Welcome to BSides OT UK 2026 in Bristol!
Collect your badge, lanyard, and all the swag and head on in for a quick cup of tea/coffee and a pastry before the day begins!
Now's your moment to do some quick hellos to old friends, meet some new people, and review the brilliant schedule to decide your fate for the rest of today!
Welcome to BSides OT UK 2026 in Bristol!
The team behind today's event will take to the stage to provide information for the remainder of today's activities, and issue an ever-lengthening list of thank yous to everyone involved in making today possible (you included, you lucky thing!).
Let's kick off the first-ever BSides OT UK! 🎉
Our opening keynote for the inaugural BSides OT UK will be delivered by Kevin White.
Kevin is the Head of Cybersecurity for the Energy businesses of SSE Group and specialises in Operational Technology.
He has worked in sectors as diverse as food, nuclear and utilities and in technologies that range from industrial networks to cloud-based analytics. He currently focusses on securing the energy-generating assets of SSE in the race towards NetZero.
Having spent several years securing downstream oil infrastructure from cyber attacks, I can confidently say that traditional IT approaches to cyber security do not translate well into OT environments. We can spend a decade trying to force that square peg into a round hole, or we can do something different. After all, have those IT approaches even worked in IT?...
In this talk I'll take you through several lessons we learned out in the field, securing critical OT infrastructure. We'll talk about how went about securing OT networks, how we utilised zero day vulnerabilities to our advantage, why we don't consider patching systems to be that important, how we handle topics like security testing, and how to implement effective detection capabilities all without disrupting operations or compromising safety.
This talk is us learning out loud in the field of OT security, sharing our experiences in order to contribute to collective shared wisdom. I hope to leave you with some insights and examples from our own journey that you can take away and use on, and maybe challenge, your own approaches to OT security.
Attendees will leave able to ask more informed, stronger questions of suppliers, read assurance claims with appropriate scepticism, and make more defensible decisions about OT risk in the real world. They will gain a better understanding of where control sits in OT environments, how supplier relationships and commercial structures shape security outcomes, and why many common assumptions and frameworks around ownership, responsibility, and governance collapse in practice.
The talk explores common myths around ownership: that asset owners control patching and change, that contracts offer meaningful protection, that assurance means security, and that responsibility aligns with authority. It examines how dependency, inertia, lifecycle constraints, vendor power, and incentives often dictate security posture far more than policy or wishful thinking, and offers practical ways to reframe discussions and challenge supplier narratives.
Remote access keeps OT environments running, but it also concentrates risk. Many incidents do not start with a sophisticated Programmable Logic Controller (PLC) exploit. They start at the “front door”: vendor VPNs, jump hosts, shared support accounts, and rushed identity checks during outages. According to the SANS State of ICS/OT Security 2025 findings, about half of ICS/OT incidents begin with unauthorised external access, often through third-party remote maintenance.
This 20-minute talk shows how to secure OT remote support without breaking production. Using a simple “front door path” diagram (Vendor → Remote Access → Jump Host → Engineering/HMI), we cover two repeatable failure areas: 1) remote access pathways that become broader or more permanent than intended, and 2) identity/support workflows that expand access under operational pressure. For each, we pair the risk with practical controls that work in legacy OT environments: time-boxed vendor access, least-privilege support identities, and a safety-aware “normal vs emergency” access lane that preserves availability while improving accountability.
We close with three high-fidelity monitoring signals you can implement even in legacy OT environments: authentication anomalies, interactive remote logons, and privilege/role changes. I’ll map these signals to common jump-host and remote-access setups, and include one worked example from Windows event logs (e.g., 4624/4625, RDP logon type 10, 4728/4732). We finish with an actionable OT access plan that attendees can apply immediately.
Monitoring is often seen as the silver bullet for ICS security, but how effective is it really? In this interactive lab, you will launch realistic attacks with CALDERA against a live industrial setup and evaluate detections across EDR, logs, and network monitoring tools. Discover OT blind spots and walk away with a clear methodology to assess and improve monitoring.
OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be.
What happens when a cyber incident doesn’t start with malware… but with a door?
In this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast.
As IT and OT systems become increasingly interconnected, the line between “IT security issue” and “OT safety problem” is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other.
Set inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick.
Operational Technology (OT) environments are people-first systems, where operators, engineers, vendors and security teams are making real-time decisions that directly impact safety, production and business continuity/uptime. For example, when incidents occur, technical controls alone are rarely the deciding factor, whereas communication is.
