood maybe or college years or whatever.

[20:23] ICS Gabe: So as I was growing up, so I grew up born and raised, went through school all in Detroit, Michigan.

[20:29] Ayman Elsawah: Okay.

[20:29] ICS Gabe: So I ran from Detroit, the west side of Detroit, as they say, so within the city. And as I was growing up, and this was like the 90s, right, early to mid 90s, I didn't have a whole lot of exposure to computers. And I'm sure that you know from Jen, there wasn't a wide proliferation of consumer computers, right, to the commercial use.

[20:50] Ayman Elsawah: Mm-hmm.

[20:50] ICS Gabe: So I was heavily into like Game Boys and Game Gear and PlayStation. So I really liked the game. I guess the consumer electronics there. But I didn't really have exposure to computers until kind of mid to late high school. And mid to late high school, I had a C programming class and my teacher was horrible. He was absolutely horrible and turned me off to much of programming.

[21:17] Ayman Elsawah: Oh no. Why is that? What is it that they did that turned you off?

[21:21] ICS Gabe: So it's just, he made it so cryptic. When now that I look back, it is so understandable, right? It's so logical in its conception. So again, kind of even a little bit more back through middle school and high school, I was a part of a summer math camp program called Wayne State Math Corps. So it was literally a summer math camp that I was a part of from sixth grade all the way to my senior year of high school. And in that program, we pretty much learned math for the next grade, but also made it fun and made it understandable and logical. We played all types of mathematical logic games. We learned chess. We were very much so involved in the process of math. So that was really the foundation of me getting into electrical engineering.

[22:10] ICS Gabe: So I was more, I guess, engineering based going from high school into college. And that's why I made that decision for electrical engineering.

[22:18] Ayman Elsawah: That's awesome. Now, engineering almost by default has that hacker mindset. Do you feel you had that hacker mindset before you went to engineering and it got tuned later? Or where do you think you developed your hacker mindset throughout your life?

[22:32] ICS Gabe: Definitely not in college.

[22:34] Ayman Elsawah: Okay.

[22:34] ICS Gabe: Not at all.

[22:35] Ayman Elsawah: Yeah.

[22:36] ICS Gabe: So college was pretty much theory, right?

[22:38] Ayman Elsawah: Right.

[22:39] ICS Gabe: I mean, you go electrical engineering, it's pretty much a math degree.

[22:42] Ayman Elsawah: Okay.

[22:42] ICS Gabe: With electrical engineering on top of it. So you go through like your calc one, calc two, calc three. Right. Your different equations, your literature, algebra.

[22:51] Ayman Elsawah: Yeah.

[22:51] ICS Gabe: But then you throw on a lot of science, right? You throw it on physics one, physics two. And then physics two is pretty much like introduction to electromagnetism.

[23:00] Ayman Elsawah: Uh-huh.

[23:01] ICS Gabe: So then you take your electromagnetism class and you take digital signal processing. So a lot of this was just a lot of engineering theory with like electrical circuits. But I mainly focused therein on power systems. So I took a lot of power systems analysis classes. So these are your substations, your electrical lines and even get into some of your generations. That was my end to get into nuclear not too long after college. But so that was kind of like my end into nuclear. Although Detroit and Michigan in general is very much so that of automotive.

[23:30] Ayman Elsawah: Right.

[23:31] ICS Gabe: So Detroit is the headquarter for Chrysler, GM and Ford. And I had an internship coming out of high school with Ford Motor Company. So that was my biggest introduction to engineering. And that math was an introduction into that of electrical engineers for college.

[23:47] Ayman Elsawah: Okay.

[23:48] ICS Gabe: A lot.

[23:49] Ayman Elsawah: Now, growing up in Detroit as a black person, do you feel like the school system maybe didn't have enough computing or computer resources that maybe other school districts might have?

[24:00] ICS Gabe: So as it concerns computing resources in Detroit public schools.

[24:03] Ayman Elsawah: Yeah.

[24:04] ICS Gabe: They were non-existent, really. Right.

[24:06] Ayman Elsawah: Okay. Okay.

[24:07] ICS Gabe: I mean, it was even bad to the point where I had graduated and I would come back and visit right as an alumni and talking to the students. And I would see the same books, like the history books, the math books that I was learning with while I was in high school, the middle school were the same books that the students were learning four or five, six, even 10 years after I had graduated. But as it concerns computing resources, I mean, we had some AutoCAD classes, but like AutoCAD 2010, I think they were still using the same stuff. Okay. So it was very antiquated.

[24:39] Ayman Elsawah: Okay.

[24:40] ICS Gabe: Right. Very much so like ICS.

[24:41] Ayman Elsawah: Okay. Interesting. Maybe they were setting you up for ICS. Yeah.

[24:46] ICS Gabe: Yeah, indeed.

[24:48] Ayman Elsawah: Now, so you graduate. Tell us about finding a job after graduation. Did you have any difficulties? How was the job search? How did that go just in general, in your experience?

