Speaker 1: We can't just said idly buy and say oh, well,
the worst thing we've seen is x y Z. That
does not necessarily mean that's the limit to the imagination
and capability of Nation States.
Speaker 2: Welcome listeners to the Industrial Security Podcast. My name is
Nate Nelson. I'm here with Andrew Ginter, the vice president
of Industrial Security at Waterfall Security Solutions, who's going to
introduce the subject and guests of our show today. Andrew,
how are you?
Speaker 3: I'm very well, Thank you, Nate. Our guest today is
Joseph Price. He is a senior manager and the program
lead for the OT Cybersecurity program at Deloitte. And our
topic is Nation States more or less you know the word,
you know, credibility comes to mind. How worried should we be?
I mean, how likely are is the is the average
site to be the target of a nation state grade attack?
This is, you know, the kind of thing that Joseph
is an expert on.
Speaker 2: Without further ado, here's your interview with Joseph.
Speaker 3: Hello Joseph, and welcome to the podcast. Before we get started,
can I ask you to say a few words of introduction.
Please tell us a bit about your background and about
the good work that you're doing at Deloitte.
Speaker 1: Sure, thank you very much Andrew for having me on.
I've followed you and it's exciting to be a part
of your podcast, so thanks for this opportunity. My name
is Joseph Price, I go by Joseph, and I'm zeroing
in on about thirty years of being in cyber I
started back in the mid nineties with what we called
information warfare. We didn't use the term cyber back then.
As an actiduty military officer in the Air Force. I
spent about four years defending networks various places around the world,
and then I switched over into the offensive cyber side
of things. I don't get to talk a lot about that, obviously,
because details are not things we can discuss open. But
I will tell you this, the one thing of spending
sixteen years in that community is I even just learn
about how we conduct offensive operations, but how other nations
and other groups and organizations can conduct offensive operations and
really what they can do, whether we've seen it mentioned
in the news or not. So I enjoyed about twenty
years total working for the Department of Defense in various capacities,
and after that I moved here to Idaho Falls, Idaho,
where I now live. I joined Idaho National Laboratory and
was a deputy director for Critical Infrastructure Protection there, and
then three years ago I shifted over to Deloitte and
Touche or just Deloitte if you prefer, and I'm a
senior manager there and the program lead for our OT
cybersecurity program. So I help develop our capabilities and service
offerings and deliver them to our clients who have OT
systems to help them secure and protect and create more
resilient architectures that are supporting their OT systems. So that's
where I focus now, and it's a pleasure to be here.
Speaker 3: And the world needs more OT security, so thanks for that.
Nation states is our topic, and you know, we read
about nation state threats in the news. You know, I'm
I work for a vendor. I go to a lot
of these, you know, face to face conferences. I hear
a lot of vendor pitches. I'm sorry, a lot of
vendors get up there and waive the nation state threat flag.
And you know, fear, uncertainty, in doubt. You know, the
sky is falling, the sky is falling, We're all going
to die, And yet here we are you know you've
been on the inside without stepping on on you know
anything you're not allowed to tell us. How accurate is
the the news, How you know really what's going on
behind the scenes. How how worried should we be?
Speaker 1: That's a great question. I think in the absence of
details and information, a lot of times people just make
presumptions about what a nation state might do. In terms
of capability, nation states don't tend to just be opportunity.
There's certain amount of opportunistic elements to any campaign, but
they're not just necessarily saying, oh, let's see what we
can find. Often actions are deliberate. Now, the problem we
have is we don't necessarily know what they might target.
So we might talk about a few examples or ideas
around some things we've seen recently in the news. But
for most processes, it's a deliberate it's a deliberate activity.
Nation states have the resources, they have access to talent,
they have the patience to do things. So in many
ways we might conclude that, you know, they're ten foot
tall and bulletproof. Now that's not entirely true, but I
think we were we are full in ourselves to think
that the best capability out there is some closely related
version to what we've seen in the news when a
particular operation was exposed. I think that capabilities are really
only limited by imagination and one's dedication to a particular
operation or operational objective. And so I tell people that, yes,
the Nation States are highly capable, they aren't necessary. You know,
a lot of people say, well, do I have to
worry about them targeting meat? Well, that depends, But I
would say on the whole, operational technology systems are more
attractive for targeting for military or diplomatic purposes than it systems,
or I should say they're attractive for a different reason,
and that's as we all know, those of us who
tried to defend them, is that impacts from the cyber
domain can manifest themselves in the physical domain. And so
if you think about it, you can achieve military goals
which may be to cause some destruction or to impact
the availability of some critical resource, all through the cyber domain.
And so I believe there's a lot of capability and
a lot of emphasis and focus out there, and so
we can't just sit idly by and say, oh, well,
the worst thing we've seen is xyz. You know Ukraine
they flipped a few breakers. That does not necessarily mean
that's the limit to the imagination and capability of nation
states at this time.
Speaker 2: Andrew to get us started here, we're talking about nations
state apts. It could sound like it's all one thing,
but in reality, we're talking about a wide tapestry of
different threat actors from different places with different motivations. Which
are the ones that we are most interested in in
this podcast today.