This talk aims to explore why "soft skills" such as risk translation, negotiation and de-escalation are actually safety-critical OT security controls. Drawing on experiences common to women in cyber and OT roles, the session will aim to highlight how skills often labelled as "non-technical" directly impacts safety, resilience and uptime (Why women often develop these skills early.). Rather than focusing solely on incidents, the talk aims to examine the everyday decisions and interactions that determine whether OT security controls are adopted, ignored or bypassed. The talk will also look at practical moments that define OT security success (i.e. managing vendor relationships where tone matters more than technical accuracy).
The aim is to have attendees leave with a reframed understanding of OT security maturity, where human communication, coordination and trust are recognised as essential components of effective risk management.
Modern SOCs are being asked to monitor OT environments that behave nothing like the IT systems they’re used to. This talk cuts through the hype to show what it really takes to bring OT visibility, detection, and response into a SOC without disrupting safety‑critical operations. Attendees will leave with a practical, realistic view of how to evolve their SOC for converged IT/OT threats.
In Grayzone Warfare: From IT Systems to OT Effects, Ian Thornton‑Trump CD examines how modern cyber conflict operates in the space “between peace and war,” where adversaries pursue strategic advantage without crossing traditional thresholds of armed conflict. Using his established insights into hybrid warfare and cyber‑physical risk, Thornton‑Trump reveals how attacks that begin in enterprise IT environments increasingly cascade into operational technology (OT), critical infrastructure, and industrial control systems.
This session presents cyber incidents as components of intentional grayzone campaigns that blend espionage, disruption, economic coercion, and psychological pressure. Thornton‑Trump demonstrates how weaknesses in identity systems, supply chains, governance, and security visibility are exploited to bridge IT and OT, turning digital access into real‑world consequences—including safety risks, service disruption, and national‑level instability.
Ultimately, this presentation challenges leaders and security professionals to view cyber defense as a matter of operational safety and geopolitical reality—recognizing and countering grayzone activity before IT compromise becomes irreversible OT impact.
Attackers are using GenAI to get better at what they do. Why aren't more of us as defenders?
The truth is that the majority of OT/ICS enviornments have limited (to no) budgets for OT/ICS cybersecurity. And yet, we're expected to continue to do more with less. GenAI platforms can act as the great equalizer and help us successfully defend our environments - and it doesn't have to be difficult! This session will walkthrough creating both offensive and defensive tools for OT/ICS environments, providing detailed prompts to help YOU secure OT/ICS!
In a world of AI slop and next-gen nonsense, how do you know the thing you bought is actually secure? How do you firewall the unfirewall-able?
This is a love letter to bench testing and vulnerability research in an industry where transparency never trends. You'll see intended functionality abused for firmware-level backdoors, controller logic swapped with segregation-busting implants, and why "secure" in OT just means "nobody looked too closely (yet)".
In short: 2 basement gremlins, 1 crusty PLC, and unlimited Monster.
Your incident response playbook has been battle-tested through countless IT security incidents. You know the drill, isolate compromised systems, preserve evidence, rebuild from known-good baselines. But in operational technology environments, these same best practices can be catastrophic.
This talk examines the dangerous assumptions that IT security teams make when responding to OT incidents in critical national infrastructure. Through real-world scenarios, we'll explore why standard IR practices, from immediate network isolation to credential resets, need fundamental rethinking when dealing with industrial control systems. Learn what happens when you try to "pull the plug" on a system controlling safety mechanisms, why forensic imaging a 15-year-old PLC isn't an option, and how to navigate the tension between investigation needs and operational reality.
This session will challenge your assumptions and provide practical frameworks for adapting your IR methodology before an incident puts them to the test.
The talk will cover the basics of windfarms and their operations, I’ll briefly discuss prior research in this area, noting that those findings are still valid today. Then the core of this talk will focus on identified security threats and their mitigations based on real life assessments. The impact these threats can have both in terms of windfarm operation and the physical damage that can be caused. I will show how physical and remote access to the windfarm can be gained, and by investigating the vulnerabilities found, I will show that there is an over-reliance on security boxes and buzzword solutions that has left general, basic, security hygiene lacking. So much so that that in some cases, not only have systems not been patched, but they were installed insecurely in the first place. I will then discuss the recent 2019 UK outage and the part played by windfarms in that, from the initial outage to their impact on restoration as a result of how micro generation is modelled within control systems.