[24:58] ICS Gabe: Right. I think the job search wasn't too bad for me because as I was in college, that is when the economic downturn happened, right? So that was like 2008, 2009. Uh-huh. So I was still in college and learning, but I was also doing internships at the time. So while I was in college, I interned with Ford Motor Company, another company called CompuWare, which is a software development company in Detroit. I also interned with Caterpillar down in Peoria, Illinois. And then I did a, what you call like a SCEP program. I forget the name, what it stands for, but it's with the Department of Defense.

[25:35] Ayman Elsawah: Okay.

[25:35] ICS Gabe: So I worked as a government employee, co-op slash intern with the Department of Defense in engineering as I was going through college. So I was kind of coming out of college with a lot of, I guess, job experience.

[25:49] Ayman Elsawah: Yeah, more than most, I would say.

[25:51] ICS Gabe: Yeah, I kind of OD'd it, man. It took me like six years to graduate from college. But I was working like every single summer, sometimes even during the semesters.

[25:59] Ayman Elsawah: So that's awesome. That's a very valuable experience, right? Okay. So I guess you're saying transitioning into the private sector was relatively straightforward, I guess. Yes. Okay, cool. What is the thing that you wanted to talk about that you said you mentioned earlier that was appropriate?

[26:16] ICS Gabe: Oh, yes. So when I was in college, I don't know if you know where Michigan Tech is, but it's way, way, way, way up north. So it's a very different environment than Detroit. Pretty much Detroit, Flint, Lansing, those are like the black places in Michigan. Everywhere else in Michigan is primarily white, right? Or even Finnish in the UP, in the Upper Peninsula. So when I was going to school at Michigan Tech, it was a very different place from Detroit. So in my Calc class... One thing that we had to do to get out of Calc 1 is to test out of it. So we had to take an exam on the first day of class, and we had to get 100% on all the questions. If you got 100% on all the questions the second day, the professor said that you can leave early.

[26:56] ICS Gabe: So people had to keep testing until they could. So when I had got my – like I tested 100%, right, because I'm a part of this math program all in high school. So I was above, right, I was above my math level at the time.

[27:08] Ayman Elsawah: Oh, okay. Yeah.

[27:09] ICS Gabe: But then I was leaving the class. It was probably like four or five of us out of like 30 or 40 students. The professor looked at me. Right. We're all in like a group. The professor looked at me and said, you got 100 percent on the exam.

[27:19] Ayman Elsawah: Oh, wow.

[27:20] ICS Gabe: Yeah. And the thing that I thought of is that what differentiates me, like your instructions weren't unclear and I wasn't like doing anything that made me stick out. So the only thing that I knew that differentiated me from all of my other peers was that I'm black. And everybody like I was the only black student in the entire class out of 30 or 40 people. Oh, my God. So I'm like, that had to be the only thing that stuck out to him. And he seemed to be surprised that I was able to score top within the class on this particular exam.

[27:51] Ayman Elsawah: So that's crazy.

[27:52] ICS Gabe: Yeah, that happened freshman year.

[27:55] Ayman Elsawah: Wow. It's like when I saw recently on a conversation with a black man, like where he said, Oh, you're smart for a black person. Right.

[28:03] ICS Gabe: Like, Oh yeah. All the time.

[28:05] Ayman Elsawah: That's basically what he's saying in essence.

[28:08] ICS Gabe: Yes.

[28:08] Ayman Elsawah: Yeah. That's unfortunate. That's really unfortunate. Indeed. Yeah.

[28:12] ICS Gabe: Yeah, I had a long conversation with my mom on the phone and really kind of going through things in my mind. And the thing that I came out and was realizing is that, you know, I'm here for my education. I'm going to get this education and not even necessarily prove this person wrong, but I'm going to be here and do what I have to do in order to get where I desire to be. And I'm not going to let anybody's presuppositions about me and how I look deter me from getting to the point where I desire to get.

[28:36] Ayman Elsawah: I love that.

[28:36] ICS Gabe: So I really had to, but I had to train, like I had to train my partner to do that. Right. It's not easy. It definitely was not an easy experience.

[28:43] Ayman Elsawah: No, it's not easy. And you know, it's funny, we all say this and it's like, okay, you could only control your actions and we'll do things. And I like what you said about overcoming it. But there's still the mental like baggage or anguish that lingers in your head and you know you try to shake it off but you got that like it's just like circles around in your brain yeah and you can't get it out and i guess we're gonna make this a therapy podcast It's true. There are these things, right? And I like how you overcome it, but it's not easy, right?

[29:19] ICS Gabe: It's not. And even to this day, I kind of think sometimes that I probably should have questioned it more or really addressed it, right? Because there's somebody that was coming behind me that was coming from Detroit because they recruited heavily from Detroit that I wouldn't have wanted to go through the same experience.

[29:35] Ayman Elsawah: Yeah.

