Expansion of ICS Testbed for Security Validation based on MITRE ATT&CK Techniques
Talkat 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20) · on Monday, 2020-08-10·
summary
Expanded ICS testbed collects network, host, system and physical signals mapped to MITRE ATT&CK techniques and forwards mirrored traffic to an aggregator that replicates and distributes it to five commercial appliances and two open source IDS called salt and circuited. The environment uses an XC hypervisor for a separated virtual lab, implements port mirroring, reproduces 14 single attacks and 19 sophisticated attacks, and provides a data enrichment tool DT with EOI augmentation and time augmentation to scale long, multi-stage attack scenarios.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:37Framework
- 3:38Background
- 5:55Monitoring Field
- 9:14Expansion of High Testbed
- 14:46Data enlistment tool DT
related talks
04h 02mOpen-source Tools for CSIRTs
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
48mMITRE ATT&CK: The Play at Home Edition
40mAdversary Simulation: Close the Gaps in Your Security Posture
40mStrengthening Cyber Resiliency in a Time of Geopolitical Crises...
30mShall We Play a Game?
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
46mAn OT Cyber attack simulation on a chemical plant