There will be two key takeaways from this talk. Firstly, I will be busting the myth that ‘cutting off the supply’ is the most interesting attack that can be performed. It is the most likely, and one of the simplest attacks, but it is not the most interesting. Secondly, I will cover a point often glossed over in other talks. When an attacker ‘takes control’ it is often simply left at that, as if taking control was the ‘win condition’. This talk will cover some of the more interesting cyber physical attacks that can be performed on a wind farm and look at some of the ways that actual physical damage could be caused.
Presentation will discuss practical aspects of SCADA protocol security, and includes work from my MSc In Ethical Hacking & Cybersecurity dissertation "Enumeration and Attack Tools for the DNP3 SCADA Protocol Used in the Energy Industry"
Topics covered:
What SCADA protocols are and where are they used
Why some of them are inherently insecure
How threat actors have used SCADA protocols to compromise real OT systems
Technical coverage of DNP3 including:
- Overview of DNP3 protocol
- Demonstration of custom tools (replicating threat actor capabilities):
- How DNP3 can be enumerated
- MITM data manipulation attacks compromising data integrity
- Direct protocol injection commands
- Details on DNP3 specific security settings
General practical measures to improve the security of SCADA systems
Cross domain solutions are the gold standard for bridging air-gapped networks, a classic example being between IT and OT networks. Specialist and often with an eye-watering price tag they are mostly out of reach of security researchers and tinkerers alike, but what if you could build something using the same fundamental principles for the price of a round of drinks?
Security analysts or operators know that an intrusion occurred but they often cannot answer these critical questions: Which physical processes are threatened? How will the attack evolve? What is the attacker likely to do next? Your security tools detect the attack, but critical context is missing. This gap, between technical detection and operational understanding, represents a fundamental blind spot in industrial security approaches.
This interactive workshop offers a practical, hands-on experience within an Operational Technology (OT) laboratory setting. Participants will work with real-world industrial control processes to gain a clear understanding of how OT systems function and where vulnerabilities can occur. Through guided activities, the session will uncover common cyber risks affecting critical infrastructure and demonstrate proven approaches to identifying, assessing, and managing these threats. By the end, attendees will appreciate the unique challenges of securing OT environments and take away practical strategies to strengthen resilience against evolving cyber threats.
The threats facing Operational Technology our outpacing the delivery of secure solutions in our critical infrastructure. Organisations deploying OT must now accept that connectivity is no longer an edge-case, and the “walled garden” model no longer reflects the way our industrial environments operate. To accelerate transformation and meet the threat we must challenge some of these beliefs to build critical infrastructure suitable for a modern threat environment.
In this talk, David G2 a NCSC Cyber Physical Security Architect will introduce explain the context behind three new pieces of NCSC guidance - Creating and Maintaining a Definitive View of Your OT Architecture, Secure Connectivity Principles for OT, and PAWs for OT. Articulating how these documents fit together to support a realistic, defensible security posture for modern industrial environments.
Do not fear this won’t be a guidance recital.
This talk aims to challenge some long‑held beliefs, exploring why the traditional prioritisation of Availability, Integrity and Confidentiality (AIC) is often poorly suited to modern OT environments; why safety considerations are more nuanced than simply being “the most important factor”; how patching can be possible in practice; and how isolation is frequently misunderstood. We will examine why these beliefs emerged, what threats they can blind organisations to, and how they limit our ability to modernise, operate efficiently, and defend at scale
The aim is for attendees to leave with:
- A practical model for understanding their OT estate, as a system not just as assets.
- Pragmatic approaches for securely enabling necessary connectivity rather than creating bespoke routes for all new connectivity.
- Why Privileged Access Workstations (PAWs) matter more than ever and how they translate to the OT environment.
- Clear, achievable steps for uplifting brownfield environments without waiting for the next lifecycle refresh.
- A forward-looking vision that looks for operators to demand more of their vendors and integrators, drives vendors to raise their security baseline, and creates space for startups to innovate rather than replicate the past.
The threats are already here, the the old rules won't save us.
Industrial Control Systems and Operational Technology security is a growing field, but the barrier to entry remains prohibitively high. Commercial PLCs cost hundreds of pounds, training courses run into thousands, and purpose-built lab equipment can rival the price of a small car. This leaves aspiring OT security researchers stuck reading theory without hands-on practice.
This talk charts a practical journey from zero to a functional OT security lab without breaking the bank.
