Throughout the last 10 years, those in the nascent operational technology (OT) security community have consistently strived to highlight the unique characteristics that differentiate them from IT security professionals. Stressing the differences between the two communities has made it possible to increase awareness about the various challenges we face to protect industrial control systems (ICS) and critical infrastructure. However, recent analysis of major OT security incidents and attacker techniques, tactics and procedures (TTPs) shines a light on the need to re-evaluate this posture.

Most sophisticated OT attacks leveraged computers and servers, and the same or similar operating systems and protocols as used in IT as a conduit to their ultimate targets. This infrastructure served as an avenue for impacting physical assets or controlling physical processes. As a result, advanced skills from IT security professionals represent a unique opportunity for defenders and incident responders to explore and understand the intrusion methods, or TTPs, that take place in intermediary systems across the OT attack lifecycle.

In this talk, I will discuss a series of cases and war stories observed by our cyber physical threat intelligence team to showcase the impact of IT threats to OT security and highlight some challenges that can only be solved with both advanced IT security skills and a strong understanding of OT environments. This presentation seeks to encourage the audience to embrace a new perspective and bring their skills to task on some of the most compelling challenges of cyber physical security.