ICS 2022

Join this session as we explore various approaches that defenders can take to operationalize valuable ICS threat intelligence and take action to defend critical assets.

Threat intelligence has long been considered an apparatus of militaries and three letter agencies. Unfortunately, given the fact that sophisticated threat groups have shifted to disrupting civilian infrastructure as an objective of their cyber operations, threat intelligence is now a necessary component of every strong OT security program, including those in private industry. Although the term "threat intelligence" can sound nebulous or intimidating to security leaders, receiving and actioning threat intelligence can easily amplify preexisting security processes and enrich security operations, increasing industrial safety and resiliency. This talk will seek to inform OT defenders on the ways in which, with good planning and direction, OT threat intelligence can be implemented into security programs with easy alignment to the NIST Cybersecurity Framework, limited strain on human resources, and improved security posture. The talk will focus on ICS Threats and their implications, key strategic and tactical intelligence workflows, and extraordinary examples of industrial organizations (unattributed) actioning OT threat intelligence to prevent disruption.