We begin with purely software-based approaches using OpenPLC and PyModbus to simulate industrial environments on hardware you already own. From there, we graduate to Arduino and microcontroller-based solutions, which run real PLC logic on inexpensive development boards. We then enhance these setups with LEDs, switches, and physical I/O to visualize ladder logic execution in real-time, making abstract concepts tangible.
To bring industrial processes to life, we explore 3D-printed models of substations, pumpjacks, and conveyor systems that respond to PLC outputs, creating compelling demonstrations without the need for large industrial budgets.
We also navigate the second-hand market for genuine PLCs and HMIs, discussing the licensing pitfalls, firmware challenges, and security considerations that await bargain hunters.
Finally, we announce the open-source release of the ModPwn Challenge Board a Raspberry Pi Pico-based Modbus challenge board - a complete attack and visualisation platform buildable for under £15, enabling anyone to practice Modbus protocol attacks and visualise the inputs and output.
Attendees will leave with practical blueprints, parts lists, and open-source tools to build their own OT security labs immediately.
This talk addresses the challenges Critical National Infrastructures (CNIs) face during on-going adversarial campaigns as they could cause physical damaged and even threaten life. Defenders struggle to keep CNIs operational (albeit at reduced capacity) whilst they try to wipe attackers out of their systems. By monitoring network telemetry, we will explore how we can identify in near-real-time different ways a campaign could escalate to an unsafe state and place the minimum mitigations required to keep CNIs operational.
OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be.
What happens when a cyber incident doesn’t start with malware… but with a door?
In this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast.
As IT and OT systems become increasingly interconnected, the line between “IT security issue” and “OT safety problem” is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other.
Set inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick.
A short exploration of industrial honeypot research in its current state, including what popular solutions look like; what function they perform; how cyber deception benefits industrial control systems; what challenges their deployment; and what future research could look like in this area. Despite being a defensive technology, this talk will address honeypot research from both an offensive and defensive perspective.
Implementing ICS/OT cybersecurity in greenfield projects should be easier than existing brownfield projects. However, greenfield projects present their own challenges to implementing ICS/OT cyber security, especially if not properly planned. Chris will present challenges and lessons learned implementing ICS/OT cybersecurity on multiple large and complex offshore greenfield projects.
Operational Technology (OT) cyber risk is one of the few topics where you can brief three audiences—engineers, the Board, and a regulator—and still feel like you’ve spoken three different languages.
This talk is about that translation problem. I’ll share a practical way to explain OT cyber risk at leadership level (without turning it into either a Hollywood script or “it’s just IT”), and how the complexity increases when you also need to provide confidence to an external overseer—without over-promising, name-dropping frameworks, or producing a one-off “assurance pack” that nobody maintains.
We’ll cover:
Why OT is different in ways that matter to governance: safety, availability, lifecycle, and constraints that are genuinely non-negotiable
The Board narrative vs the regulator narrative: what changes, what must stay consistent
What credible evidence looks like (and what looks like security theatre)
The small set of artefacts that do most of the work: ownership, asset visibility, remote access, segmentation, monitoring, incident readiness
Handling the awkward questions (“So are we safe?”, “Is it compliant?”, “What’s our worst day?”) with honesty and momentum
No war stories and no named organisations—just patterns, pitfalls, and a set of reusable structures you can take back to your own environment.
Amy is a Chartered Engineer with over 15 years' experience applying hardware cybersecurity principles across telecommunications, IoT, medical devices, transportation, and operational technology. This breadth of client work informs her current portfolio of consultancy, advisory, and NED roles. She is currently working with Kry10 on their verified seL4-based operating system for OT environments.
In this talk, Amy will draw on her experience securing safety-critical systems and explain why an engineering background creates valuable common ground when working in someone else's OT environment. She will offer practical advice on bridging the safety-security divide and discuss how Chartered Engineer status has helped her build trust and reduce barriers.
Insider threats in water treatment plants are often misunderstood as overt acts of sabotage. In reality, the most credible risk comes from low and slow actions that stay below detection thresholds.
This short talk examines real-world case studies of insider activity in critical national infrastructure, introduces a simplified water treatment process model, and explores attacker goals such as water quality degradation, service disruption, and loss of public trust. We’ll walk through plausible attack scenarios that do not trigger alarms, signature-based detection, or traditional IT security controls.
The session concludes with practical countermeasures focusing on process aware monitoring, assurance techniques that work in live OT environments and signposts a supporting white paper for deeper technical detail.
