0:03i thought about what to share with you and what i'm not going to talk about is ai i realize that some 60 percent of the content for this event is focusing on ai but there is one thing that we don't want to do you know we don't want to put train safety or the safety of the power greed in the hands of ai because we definitely want to reach home safely not probably reach home safely and ai being a probabilistic engine a bloody good one um is still a probabilistic engine so i'm going to talk about something uh rather basic at least i hope it's rather basic but nevertheless important because our ad the series are using those nice tools against us and if we don't get the basics right we're going to be on the headline saying that ChatGPT hacked them.

1:02No ChatGPT didn't hack them. It discovered the control that we failed to implement and it used it like any other good hacker with skills. So that's what I'm going to talk about in the context of critical and OT and how to protect it with zero trust. I am Tonu Tamer, I'm Director of Technology for Estonian Railways

1:36and previously as a Director of National Cert. So I have seen some incidents in my life, quite a lot actually. Let's see if this is working. It doesn't want to change. Ah, nope.

2:02Ah, we have another one. So, cheers.

2:13When I put the abstract together, I was thinking back in July, what... talk about and when making slides you know life does go forward so some things are not quite as I thought about that yes we are using tunnels for also OT we are using zero trust client or warp or however you want to call it that all works quite nicely but that That's more or less where the divergence between IT and OT become two different worlds.

2:57We have zones and conduits go per vendor and we hope that logs outlive the device because not all devices in that area are even capable of basic logging, but I will cover all of those aspects. little bit deeper later a brief background so over a thousand kilometers or a little less than a thousand miles of tracks a number of stations typical ot lifespan is 25 years so windows xp folks is a feature not the bug you're laughing but that's what it is and But on the OT side, the technology, in terms of maturity, is where everything you put on a wire, by default, is trusted.

3:58There is nothing that explicitly forces authentication. Some of the newer things bring encryption, but even that, to a degree, is frowned upon because speed. and deterministic approach is first and foremost that matter you don't want an emergency shutdown valve to fail if temperature in the nuclear reactor goes a little bit too high perhaps authentication is not the most critical question at the time but again this is just to uh just to highlight that ot and it are a little bit of a different species so for us a typical approach when it comes to OT is that it's very custom built usually by a vendor or an integrator typically operating abroad and of course in such a condition you have need for vendors to occasionally come and and do maintenance and they do need access around the clock and typically every uh supplier used to be a firewall change if you work in uh in industry that requires this approach raise your hands is this the case for you

5:31voila we live in the same world still

5:36So, what worked? Putting stuff in a traditional way means exposing your services to the public world. It means that every port that you put out there can be hacked. Every door that you expose to the internet can be opened. Lock, we say, is only to keep animals in bay. humans and one weak tunnel means trusted insider is in and they are able to roam around wherever possible now with cloudflare we have taken out the doors no door no lock nothing to pick easiest way to defend is by denying the opportunity to attack you cannot force a door that is not there this is what we gain by having tunnels and easiest way to put different services through wire or through starlink or whatever internet you want to use is through tunnels that doesn't matter anymore because uh it's an inside out connection not outside in put cdn in front of that and you have a pretty amazing tech stack to even cater over a satellite

7:07because CDN actually consumes a lot of volume. We have quite a number of different partners that we need to work with. Trust me, not all of them are as mindful of security as we are.

7:31We even have a vendor who has introduced ransomware to a number of their customers. Why? Because certain solutions you don't have many options to choose from. If you know who your vendors are, you also need to adjust how you work with them and how you defend given the... that they are. On the OT, there is no identity. A SCADA controller or an ICS controller does not have an identity, it only has a function. It does what is programmed and that's it.

8:16However, people that work with those systems, they have an identity. So identity in OT needs to move with a person. Interlocking. Nothing. It does what it's told and programmed. An engineer who works or maintains the system has a name, has a device, has a multi -factor authentication, and has an identity. As long as he or she works for our... contractor he or she also works for us so we can control how they have an access to our system

9:04and that is the best part of of the technology that Cloudflare has to offer in this context so we rebuilt a perimeter from the classical approach of having VPN and we call it the zero trust and you know in some sense you can argue is it but it definitely is not a wrong answer we have and we are working on that to have number of routes one routes leading to one destination it's easier when we have virtualized service but as i said on the ot side if you put everything on the wire and how you normally do you divide systems into zones which have the same security requirements and inside you can have multiple different vlans but because those systems don't have an identity you can't put a tunnel on of scott controller.

10:17The only thing you can do is you can create tunnels to specific zones and you can control access through those tunnels to these specific zones and you can regulate how much of the surface you are going to expose. I hope it makes sense.

