5th Annual Industrial Control Cyber Security Europe Summit. London Marriott Hotel Regents Park London, England | October 9/10th 2018IOT/OT Security, Threat Detection and Mitigating the Impact on Safety CasesSectors Represented include Smart Grid, Nuclear, Oil and Gas, Rail, Maritime, Aviation, Chemical and more to be announced!
Back To Schedule
Tuesday, October 9 • 3:50pm - 4:20pm
Results from Analyzing Real-World ICS Malware in an ICS Network Sandbox

Log in to save this to your schedule, view media, leave feedback and see who's attending!

TRITON and CrashOverride showed us the potential of autonomous, purpose-built malware that enumerates and subsequently hijacks ICS devices using their native protocols. What if we could detonate ICS-specific malware in an "ICS Network Sandbox" that detects and analyzes purpose-built ICS malware before it even gets deployed? Current malware sandboxing technologies are designed for IT protocols and devices rather than OT protocols and devices; as a result, ICS-specific malware such as TRITON is undetected because IT malware sandboxes are unable to flag ICS-specific activities such as OPC scanning, overwriting of PLC configuration files, calls to ICS-specific libraries and ports, etc. CyberX's research team has built ICS-aware malware analysis sandbox that simulates a complete ICS execution environment in a virtual or offline state, and also instruments the execution environment to detect ICS-specific behavior. During this session, we'll describe the results of analyzing known ICS malware (Stuxnet, Industroyer, TRITON)  in the sandbox as well as data we've collected about the prevalence of ICS-specific malware "in the wild." Attendees will learn about ICS malware characteristics and ICS attack vectors so they can be better prepared to detect and respond to ICS security incidents in the future.

avatar for Ron Yosefi

Ron Yosefi

Sales Director, CyberX
Ron Yosefi leads CyberX’s sales and partner management in Europe. He brings more than 20 years of experience in Industrial Automation and Software Solutions for Manufacturing and Infrastructure. Ron held various Business Development, Sales and Marketing roles in leading International... Read More →

Tuesday October 9, 2018 3:50pm - 4:20pm BST