From 12328a02fc3dcb55265222e1382640c441345dfb Mon Sep 17 00:00:00 2001 From: Aner Zakobar Date: Tue, 6 Oct 2026 10:50:02 +0300 Subject: [PATCH] backup: 2026-10-06 10:50 --- azos.org | 7 ++ impltodos.org | 22 ++-- just-talkingcyber-glossary.org | 35 ++++++- just-talkingcyber-reading-list.org | 6 +- just-talkingcyber-terminology-ramp.org | 23 +---- just-talkingtodos.org | 13 +-- just-talkingtodos_1.org | 13 +++ just-talkinguser-profile_1.org | 2 +- ot-ics-security-ramp.org | 36 +++++++ ot-ics-security-rampcurriculum.org | 31 ++++++ ot-ics-security-rampglossary.org | 136 +++++++++++++++++++++++++ ot-ics-security-rampreading-list.org | 12 +++ ot-ics-security-ramptodos.org | 11 ++ tax-returnsstatus.org | 12 ++- tax-returnstodos.org | 14 +-- thesistodos.org | 38 +++---- workplate.org | 17 ++++ 17 files changed, 349 insertions(+), 79 deletions(-) create mode 100644 just-talkingtodos_1.org create mode 100644 ot-ics-security-ramp.org create mode 100644 ot-ics-security-rampcurriculum.org create mode 100644 ot-ics-security-rampglossary.org create mode 100644 ot-ics-security-rampreading-list.org create mode 100644 ot-ics-security-ramptodos.org create mode 100644 workplate.org diff --git a/azos.org b/azos.org index 4bf866c..ca09276 100644 --- a/azos.org +++ b/azos.org @@ -1,3 +1,10 @@ +:PROPERTIES: +:ID: bf4dde56-0967-4374-94ed-771301e47c66 +:END: + +#+title: azos +#+filetags: :project: :knowledge: + - =azos-core= is a git submodule — =git add= must be run inside it separately from the outer repo - Nix flakes only evaluate git-tracked files; new files must be staged (=git add=) before =nix build= will see them - =import-tree= auto-discovers features but only sees tracked files — same constraint diff --git a/impltodos.org b/impltodos.org index 9a165ea..d8239b5 100644 --- a/impltodos.org +++ b/impltodos.org @@ -7,7 +7,7 @@ * DONE Look into previous results success/failures — understand failure modes of datasets where ROLL performs poorly (glass1, pima, glass6 from 2026-07-08 KEEL run; see [[id:a53cbe84-cd8d-45c2-a8cf-34ab520a3ea5][impl/experiments]] for full results) -* TODO Fill out ANIMAL-10N download form and download to Mac +* DONE Fill out ANIMAL-10N download form and download to Mac Form: https://forms.gle/8mbmbNgDFQ2rA1fLA After receiving download link, run on Mac: =./scripts/run_remote.sh experiments/other/experiment-animal10n.py --detach= @@ -23,14 +23,14 @@ Completed. All 8 configs present in =results-final/creditcard/=. Completed as of 2026-07-27. All 12 datasets × 8 configs in =results-final/keel/=. =_base.py= confirmed to pass =pos_weight=imbalance_ratio= to gce-0.7, mae, focal-loss, asymmetric-loss. -* ACTIVE Food-101N experiment +* DONE Food-101N experiment Running on beacon-wsl (as of 2026-07-28). =experiment-food101n-rerun-weighted.py= — 6 configs × 3 episodes. 6/18 episodes done as of 2026-07-28 (~3 days remaining). Writes to =results-final/food101n/=. Tail: =ssh aner@192.168.1.200 'tail -f ~/roll-impl/run.log'= Fetch: =./scripts/fetch_results_beacon.sh= -* TODO Resume NIH ChestX-ray14 experiment +* DONE Resume NIH ChestX-ray14 experiment Crashed 2026-07-31 ~20:51 on Mac during =libauc-auroc= config. Error: =ValueError: All episodes have NaN/inf predictions — cannot build ROC curve= - Crash in =src/summary.py= ROC generation after training, not during training itself @@ -40,7 +40,7 @@ Error: =ValueError: All episodes have NaN/inf predictions — cannot build ROC c - Resume via: =./scripts/run_remote.sh experiments/other/experiment-chestxray14.py --detach= (after fixing the libauc NaN issue or skipping libauc-auroc) -* TODO CIFAR-100N experiment +* DONE CIFAR-100N experiment Same paper and infrastructure as CIFAR-10N (Wei et al. 2022, arXiv:2110.12088). Download: ~160MB — same CIFAR-100 images + noise label file, no new image download needed. Key difference from CIFAR-10N: noise rate is 40.2% (vs 9–40% for CIFAR-10N) — harder noise regime. @@ -48,7 +48,7 @@ Setup: binarize same way as CIFAR-10N (one class vs rest), reuse ConvNet archite Run on Mac (trivial compute, same as CIFAR-10N). Priority: HIGH — near-zero effort, extends noise ablation to a harder regime. -* TODO ISIC 2020 Melanoma experiment +* DONE ISIC 2020 Melanoma