The European Cyber Resilience Act (CRA) represents one of the most significant regulatory shifts in product cybersecurity to date—particularly for operators and manufacturers of operational technology. This talk provides a practical, experience‑driven exploration of what the CRA means for OT environments and the emerging landscape of product security regulation.
Attendees will gain a clear understanding of the CRA’s objectives, lifecycle‑oriented security requirements, vulnerability reporting obligations and conformity assessment pathways. The session will map CRA requirements to existing frameworks highlighting both areas of alignment and critical gaps that OT manufacturers and integrators must address.
The talk will also examine the CRA’s timeline, expected industry impact, and how organisations can turn regulatory pressure into opportunities by strengthening SDLC processes, maturing vulnerability handling (including SBOM and coordinated disclosure), and building scalable security testing capabilities.
Finally, the session offers insights into preparing for the next 24 months of uncertainty and rapid change, including the role of harmonised standards, CE marking challenges, and strategic considerations for both internal teams and clients navigating compliance.
This presentation provides OT security professionals with a roadmap for readiness—grounded in regulatory expertise, industrial experience, and a focus on enabling secure‑by‑design products in a fast‑evolving European regulatory landscape.
OT security careers rarely follow neat, linear paths. This talk begins with the personal transition from Associate Professor of Cyber Security to Senior OT Security Consultant as a case study in how non-traditional career moves can become a strategic advantage rather than a risk.
Drawing on experience across academia, consulting, and live operational environments, this session explores what actually builds credibility in OT security roles. It examines how demonstrating tangible operational impact earns trust with decision makers, why human factors are just as important as technical controls in OT, and how security decisions get made when safety and availability outweigh confidentiality. The talk also explores why cyber exercises are crucial to building organisational resilience.
This is not a “which cert should I get next?” talk. Instead, it's about developing the mindset and skills that make OT security professionals effective in environments where production can't stop, downtime is measured in millions, and your credibility determines whether security recommendations become implementation plans or left at the side of the road. It is also about recognising how experience in teaching, research, or consulting strengthens your position.
For students, career switchers, and practitioners feeling stuck, this talk offers a practical reframing: OT security rewards curiosity, breadth, and time spent in uncomfortable environments. If your career choices help you enable operations instead of obstruct them, you’re building the kind of experience the field actually needs.
What if the superconducting magnet of an MRI machine breached containment?
What if the checks and controls of an MRI machine are connected to the network?
In this short talk I explore the cyber-physical risks of cryogenic systems, with the particular example of MRI superconducting magnets.
MRI magnets rely on cryogenic cooling - liquid helium near absolute zero - to maintain superconducting magnetic fields. Superconducting relies on the coil being so cold that it has no electrical resistance, so massive currents (hundreds of amps) can flow through it and sustain magnetic fields almost hundreds of thousands of times that of the Earth. If that coolant warms up at any point the superconducting property is lost, the conductor becomes resistive and heats up, and a truly vicious cycle of heating and increasing resistance develops so the nitrogen or helium boils - called a 'quench'. The boiled gas is hundreds of times bigger than the liquid so creates intense pressure: so much that your ears will probably pop but worse, you probably can't open the door: and it forces the oxygen out of the room so you suffocate, while also getting instant frostbite. The collapse of the magnetic field can stress the magnet's structure and permanently damage the coils: which cost tens of thousands of pounds to replace while you lose weeks worth of imaging throughput. Even a controlled quench costs thousands and risks damage. These things are prevented by failsafe systems: constant monitoring, automatic venting, secure supply chains, early warnings, regular maintenance and checks.
But what if they're not? What if someone or something interferes with the complex and supposedly resilient supply chain and safety monitoring systems? Then small anomalies can cascade and we have cryogenic bombs waiting to go off.
Cryogenics is now a cyber‑physical risk surface: pervasive networking and the Internet of Things now means system failures - through accident or attack - can cause failures in ordering systems, delivery delays, failing fail-safes so that Operational Technology is increasingly exposed to cyber risks in cryogenic monitoring and control.
The mitigations are obvious - and routine - but we all know that awareness and caution are not at all routine in cyber security, and restating the obvious is part of the toolbox of any cyber security professional so I will discuss mitigations including diversified helium and spares strategy, raised refill thresholds, network segmentation, encrypted telemetry with certificate lifecycle management, MFA for vendors, runtime physics‑based validation of sensor data, “alarm‑the‑silence” watchdogs, manual overrides, and blended quench‑plus‑cyber table-top drills, as useful tools that can help prevent incidents and avoid us breaking out into a sweat about liquid helium.