Speaker 3: There's a lot of different capabilities out there, and you know,
this is not comprehensive, but maybe just to give people
sort of a taste of what's possible, let me cover
off maybe a half dozen of the threat actors and
sort of the different ways they approach the you know,
nation state great attacks. Starting the low end. Iran is
accused of sponsoring activist groups. You know, most recently, they
targeted some PLCs that were on the Internet that were
manufactured by an Israeli manufacturer. They you know, disabled water
distribution in a small town in Ireland, and you know,
doing this by sort of low tech, low investment targeting
of Internet exposed assets. North Korea has more sophisticated professionals
that are paid every day the ransom Sorry, the activists
aren't paid. Their amateurs professionals are paid every day to
attack things, and mostly what they do is ransomware, because
this is how the sanctioned regime makes a lot of
its foreign currency, is stealing it in ransomware attacks. So
they've got some very sophisticated ransomware groups. China sort of
is credited with bringing nation state grade cyber attacks to
the forefront back in the day. The DHS at the time,
in like two thousand and six two thousand and seven
put out alerts about advanced persistent threats that was code
for Chinese intelligence agencies, and they pioneered sort of the
public use of what's now the classic remote access trojan
or remote access targeted attack, where you get a foothold
on a network, you install a RAT, a remote access trojan,
a piece of malware. It calls to a command and
control center on the Internet, and you operate that malware
by remote control. You use it to attack other machines
on the compromise network. You spread the RAT to other machines.
You might spread different versions of the RAT in case
your first version is found out and you establish a
persistent presence. The very latest there is volt Typhoon, which
is saying there isn't even a rat anymore. They're using
the facilities in the operating system to maintain remote control.
Extremely difficult to detect that the remote control is there.
The Russians take a different approach. Historically, they've produced malware
artifacts for attacks. Think Black Energy had code in it
to manipulate DNP three devices. DMP three is a widely
used protocol in the electric sector. The latest out of
Russia or credited to Russia, I mean, none of this
is officially confirmed, is pipe Dream, which again is a
code that it's attack code that has a lot of
capability in it for manipulating devices in control systems, presumably maliciously.
And you know, we haven't heard much about them lately,
but back in the day, I think twenty ten, you know,
American and Israeli intelligence was accused and has never officially
accepted responsibility. But you know, is widely thought to have
produced stucks net, which is a very sophisticated artifact that
once you let it loose in a target network, it
just does its thing. It's autonomous, It spreads autonomously, it
finds its target its sabotage is the target. It does
not need remote control the way the Russian tools do,
the way the Chinese prefer to sort of silently volt
typhoon living off the land remote control systems. The stucks
net was autonomous. So this is sort of the spectrum
from low tech activist attacks to remote control attacks, some
of which are very sophisticated, to autonomous attacks, some of
which you know, have been historically very sophisticated. And there's
probably more that I've missed, but it's you know, it's
a it's a sobering set of capabilities. We read about
these nation states in the news. A lot of the
nation state grade attacks that make the news are espionage,
breaking into governments, breaking into nonprofits, breaking into you know,
anybody who who dares to you voice any opposition to
a regime, breaking into these places and stealing information. You know,
you mentioned a couple of instances, uh, you know, the
Russia breaking into the Ukraine twice, uh, causing you know,
physical power outages. You know. The the I guess that
the question is we hear a lot comparatively about espionage,
not so much about sabotage. You know, is there sabotage
happening that just isn't being reported. What's going on there.
Speaker 1: That's a great question, Andrew. And you know when I
mentioned earlier that that the activities you see in the
news are not the limit of the capabilities of a
nation state level actor. It's important to realize like these
are not singular transactions, especially when you consider targeting O
T systems. This is a campaign, right, so it involves
over time, and sometimes our defenses are good, we catch
them early on in the campaign. So even the simple
acts within Ukraine twenty fifteen, were there are a number
of were there a number of circuits that were that
were opened as part of that particular action. It started
with a lot of information gathering, a lot of reconnaissance.
We even saw right after the twenty fifteen activity in
January of twenty six that Ukrenergo, which is the transmission
company that was later the target in December of twenty
sixteen of the follow on attack was part of a
phishing scheme and some of the particular people that they
targeted in that scheme were protection engineers. So you start
to put these pieces together and you realize they're looking
at those people who are responsible for the overall protection
system of the transmission network. And in December of twenty sixteen,
rather than throwing several breakers and several different distribution companies,
they threw one breaker in a transmission company and it
was something on the order like an order of magnitude
more power loss in that one breaker trip than in
all the rest of the twenty fifteen during the twenty
fifteen attack. And so you realize that there's deliberate processes
going on, and sometimes, like I said, we're lucky and
we interrupt the process early. But the goal for to
attack a particular ot system, let's use the United States
as an example target. The goal is not to let's
get in there, gain access, you know, pull all the
information we can, and then cause sabotage. Because when your
sabotage takes place in the physical realm, the chance of reprisal,
the chance of every anything from a diplomatic to a
military response, certainly it raise it or excuse me, rises considerably.
But if you have those assets to hold at risk,
if you can gain access, secure that access, and hold
it at risk, you can integrate that the you know,
the whatever sabotage or whatever attack scenario into a suite
of capabilities that you could have as part of a
campaign plan, and it could be very effective too. So
the adversary is going to use the most minimal force
required to gain access. And if they can use something that,
let's say is out there in the wild, but you
know they can tell you're not patched against, well sure
they're going to use that. They're going to use that
before they go to some zero day that they know
and no one else knows. Right, you're going to be
economical in your use of your various offensive crown jewels.
