I teach Dragos’ ICS security course, and I want to share my two maxims about infosec that I try to beat into my students heads for a week:
1) Adversaries are generally as lazy as the rest of us.
2) Adversaries (no matter how advanced) have to follow the laws of reality.
1) Adversaries are generally as lazy as the rest of us.
2) Adversaries (no matter how advanced) have to follow the laws of reality.
1) Cray cray 0day and theoretical attacks are cool and all, but why are you worrying so hard about them when you still run XP and have 380 undocumented firewall holes?
What do you think the path of least resistance and cost is?
What do you think the path of least resistance and cost is?
2) Adversaries can’t simply yeet themselves to a target in your network. Even with a sophisticated, Bloombergesque supply chain back door, parts of the kill chain still *have to* happen. The device has to receive or send C&C across other infrastructure. It has to action, too.
What does this all mean?
It means do good proactive architecture and threat modeling to figure out your vulnerable points and likely attack pivot points.
It also means do defense in depth to detect and deter adversaries at as many kill chain stages and segments as you can.
It means do good proactive architecture and threat modeling to figure out your vulnerable points and likely attack pivot points.
It also means do defense in depth to detect and deter adversaries at as many kill chain stages and segments as you can.