Most OT security failures don’t happen because the technology was wrong, they happen because the security programme didn’t fit how manufacturing actually operates.
This session focuses on the operational and organisational reality of embedding OT security in live production environments, drawing on experience leading a £97m global OT security programme across 77 manufacturing sites. Rather than centring on attack mechanics, the talk explores what it truly takes to introduce security into environments where uptime, safety, and throughput are non-negotiable.
Attendees will learn how OT security initiatives succeed or fail based on governance alignment, decision-making authority, and cultural adoption on the shop floor. The presentation examines common friction points: engineering resistance, unclear ownership between IT and operations, security controls that disrupt maintenance, and change processes that collapse under incident pressure.
Through real-world examples, the session shows how organisations can shift OT security from a bolt-on technical function into an embedded operational capability. It explores how to design security programmes that engineers trust, operators understand, and leadership supports, without slowing production or increasing risk.
The talk also addresses how resilience is built over time through repeatable processes, training, and scenario-based planning, rather than one-off tool deployments. It concludes with a forward-looking view of how emerging threats, regulatory pressure, and supply chain complexity make operational resilience a board-level responsibility.
Attendees will leave with:
A clear understanding of why OT security programmes succeed or fail operationally
Practical approaches to aligning security with engineering and production priorities
Change-management strategies that work in industrial environments
Insight into building resilience through people, process, and governance — not just tools
Actionable ideas for embedding security into day-to-day operations without disrupting uptime
The session will include interactive discussion and open Q&A, allowing participants to share challenges, compare approaches, and leave with practical, real-world insights they can apply immediately.
This talk reflects on the lessons learnt through 10 years of cyber security consulting, sharing practical lessons from industry and highlighting what is often learned only through experience.
It explores how technical skills, professional judgement, and soft skills such as communication and adaptability develop over time, and offers insight into common early career challenges and what matters most when progressing in the field.
OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be.
What happens when a cyber incident doesn’t start with malware… but with a door?
In this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast.
As IT and OT systems become increasingly interconnected, the line between “IT security issue” and “OT safety problem” is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other.
Set inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick.
A Q&A with a panel of experts to provide guidance and advice on OT security careers
In OT environments, it is easy for cybersecurity programs to look robust on paper, but what happens when those same environments are put under the lens provided by a penetration test? In this talk we examine the results of pairing an OT Cybersecurity Maturity Assessment with an OT Penetration Test at the same facility, revealing a consistent pattern: the documented controls and expected risk posture don’t match what is actually happening on the wire.
We will walk through anonymized case studies across several sites at multiple organizations in multiple geographical locations, highlighting that the results we expected based on governance were not always upheld by the reality we found with technical assessments. The goal of this talk is to demonstrate how gaps can form between OT security program standards and actual operational reality. Attendees will walk away with practical recommendations on how to test and validate expectations and risk.
Command and Control Servers have long existed for IT facing networks. They are the central infrastructure which allow adversaries to maintain persistent remote control over compromised systems and orchestrate large-scale cyberattacks. What if adversaries brought these tactics to OT?
This presentation explores the creation of C2 infrastructure specifically for OT Networks, using the OPC UA protocol as the example. We can examine how the OPC UA protocol can be abused to enable covert data exfiltration from airgapped networks, and how we can connect to an OPC UA server to create persistent command channels that blend with legitimate industrial traffic. Through a practical demonstration using Factory I/O and containerized PLCs, this presentation reveals the techniques adversaries could use to maintain covert control over industrial systems while evading traditional security monitoring.
No photos or recording for this session. Chatham House Rule.
A panel with representatives across government, regulators, and industry.
Phew! What a day!
The BSides OT UK organising team will take to the stage to close out an awesome day, and to draw the raffle prizes - tickets at the ready!
As a reminder, all the proceeds from the raffle and the sticker stall go to our chosen charity - The Bristol Children's Hospital Grand Appeal - so please donate what you can, pick up some great new stickers for your laptop, and be in with the chance of winning some brilliant raffle prizes!
The after-party will begin at 6:30 at a nearby venue, only a few minutes' walk from the main conference venue. The location of the after-party will be announced during the closing remarks. There is a sizeable bar tab thanks to our after-party sponsors, Pen Test Partners. All attendees are welcome to attend! Make sure you keep and wear your badge; the bar staff will use it to identify attendees. Food will not be provided, but a good range of food is available to order (note that this will not be covered on the bar tab).