Once they've gained a foothold, once they've secured their position,
they may do the need to do additional reconnaissance to
figure out what are our options. I always felt that
Ukraine twenty fifteen was kind of a hastily, hastily executed
operation because so many things happened at once, and then
they burned all the infrastructure at the end. But if
you go back and look at each individual action that
was taken at each of the distribution companies, you recognize
that in some cases they obviously had people that couldn't
read or understand Ukrainian because they had messages on the
screen that they were remotely operating that said, this is
just a test system, and they continue to try to
do things. They opened a tiebreaker, which in general, unless
you're under some maintenance function, tiebreakers aren't going to shut
the power down anything. And so what we saw as
things progress and you get into the December twenty sixteen event,
you realize that things are more specific to the equipment
that's in use. It's highly targeted. There clearly had someone
who knew what was going on in that system. And
I think we need to recognize that a nation state
adversary will understand your process. They may not understand your
systems and exactly your processes for running through things or
your contingency measures, et cetera, but they'll understand the physical
process that you're controlling so that they can understand the
effects they may have. And then they may just sit
on that access monitorp it may only phone home once
in a blue moon, because they don't need to risk
detection by having frequent and regular communications or a massive
amount of information flowing back and forth between that target.
They have it there, they can hold it and they
can use it again for what I would say is
you know potential military or even just diplomatic influence operations.
But without having to you know, take any physical action themselves.
They can do it remotely. So I think that's that's
something that is the reasons why they're not necessarily going
straight to sabotage. It's not because as I've seen in
an article recently, Oh, they wouldn't mess with us. No, Actually,
this is the exact way that people would put in
bess with the United States, you know, attacking it asymmetrically,
using capabilities to cause damage, or to cause service outages
or even uncontrolled environmental release risk safety of risk a
safety basis or violated safety basis, and cause potential harm
to humans. Those are all things that could be done
from AFAR via the cyber domain. That's that's a nice
capability to have, you know, an arrow in your quiver
if you will, that Nation States would want to hold
on to for some future conflict.
Speaker 3: The example you gave of, you know, campaigns developing capabilities
that sort of describes volt Typhoon to a t. But
in the news lately there's been a lot of sort
of lesser stuff. I mean Russian uh, you know, state
sponsored Russian activists are are accused of I don't know,
overflowing a water tank in Texas. The uh you know,
Iran's nation state sponsored activists are accused of targeting and
has really made PLC that's used in a couple of
small water systems, and turning off the water to one
hundred and eighty people in Ireland for two days. None
of this seems terribly consequential. I mean, what really is
the goal here? That doesn't sound like a campaign.
Speaker 1: Yeah, that's a great question, a great observation, Andrew. It's
interesting when you and I think this is again, this
is a that tendency I think, especially within the media,
to presume that what we see is the totality of
the operation. And I just don't think that's the case.
So you mentioned a couple of really good examples. In fact,
we had a very recent example on Monday, there was
a the Arkansas City Kansas was also attacked. Its water
authority was attacked. Very little details have come out. I'm
very interested to hear what they find, and we're trying
to get some additional details through some contacts.
Speaker 4: But because it on the face, it just looks like, well,
not only did they not really have much of an
effect the plant in Arkansas City went into manual mode
a similar situation with some of the examples from cyber avengers,
the ones you mentioned attacking water authorities and kind of
defacing the PLCs.
Speaker 1: The only place that actually caused an impact was that
village in Ireland that you mentioned. And you're like, well,
and now they're exposed. So, like you said, what did
they what did they really gain from that? And so
my answer to that is, let's think deeper about the campaign.
The campaign ultimately has let's say, high value targets at
the end of it, and maybe that high value target
is a major municipal water system in the US, one
that cannot be ignored if you were to have significant
impacts against. So how do you how do you target that?
And everyone might think, okay, well, let's jump straight to
I'm gonna learn about their systems. If I can, who
are the key people, I might start fishing, et cetera.
But part of you has to ask, wait a minute,
if we were to get caught early in the campaign
and there were to be any reprisals, like would would
that completely wipe that campaign opportunity off the map? Do
we need to use better tools? Do we need to
invest more time in a human related a human related operation.
You know, there's a lot of things to consider, and
so even starting, you might say, how's the US going
to react when we cause when we launch an attack
and cause any impact whatsoever to a water system. Well,
we need a we need a lab environment. Right, So
there's I'm sure funny in Nation States. I'm sure they
all have labs where they go test things out. But
to really get ours to measure our response, they need
to do it somewhere. Well, what is you know, if
you consider large metropolitan areas New York City, Los Angeles, Philadelphia, Baltimore,
you know those you're gonna get. Those are gonna get
pretty big reactions pretty quickly, for sure, Right, a lot
of people will know if something happens there. Well, what
about Muleshoe, Texas. Probably not a large number of people
even are gonna know where Muleshoe, Texas is on the map.
So we're going to hit some of these smaller rural areas.
Number one, It's gonna be easier target, right, because these
water authorities suffer from what I call stp same three people,
the same three people are responsible for making sure they
have all the necessary chemicals for treatment of the water
that the water distribute sourcing and distribution, all works. You know,
they go and deal with issues. They've got to handle
and manage the budget. They've got to handle the maintenance calls,
the late night calls of issues, the water main breaks,
all those things. Same three people are response for everything.
So it's a pretty good bet they're not going to
have high end cybersecurity capabilities. So and then we're gonna
do someth We're gonna take an action, and that action
isn't going to directly cause loss of life or anything
major like that. So they had to go into manual
operation mode. Big deal, right that of all the potential impacts,
that's probably the least not for those same three people
because now they're probably a lot busier, even more so
than usual. But you know, that's going to give us
a window to does that cross a threshold? How fervent
is the US's response at the executive level at the DHS,
is a level at the state governor's level, what are
how do we respond as a community as a nation
when we recognize that a foreign actor is taking action
against these life critical you know, services that we just
take for granted every day, and so I think that
again part of this camp, part of the campaign is
figuring out where are those limits to government response, what's
going to what's going to you know, trip a greater
response or something, and what will those responses look like.
