If I answered some questions about Industrial Control System cybersecurity and cyberattacks during my downtime today, what would you like to know?
Some background - my expertise is in incident response and digital forensic investigation of hacking of infrastructure systems - like power, water, manufacturing, oil and gas, transportation, agriculture, etc. There aren’t a lot of people who specialize in this. My company provides consulting and products to do cybersecurity for weird stuff that powers critical infrastructure like PLCs and SCADA. These networks are quite different than enterprise IT, and doing security in them can be challenging.
My own background is pretty left field as expected, with degrees in Networks, Electronics, and Avionics. I’ve been doing this for a while now. What would you like to know?
#cybersecurity #DFIR #ics #CriticalInfrastructure #ICSCybersecurity #IndustrialControl
@hacks4pancakes [Context of these questions is around attackers who gain access to exploit later vs those who take advantage immediately.]
What are the average incubation times between an attacker getting a foothold in a system and discovery? Are there particular things they do that blow their cover?
