DEF CON 33 - The Worst ICS OT Love Story Ever Told - Mike Holcomb

This presentation highlights how OT/ICS environments are making it too easy for attackers, with statistics showing most critical infrastructure lacks basic cybersecurity protections 0:00.

Key Takeaways:
• The movie "Hackers" (1995) surprisingly predicted OT attacks 15 years before they became common, featuring a hacker controlling robotic arms and malware designed to capsize oil tankers 1:56-2:29
• Draos OT/ICS report reveals alarming security gaps: 65% of environments have unsecure remote access, 45% have active SSH connections to the internet, and less than 5% actually monitor their networks 4:55-6:31
• A concerning trend is the alignment between activist groups (frequent but low-impact attacks) and state adversaries (rare but high-impact attacks), creating new threat vectors 6:42-9:31
• Basic cybersecurity fundamentals - including backup and recovery, asset management, secure network architecture, incident response planning, and vulnerability management - can defend against all attacker types 14:54-17:08

Focusing on fundamental security practices can protect critical infrastructure despite resource limitations, keeping power, water, and food systems operational 24:04.

Sources:

• 0:00 Introduction about "the worst love story for ICS/OT"
• 1:56-2:29 Hackers movie predicting OT attacks and malware
• 4:55-6:31 Alarming statistics from Draos OT/ICS report
• 6:42-9:31 Alignment between activist groups and state adversaries
• [14:54-17:08