It's no different in my mind, like when you have
Russian bombers flying into our air defense identification zone up
near Alaska. They're not crossing into our national airspace, but
they're in those areas just outside of it, and they
watch with their radars and their surveillance planes, how quickly
we scramble, how quickly we are able to intercept the aircraft,
you know, what tactics we use. I believe that's also
going here, going on here, because in the end, if
we believe, I mean so, one of the things I
mentioned earlier was, hey, we can't guide our greatest adversaries
capabilities based on what we see in the news. I
was quite honestly shocked in twenty nineteen when the Director
of National Intelligence published an unclassified threat assessment and in
it identified a couple of interesting facts. Number One, they
named Russia and China in there, which you know, for
those of us who have worked with the intelligence community
before that wasn't it wasn't surprising that those were the
potential adversaries they named. What was surprising is that they
were saying this at the unclassified level, and it said
that Russia could cause a power impact, an impact to
our power, whether it be generational distribution that could last
from hours to days, That China could impact our water
systems in you know, in such a means to last
from days to weeks. Like those are pretty bold statements
coming out in an unclassified intelligence report. So I think
there's a recognition at other levels of the government that
nation state adversaries do have a greater capability than what
we might presume just by watching the media and the
smaller activities. You know, Yes, they could be isolate incidents.
In the case of the cyber Avengers, you know, they
were trying to deface the the HMI screen on Israeli
made equipment. Okay, that might have been an isolated campaign.
Speaker 5: But for the other things, I sit there and I think, hmm,
how could this be used as part of a larger,
more diverse campaign to see how we respond, to see
what we put in place as a result of those attacks,
and how can we can you use that as part
of of our higher value target, higher value target operations
and preparing for those you know to have capabilities there.
Speaker 3: So, if I were to summarize the one sort of
surprising thing that I took from from you know, the
detail is the concept of a campaign. You know, it's
not just that small water systems are easier targets and
so let's go after them. It's you know, I've never
really thought of these attacks as stepping stones. I really
hadn't thought of these attacks as testing our response capabilities.
I mean, the one concrete example that springs to mind
is I forget It was a few years ago the
American administration announced that, you know, attacks on critical infrastructure,
civilian infrastructure would be regarded as acts of war. Well,
someone just overflowed a water tank in Texas. Did anyone
declare war?
Speaker 1: No?
Speaker 3: So yeah, it does. You know, it almost does feel like,
you know, people are pushing a little bit, you know,
the bad guys are pushing a bit to say, well, really,
when would you when would you respond? How would you respond?
Speaker 2: This?
Speaker 1: This makes sense?
Speaker 2: True? And what I didn't hear him say that I
believe is also occurring is when nation state apts use
one of their targets as a springboard or a relay
point to another. So, for example, you're targeting one major
utility or telecommunications organization or whatnot, you go after a
smaller target and then you can use that as a
relay point to hide your malicious communications. For example, among other.
Speaker 3: Things where I have heard of that is in supply chain.
More than you know, targeting one critical infrastructure to get
into another. You tend not to have that kind of
connection between a smaller water utility and a larger water
utility in my recollection, at least in North America. You
might have stronger connections like that in Europe where things
tend to be sort of closer to each other, more connected.
So yeah, that's that's a good point. So work with me.
You know, we've been talking about the threat, and you know,
I'm convinced that the nation state threats are real. The
question becomes what do we do about them? You know,
if I mean the the the truism, I don't know
if it's true, but the truism is that a nation
state military essentially has unlimited money and talent and time
to come after us. And when you have that coming
after you. You know, it's hard to imagine how you
could stop an attack like that. You know, given what
you've said about the threat. You know, we as defenders,
from small water systems to large high speed passenger rail
switching systems. We as defenders, what should we be doing
about the threat?
Speaker 1: The challenge in answering that question is that the problem
is multi dimensional and multifacting. But in general, I believe
what we should be doing first and foremost is recognizing
that this is a business risk or an operational risk,
not a technical risk. So often when you bring up
the topic of a potential cyber attack, let's say you're
talking to a CEO or a board, Well, go talk
to the sizzo or go talk to the CSO, Right,
that's their responsibility. But when we consider that impacts can
directly impact the business, whether we're brewing beer or providing
clean drinking water to millions of citizens, the ability for
cyber to now create business impacts means it should get
some degree of attention, and the consideration for what should
be done should not be reserved to While I did
the minimum, I followed the checklist. I'm compliant with this
standard because, as we all know, in any standard, your interpretation,
your finding for how you've met that standard, the exceptions
that you might apply for and get granted for that standard,
all could become your own undoing. So to start with,
how do we talk about security of security of OT
systems to thwart the business risk. When you have attention
to that level, then you start to recognize the investment
that's made in any business activity, whether it's bringing on
new equipment, whether we're upgrading. Let's say we're a utility
and we're upgrading to it. You know, we're large provider
and upgrading to a new energy management system. Right, part
of that capital expense is the security, and with that
we're not trying to meet some minimum required. Now we're
recognizing that just as the adversary is dynamic and can
be active at different times, we need to make sure
that our systems are actively monitored. That there is a responsibility,
whether it's done locally by organically within a given company
or provider, or if it's contracted out, or if there's
some higher level organization that provides that. We talked earlier
about rural water systems and the fact that you've got
maybe the same three people are responsible for everything. It's
unreasonable to go tell the community of Muleshoe, Texas or
do Boys, Idaho, Hey, you have to come up with
and fund your own cybersecurity expert. And oh, by the way,
you've got to pay him or her a healthy sum
because there's a lot of demand in the market and
they're gonna cause a have to cause a hefty price.
