ATLANTA – SECURITYWEEK 2023 ICS CYBERSECURITY CONFERENCE – Cybersecurity techniques and penetration testing used in the field of weapons systems can provide valuable lessons for securing industrial control systems (ICS) and other operational technology (OT).
Insights on the topic were presented at SecurityWeek’s ICS Cybersecurity Conference in Atlanta, in separate sessions, by Brian Schleifer, who specializes in system security engineering and analysis for new weapons technologies at Modern Technology Solutions Inc. (MTSI), and Jon ‘McFly’ McEllroy, offensive/defensive team lead at MTSI’s Weapon Systems Cybersecurity (WSC) group.
According to NIST’s definition, a weapons system is “a combination of one or more weapons with all related equipment, materials, services, personnel, and means of delivery and deployment (if applicable) required for self- sufficiency”.
Schleifer and McEllroy pointed out that the vulnerabilities potentially affecting weapons systems and the techniques and processes that can be used to secure them apply to other cyber-physical systems as well, and the lessons they’ve learned can be useful to those looking to secure ICS or OT.
McEllroy outlined several types of issues that can impact any type of cyber-physical system, such as maintenance shells, poorly secured wireless connectivity, unused and/or outdated software, and hardcoded credentials. He identified these types of issues while conducting penetration testing on weapons systems.
As for cybersecurity techniques applied in the weapons systems field that can also be used to secure OT, Schleifer summarized various considerations and techniques for supply chain risk management, digital engineering, system configuration, modular systems, and cyber hygiene.
Related: New Project Analyzes and Catalogs Vendor Support for Secure PLC Coding