[29:36] ICS Gabe: At times I think back about it. I'm like, I should have like faced that thing. Right. Rather than saying, I'm going to let that go. I think that if I faced it, many people coming behind me in the same program might have benefited from it. Right. I don't have any way of knowing. Right. But I kind of question myself on some of those things.

[29:54] Ayman Elsawah: You know, don't be so hard on yourself because I would say if it was me in your shoes, it probably hit you like you didn't realize what hit you until you like you walked out. Indeed. Because you're walking out, right? Yes. So you got the slap, but you didn't really feel the impact of it. Until later yeah and you're just like you're literally like blinded by that statement yeah and just caught off guard and like what you know yeah and you seem like a nice guy so you know you're not expecting that this professor you know you had your guard down right yeah and so i was proud that was my pride like right because i'm like a hundred percent yeah it's only about four or five of us in this group i know right you know i'm this is my pride walk and that pride got cut quickly yeah

[30:40] Ayman Elsawah: That's why I say it's just not easy. So don't be hard on yourself. Indeed. You got up and you kept going.

[30:46] ICS Gabe: Yeah. Yeah.

[30:49] Ayman Elsawah: For those out there that are struggling, whether they're struggling with specific issues to their race, to their gender, whatever it may be, you're going to get rejections out there. Not all your bosses out there are going to be nice. Right?

[31:02] ICS Gabe: Yeah.

[31:02] Ayman Elsawah: Like the world is full of a-holes, right?

[31:05] ICS Gabe: Yeah.

[31:06] Ayman Elsawah: But anyway, it's about just getting up and moving on, right? But if you have the strength, definitely stand up for yourself, right?

[31:13] ICS Gabe: Absolutely.

[31:14] Ayman Elsawah: Strength and agility and weightiness.

[31:16] ICS Gabe: And that's a growth, right? Yeah. I mean, I'm an eight-year-old kid, right?

[31:19] Ayman Elsawah: Exactly.

[31:20] ICS Gabe: Coming from Detroit into a very foreign environment. I mean, I got hit and I'm like, whoa, what is this?

[31:25] Ayman Elsawah: Right.

[31:26] ICS Gabe: So, you know, growing from those situations, I mean, I think your advice is very pointed and very appropriate for those types of things, right? If you say something, right?

[31:34] Ayman Elsawah: That's right.

[31:35] ICS Gabe: See something, say something. Experience something, say something. So.

[31:38] Ayman Elsawah: That's right. You know, there are things that sometimes people would let go. And then it's when you grow and when you get the strength and now you could kind of like see it coming. Then you have the strength to talk back, right?

[31:50] ICS Gabe: Yeah. That was actually the light one, man.

[31:53] Ayman Elsawah: Oh, that's the light one?

[31:55] ICS Gabe: Yeah, I have a heavier one.

[31:56] Ayman Elsawah: Yeah, we can make it a bonus episode if you want.

[31:58] ICS Gabe: Do you want me to cover the heavier one?

[32:00] Ayman Elsawah: Yeah, go ahead.

[32:01] ICS Gabe: Okay. I know of another experience that I had while I was in college. I had a very close roommate of mine. And he was actually from what you call like the UP or the Upper Peninsula of Michigan.

[32:12] Ayman Elsawah: Okay.

[32:12] ICS Gabe: And he had never really had exposure. And that was a time where, you know, there wasn't a whole lot of exposure to people outside of your culture beyond those people who lived around you.

[32:23] Ayman Elsawah: Right.

[32:23] ICS Gabe: So geographically. So he told me like the first day he saw me, like we became roommates. He's like, wow, you're the first black guy that I have ever seen in person.

[32:32] Ayman Elsawah: Oh, my God.

[32:32] ICS Gabe: All the other ones have been on television. I'm like, oh, this is going to be an uphill battle here. But we ended up, let me tell you, like we ended up getting along grandly. Like this was my buddy.

[32:42] Ayman Elsawah: Right. Awesome.

[32:43] ICS Gabe: I almost rushed with him for one of the frats. Oh boy. I didn't know anything about frats. They were just pulling me into frat houses. Like I don't drink or anything. Okay. Nothing wrong with that. But that was never like, I knew that I was coming from, from Detroit. I'm like, I have to remove all possibilities of me failing.

[32:59] Ayman Elsawah: So yeah, that would have been a lot.

[33:00] ICS Gabe: Yeah. It would have been a lot.

[33:02] Ayman Elsawah: That rush would have changed your life probably. Yeah.

[33:05] ICS Gabe: I'm sure. But we were the best buddies. We were very close. But there was times where and I don't know if you experienced this while you were in college, being very in a very small area, but just little tick tacky things. Right. You're leaving your socks on the floor. You leave the window open during this particular time and it's too cold or too hot. You know, little microaggressions that kind of we started to argue. Right. OK. And it got to the point where when we were arguing, other students will hear the arguments. And so there was times where he would get mad. He would start to mock the way that I talked, because, again, coming from Detroit, we have a certain vernacular. We talk kind of different and especially from the U.P.