But what we could look at is to say, okay,
the threat to those smaller water systems is not only
is it probably lower in terms of somebody trying to
cause sabotage, that is probably lower, also the resulting impact
if that rural community were without water or let's say
hours to days. There are means at certain levels of government, state, federal,
et cetera, to help compensate for that temporary outage. It
is a lot harder to compensate as the population served
by that water system goes up or the demand on
that water system goes up considerably. So there's still challenges
within certainly agricultural areas and things like that that rely
on the water supply for growing crops, et cetera. But
if you could instead of telling every individual function you're
responsible for your own defense, you do give them some
minimum amount of requirement or maybe even assist them in
meeting some minimal safe configuration. A firewall that's properly configured
to serve business, you know, to allow business purposes but
not allow unsolicited communications in from the outside. You have
some continuous monitor on there, even if it's not monitored
by those individual by that particular water authority. But look
at like the state level, and look at you know,
there are emergency response centers popping up in all states,
and you know, being able to be able to handle
different incidents, right some sort of incident management or incident
response capability at the state level, and maybe you bring
it up there. I've always said, you know, when I
look at the state of Idaho, we have three kind
of population centers in Idaho Falls Pocatello where I live
on the southeastern side, the capital city of Boise in
the southwest side, and then the town of Portalaine not
that far from Spokane, Washington up in the northern end
of the Panhandle. So you might be able to attract
some talent to those population centers and have a regional
secure operation center for let's say the water sector. When
we pivot over to power now you're talking about, well,
you have regulated utilities, you have NERD SIP certainly a
lot more investment in what you know, what is being
done right now to set the bar to begin with
for regulated utilities. You also have private owner operators, right,
you have companies that might have a little more bandwidth
if you will, within the budget to bill do things,
and so you might require more self sufficiency in that
kind of scenario because in the end, what you don't
want to do is pass all of these you know,
costs onto the consumer. I think we all probably pay
for it one way or another, but you don't want
to suddenly triple somebody's water bill or their power bill
to say, oh, well, we have to do this, you know,
this particular cyber thing. Because we have these to your requirements,
you want to look at how can I pool resources
and use where it makes sense other sources of funding
and support for those activities where it's just not feasible
to bring the talent or the capability and run it
organically within that organization. I think if we you know,
then we start to expand to the federal level and
say what's the federal government's responsibility? Now? To be clear,
I'm not speaking on behalf of my company or the
Department of Defense, my former employer, anyone like that, but
I did notice that recently Jenn Easterly, the director of SIZA,
started talking about pushing responsibility for software vulnerabilities vulnerabilities onto
the vendors themselves or software hardware. So that is one
tact that can be taken is you start spreading that
around the equipment and you know, and software manufacturers in
addition to requiring the owners operators to provide some level
of protection. In addition to looking for communities of interest
that might be able to come together and assist in
providing active monitoring where it's just not feasible to have
the organic capabilities. So those are some of the ways
that I think, you know, getting off the dime and
thinking that this is just an issue like for checklist security,
that no, we need to move on that, and we
need to be actively monitoring our systems someone and we
need to be able to share that information. We've got
a great model. We've got information sharing analysis centers ice
acs out there. Let's make sure that they're properly funded
and resourced so that when something does happen in Muleshoet,
Texas or in Arkansas City, Kansas. That information can be
pulled in quickly and shared elsewhere, so that if part
of that campaign is hitting multiple small utilities, you can
make them aware and quickly disseminate even you know, response
measures to help protect against them or to counter anything
that's been done. I think those are some ways we
can start getting after this problem. But it again, it
requires a shift in our thinking that this is just
this is a a Sizzo problem, or this is just
you know, the network shops problem to solve. You know,
As I was talking about what we should do, how
we should sort of change our approach, I'm reminded of
when I attended my first sans ICs security conference in
twenty fifteen. I had just less than a year ago
moved to Idaho from Germany. I knew Mi Casante, who
many in this community, if they've been around at all,
know who Mi Casante is. And I was listening to
somebody give a talk at that conference. Kim Zetter was
in attendance, and she's the author of the book Countdown
to Zero Men, and so almost every speaker up to
this I think we were on day two almost every
speaker it received some sort of question about stucks meant
right and based on Zera's book, and they wanted to
know how do I protect against, you know, the nation
state level attack that is stucks meant And the speaker,
I forget his name, but he said, you know, he said,
I find it kind of funny, said everyone's sitting here,
one are out saying how do we solve against stuxtent.
He's like, most of you don't even know what assets
you have on your network, So there's probably there's probably
a preparatory comment to be made, which is, if you
have no cybersecurity program, or maybe a very nascent one,
you can be bombarded with all these different tools that
people will bring you or say, oh, bring us on
and we'll do this for you, we'll do that for you,
and it can become quite noisy and confusing. What is
the best step I should take? What are the first
steps I should take? And so I will coveyat my
previous response by just saying, consider first and foremost knowing yourself,
knowing what you have on your network, identifying that, and
certainly there's automation and tools that can assist you in
doing that, but know what you have, have some sort
of pop so that you know how you're going to
treat these systems right, And there's lots of policy examples
out there. You can you can use somebody to assist
you in that, or you can you know, if you've
got the ability, you can study examples that are out there.
But know what you have, have some policies. Is how
you're going to treat whether you're onboard, off board that equipment,
dispose of it, how it's going to be configured, how
you're going to let users access and then put some
sort of monitoring capability in place so that you can
assess what is going on and you know, and then
you can start to graduate to the more complex cases.
How do I need to integrate threat intelligence? How do
I do attack surface management? What are my exposures to
a very highly capable adviser or an advanced persistent threat.
It's important to recognize that you can't just make all
that happen overnight. So I would just say, you know, broadly,
we need to think about monitoring, active monitoring, having responses,
rehearsing our instant response plans, knowing what assets we have
in our systems, if we can get there, then I
think as a nation we'll be better prepared to start
dealing with the more nuanced in advanced threats and being
able to respond when we see a noise somewhere in
the system and recognize that might be part of a
broader campaign. How do I need to respond to whatever
happened there to make myself or protected more resilient?
Speaker 3: So nate what struck me there? You know, long discussion
of what smaller utilities can do. How important you know
detection is. I'm reminded of the incident in Denmark. The
sector cert documented the Russians compromising some twenty two Internet
facing firewalls that they've been monitoring. What is not widely
known about that incident is the funding model for the
Denmark sector cert. The sector cert is not publicly funded.
It serves some two or three hundred utilities, most of
which are tiny. It serves three large utilities. I don't
know if they're power or water, but three large utilities
is my recollection when I was talking to these people.
I might have the numbers off by one or two,
but it's a very small number of large utilities, and
those large utilities pay for the sector cert and the
sector sort provides its services to the tiny hundreds of
tiny utilities for free. You know what's the benefit. Well,
part of it is, you know, the larger utilities giving
back to society. Part of it is in my in
sort of the analysis, you know analysis here. Part of
it is the larger utilities benefit from visibility into what's
going on in the smaller utilities. If the smaller utilities
are being attacked as part of a larger campaign the
larger society, the larger utilities want to know what steps
the enemy is taking, want to know how.
Speaker 1: Much trouble they're in.
Speaker 3: So this is an interesting funding model. You know, he's right,
the same three people do not have the skills, nor
the ability, nor the money to set up their own
monitoring system to pay for their own threat intelligence feeds,
whereas a central sector search style organization that is sort
of providing service to the smaller utilities can afford to
buy threat intelligence feeds from the commercial providers of these
things can't afford to have a relationship with their government
and get access to classified information, you know, having sort
of the big fish, be it the government or the
larger utilities, pay for for these services for smaller utilities
seems to me to make a lot of sense in
terms of a funding model to bring about the kind
of capabilities that Joseph was talking about. What I kind
of heard you say was the perspective of the government.
I mean, in the United States, the federal government. In
other nations, you know, the national government may be somewhat
different from the perspective of the tiny utilities. With the
same three people. You know, you've talked about the need
for monitoring. Absolutely, the nation needs to monitor these campaigns
and figure out, you know, how many doors is the
enemy knocking on. But in terms of monitoring, you know,
most small utilities they want you know, the attacks kept out.
They you know, they don't want to focus on the
detect part of the cybersecurity framework. They want to focus
on the protect part. And you know, to me, this
is them saying, well, you know, we can if the
nation wants uh, you know, insight into my systems, let
them pay for the monitoring. Because I'm you know, that's
benefiting the nation, not me. I need to put protection
in for those small utilities. When they're designing their security program,
you know, should there be assistance. I mean I don't
want to you know, again, I guess I don't want
to drift into into monetary How much should the small
utility be focused on sort of assisting the nation in
terms of detecting widespread campaigns and you know, how much
should the how much of the nation state threats should
each small or large utility regard as credible that credible
threats to their own their own user base, their own citizens.
Speaker 1: Yeah, those are great questions. Let's start by recognizing that,
as we discussed earlier, as I mentioned earlier, smaller utilities
are not going to have the resources or access to
the skill sets to take to take on all the
responsibilities on their own. And I agree with you, let's
not drift too much into you know, the policy of
who pays, et cetera. But let's think in terms of
where is that expertise who can assess what is credible
and what is not. You know, I pause a little
bit at the use of that term, because if we
talk about in engineering, if we talk about design basis threats,
I mean we look in terms of Okay, I have
two gears are made of a certain metal, we put
them together, they're gonna turn. We're gonna use some sort
of lubrication or something. But I can relative with relative accuracy,
predict when that's gonna fail or when it needs to
be replaced to avoid it failing in operation, right, because
we know how metals break down over time and expose
to certain elements and temperatures and stresses. When we look
at measuring risk for natural disasters, we look historically, we
rely on the fact that, well, there's a you know,
thirty percent chance that we're gonna have, you know, a
hurricane between categories one and categories two strike somewhere within
this one hundred miles of our shoreline, you know, in
the next three years. We base everything off of the
you know, the historic occurrences and use that and stend
that into a you know, probability statement for it happening again.
