ZeekWeek 2022 - Two Years of Developing Parsers for Industrial Control System Protocol - Seth Grover
By Seth Grover, Cybersecurity Researcher, Idaho Lab
The Industrial Control Systems Network Protocol Parsers (ICSNPP) project is an ongoing endeavor of cybersecurity researchers supporting DHS CISA at Idaho National Laboratory for about two years. Since its initial commits to GitHub in January 2021 we’ve developed eight “from scratch” ICS protocol parsers for the Zeek network security framework, extended logging capabilities of Zeek’s default Modbus and DNP3 parsers, released an LDAP parser (thanks to some resurrected old BinPAC++/Hilti proof-of-concept code and the great work the Spicy development team and others in the Zeek community) and submitted nearly 30 PRs to third-party Zeek plugin repositories to make them compatible with the latest releases of Zeek. This presentation will cover how we approach developing new Zeek protocol analyzers and how we’ve addressed challenges we’ve encountered.
Bio: Seth Grover is a software engineer in cybersecurity R&D with eighteen years of experience in SIEM and other security-related network traffic analysis technologies. An Idaho native, Seth has worked at Idaho National Lab since 2018, much of which has been focused on the creation and development of Malcolm, an open source network traffic analysis tool suite providing visibility into OT network communications.