The infosec industry has spent decades struggling to secure computers and the vital data they hold, with some successes and many frustrating failures. Security professionals and hackers alike have a wealth of lessons learned borne in our scars from battles to protect PII, PHI, and other information assets. Increasingly, however, we are facing a shifting threat, as attackers target not just computers and data, but instead the critical infrastructure and related equipment we use to operate our physical world. Successful attacks in this realm could pack a lot more wallop than merely purchasing credit monitoring for a year or re-imaging worm-infected PCs.
In this talk, Ed will analyze this shift, looking at actual attacks against the power grid, water systems, transportation infrastructure, and more. We’ll see how the separation of the computer realm from the kinetic world is evaporating, as most equipment is online all the time. We’ll discuss how hackers and information security professionals can marshall our capabilities to apply the hard-fought lessons we’ve learned in securing data to the kinetic control system realm, along with the types of new skills and thinking that will be required.
About Ed Skoudis
Ed Skoudis is the founder of Counter Hack, an innovative organization that designs, builds, and operates popular infosec challenges and simulations including CyberCity, NetWars, Cyber Quests, and Cyber Foundations. As director of the CyberCity project, Ed oversees the development of missions which help train cyber warriors in how to defend the kinetic assets of a physical, miniaturized city. Ed’s expertise includes hacker attacks and defenses, incident response, and malware analysis, with over fifteen years of experience in information security. Ed authored and regularly teaches the SANS courses on network penetration testing (Security 560) and incident response (Security 504), helping over three thousand information security professionals each year improve their skills and abilities to defend their networks. He has performed numerous security assessments; conducted exhaustive anti-virus, anti-spyware, Virtual Machine, and IPS research; and responded to computer attacks for clients in government, military, financial, high technology, healthcare, and other industries. Previously, Ed served as a security consultant with InGuardians, International Network Services (INS), Global Integrity, Predictive Systems, SAIC, and Bell Communications Research (Bellcore). Ed also blogs about command line tips and penetration testing.
Connect with Ed Skoudis on Twitter.