The challenge we have in cyber is there's a in
most cases, there's a human actor involved, and really at
some level there's a human actor deciding to do to
take certain actions. And so when you talk start talking about,
you know, is the threat credible? Do I need to
be worried? It's very difficult. I think you'll you'll get
some broad statements made based on how critical that service
or that utility or that function is. And then you'll
think in terms of how likely is it that a
nation state level adversary would want to have that impact
on them? And I say, well, again, go back to
our earlier conversation. I think holding that infrastructure at risk
is a much bigger coin in their pocket than causing
some impact. So for that reason, I look at in
terms of prioritizing and look at credible threats. I think, okay,
if if you could either cause interruption of a critical
service like water power transportation in a large metropolitan area,
there is there is the potential of bending political will. Right.
Always tell people, you know, why is why is the
US Navy such a you know, the most powerful fighting
force you know on the on the seas anywhere in
the world. Well, it's because they can park you know,
a dozen acres of some renewed territory twelve miles off
somebody shore and give them pause, give them time to
think and recognize that, you know, maybe whatever action that
prompted that, there might be a you know, a diplomatic
solution to well, if the suddenly the populace of the
US or a significant number of the populace of the
US are threatened with the loss of life critical services.
I think we'd be foolish not to believe that that
might give us political pause, right, that might cause you know,
the executive branch to think carefully, what is the next
move if they can hold that large of a population
at risk, what are our options now? It will probably,
I'm sure it will drive multiple different options, political, military,
et cetera.
Speaker 3: It occurred to me when you're talking here, is it
credible that you know, voult Typhoon is in the news,
living off the land, extremely difficult to attect and to
detect these adversaries. Is it is it reasonable to believe
that hundreds of other utilities have been compromised in the
same way, and the Chinese deliberately leaked the fact that
they've taken over these fifty odds this way to make
you know, the the authorities aware that this capability exists,
because it does no good to hold you know, when
when the when the Navy parks, uh, you know, off
the shore of some other nation and says, you know,
let's think twice about this. The the the sort of
the response capability, the capability of the navy is clear Okay,
these ships are sitting there. If nobody knows that the
Chinese have the ability to cause you know, widespread physical consequences.
You know, is it credible that the Chinese leaked volt typhoon,
you know, deliberately or or or you know, really accidentally.
But weren't that dismayed by it? Because they have these
other capabilities and it does you know, those other capabilities
do no good as a threat if nobody knows to exist.
Speaker 1: So that's a great question. Volt Typhoon, in my mind,
is an example of or I would say, it's an
exposition of an extended campaign, right as as you're well aware,
as you mentioned your question, it uses living off the
land techniques very difficult to detect, and in fact, in
the in the infection details that I reviewed, or the
excuse me, in the instances of volt typhoon attacks that
I reviewed, quite often they say we have no idea
how they landed. And so that to me reeks of
an extended campaign of holding assets at risk, because once
you have them, number one, remove all traces of how
you got there. To use living off the land techniques
to maintain that access, and like I said, occasionally you
phone home and I say phone home, it's probably to
some other listening post, so that you know you have access.
But if you've done that and you sit back and say, haha,
we have all these infrastruate ructure operations that we hold
at risk. Do you need to actually create cause sabotage
or create mayhem to be able to have an have
an effect? The answers no, but it might be worth
letting them know you have a certain amount of assets
held at risk. Now, if you're smart, and I believe
our nation state level adversaries are very smart, you're not
going to, let's say, manage and care for all of
the places you hold at risk with the exact same infrastructure, right,
You're going to spread it around the technique by which
you by which you connect with them and contact them,
do any of your you know, your your maintenance of
that connection. If you do collect information, you'll use different
infrastructure to get that back that information back to you,
So you don't necessarily have to burn the entire the
entirety of your targets held at risk, but you absolutely
could take a portion leak sufficient information or maybe it
was found because of just you know, great sluice looking
carefully at crashed ups. But the point is, at some point,
when your target knows they've been owned significantly, you might
have leverage to, let's say, accomplish some diplomatic objective or
some other political objective short of military conflict or things
of that nature. That might be very helpful. And let's
say talks that are upcoming about you know, trade, or
about conditions in adjacent territories or other other nations that
you know that are that are allies to one of
the countries in question, and and and not to the other.
I mean, there's a lot of ways that that could
be useful. And and again it causes a response. You see,
how willing is the target to negotiate as a result
of recognizing you hold some of their key infrastructure at risk.
So I think that also would explain in my mind
why the government has been so united and adamant that
we do what is necessary to root out and you know,
to identify and cleanse vault typhoon from our systems. It's
a it's in me, it's it's a compelling conjecture. And
again this is all conjecture. Not neither one of us
is talking from a position of some greater knowledge of
exactly what's happening or what happened with both typhoon, but
it certainly makes sense to me that you would possibly
burn some of your infrastructure to sort of, you know,
or show one of your cards or maybe two of
your cards, to give you leveraging power in whatever is
going on globally or between the between those nations.
Speaker 3: At that time. Well, Joseph, this has been sobering, you know,
thank you for joining us. Before we let you go,
can you sum up for us what are sort of
the key things we should take away from this nation
state threat business.
Speaker 1: I would say the first nugget is, let's keep in
mind that the capabilities of any adversary are not merely
defined by what we read in the news. Events or
activities were essentially caught and then publicized. Computers will do
exactly what we tell them to do. Right, The computers
and digital devices that run our OT systems are not
all that different from the run the ones that are
running our IT systems. And if someone with sufficient access
and authority tells it to do something, it will absolutely
do it. And when those logical actions are tied to
physical systems, are impacting the physical world again the range
of potential effects are limited by our adversaries limitations, excuse me,
They're limited by our adversaries imagination, and further by what
we do to actively defend and protect those systems from maloperation.
