OT-REX: testing what cannot be switched off

A control room cannot be switched off because somebody wants to run a scan. A controller that has been in the field since 2009 sometimes answers a port scan differently from what its data sheet promises, and you find that out afterwards. An active test against a plant in operation is therefore not a procedure with a known outcome.

The run is rehearsed in our own laboratory environments first and only then carried out on the plant. YekCity is one of them; alongside it stand rigs for further sectors. In the lab, the things that must not go wrong on the plant are allowed to.

That rehearsal is the expensive part. It costs hardware, build time and people who know the sector, and all of it falls due before the first finding exists. Through the project we extend the laboratories with real industrial hardware, so that sector environments are reproduced rather than simulated.

Both sides we have in the house go into this. Offensive security supplies the attack paths and the test steps. Blue teaming answers the question of what the same attack would have looked like from the defending side. A finding on its own changes little in a plant as long as nobody knows what signal it raises in monitoring.

A programme like CYSSDE does not pay for reports. It pays for what the assessments leave behind for everybody else: test steps that can be repeated, attack paths that work in more than one plant, and detection patterns an operator can take into their own monitoring. That goes out anonymised, without names, addresses or configurations.

Then there is what stays in the laboratory. Every sector environment reproduced there remains usable afterwards, for the next assessment, for exercises and for work on detection rules. Which is why the laboratory build is part of the project and not a by-product of it.