[33:43] ICS Gabe: We sound different. And he would at times mock, I guess, what he thought sounded, quote unquote, black.

[33:49] Ayman Elsawah: Oh, wow.

[33:50] ICS Gabe: And like one time I said, you lucky that is me, because if there were other black students on campus that heard you saying things like that, they would probably have a problem.

[33:57] Ayman Elsawah: Oh, wow.

[33:58] ICS Gabe: And he said, oh, are you threatening me? I'm like, no, I'm not threatening you at all. So at that point, he just stopped talking to me completely.

[34:07] Ayman Elsawah: OK.

[34:07] ICS Gabe: I was just really like kind of strongly and kind of angrily giving him some pointed advice. And, you know, like I didn't curse or anything.

[34:16] Ayman Elsawah: Yeah.

[34:16] ICS Gabe: But he took that and went to the dean of students.

[34:19] Ayman Elsawah: Oh, my God.

[34:19] ICS Gabe: It was telling the dean of students that I was threatening him. And so this is the heavy part. So during the time of this counseling meeting between myself, my roommate and my then roommate and the dean of students, the dean of students was hearing both of our sides. That's what they do. They have to hear both.

[34:37] Ayman Elsawah: Yeah.

[34:37] ICS Gabe: And I explained what I had said in that instance and he explained how he took it. And then she was saying, OK, I understand. It didn't sound like he threatened you. And then at the time, my roommate had got extremely angry. OK. And then he started to spew out certain things.

[34:51] Ayman Elsawah: OK.

[34:52] ICS Gabe: I don't know if you remember at that time, affirmative action was a big issue.

[34:55] Ayman Elsawah: Oh, OK.

[34:56] ICS Gabe: In the time. And he said, quote unquote, I know that these people have been getting all types of affirmative action.

[35:01] Ayman Elsawah: Oh, my God.

[35:02] ICS Gabe: This is ridiculous that you're taking his side. At that point, the dean of students said, you are completely out of line. We're going to end this and you're going to have to move to another room. I think the administration took the right action. But I mean, I lost a friend. Yeah I lost a close friend and years later he apologized and everything oh wow yeah wow yeah but I mean those years yeah it was a heavy situation and this was like finals and everything during this yeah and you could get kicked out if they didn't believe you know Absolutely. And many have.

[35:35] Ayman Elsawah: I'm sure, right?

[35:36] ICS Gabe: Yeah, many have. So it's like their word over your word at whatever party that is.

[35:42] Ayman Elsawah: Yeah, not to be taken lightly. Yeah, it's like that video of that lady who called cops in Central Park on someone. She's like, I'm going to say you're threatening me. Right. It's like, what?

[35:51] ICS Gabe: Right. Wow. Right. So that happened. And I think I learned from it. There have been times in my life where I've been more distrustful of people who aren't from my culture because of that. Right. Because this was my roommate. I mean, like anytime he would get sick and he was throwing up or something, I let him use my trash can.

[36:11] Ayman Elsawah: Right.

[36:12] ICS Gabe: And I clean that out so that he didn't have to smell that in the morning. Like that was my buddy.

[36:16] Ayman Elsawah: Yeah. That's too bad.

[36:17] ICS Gabe: But, you know, that's how that kind of ended.

[36:19] Ayman Elsawah: And it probably was over something silly to begin with, right?

[36:23] ICS Gabe: Super silly. On both sides. Uh-huh. On both sides.

[36:26] Ayman Elsawah: Yeah. That's the problem. Like, we don't have the emotional intelligence. Like, we become Insta friends, right? Yeah. In those first years of college. Yep. But we don't have the emotional intelligence to, like, carry it through and accept our faults and...

[36:40] ICS Gabe: Yeah. Our faults, our changes, our differences.

[36:43] Ayman Elsawah: Yeah. It's too bad.

[36:44] ICS Gabe: Yeah.

[36:45] Ayman Elsawah (spoof ad): Well, hopefully others listening can learn from this experience. If anything. Yeah. And now a message from our sponsor. This is a public service announcement. The government has spawned the new pre-hack majority report division. We will save countless lives by predetermining who is about to get hacked in the future and wiping their devices ahead of time, saving you from an imminent hack. Our precogs are 100% accurate in determining pre-hacks working towards a hackless future.

[37:18] Ayman Elsawah: So going back, you were an ICS engineer in a nuclear plant to begin with. Yes. And then the fallout of Stuxnet came. And so essentially all these cybersecurity positions probably just opened up, right?

[37:31] ICS Gabe: Absolutely.

[37:32] Ayman Elsawah: Okay. How did that exact transition come in? They're like, hey, Gabe, do you want to do this? Or like, were you interested in security? Like, how did that happen?

[37:39] ICS Gabe: So I was really brought in to be kind of tailored to become the program manager.

[37:45] Ayman Elsawah: Okay.