The other point that I would say to keep in
mind is that we can't prote everything against everything. We
need to prioritize. But if you consider where OT systems
and OT cybersecurity is, I often feel like for twenty
years or more behind of where we are with it,
and so and yet these are the systems that most
affect our day to day lives, and an impact of
them would be felt much stronger. I always tell people
somebody hacks my computer and gets my online banking password,
it's a bad day for me. But if someone goes
in and hacks a power distribution subsystation, or if they
hack the water treatment facility, it's a bad day for
a whole lot of people. So there's a certain degree
of scale and again reliance upon our critical infrastructure, and
we should we should give it due diligence, and that
includes resourcing, funding, attention to those systems over and above
some of the other areas that we maybe emphasize. Right
now and then the last nugget is recognizing that these
capabilities are out there. Obviously doesn't hit the easy button,
easy button on solutions, so there's really no excuse to
I would say, basic levels of having basic levels of hygiene.
But in order to achieve that and move on to,
like you said earlier, right, protecting, not defending when they're
already there, but protecting against these capabilities, then we really
need to take a much more active role, and we
need to move the decision from maybe the lower end
of the C suite to the higher end, and certainly
for OT systems. Again, whatever it is, whether you're whether
you're manufacturing something, manufacturing pharmaceuticals, or treating wastewater in a city,
those OT systems control your business and therefore it is
a business risk that takes the attention of not just
a CSO or a CIZO, but the CEO, the COO,
the board, even those who recognize that the proper investment
needs to be made to protect these systems that are
core to whatever service or product they provide. I've really
enjoyed getting to be on this podcast, Andrew. This is
an area that's been near and dear to me for
quite some time. Like you, I've spent a lot of
my career focused on cybersecurity and various areas. The last
ten of it's solely focused on OT systems. If you know,
and I work at Deloitte, I have to tell people
when I show up, hey, I'm not here to do
your taxes, because that's what Deloitte is often known for
as a taxon audit company, which it is that for sure,
But we also have for twelve years running the largest
cybersecurity consultancy within the United States.
Speaker 3: And so.
Speaker 1: If anyone wants to learn more about how Deloitte can
assist them in tackling some of these challenges, I urge
you to go to www dot Deloitte dot com and
look at the services there. You can certainly reach out
to me on LinkedIn and I can connect you to
if there's an interest to have a professional discussion. But
in the meantime, Andrew great podcast Again, I really appreciate
you inviting me and allow me to come on here
and talk with you about these subjects. With you, you've
actually encouraged me to think a little bit deeper on
some things too, So I'm excited.
Speaker 3: I'm decited to hear it. Thank you so much. You know,
the podcast would be nowhere without guests like you, experts
coming in and sharing. You know, I call it a
piece of the elephant, show us a face of the elephant.
And you know, the Nation State face is something a
lot of people like I said Bandy about but you know,
it's tremendous to be able to dig into it in
some depth. Thank you so much.
Speaker 2: So I know it's just one little sentence and a
much longer answer there. But Joseph mentioned that in his
view it was like twenty years ahead of OT security,
which struck me as very surprising. In what universe is
it that far ahead? If ahead at all? I mean,
based on the conversations we have here. These are much
more in depth, technical, forward thinking conversations than ten to
have with people in it.
Speaker 3: I fear that, you know, your perspective on OT security
has has been tainted by one hundred episodes of the
of the podcast here, you know, partly, you know, on
the podcast we interview people who are very active in
OT security, you know, and sort of the examples I
give out of my own experience at Waterfall, we work
with the most CyberSecure, you know, industrial operations on the planet.
We're on the on the very high end of industrial cybersecurity,
so you know, you've been sort of seeing that side
of the coin Joseph in my recollection, you know, he
worked at Idaho National Laboratory, working with lots of different
kinds of stakeholders in the in the ot security space,
you know, large and small, advanced and not. At Deloitte,
he's working with presumably a very wide cross section of
the industry, much more so than you know we have
on the show here, much more so than I have
in my practice. You know, the sort of the leading
edge of industrial cybersecurity is very sophisticated. The average is
probably much closer to what he's pointing out saying, No, no,
there's a lot of people out there.
Speaker 1: You know.
Speaker 3: We had an episode I don't know a year ago
talking about starting from Zero, which interviewed a gentleman who
made it sort of his calling to walk into industrial
sites who had done absolutely nothing one after another after another.
So there's a lot of zero out there. What I
took away from the episode, you know, was sort of
two things. One is it was sobering thinking about sort
of bigger picture campaigns I have been focused on sort
of individual breaches, individual sites. What can the small sites do?
I wasn't really thinking about how a multi site campaign
might work and what would be the advantages to a
nation state in carry out such campaigns. So that's that's
sort of some sobering food for thought. The other thing
I took away again, I'm reminded of the Denmark sector
cert model where the largest utilities, or presumably if you'd rather,
the government, but you know, big fish pay for a
facility that a protects the little fish because it's the
right thing to do, and b provides intelligence to the
big fish about large scale campaigns that might be feeling
their way through the little fish in the course of
you know, eventually targeting the big fish. That you know,
to me, that's that's a nuggative solution here that you know,
maybe we should be as a society considering applying more widely.
Speaker 2: All right, Well, with that, thank you to Joseph Price
for speaking with you, Andrew, and Andrew, as always, thank
you for speaking with me.
Speaker 3: It's always a pleasure, Nate, thank you.
Speaker 2: This has been the Industrial Security Podcast from Waterfall. Thanks
to everyone an out there listening.