S4 Proof Of Concept (POC) Pavilion
Purpose: Demonstrate to the S4 attendees OT security products attempting to solve an asset owner problem.
Approach: Simulate a proof of concept (POC) project, installation and demonstration on a manufacturing plant. The Pavilion sponsors must install and demonstrate their solution on the OT environment provided and run by Booz Allen.
Pavilion OT System: A highly realistic manufacturing system. It include the MES, SCADA, HMI and PLC levels of the manufacturing automation stack. The primary vendors in the system are Inductive Automation, Rockwell Automation, and Siemens (see network diagram below).
Four Questions For The POC Pavilion Stage Presentation
- What problem is your solution solving?
- What are the criteria to determine if your solution is successful?
- How long did it take to implement the solution?
- How much does the solution cost at deployment and annually?
The information below is from the S4x26 POC Pavilion. We will be putting up information about POC Pavilion OT system, the POC Pavilion provider, and the participants problem statements and success criteria prior to November 1st.
S4x27 POC Pavilion
Created & Operated By Booz Allen
The ten POC Pavilion Participants will be demonstrating their solution in their exhibit and once live on the POC Pavilion stage. There’s nowhere to hide, and the Participants will answer questions from the emcee and audience.
A new addition for the S4x27 POC Pavilion … an offensive / attack team. They will be used for solutions that provide protection and detection. Much more than a canned demo.
| Vendor | Problem | Success Criteria |
| Cisco | Knowing attackers will eventually breach the perimeter, how do we quickly implement zone segmentation across thousands of assets without manually creating policies, or risk a rule that breaks production? | Zone segmentation stops attackers trying to cross zones, and it allows authorized communication across zones. |
| Elisity | Pending | Pending |
| Forescout | How do we create and maintain an asset inventory of networked OT cyber assets? How do we prioritize vulnerability mitigation in the asset inventory? |
1) An accurate asset inventory. 2) A list of prioritized risk mitigation recommendations. |
| Frenos | How can we identify the attack paths an adversary could use to compromise critical operations? What are some possible mitigations for each identified attack path? | A comprehensive list of attack paths and one or more recommendations for each identified attack path. |
| Industrial Defender | Pending | Pending |
| Palo Alto | How do we protect vulnerable OT assets from exploitation when disclosed software or firmware vulnerabilities cannot be patched without disrupting operations? | The solution will stop attempts to exploit disclosed vulnerabilities that have not been patched. |
| ServiceNow (Armis) | How do we build one accurate, continuously updated inventory of every cyber asset and connection from Level 0 to the internet edge, and know which vulnerabilities and exposures put production at risk, without affecting the process? |
1) An accurate asset inventory 2) The ability to identify new and changed OT cyber assets and update the asset inventory 3) A list of the KEV vulnerabilities in the OT system |
| ServiceNow | When new exploited vulnerabilities hit OT assets, how can we make sure the right owner sees the exposure, understands who and what can reach it, and makes a patch/ mitigate/accept decision that turns into plant-approved work, without disrupting operations? | Simulate a new item on KEV list that affects an OT cyber asset. The workflow operates will operate as described in the problem statement and the information required to make decisions is available. |
| TXOne | We have OT assets that cannot be easily patched, upgraded, or taken offline. How can we protect these assets against cyberattacks without disrupting operations or requiring changes to our existing network architecture? | The solution stops attacks trying to exploit unpatched vulnerabilities. |
| Xage | How do we control access to assets and data that may live in both IT and OT environments? | Approved access is allowed and all other access disallowed. |
POC System Documentation
The S4x27 POC Pavilion environment consists of three skids (Batch/Mixing, Bottling, and Packaging) and a half-height server rack, designed to simulate key stages of a beverage manufacturing plant. Each skid is equipped with representative industrial control systems, physical devices, and network infrastructure, while the server rack houses the shared network infrastructure and servers.
The Booz Allen team put together a document than mimics what an asset owner would provide a vendor coming in to install and perform a POC with their solution. It actually exceeds what most asset owners provide in detail and accuracy. We are simulating an asset owner with a mature OT and ICS security program.
POC Pavilion Provider
S4x27 POC Pavilion Vendor Participants
