Interview with Pascal Ackerman - Author of Industrial Cybersecurity

### Overview On this episode of the Unsolicited Response Show, host Dale Peterson interviews Pascal Ackerman, Manager of Industrial Cybersecurity Technologies at Ernst & Young Global Consulting Services and co-host of the podcast *OT Exposed Raw*. The discussion centers on Ackerman's book, *Industrial Cybersecurity* (labeled as a second edition by Packt Publishing, but conceptually a standalone "Volume 2"). While the first book focused on setting up an ICS cybersecurity program and establishing network segmentation, the second book concentrates heavily on efficiently monitoring the cybersecurity posture of ics environments and conducting threat hunts.

### Key Topics - **First Edition vs. Second Edition/Volume 2**: Ackerman explains that the new book is essentially a volume two rather than a simple revision, with only about 3–5% introductory overlap to review architecture and segmentation philosophies before moving into monitoring. - **Target Audience and Reading Structure**: The book is designed for asset owners and engineers who have already established basic segmentation and security programs, or those needing to assess their current posture (e.g., assessing newly acquired industrial plants). Readers can approach the book non-linearly or skim hands-on lab exercises depending on their practical needs. - **Architecture as a Future-Proof Baseline**: While monitoring tools and software packages change rapidly (requiring updates such as moving from Security Onion 16 to version 2), the underlying architectural principles—such as establishing network choke points to inspect data—remain durable over time. - **IT vs. OT Security Assessments**: Discussion on why assessment techniques, pen testing, and red teaming in industrial environments still heavily utilize standard enterprise and IT tools due to the convergence on Ethernet and IP, while emphasizing caution when transitioning directly onto OT and production networks. - **Hands-On Tooling and Monitoring**: The value of deploying open-source or low-cost tools like pfSense and Security Onion to help asset owners understand their assets, inspect traffic, and determine requirements before committing to commercial monitoring or SIEM platforms.

### Technical Details - **Threat Hunting Approaches**: Ackerman highlights three key threat hunting methods discussed in the book: detecting outbound malware beaconing; identifying malicious startup items on Windows systems using Sysinternals Autoruns scripts coupled with VirusTotal hash lookups; and inspecting firewall logs for anomalous directional traffic, particularly inbound traffic from the internet into the industrial network or outbound connections from OT to the internet. - **Virtualization and Network Segmentation**: Emphasizes that ICS virtual platform management should never be directly exposed to enterprise networks. The discussion covers the security risks of shared virtualization environments (VMware/Microsoft) versus physical segmentation or separate active directory forests, noting how ransomware like Ryuk leverages Active Directory and newer threats target vSphere/vCenter. - **Penetration Testing Limits in OT**: Ackerman notes that once an attacker reaches the OT control network, lack of native protocol authentication (such as in Modbus) makes exploitation trivial. Therefore, testing production PLCs directly risks disruption with little added insight unless conducted on safely isolated lab hardware for fuzzing or vulnerability research. - **Commercial Detection Constraints**: While tools like Nozomi and Claroty flag events like PLC program uploads, asset owners often find it challenging to distinguish legitimate changes from malicious activity without deep integrations into disciplined change control systems.

### Takeaways Ackerman views the books as practical supplements to formal hands-on training (such as SANS courses), providing direct blueprints for engineers and asset owners to build lab environments and assess security. Looking forward, Ackerman highlights emerging risks involving firmware manipulation, remote access trojans (RATs), and stealth rootkits running directly on PLCs that alter control logic dynamically without simple recovery via spare hardware replacement.