[37:45] ICS Gabe: Of that. So the cybersecurity program manager for the nuclear plant. And at the time, because my current manager at the time, he was very close to retirement. So with my engineering background and my experience doing the INC, the electrical INC work, the nuclear INC work, I was being kind of pushed into being the manager type of roles. But I didn't want to do that. And just like you mentioned, so many roles were open. And I really wanted to get my hands in there because there are these, what you call these assessments. That the NRC, the Nuclear Regulatory Commission, does with these commercial nuclear plants. And they need, in a lot of organizations, contracting organizations, or even plants themselves, they hire people called assessors.

[38:23] ICS Gabe: So they'll come in and do an assessment of all these nuclear assets, giving heavy consideration to cybersecurity and safety.

[38:31] Ayman Elsawah: What made you want to get in that field? What was it that you saw? Two things.

[38:36] ICS Gabe: One is that I saw that I would gain a greater exposure to a lot more technologies within my field. I get to see different plants. I get to touch different areas. And two, money. I mean, at the plant, I was making good money, right, for engineering. But when you start contracting for these assessor roles.

[38:56] Ayman Elsawah: Right.

[38:57] ICS Gabe: I pretty much tripled my salary or almost tripled my salary at the time. And I was very much so determined to pay off my student loans. And so those two were motivations. One is I really wanted to get exposure to a lot of different areas rather than just being a program manager in one place. Yeah. And two, I did want to get compensated better. Yeah.

[39:16] Ayman Elsawah: I mean, there's nothing wrong with upper mobility. Indeed.

[39:19] ICS Gabe: Indeed. Indeed. So those are the two factors.

[39:21] Ayman Elsawah: Yeah. Yeah. And you know, cybersecurity is that one field where you just have to know a lot of things about a lot of things.

[39:28] ICS Gabe: Yes.

[39:29] Ayman Elsawah: And it's funny, like when I come into a company, I find myself giving advice to places outside of security because I've seen so many. So I obviously have to be a little careful, but it does give you that really quick exposure. You have to know networking, a little bit of programming, a little bit about This firmware specifically to your field. So that's awesome. I heard the episode recently with Darknet Diaries called Triton. Have you heard that?

[39:53] ICS Gabe: Absolutely. Yes. Awesome. I love Darknet Diaries.

[39:57] Ayman Elsawah: Yeah. I found that fascinating. And for those listening, I've had Jack on the show too, and I talk with him a lot. So I think I found that episode really informative for someone looking to do ICS security or OT security.

[40:12] ICS Gabe: Mm-hmm.

[40:13] Ayman Elsawah: How does one actually like someone out there, how does one get into the field? You know, do they need some sort of baseline? Do they need someone that's good at firmware? Is someone good at car hacking going to be good for ICS? Like, how does one actually get in the field?

[40:28] ICS Gabe: There are so many different ways. I think that for me, as I've kind of explained, it's more like happenstance, right? Where Stuxnet happened, a lot of my role changed. And, you know, I typically coined the phrase Stuxnet changed my life. It really did. Yeah. Yeah, I'm going to have to write a book or something about that.

[40:46] Ayman Elsawah: Yeah.

[40:47] ICS Gabe: But anyway, like pretty much Stuxnet happened. And as I was in engineering, I transitioned into cybersecurity slash engineering.

[40:54] Ayman Elsawah: Right.

[40:55] ICS Gabe: And I think that it's very important for ICS. I think it's very important to kind of really have those baseline understandings of technologies and systems. Right.

[41:06] Ayman Elsawah: Mm hmm.

[41:06] ICS Gabe: Really, like you were mentioned, networking. So kind of a lot of times I aligned my necessary understanding with certifications. So while I was there at the plant, I was able to obtain one of the SANS certifications. They did that one. But I recognized that I had a gap in networking. So I just self-studied for the CCNA. To really gain an understanding of TCP, IP, switches and routers, because these were all in the ICS environment, firewalls and all of these different devices. And then I needed to have a better understanding of attack techniques. And I don't know how people feel about the certification, but the CEH, the Certified Ethical Hacker certification, I found it to be very valuable because it gave me a great understanding of foundational offensive security methods, right where you get into your career.

[41:56] ICS Gabe: Your scanning, your exploitation, post-exploitation, kind of going through a lot of that foundation. But then I think that a lot of times when you're talking about transitioning into ICS, many times people are looking for individuals who are already working within the ICS field. So maybe like that of automotive, right? Somebody who already understands cars, right? Then they'll get into that of cybersecurity for cars or an individual who might work at an electrical utility, right? They might be a linesman or they might be a plant engineer. A lot of times plant engineers, because they're already responsible for these different digital systems in the plant, these ICS systems in the plant. So they typically throw on cybersecurity as an additional responsibility.

[42:42] ICS Gabe: I've seen that.

[42:43] Ayman Elsawah: Oh, interesting. Okay. Yeah.

