You know IT security. You know networks, endpoints, Active Directory, vulnerabilities, phishing, and all the other fun ways computers can ruin your day. Now imagine that instead of taking down a website, your network ping can decapitate a person, and your nmap scan can fill the public drinking water resertve with cholorine.

Welcome to Industrial Control Systems!

ICS, and the broader world of Operational Technology (OT), runs factories, power plants, water treatment, pipelines, and a whole lot of other things that we'd really prefer to keep running. And while these environments use plenty of familiar technology, they come with their own strange rules, ancient hardware, proprietary protocols, and one particularly important consideration:

You can't always just reboot it, and you definitely can't just patch it.

This talk is an introduction to the terrifying world of ICS cybersecurity. We'll cover what an industrial control system actually looks like, what PLCs, HMIs, SCADA systems, and industrial networks do, and how they differ from IT environments.

We'll also talk about how attackers actually get into these environments, what can go wrong when they do, and what defenders need to think about when what they're protecting isn't just data, it's health and safety.