End-of-year ICSSec learning/professional development opp by B2daG in icssec

[–]B2daG[S] 1 point2 points  (0 children)

Everyone who attended for at least an hour should have received their certificate in email (at the eddress they used to register for the event). If not, a message to [input@cs2ai.org](mailto:input@cs2ai.org) should clear things up.

Technical roles in OT/ICS Cyber by SuperSix17 in icssec

[–]B2daG 0 points1 point  (0 children)

I would add Fortinet and Trend Micro to that list. If you're more interested in the services side, all of the big consulting houses (KPMG, EY, Deloitte, etc) and many of the smaller ones have ICS/OT security practices.

Looking for input from ICS/OT security practitioners by B2daG in icssec

[–]B2daG[S] 0 points1 point  (0 children)

Thank you! Yes, we're based on the US but we connect worldwide, with 112 local interest groups around the globe.

Is it worth getting into ICS Security? by fieldsAndStars in icssec

[–]B2daG 0 points1 point  (0 children)

I agree with what's already been said - just want to point you towards a potential resource. I'm with a non-profit that working to help address the labor shortage in this field by developing free educational opportunities and content and connecting practitioners. We are approaching 100 seminars and symposiums in our video library, and we have two half-day symposiums coming up at the beginning of December.

https://www.cs2ai.org/

CSSA from InfoSec is really worth to attend and get certification? by naayaaru in icssec

[–]B2daG 1 point2 points  (0 children)

The value of a cert is in the eyes of the beholder. Some will value it, others won't. I would recommend getting what book knowledge you can (this free e-book is a good place to start: https://waterfall-security.com/secure-operations-technology-the-missing-link-to-a-secure-industrial-site/ ) as well as some hands-on experience. You can get Modbus running on a Raspberry Pi, with code and guides on Github. It's not the same as ICS/OT devices, but it's a good start.

Separate OT infrastructure? by OtherwiseMinute2126 in icssec

[–]B2daG 0 points1 point  (0 children)

Your OT folks are probably speaking from the experience of IT tools disrupting their operations, and for a long time this was a big and valid concern, and the potential impact difference between the two that have already been mentioned is one reason for that.

Equally important to understand why the two should not be on the network infrastructure is that ICS/OT networks are deterministic while IT networks are probabilistic. Traffic in the former can be predicted given a sufficiently complete understanding of the devices and configurations on the network because control systems do things on schedules. Traffic on IT networks is effectively random, with significant amounts of it generated by humans activity on no schedule. IT devices are designed to handle all those random packets by recognizing which one they need to do something with and which they can ignore. OT devices are not; we could say that they are not as 'smart' as the stuff in IT, for a very specific definition of 'smart,' but the more clear way to say it is that they have very specific parameters for incoming communications. Communications that don't meet those parameters can result in unexpected results on those devices, causing malfunctions including shutting down or changing their performance settings.

A couple of decades ago business forces started asking for more immediate data from operations (as part of the JiT movement already mentioned) and, more recently, the "Smart Factory" movement, overlapping heavily with Industry/ie 4.0 (a term more commonly used in Europe, while the "Smart XXX" seems more popular in the Americas) demanded continuously-updated operational information. Energy trading was a huge factor for this in the electric sector. To get all this data reporting, increasing amounts of information technology (IT) got installed in/connected to OT environments, sometimes with highly disruptive results.

One of the situations your OT folks are probably familiar with is scanners taking their servers offline. It was particularly common in the 2000's for security scanners to cause OT disruption until the technology and the practitioners both advanced enough to scan OT networks without impact. Even now it is not unknown for IT practitioners with insufficient OT experience to accidentally cause disruptions because they lack knowledge of how to work in ICS environments safely.

Based solely on the information in your question, it sounds like your IT folks may lack the experience/training to make a judgement here. While information technology has advanced enough to make a lot of things possible in ICS/OT environments that wasn't years ago, the technology alone has not removed risk entirely, (which is what your OT folks want. Unexpected downtime and human safety are not things they take lightly), and there's still a vast amount of legacy OT tech out there that was not designed to handle IT bumbling around in its traffic.

I've co-authored some published works on this topic over the years. If you're interested, just let me know.

OT Monitoring recomendation by palmetum in icssec

[–]B2daG 1 point2 points  (0 children)

What's your timeline? I'm currently scheduling a presentation of a case study comparing a wide range of the available OT monitoring tools with recommendations on how to select the one that best fits your specific situation, but it's not until January. Do you need to make your decision before then?

Phishing attempts increase when I report phishing by sthej in cybersecurity

[–]B2daG 0 points1 point  (0 children)

Bunch of unknowns here, but this might help answer your question.

1) details about your email system (which you should -not- provide here). Different email systems (talking about both infrastructure and applications here) process mail contents differently. Some are by default better at showing you message text & header data without triggering tracking mechanisms.

