Confessions of an Offensive ICS Researcher
Reflects on years of offensive ICS research, physical process manipulation attacks, and defensive lessons learned.
Summary
In this introspective presentation from the DEF CON Safe Mode ICS Village, a seasoned industrial penetration tester presents "Confessions of an Offensive ICS Researcher," detailing the transition from offensive vulnerability discovery to managing an enterprise cybersecurity program. Opening at 00:19, the speaker reflects on how offensive security mindsets often diverge from operational realities.
At 05:01, the presenter explains that while offensive researchers naturally focus on high-severity zero-day exploits, industrial defenders face complex operational constraints including regulatory compliance, patch validation, and 24/7 continuous uptime requirements.
Past 20:00 and 40:00, the talk explores real-world case studies of finding vulnerabilities in programmable logic controllers (PLCs) and supervisory systems. The speaker details the friction of coordinating disclosures with industrial hardware vendors and offers practical advice on translating red team findings into actionable, risk-prioritized engineering remediations. (AI summary — Gemini Flash)
Related talks
ICS Village·24 min
Yardeni · Lemley
Shares practical survival tips and methodologies for researching and disclosing vulnerabilities in industrial systems.
Creator Stage·18 min
Dan Berte · Alexandru Lazar
Reveals critical vulnerabilities in solar inverter management platforms that could allow attackers to manipulate power grid infrastructure.
Creator Stage·14 min
Bryson Bort · Tom VanNorman
Introduces industrial control systems architecture, the Purdue model, attacker viewpoints, and steps to build a personal ICS research lab.