[42:44] ICS Gabe: But then there's also, as I mentioned before, with the SANS certifications, they have ICS specific certifications. So I was able to obtain the GICSP. That's the GIAC Industrial Control Systems Certified Professional, something like that.

[43:01] Ayman Elsawah: Okay.

[43:01] ICS Gabe: But that is very ICS focused, and it gives you an understanding of the architecture, the environment, and all the security considerations and past events. So I would say certifications and understanding those base fundamentals of cybersecurity.

[43:15] Ayman Elsawah: And on certifications, on the topic, everyone should listen to Ari episodes, but episode two about certifications. I really love how you break down what certifications are and what they're not. So- For anyone interested, definitely check out his episode two, kind of more explanation on what certifications are. But anyway, go ahead.

[43:35] ICS Gabe: Sure. No, just like the certification route and understanding the base knowledge of networking and security, but even getting into that of getting that hands-on experience, seeing where you currently are and seeing if you can transition to one of those organizations.

[43:48] Ayman Elsawah: Yeah. So Cisco devices are hard to get a hold of, right? And are there specific Cisco routers and switches for ICS environments?

[43:56] ICS Gabe: Absolutely.

[43:57] Ayman Elsawah: Oh, there are? Yes. Oh, okay.

[43:58] ICS Gabe: Sometimes it's just pretty much ICS, but with the same systems, right? So there is what you call like an industrial control system firewall. It's called like a Tofino firewall. So this firewall specifically does all of what firewalls do, right? Access control, Yeah. Control lists and whatnot. But this one also does deep packet inspection and is able to recognize Modbus, Profinet, DMP. So it's able to recognize those ICS protocols.

[44:28] Ayman Elsawah: Oh.

[44:28] ICS Gabe: And there's also like these large vendors like a Siemens or, and there's also like a Stratix switch. A Stratix switches are pretty much industrial switches that can talk what you call like serial ports. So serial communications. Uh-huh. Over TCP, but they are actually just a Cisco switch. So you get to the command line and it's just a Cisco ISO.

[44:51] Ayman Elsawah: Wow. That's funny.

[44:53] ICS Gabe: Yep. So a lot of the information is translatable. And a lot of organizations, they're still using like Cisco ASAs.

[44:59] Ayman Elsawah: Oh, wow. Okay.

[45:01] ICS Gabe: Yeah. A lot of the stuff is very, in IT and in ICS or OT, it's the same type of technology.

[45:07] Ayman Elsawah: How can someone build like a home lab with ICS stuff? Are there any simulators online for free or any certs that are like lower cost or self-study that people could do? How can ICS be accessible for people?

[45:21] ICS Gabe: So one, the Department of Homeland Security, they have a division. Forget the current name, but I believe it used to be called ICS cert.

[45:29] Ayman Elsawah: Okay.

[45:29] ICS Gabe: And they have a number of online free modules that kind of go over a lot of the basics as it concerns industrial control systems. So it'll get into what is a PLC? What are RJ45s? What are serial like RS232s or RS485s? Or what are these communication protocols or network architecture and firewalls? So that's free.

[45:53] Ayman Elsawah: Oh, okay, cool.

[45:53] ICS Gabe: That's a free resource. But then as it concerns a simulator, right, they have Modbus simulators, which you call like RTUs. Okay. These are used in the electrical utility environment, remote terminal units. They have simulators that you can run as virtual appliances. So you can set up your own little home network where you're able to generate traffic that looks similar to that of an ICS environment.

[46:18] Ayman Elsawah: Mm-hmm.

[46:18] ICS Gabe: Yep. And also, if you guys Google like ICS protocols, PCAPs, ICS protocol PCAPs, there are several repositories that are online that you can find and that you can pretty much pull up Wireshark and start to evaluate what some of these protocols look like on the wire.

[46:38] Ayman Elsawah: That's awesome.

[46:39] ICS Gabe: A couple of different things.

[46:41] Ayman Elsawah: I think PCAPs are a great way to really democratize access to either previous incidents, right? Yes. Of course, you know, do it on a sanitized machine.

[46:51] ICS Gabe: Absolutely.

[46:51] Ayman Elsawah: On a lab machine. Don't look at malware PCAP and, you know, on your home machine. Yeah. But what I'm saying is I love that PCAPs really democratize. So that's really good. Yeah. Any resources you have for someone at home? I mean, there's a lot of people with that transition, right? You could be a teenager or you could be a college student or you could be an older experienced tech, right? Looking to do your next thing because you might be bored in whatever you're doing. So do you think ICS still has a long way to go for security?

[47:20] ICS Gabe: Yes, it definitely does. I think that one thing that we're seeing heavily within this environment, and it's been happening over the last several years, is that organizations aren't taking advantage of the security that comes from air gapping, right? A lot of organizations are literally attaching their ICS devices to the internet, right? For remote access and remote management, or even to collect logs, right? Because in order to get logs, you need to be able to get to whatever your SIM solution is. And a lot of times that same solution exists within the enterprise IT environment. So there needs to be some type of communication back and forth or just even home management, right? Say, for instance, a generator goes down.

