Professional Documents
Culture Documents
Nikolas Upvanage - Do We Have Logs For That
Nikolas Upvanage - Do We Have Logs For That
Nikolas Upvanage - Do We Have Logs For That
Phase 2 - Drain
Control is manipulated to
overflow a tank.
T0847 –
Replication T0863 - User T0859 - Valid
Through Execution Accounts
Removeable Media
T0807 - T0843 -
T0853 -
Command- Program
Scripting
Line Interface Download
Supervisory
Local Control
Local Control
Malcolm Engineering Tag/Logic
Open
Operators:
• Being able to view all proprietary protocols in your system in not realistic in many cases due
to time/budget concerns
• Network indicators may be easy to access, but hard to analyze
• Host based logs are a key data source and should be brought out to SIEM databases
• Ask vendors about logging capabilities (for all types of applications and systems)
Vendors:
• Get proactive about automating the export of process information and host-based indicators
Nikolas Upanavage
Derek LaHousse
Sonja Nguyen
Erika Poole
Ovi Hossain
Ben St. Amand
Contact Info: