Kaspersky Lab and MIT host a successful second annual ‘Think Security’ seminar

On January 23-26, 2018, the Massachusetts Institute of Technology (MIT), in collaboration with Kaspersky Lab, hosted its second annual “Think Security” seminar devoted to protecting industrial automation systems from cyberattacks. The event was organized jointly with MIT Cybersecurity at MIT Sloan (formerly (IC)³) and the Sloan School of Management, with the participation of Kaspersky Lab’s Department of Educational Programs.

“The weeklong seminar allows our students and staff to interact and work together in order to solve some of today’s most pressing problems with industrial control systems – creating an unforgettable, educational experience,” said Stuart Madnick, director of Cybersecurity at MIT Sloan and professor of information technology at the MIT Sloan School of Management and the MIT School of Engineering.

During the first two days of the seminar, Kaspersky Lab ICS CERT researchers introduced the audience to cyberattack investigation techniques and shared their experience of searching for and researching vulnerabilities in industrial systems. In addition, Kaspersky Lab’s senior security researcher, Maria Garnaeva, talked about advanced persistent threat (APT) attacks and gave a master class on the use of YARA rules to detect them.

“What I really liked was how interested and diverse the audience was. Participants included students, teachers and people working for large companies. This made it possible for us to touch on a variety of issues, both theoretical and practical. After the talk, we were glad to hear that many were seriously thinking of doing their own research into the topics and issues we talked about at the seminar,” said Garnaeva.

Sergey Temnikov, senior security researcher at Kaspersky Lab, added to the discussion by presenting new research from the company’s ICS CERT team, which found 14 vulnerabilities in a popular hardware-based software licensing solution. Then, Kaspersky Lab ICS CERT expert Pavel Cheremushkin shared his experience of searching for and analyzing vulnerabilities in industrial systems. He provided examples of vulnerabilities being discovered and exploited in various popular applications.

Another topic of focus during “Think Security” was Internet of Things (IoT) cybersecurity. Kaspersky Lab security researcher Roland Sako introduced the audience to IoT, then presented a methodology for analyzing the security of IoT devices and explained how such devices can be connected with industrial control systems.

The seminar also featured an industrial Capture the Flag (CTF) contest, a shortened version of the annual contest organized by the Kaspersky Lab ICS CERT team. The competition included a variety of tasks ranging from Application Security, Binary Exploitation and Reverse Engineering to Digital Forensics, Fun, Cryptography and Networking. The most successful participants were awarded prizes.

Kaspersky Lab North America’s Head of Human Resources, Alena Reva, also spoke to the students about the company’s award-winning culture, history and hiring practices. Alena then answered questions on the differences between ‘whitehat’ and ‘blackhat’ hackers.

The final days of the seminar were devoted to management, strategic and organizational aspects of cybersecurity.

In her lecture, MIT (IC)³ Executive Director Keri Pearlson focused on building a cybersecurity culture in society. She also conducted a case study on the subject, while MIT (IC)³ member Andrew Stanley spoke of cybersecurity metrics and their practical applications.

Speakers also included Kaspersky Lab experts Tara Hairston, Head of Public Affairs, North America, and Sergey Novikov, Deputy Head of the Global Research and Analysis Team.

Another event, available to all seminar participants, was the Cyber Safety Management Games practical training. Participants learned how to recognize insecure user behavior, analyzed standard work scenarios from an IT security standpoint and practiced making business decisions based on a reasonable risk reduction approach.

The experts’ presentations were met with a lively interest by the audience. According to student reviews, the seminar was very informative and offered a good mix of theory and practical experience from industry experts.

“These days, when more than half of all industrial companies have been subject to at least one cyberattack in the past year, training a new generation of critical infrastructure and industrial IoT security experts is more important than ever,” said Evgeny Goncharov, Head of Kaspersky Lab ICS CERT. “We were glad to once again take part in the ‘Think Security’ seminar and we tried to make it an enjoyable, interactive event, to enable the audience to gain valuable practical knowledge and tools. Such events promote industrial cybersecurity awareness and we hope to continue our collaboration with the Massachusetts Institute of Technology.”

More information on other Kaspersky Lab educational initiatives can be found at academy.kaspersky.com. Information about Cybersecurity at MIT Sloan Consortium can be found at https://ics-cert.kaspersky.com/away?url=https%3A%2F%2Fic3.mit.edu&hs=1f0e3dad99908345f7439f8ffabdffc4.