AI
The Gap Between Claimed and Actual Lockdown
Operator workstations in control rooms run critical plant assets. The common claim is that they are locked down. Boyd’s definition of that term sets a high bar: GPOs restrict executables to an approved list, allow-listing tools actively enforce it, nobody holds local administrator rights, and login scripts do nothing more than configure sessions. In practice, almost none of those controls hold on a pentest.
Why Allow-Listing and GPO Controls Fail in Practice
Group policy objects block alarms.exe by name, not by hash or path. Rename PowerShell or cmd.exe to alarms.exe and the block disappears. Boyd gets code execution that way on the first try. Allow-listing tools compound the problem. Installed to protect, they are typically left in learning mode rather than enforcement mode. That means regsvr32, msbuild, and bitsadmin all run without challenge. Alerting is configured so broadly that Microsoft-signed binaries never trigger an alert, and LOLBIN techniques go unnoticed.
Default Credentials and Editable Scripts as Entry Points
Default credentials are the third escape. Boyd logged 39 installations of one unnamed solution over six months. 38 carried identical credentials. The pattern repeats after remediation: integrators reimage during the next maintenance window and reintroduce the default. Login scripts are the fourth route. Operator accounts run them at login, and the files are editable by any user. Boyd modifies the script to add a local administrator, waits for a real admin session, then passes the hash with mimikatz across every machine sharing that password.
Vendor Incentives and Compliance Culture Explain the Pattern
Two structural forces create these openings. Vendors ship default images and sell security add-ons built on the same template. Integrators under deadline pressure copy the last working configuration, so the same oversights move from project to project. Allow-listing tools get treated like antivirus: installed once, never re-examined. Compliance audits ask whether a tool is enabled, not whether it actually blocks anything. Boyd cites a CISO who acknowledged in a board meeting that the company was following compliance rules rather than attacker behavior.
From Compliance Checking to Adversarial Validation
Boyd’s fix starts with accountability: security is the asset owner’s job, not the vendor’s. Validate what integrators claim by testing it yourself. Treat allow-listing and GPOs as living systems that need regular tuning, not one-time deployments. Shift from a compliance checklist to a challenge mentality. Test whether controls actually stop an attacker. Single jump servers in a DMZ are a concentrated target: compromise one and you can hijack every session using it. Boyd also argues for including plant operators in security decisions. Controls imposed without operator input get worked around.
Q&A
Do people over-rely on network segmentation as a substitute for real security? Boyd says yes. Firewall rules use /24 or /22 subnets, allowing hundreds of devices through a perimeter that only two or three actually need to cross. ▶ 13:02
How do you get management buy-in for remediation in OT environments? Boyd includes management from the start, times assessments to maintenance windows, and scores findings by operational and safety impact rather than CVSS. ▶ 13:48
Can a connected industrial process be secure despite cyber gaps? Boyd runs Windows XP in some environments with no network cable, arguing that physical isolation makes it harder to attack than a fully patched connected system. ▶ 16:30
How do you prioritize vulnerability management in OT? Boyd tracks four to six vulnerabilities at a time. The filter: does an exploit exist, and is it remotely exploitable? If no to both, move on. ▶ 17:27
Notable Quotes
environment now belongs to me. Aaron Boyd · ▶ 8:12
not the vendor’s job. It is ours. Aaron Boyd · ▶ 10:35
Don’t wait for the attackers to test it Aaron Boyd · ▶ 12:37
Key Takeaways
- Renaming PowerShell to an allowed executable name bypasses GPO controls without any exploit.
- Allow-listing tools left in learning mode provide no protection and generate compliance theater.
- One unnamed DCS solution had default credentials in 38 of 39 production deployments over six months.
About the Speaker(s)
Aaron Boyd has over ten years of experience testing OT and ICS environments across oil and gas, aerospace, and manufacturing. He has worked at the NSA and conducted penetration testing and red team operations at Dragos. He currently works as a systems engineer at Liberty Energy, where he focuses on security improvements that hold under attack rather than compliance that looks good on paper.