OT Threat Hunting: What Actually Works in ICS Environments with Joe Slowik

Value of the Information & Strength of the Argument

The value of the information is high, offering practical insights from a seasoned practitioner. Slowik debunks common myths about threat hunting, such as the idea that it is purely proactive, and provides a nuanced view of behavior-based detection. His argumentation is solid, grounded in real-world experience and logical reasoning. He effectively explains the trade-offs between specificity and false positives, and the importance of understanding normal behavior. The discussion on AI is balanced, acknowledging both its utility and risks. The arguments are coherent and well-supported by examples from his career.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the content is based on expert opinion rather than formal research. No specific sources are cited, but Slowik references his experience and mentions organizations like Google Threat Intelligence Group and Microsoft. The title accurately reflects the content, focusing on practical threat hunting. The discussion is well-structured and avoids sensationalism. The lack of formal citations is typical for a webinar format, but the credibility of the speaker adds weight to the claims.

The title accurately reflects the content, which focuses on practical threat hunting in ICS/OT environments.

8/10

High credibility due to Joe Slowik's extensive experience in OT security, including roles at Los Alamos National Laboratory, Dragos, and MITRE. The discussion is grounded in practical knowledge and avoids hype, but it is an opinion-based conversation without formal citations or peer-reviewed sources.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction of Joe Slowik and his background in OT security.
• 05:00Discussion on the importance of understanding your own environment before hunting.
• 10:00Debunking the myth of proactive threat hunting.
• 15:00Explanation of behavior-based detection vs. indicator-based detection.
• 20:00Challenges of asset inventory and visibility in OT environments.
• 25:00Discussion on AI in OT security, both defensive and offensive.
• 30:00Risks of AI knowledge leakage and over-reliance on AI outputs.
• 35:00Concerns about AI-generated code and the need for human review.

• Google Threat Intelligence Group — Mentioned as documenting adversary use of AI.
• Microsoft Threat Intelligence — Mentioned as documenting adversary use of AI.

• MITRE ATT&CK for ICS — Provides a framework for understanding adversary behavior in ICS, aligning with the discussion on behavior-based detection.
• SANS ICS Security — Offers training that emphasizes the importance of visibility and understanding normal operations.

• No discordant sources found — The video does not contradict established knowledge; it aligns with common best practices in OT security.