[48:03] ICS Gabe: A plant engineer needs to be able to have knowledge of that and be able to check certain set points and certain information without necessarily being on site.

[48:12] Ayman Elsawah: Yeah.

[48:12] ICS Gabe: Or even third-party vendors having access to be able to maintenance their GE transformer. They need access. So that is one area that is increasing. But that squishy middle is still there in many cases. It's definitely still there. So I've been involved in several assessments where they're like internal pen tests where we're looking at the ability to go from an enterprise IT environment into OT assets. So a lot of times we have an assumed breach perspective, right? Phishing emails happen all the time.

[48:41] Ayman Elsawah: Right.

[48:42] ICS Gabe: So if that corporate environment gets infected, what is the probability and the likelihood that this will propagate to an OT environment? Because it can cause some real issues there.

[48:51] Ayman Elsawah: Yeah. And tell me, like, have you ever been on an assessment and find evidence of an intrusion and describe the feeling in your body like if that happened?

[48:59] ICS Gabe: So I've responded to an incident in an ICS environment. So the setup is pretty much like, so what happens is that you have the technicians who are programming these PLCs, programmable logic controllers. And companies like Siemens or Rockwell or AB, Allen Bradley, they produce these PLCs that are a lot of times, they're able to be managed by RJ45. So you can SSH into these devices. They have some type of remote connection. Anyway,

[49:26] Ayman Elsawah: I'm surprised they have SSH. I thought they'd still be using Telnet.

[49:30] ICS Gabe: Hey, you see Telnet too? Clear text protocols, you can see everything. So the technician with his laptop was able to program this PLC and his PLC was responsible for controlling a bridge going up and down. So you get into the safety of these different systems. That is the criticality of this particular device. What happened is that this particular individual, they connected this machine, this Windows laptop to the Internet and it being connected to the Internet to download some firmware, some software, left it connected overnight. And what happened was that it Oh, boy. It came back to the machine. It had all types of pop ups and evidence of a compromise. Yeah. I mean, literally. And so it was very interesting to investigate that because I was getting it on that side and was able to attribute it to some commodity malware from a very popular APT.

[50:31] ICS Gabe: Right. So.

[50:31] Ayman Elsawah: Okay.

[50:32] ICS Gabe: I mean, going through this whole process of scoping this thing out. And really the thing that I found the most fulfillment in was really like calming the nerves and really giving sound advice and next steps to that individual who was responsible for that compromise. Right. Yeah. The person is like, I don't know what to do. And I got all these pop-ups and I don't know what's happening here and what I need to do next. And I think that was the thing that brought the most fulfillment. It wasn't It wasn't necessarily just doing the research and finding the responsible party, what the malware was, but it was actually calming and quelling the nerves of the person that was involved or the customer that was involved in the compromise.

[51:11] Ayman Elsawah: Yeah, there's something to be said about helping someone. So we're here at the end of the day to help people, right? Yeah. In our own ways. And so calming someone and kind of giving them the reassurance or even the quote unquote medicine on how to protect themselves in the future. So that's interesting you say that. That's really good. I did have one more question. Is that a vector? For example, someone could upload fake firmware or altered firmware into these devices. Out of the percentage of all the ICS devices that you've seen out there, How many are actually checking signing for updated or uploaded firmware?

[51:46] ICS Gabe: I don't get a lot into the firmware side. I'm actually trying to transition more and more into that area. But I saw a recent talk. I don't know if you've ever heard of this conference called S4. Hmm. It happens every year. It's pretty much like the ICSOT Securities DEF CON. Oh, cool. So it happens every year, typically in January, typically in Miami. And this is like the most cutting edge ICSOT security research and presentations. Mm-hmm. I saw a presentation about firmware signing in the state's firmware within the ICS security environment. And there is signing, right? There is signing that occurs. But I don't believe that there are many mechanisms out there right now that are checking for that.

[52:33] ICS Gabe: Actually, that is one vector that a lot of times is compromised. I remember I was doing a penetration test against what you call these smart reclosers. So these are devices that if it senses a fault in the electrical line, it opens so that devices down the line don't get overcurrent, right, and get destroyed.

[52:51] Ayman Elsawah: Oh, wow. Okay.

[52:52] ICS Gabe: Yeah. So then it continues to evaluate and sense the current in that particular line, and it'll reclose by itself, which stops the utility from having to send out a truck or an individual. Okay.

[53:02] Ayman Elsawah: And if that fails, what's the worst going to happen?

[53:05] ICS Gabe: Then somebody will have to come out and service that particular line or it can cause an overcurrent and destroy. Right. Yeah, it can destroy. Like, I don't know. It could be connected to a factory, right, that controls robots that makes baby food.

[53:18] Ayman Elsawah: Who knows? It could cause a surge or maybe even a spark or fire or something, right?

