Marina Krotofil


Marina Krotofil is a cyber security professional with over a decade of hands-on experience in advanced methods for securing Industrial Control Systems (ICS)
and other cyber-physical systems. She is also an experienced Red/Blue Teamer who contributed research on novel attack vectors, exploitation techniques and
design of novel defence methods. She is an experienced incident responder, forensic investigator and ICS malware analyst. Marina frequently collaborates with
international organizations on the topics of critical infrastructure security and is a regular speaker at the leading conference stages worldwide. She is also
a frequent reviewer of academic manuscripts and talk proposals including Black Hat and Usenix WOOT. She holds an MBA in Technology Management, MSc. in
Telecommunications, and MSc. in Information and Communication Systems.

All Sessions by Marina Krotofil

  • Scenario 2


  • 15:05  - 15:35
    Supply chain attacks and Software Bill of Materials (SBOM) topics have been dominating security news for the past few years. Supply chain threat and associated risks are especially concerning in the context of critical infrastructures where most equipment evolved historically and carries lots of legacy code and software architectures. In this talk Marina examines memory allocation, PLC programming practices, and user APIs in relation to library of functions which are used to create control logic. She will show how current PLC software designs open the door to automated enumeration of PLC control logic, identification of key infrastructure configuration and process control variables, and allow for automated development of targeted attack payloads in an arbitrary facility. Additionally, allocated but unused memory can be applied to the establishment of covert C2 channels, from which attackers are afford with the ability to execute data exfiltration and high-precision cyber-physical attacks on previously inaccessible network segments. To keep the story realistic and interesting, Marina formulates a threat scenario around an assumed industrial network architecture with advisable security measures, including the integration of network monitoring and segregation from the Internet via firewalls. She will then conclude the talk with stating an obvious challenge of outdated software design practices in “modern” control equipment and outline the importance of secure network architectures as critical compensating security control.
    Supply Chain




Share

Marina Krotofil