A SOC in the Sandbox

### Operational Realities of Industrial Control Security At 00:00, Tom VanNorman, Director of Engineering Services at Dragos, discusses designing and staffing Security Operations Centers (SOCs) specifically tailored for industrial control systems (ICS/SCADA) at the ICS Village. VanNorman addresses common pitfalls when enterprise IT teams attempt to manage operational technology (OT) environments.

### The Headcount and Technology Silver-Bullet Fallacy At 03:14, VanNorman challenges common corporate misconceptions, explaining that merely increasing headcount or purchasing general IT security tools will not secure an industrial plant. Because OT environments rely on proprietary industrial networks, successful monitoring requires specialized domain knowledge of physical processes and automation systems.

### Developing Repeatable OT Incident Response Playbooks At 06:40, the presentation emphasizes standardized operational procedures. VanNorman highlights that in ICS environments, operational availability, employee safety, and equipment integrity take precedence over data confidentiality, requiring customized triage workflows that prevent security controls from inadvertently causing plant shutdowns.

### Unified Telemetry and Industrial Network Visibility Concluding between 09:52 and 13:02, VanNorman reviews technical architectures for ICS visibility. He stresses the necessity of passive network monitoring across specialized industrial protocols (such as Modbus, DNP3, and Ethernet/IP) to detect unauthorized controller logic changes and firmware modifications without injecting active network traffic.

(AI summary — Gemini Flash)