Anatomy of Smart Building Ransomware Attacks

The company Anthony works for, JLL, manages almost 5 billion square feet of property. Some of that large number of properties have had cyber incidents in their building management systems. In this session, Anthony shares hard-earned lessons and common pitfalls due to major events, such as the discovery of a ransom note and loss of operations due to the incident.
All phases of the attacker life cycle are explored and aligned to the MITRE ATT&CK Framework. He also highlights what evidence sources and/or forensic artifacts may or may not be available depending on which phase of the attacker life cycle was being investigated. The scenarios presented are based on real-world intrusions, their respective investigations, and real-world consequences.