Cloud Sec Orienteering, Project Discovery, and OT Links

April 20, 2022 · 1 min read

breaker of things

Via Daniel Miessler's Unsupervised learning podcast no. 327, referral to tldrsec's "Cloud Security Orienteering" written by Rami McCarthy. From there, found the AWS Well Architected Framework
- Also on Daniel's podcast I found out about Project Discovery which has a bunch of cool open source network discovery tools which can be used for security.
My buddy CD sent me this webinar "How to Evaluate the Cyber Risk of Emerging Technologies—An ICS Attack Framework"
ML sent me some OT sec links.
- How to use FAIR analysis with DREAD
- CCE
TICS reminded me of the Stuxnet documentary, Zero Days (2016). I need to check it out one of these days.
Last week I was looking into CVE Markdown Charts. I'd like to check that out for personal use, and work.
MS sent me some OT security links
- Here is a good overall description of OT and security around it
  - https://csrc.nist.gov/Projects/operational-technology-security
- Nice graphic showing something’s to consider
  - https://csrc.nist.gov/CSRC/media/Projects/operational-technology-security/documents/NIST_Control_Systems_Tips_and_Tactics_Infographic.pdf
- Examples of specific OT attacks over the years
  - https://www.fortinet.com/blog/industry-trends/evolution-of-cyber-threats-in-ot-environments
- Colonial Pipeline was a large, in the news, widespread attack. Ransom ware on IT side directly affected the OT network.
  - https://www.darkreading.com/omdia/colonial-pipeline-cyberattack-proves-a-single-password-isn-t-enough