Highlighting the Importance of Detection Context

In this presentation at the DEF CON 29 ICS Village, Otis Alexander, cybersecurity engineer at MITRE, explores the vital importance of contextual correlation in industrial control system detection engineering. He begins at 03:00 by recounting a simulated adversarial attack against a mock gas facility, where operators manipulated valve states to induce a dangerous flammable gas release without triggering physical safety alarms or tripping baseline network thresholds.

Otis reviews the MITRE ATT&CK for ICS evaluation methodology at 06:00, discussing how various commercial security platforms were scored across specific offensive techniques. He explains why isolated, atomic alerts fail SOC analysts at 09:00, arguing that detecting an individual anomalous command is meaningless without understanding surrounding engineering workflows.

Demonstrating cross-data-source correlation at 12:00, Otis shows how tying endpoint Windows security events directly to industrial network packet captures establishes a coherent timeline of attacker activity. At 15:00, he illustrates how linking host authentication logs with subsequent PLC setpoint changes builds a compelling detection narrative. He concludes at 21:00 by urging ICS defenders and detection engineers to develop enriched correlation rules that bridge the divide between IT telemetry and OT process reality. (AI summary — Gemini Flash)