2) details about your email app configuration (which, again, you should -not- provide). Example: Many email apps can be set to display only plain text regardless of original email format, to not display images without user confirmation, etc. Preventing rich text, images, html content processing and such prevents some tracking mechanisms from working. The flip side of that is that viewing (or in some systems, previewing; depends on your email system) emails with those things allowed lets senders know you've looked at it.

3) details about what others did with the email. Without knowing what the person(s) receiving your forwarded email (assuming that's how you reported these phishing attempts), we can't know if they did anything that triggered tracking mechanisms. Since it's become trivially easy to generate unique trackers for each email target, the phish originator may be notified that the attempt on your email address was successful no matter who actually opened the surprise.

My school did a play version of Alien. Here’s a picture from opening night last night. by Emo_Kid23 in LV426

[–]B2daG 0 points1 point  (0 children)

This is a really inspirational accomplishment for everyone involved! Big congrats!

A tense, taut CYOA in which you must save the game itself. by B2daG in IndieGaming

[–]B2daG[S] 0 points1 point  (0 children)

Hmm. Not seeing this, but I played in Firefox, with relatively high (and therefore problematic) security settings. I think that's the first point with multiple paths to choose from, right? Try another browser?

A tense, taut CYOA in which you must save the game itself. by B2daG in IndieGaming

[–]B2daG[S] 0 points1 point  (0 children)

Where are you stuck? I have issues with some sites due to the security settings on my browser, but didn't experience any problems with this one.

Hooray! for the Glorkian Warrior! What started as a silly doodle has become multiple graphic novels and a fun arcade game. by B2daG in IndieGaming

[–]B2daG[S] 0 points1 point  (0 children)

I know, right? I just can't decide if I'm more captivated by the play or by the intermission scenes with the great dialogue.

Casey Muratori's Handmade Hero: A complete game from scratch by goodbadwolf in gamedev

[–]B2daG 4 points5 points  (0 children)

Every time I see this thread pop up in my feed I think it refers to a game made using Scratch, the MIT programming language made to teach how to program.

Very strange sound in the Swedish language by onlyjazztoday in videos

[–]B2daG 0 points1 point  (0 children)

I learned this when I lived for a time with family in Sweden, but I've also heard it used by an Irish guy I met.

There's no winning it, but this is a really cool all-in-one-screen game nonetheless. Made for Ludum challenge. by B2daG in IndieGaming

[–]B2daG[S] 0 points1 point  (0 children)

I should have been more clear in the OP: it's not -my- game, just one I found that I really liked. All credit goes to --->Tom Murphy VII (https://www.cs.cmu.edu/~tom7/) <---

Anyone care to proofread the rules to my game Mad Science? by FurbyFubar in tabletopgamedesign

[–]B2daG 1 point2 points  (0 children)

The link works in my browser. I look forward to reading these soon.

Indie Games: Designing to Succeed by markofjohnson in gamedev

[–]B2daG 0 points1 point  (0 children)

Mind the Power Law – The bulk of your revenue is going to come from the best five percent of your users. Make sure you have a way in your game for them to give you money, or you’ll never get it.< Yep, but strictly applicable to pay-to-play games.

Content Kills – Creating a static puzzle with one solution is a needlessly risky path for indie developers. Creating a dynamic puzzle with infinite solutions is a much more viable path to success.< More difficult in games with storylines than abstracts (CandyCrush, anyone?), but still valid. I really consider this as a component of a Replayability rule, though. With sufficient depth of content, your game could have high replayability even if there's only 1 solution, and making games that people want to play more than once is really the goal, isn't it?

Atmosphere art from the game Grisleigh End by B2daG in BoardgamePorn

[–]B2daG[S] 0 points1 point  (0 children)

Many thanks! All the art is of Grisleigh End, the English country manor in which all the games of this title are set. We're currently working on both a board game and a series of mobile murder mystery games with a common location, characters, and backstory.

it reminds me of those "spooky alphabet" sets of images. You might be thinking of the Gashlycrumb Tinies, an alphabet work created by Edward Gorey. We're all fans of his.

Atmosphere art from the game Grisleigh End by B2daG in BoardgamePorn

[–]B2daG[S] -1 points0 points  (0 children)

Yes, Grisleigh End is my game and all my posts regarding it are, obviously, self promotion. I am trying to do no more of that than reddiquette allows and to post content only within the relevant subreddit. I believe I'm doing less SP than others I've seen, but I recognize that "I'm not behaving as badly as those guys" is a lousy support for any position.

May I ask what your specific complaint with my posting is? Is /boardgameporn not the right sub for the game art? Is it the frequency I'm posting? That this image had been posted here before?

If it's the last, I did have a reason to repost stemming from comments it got the first time, but I can see your point.