Lesley Carhart

As cybersecurity visibility and maturity increases across industrial environments, an increasing number of organisations are discovering long-term, pervasive legacy malware infections in their process environments. Despite temptation to respond drastically, dealing with these incidents requires a measured, careful response. In most cases, an immediate upgrade of all impacted Windows hosts is not feasible. Conversely, haphazard forensic and cleanup efforts can also be futile and even cause a process disruption. Unfortunately, even infections that have been in place for a decade can eventually cause network and computing equipment to degrade in performance and fail in unpredictable ways. Commodity malware isn't a problem to be ignored, or respond to without careful forethought. This presentation will convey practical lessons learned for evaluating, scoping, and making practical decisions to ensure the safety and reliability of impacted process networks.