EP257 Beyond the ’Kaboom’: What Actually Breaks When OT Meets the Cloud?

Guest:

• Chris Sistrunk, Technical Leader, OT Consulting, Mandiant

Topics:

• When we hear "attacks on Operational Technology (OT)" some think of Stuxnet targeting PLCs or even backdoored pipeline control software plot in the 1980s. Is this space always so spectacular or are there less "kaboom" style attacks we are more concerned about in practice?
• Given the old "air-gapped" mindset of many OT environments, what are the most common security gaps or blind spots you see when organizations start to integrate cloud services for things like data analytics or remote monitoring?
• How is the shift to cloud connectivity - for things like data analytics, centralized management, and remote access -  changing the security posture of these systems? What's a real-world example of a positive security outcome you've seen as a direct result of this cloud adoption?
• How do the Tactics, Techniques, and Procedures outlined in the MITRE ATT&CK for ICS framework change or evolve when attackers can leverage cloud-based reconnaissance and command-and-control infrastructure to target OT networks? Can you provide an example?
• OT environments are generating vast amounts of operational data. What is interesting for OT Detection and Response (D&R)?

Resources:

• Video version
• Cybersecurity Forecast 2026 report by Google
• Complex, hybrid manufacturing needs strong security. Here's how CISOs can get it done blog
• "Security Guidance for Cloud-Enabled Hybrid Operational Technology Networks" paper by Google Cloud Office of the CISO
• DEF CON 23 - Chris Sistrunk - NSM 101 for ICS 
• MITRE ATT&CK for ICS