No More Ransomware in Critical Infrastructure!
summary
Claims that analysis of 16 ICS ransomware yields a practical three‑phase defense: legacy signature scanning, an ICS pre‑detection kernel driver that flags four behaviours (process termination, file enumeration, mutex creation, shadow‑copy deletion) and a final encryption‑sequence blocking stage that recognizes five file I/O patterns. Demo shows LockBit 2.0 detected via kernel events and multi‑threaded encryption traces. Defense maps to 24 mitigations (12 policy, 9 endpoint, 5 network), notes false positives and potential performance cost, and frames the work as an OT zero‑trust endpoint strategy.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:48Speaker overview
- 3:16ICS ransomware 2021
- 6:42Defining ICS ransomware
- 8:08Ransomware behavior matrix
- 12:28ICS ransomware paths
- 14:19Mitigation framework
- 17:26Three-phase mitigation
- 18:51Detection demo
- 21:42Encryption detection
- 25:35OT zero-trust summary
- 27:01Q&A
related talks
26mFrom Existential to Reality: 3 Experts on the Evolution of ICS Threats
27mRansomware in ICS: Impacting Critical Infrastructure and Operations
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
37mRansomware Resilience: Holistic Defense for SOC Leaders
38mRansomware and Backups: A Multi-Layered Defense Strategy
51mPreparing for and Defending OT Systems from Ransomware
48mRansomware: From the Boardroom to the Situation Room
01h 14mKeynote: Our Secure Future