@SecureOwl Yeah, so we have to be a lot more gentle with industrial devices and process networks because the real life consequences of altering or modifying them can be life, safety, and damage. We don't want to cause worse consequences than the adversaries doing DFIR. So that means we have to be way more light touch and passive in our investigations - and often times we cannot even install things on machines without risking them or voiding a warranty.

The second thing that''s wildly different is the technologies. There's no XDR/EDR or agent-based forensics in most of these networks. It would cause those problems that I talked about. There's a ton of legacy devices, sometimes back to Windows 3.1 that are still doing critical functions. So a lot of gentle, legacy forensics, manually and by hand, system by system. Very different from most modern IR.

Finally, as @MisuseCase points out, we also have to be able to do forensics on niche documented/undocumented legacy network protocols and their process impact, as well as low-level devices (not usually level 0) that don't run Linux or Windows, like PLCs and RTUs.

@Jetengineweasel@hackers.townVastly increased process efficiency and cost-savings. The vast, vast majority of "secure" modern industrial networks vaguely follow the Purdue Model, meaning there's some kind of DMZ between the Enterprise network and industrial process network. It can vary in crunchiness and number of holes. So there is some segmentation, but there's a lot of necessary stuff going between networks and subnets, such as telemetry, distributed control, system updates, file transfers, and remote access. This is hugely important to business in modern process environments. I see maybe 1 or 2 airgapped networks a year doing this full time.

Are attackers already in industrial networks? Absolutely! It's hard to conduct meaningful attacks against a process (not just a device, which has redundancies and safety controls). So lots of resourced adversaries are building footholds and learning.

@c0nsid3rate How many networks do I see that are properly segmented? Quite a few in better resourced orgs... it's just that there is unfortunately almost always some pass-through via the DMZ as well as vendor / out of band connections that break the Purdue Model. So you have a firm crunchy candy outside with a very soft and squishy candy center.

Do we leverage flow logs for forensics - sometimes, but they are not very useful when we're talking attacks that primarily occur internal > internal, and potentially leveraging specific industrial protocols. Actual network threat detection and packet capture is really important in industrial, and it has to be done differently than in IT.

Who has an asset inventory... I don't have firm metrics. Lots of orgs have one in OT but it has not been updated in 5, 10, 20 years and there have been system updates and additions since then. It's a big problem everywhere.

@blackfell Documentation, honestly. We have to reverse engineer a ton of low level devices just to get logs because the physical interfaces and the memory architecture are not documented anywhere and we just need some simple diags and logging. HMIs and Engineering Workstations typically run Windows so other than figuring out where stuff is stored in the application, forensics isn't in outer space.

We tend to triage & memory collect on Windows and Linux systems, but due to the lack of agents sometimes we have to grab full disk images. We have to be very flexible due to process uptime, legacy systems, and lack of agents.

@Adman @Wil had some really good answers here. Networking systems has enabled vastly more efficient processes across facilities and enterprises, and incredible cost-savings. Staff can be centralized in a single facility, or work from home. It's no longer necessarily required to dispatch repair techs to remote sites. Process data can be shared across multiple facilities to ensure synchronization. Telemetry can be used to identify failures and inefficiencies proactively.

And, it's all a lot cheaper to do this using existing technologies like TCP/IP and vendors like Microsoft, Juniper, and Cisco.