Threat Hunting in OT Networks Using Hypothesis Based Methods

The speaker, a hunt and incident response researcher at Idaho National Laboratory, opens with why operational technology needs different handling from office IT. Legacy processes are fragile and may not recover from disruption, and downtime or a failed device can cause physical harm, not just financial loss. He also covers site hazards that are easy to overlook, including wildlife, unfamiliar environments, and personal protective equipment that is often missing on site.

He then turns to how to collect data with minimal impact. Passive monitoring from a span port is the preferred method, with taps used only as a planned outage because breaking a serial link can cause real damage. Active scanning can brick older PLCs, so he advises against it unless the risk is understood. Host agents and memory dumps can also disrupt systems, so hands-on work should be limited and done through the site's own staff and procedures.

The core of the talk is hypothesis-driven hunting. A useful hypothesis is focused, testable, meaningful and plausible, and it should be revised when site conditions differ from the documentation. Using a sample network diagram, he shows how an HMI in the DMZ suggests a design flaw and leads to checkable claims about firewall rules, transient engineering laptops, and missing OT monitoring. The practical takeaway is to treat documentation as a starting point, verify it against reality, and report results against a list of tested hypotheses.