Replay: Navigating Vulnerability Disclosures in an ICS Environment

## (CS)²AI Online™ Replay: Navigating Vulnerability Disclosures in an ICS Environment, a BADALLOC Case Study

Based on a real world event, this forum will share their personal thoughts and experiences when a supplier discovered and disclosed a vulnerability within an operating system (RTOS). We will explore the evaluation from initial RTOS risk rating to OEM evaluation techniques and messaging of recommendation to end ICS users. We will review evaluation of a vulnerability with no known exploits and discuss how tomorrow's threat landscape is going to require deep and detailed forensics, with a strong vendor/OEM partnership to provide guidance to end-users.

With the increasing connectivity of industrial systems comes the benefits of productivity, operational efficiency and process control. This connectivity also creates potential opportunity for cyber criminals to gain access to critical infrastructure systems and industrial control systems (ICS).

Safeguards against this increasing threat landscape include people, process and technical controls to mitigate and balance the risk against reliability, availability and maintainability of the asset. A key tenant to this equation is vulnerability / incident response for the ICS environment where “patching” is not as common as IT systems and at times, not an immediate option for technical or procedural reasons.