ThreatPatrol - Visualising the Modern Threat Landscape

The talk opens with the 2021 Colonial Pipeline ransomware incident, where attackers hit the billing systems and operators shut down flow because they no longer trusted their segmentation. The presenter argues that OT risk is bounded by the IT systems and trust relationships around controllers, not only by direct attacks on them. Using the Purdue model, the talk lists common weaknesses that erase the air gap: domain-joined engineering workstations, weakly authenticated historians, shared vendor remote tools, patch systems and jump hosts. Of twelve notable incidents over fifteen years, nine came from IT pivots, two were direct OT attacks and one was hybrid.

The middle section presents ThreatPatrol, an open-source SaaS platform that links threat intelligence to ATT&CK techniques and Atomic Red Team tests. Demonstrations covered framework version trends, software and actor profiles, emulation kill chains with blast-radius and choke-point views, and Sigma and Wazoo rules for DNP3 authentication spikes. The tool also builds 3D component canvases for grid and solar assets, and a simulated grid showed how spoofed alarms can hide a frequency change from operators.

The closing advice is mostly ordinary IT hygiene. Keep engineering workstations out of the corporate directory, use one-way replication for historians, time-box and record vendor access with MFA, and remove shared local admin accounts. Any detection on an IT host that can reach OT should be treated as a top-priority alert. The presenter notes that parts of the platform are still being finished.