10:45and what we do is basically we have a number of jump hosts and everyone who has in principle access they can connect through that jump host into a specific OT network segment. The beauty is that now we have logs. Before when people used to go to a data center physically connect to a serial port, guess how many kilobytes or megabytes of logs were left behind? None. Because logging is for weak.

11:31I promised that I wasn't going to talk about AI, but I maybe promised too much.

11:43So a practical use case, when presenting or preparing for another speech about a month ago, I asked one AI agent to help me with slides. And the best way to help with slides is if you give them access to a real configuration, because I'm not in the habit of lying. So what would be the best? show what is there and it made some nice slides and perfect and day before I went through I was like one point I did not quite catch I did not remember a case going through that was on the slide and so I kept poking okay explain to a dumb person like me what is on that picture it took some time but I realized found a misconfiguration in the system.

12:37A tunnel that was half decommissioned but not fully decommissioned. It took a further half an hour to back and forth how do I explain that issue into a JIRA ticket so that a network admin can then completely decommission that leftover. weakness none of this triggered an alert because at one point this was part of the configuration public dns still pointed to a tunnel but it did not resolve anywhere and nothing alerted because everything was by the book typically these things are one of the big cause of incidents that happen.

13:38People making mistakes. If you think that hacking is about trying to dig through a vulnerability or a CVE, yes, this can happen. But the easiest is you find misconfiguration because we're human. We make mistakes. AI is great in helping you understand what you have put in... place and what you wanted so hands up if you have read your public soul and verified that everything there is correct there's a couple of hands raising that's good uh i i mean no but uh this uh i think uh is worth uh checking every now and then just to make sure that the house is still clean and intact

14:31Another case to mention. One of the very reputable vendors in the field also wanted to do remote access and maintenance. If you know anything about OT, the typical approach is you never connect it online. It's very isolated. Okay. into the context that they want to work remotely and we can debate over a beer if this is considered putting it on the internet or not. However, this is not putting it on the internet. But nevertheless, they took an old 4G router, plugged it directly into an OT network because they wanted to do some maintenance and oh, it got compromised.

15:26because no one ever does it like that it means that no one ever updated the firmware

15:33people probably did not even recognize that it was there it took some sharp questions for them to say yes this probably was not the best idea but this wasn't about the punishment it was just for them to recognize that But guys, let's not do this again. So how did it come out? When it started sending smishing text messages.

16:05And who noticed? The mobile operator. Yay for the good guys.

16:14It managed to send a few thousand of text messages. and that's that how did it got compromised who knows because a firmware a few years old connected to the internet over static ip i mean i have seen devices if you take out of the box with the default configuration you plug it in the internet and in 20 minutes someone else also lives there so the world is what it is that's why denying access is i think the best way how you defend your crown jewels um so the best zero trust control is but actually a power button when i say zero trust is named account mfa and reason if you let your contractors into your data center raise your hand how often they need to be accompanied by one of your own engineers.

17:23Some hands raised, good. On Cloudflare, it's also possible to have four eyes principle in the sense that if they request an access, you get a notification whether you open the door or not. They, just because, just because they have access doesn't mean that they can access. You have to physically open the door if the jump host you operate does it need to be up and running all the time or do you only bring it up when there is the maintenance time again the way how you mitigate risk multiple ways to do little bits at the time and the beauty is all of this is logged and forwarded automatically

18:18And when you ask, is it safe? Well, you could argue, but it definitely is secure. And in my view, you cannot build security better than this. So where zero trust bends in terms of OT, we have... of legacy protocols and cloudflare is built for modern uh world wide web so one size doesn't fit all and we have to find ways to make it work zero trust and safety some things still need to go on the wire not because it's necessarily a better way but this is the mindset of people who still write the standards two years ago in a conference one guy writing a standard was proud like being on the stand where i am and say now the standard supports tls i nudged my colleague i was like i wonder which version the first one probably he goes so at the time when we talk about post -quantum uh cryptography this is the world we live in safety certified systems like no agent every change needs a vendor assessment as i said

19:49probably safe is not safe it needs a very deterministic approach and jump posts from vendor replace them with yours because you are ultimately responsible so if you if you're here you're a customer use them three things to check on monday check your links make sure nothing is visible that is not necessary check your dns zones especially for those guys who didn't raise your hands and widest route find it and ask where it really goes and i finish my presentation with a humble question If your vendor's box starts sending weird text messages, who would tell you?

20:42Your CM, your mobile operator, your vendor or your ransomware operator? Ladies and gentlemen, thank you.