Time Table

In recent years, the cybersecurity of factories and other facilities that support critical infrastructure has attracted attention, yet there are very few cases that empirically verify the effectiveness of “physical security,” the foundation of perimeter defense. Based on our experience conducting physical penetration tests against a variety of business sites in Japan, including large-scale plants, this talk explains, from technical and structural perspectives, the attack paths from physical intrusion into a business site to intrusion into its internal network, along with the key points for defending against them. On the physical side, we will present points that can become physical intrusion routes and how to think about countermeasures, such as inconsistent security levels depending on the design and use of entrances, and the physical proximity to and blurred operational boundaries with companies that make up the supply chain. On the cyber side, we will show that attackers who gain physical access can carry out a wide range of activities, including exploiting poor operation of critical on-site terminals, bypassing removable media restrictions with BadUSB, evading detection by spoofing the MAC addresses of existing devices, and a unique BadUSB payload that creates an in-memory WebShell locally and abuses it over the Internet. In addition, we will introduce an example of business impact assessment using the Ministry of Economy, Trade and Industry’s Cyber/Physical Security Framework (CPSF). Specifically, targeting an area that centrally manages a factory’s OT network, we safely assess the state of security measures by combining interviews based on the CPSF perspective with on-site inspections, and from the results we map the types of threats that could materialize and the business impacts those threats could cause. This makes it possible to visualize a factory’s security posture in a way that ties it to realistic business risks, and it is expected to serve as material that encourages management to optimize security investments. Please note that, in this presentation, some data may be generalized or abstracted so that specific organizations or locations cannot be identified.