[53:22] ICS Gabe: Yep. The surge of fire or spark. Yep. Okay. Absolutely. So this particular system, so that sits on, so the sensing mechanism or the sensing, I guess, device sits at the top of the line, but at the bottom, there is a little IoT, like communications gateway. Okay. That sits at the bottom that communicates back to the utility, I guess, like the utility version of a data center. Okay. Which pretty much is saying where our faults with devices or where the system's faults are or what's happening there if we need to send somebody out. So I remember as I was penetration testing this particular gateway, I would try to upload some faulty firmware. And what happens a lot of times is that it just bricks the system.

[54:03] ICS Gabe: It costs money. Okay. Right. Right. To be not functional okay and i think that kind of goes into one method or methodology within Right.

[54:10] ICS Gabe: Ics is that of availability you know right like the cia triad right confidentiality integrity and Availability right like in banking it's like integrity and confidentiality but in ics and Ot security it's definitely availability right you Right. You don't want your generator to go down. You don't want your nuclear plant to stop sensing what the current pressure and heat levels there are within the reactor vessel. You don't want your smart reclosing to not be smart anymore. Yeah. So firmware. So I uploaded some faulty firm. Like, I don't even know. I think it was like firmware for like some Honeywell temperature transmitter or something. And it just bricked the system.

[54:47] Ayman Elsawah: Hmm.

[54:48] ICS Gabe: So from experience, I know that it can break systems, but it's current research and security. I'm not 100% informed, but I know that there is an S4 presentation.

[54:56] Ayman Elsawah: Okay. Any other resources and conferences out there that you would recommend for those trying to learn ITS?

[55:01] ICS Gabe: So definitely there is S4, happens in January. The ICS Summit, right? That is something that I spoke at earlier this year, right before COVID-19, that we pretty much were going over a lot of different information, introductory and kind of latest ICS security research. I did it on packet capture analysis for industrial control system, ICS environments.

[55:22] Ayman Elsawah: Which ICS summit is that?

[55:23] ICS Gabe: So this one was the one in Orlando. So it's called the ICS summit. If you just Google ICS summit 2020, SANS ICS summit 2020, then you'll be able to find it.

[55:33] Ayman Elsawah: Oh, SANS. Okay.

[55:34] ICS Gabe: Yeah, SANS. Sorry. Yeah. And then there's another one that's coming up, a SANS summit, the oil and gas summit that's happening in October. And I believe that one is virtual. Okay. And I believe it's free. Okay. I don't want to be so quick, but I believe it is free.

[55:47] Ayman Elsawah: So free is good.

[55:48] ICS Gabe: Yep.

[55:49] Ayman Elsawah: Yeah.

[55:49] ICS Gabe: That's another resource for sure.

[55:50] Ayman Elsawah: Okay. Well, anything else? I think we've talked about your podcast, but anything you want to mention before we go?

[55:56] ICS Gabe: Yeah. One thing I would like to mention is for those who are career transitionists, I know this is like, you know, breaking in and getting into cybersecurity. I would say a lot of times one of my issues was that I was thinking about or I'm trying to do everything at once. Right. I was studying for my CCNA at one time. I was involved in all these different assessments and in work. I was also trying to study for my OSCP.

[56:20] Ayman Elsawah: Oh, boy.

[56:21] ICS Gabe: Really try to kill that in a year. All of these different things. And one thing that I found success in is focusing on one thing and accomplishing that and then going on to the next thing rather than trying to do so many things at once. And I think that was something that I really would like people who are transitioning, who are finding it maybe a little difficult right now, focus on one thing, accomplish that, and then go on to the next thing. There's so much information available for you to learn and so many different resources for you to transition.

[56:49] Ayman Elsawah: That is really good advice. It's amazing, you know, early on there used to not be a large amount of resources out there in cybersecurity. And now there's a ton. Yeah. And in fact, we've come paralyzed with overwhelming availability of choice. Yes. So I think that advice is really extremely sound advice. Just take it step by step. Take a practical approach to things. And yeah, that's really good advice. I appreciate that. I think many others would appreciate that. So Gabe, this has been a wonderful conversation. I had a wonderful time. And I think everyone out there, after you're done with this episode, check out ICS with Gabe. He's got a podcast just about ICS. And I think we'll talk again in the future.

[57:31] Ayman Elsawah: I think it's been great.

[57:31] ICS Gabe: Indeed. Thanks for having me, Amy. All right. Thank you.

[57:43] Ayman Elsawah: Thanks for listening. Hope you enjoyed that as much as I did. As always, if you like this show, please thank my guests for their time and let others know about the show. They might thank you for it. Intro music is Cascadia by Trash80. Trash80.com. Check out the website gettingintoinfosec.com for show notes, clickable timestamps, a preview of my book, and more. And stay in touch on Twitter for more Getting Into Infosec reflections.

[58:54] Ayman Elsawah: Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.