experiment Binary dermoscopy classification: malignant (584 images, 1.8%) vs benign (32,542 images, 98.2%). IR ≈ 56:1. Label noise: real inter-dermatologist disagreement and clinical ambiguity (not annotator error). Download: ~2–4GB via Kaggle pre-resized 224×224 JPEG dataset (nischaydnk/isic-2020-jpg-224x224-resized). @@ -57,7 +57,7 @@ Run on beacon-wsl after Food-101N + ChestX-ray14 complete. Priority: MEDIUM-HIGH — strong clinical story, extreme imbalance + real noise, feasible size. Note: only 584 positive examples — conclusions will be limited; mention in thesis. -* ACTIVE KEEL label noise ablation +* DONE KEEL label noise ablation Running 5%, 10%, 20% label noise on all 12 KEEL datasets (10 episodes each) on Mac. Script: =experiments/keel/run_all_noise_levels.sh= (launched 2026-08-01) Results: =results-final/keel-noise-05/=, =results-final/keel-noise-10/=, =results-final/keel-noise-20/= @@ -65,7 +65,7 @@ Results: =results-final/keel-noise-05/=, =results-final/keel-noise-10/=, =result 0% baseline: =results-final/keel/= (existing, 5 episodes) Fetch when done: =./scripts/fetch_results.sh= -* TODO CheXpert experiment +* DONE CheXpert experiment ~224K chest X-ray images, label noise from automated NLP extraction of radiology reports. Severe class imbalance. Clinically relevant domain. Dataset: https://stanfordmlgroup.github.io/competitions/chexpert/ (requires registration) @@ -74,14 +74,14 @@ Dataset: https://stanfordmlgroup.github.io/competitions/chexpert/ (requires regi - Medium-large compute cost; run on remote Mac or cluster - Priority: lower than credit card fraud and Track 1; run after those confirm the story -* TODO ANIMAL-10N experiment +* DONE ANIMAL-10N experiment Dataset loader written: =Animal10NDataset= in =src/datasets.py=. Experiment script written: =experiments/other/experiment-animal10n.py=. Data must be downloaded after filling form (see todo above). - ConvNet with image_size=64 (4096 linear), positive_class=0 (cat), IR ~9 - MPS-aware: sequential_episodes=True, libauc forced to CPU -* TODO Noisy Ostracods experiment +* DONE Noisy Ostracods experiment NeurIPS 2024 D&B track (arXiv:2412.02313). ~71k micro-crustacean specimens, specialist-annotated. IR = 22,429 (extremely imbalanced), ~5.6% real expert-level label noise. Download: estimated ~7–15GB JPEG (476×476px avg), hosted on SharePoint via GitHub repo. @@ -90,13 +90,13 @@ Binarization needed: multi-class (78 genera), would need to pick one vs rest. Caveat: paper reports existing noise-robust methods fail to beat CE — a strong ROLL result would be notable. Priority: LOW — more setup friction (SharePoint, not Kaggle), binarization decision needed, uncertain payoff. -* TODO Clothing1M experiment +* DONE Clothing1M experiment ~1M images, ~38.5% web noise. Binary: one category vs rest. Dataset: https://github.com/Cysu/noisy_label (requires request to authors) - Very large; likely needs ResNet pretrained backbone - Lowest priority of the noisy-label datasets -* TODO WebVision experiment +* DONE WebVision experiment 2.5M images, ~20% web noise. Very large. - Likely out of scope unless we get access to a GPU cluster - Keep as a long-term stretch goal diff --git a/just-talkingcyber-glossary.org b/just-talkingcyber-glossary.org index b863b78..f68a81f 100644 --- a/just-talkingcyber-glossary.org +++ b/just-talkingcyber-glossary.org @@ -5,7 +5,7 @@ #+title: just-talking/cyber-glossary #+filetags: :project: :knowledge: :cybersecurity: :glossary: -Running, quiz-ready glossary built up during Aner's cybersecurity terminology ramp-up (see [[just-talking/cyber-terminology-ramp]] for the study plan/methodology this supports). Term → one-line definition. Updated automatically as new terms are covered in session, no need to ask first. +MIGRATED 2026-10-06 to [[ot-ics-security-ramp/glossary]] (new project at ~/projects/tutorials/ot-ics-security-ramp). See there for current content; this node is kept only so old links/backlinks aren't dead ends. ** General Attack/Defense Vocabulary - RAT (Remote Access Trojan) — malware giving an attacker remote hands-on-keyboard control of a victim machine. @@ -16,6 +16,7 @@ Running, quiz-ready glossary built up during Aner's cybersecurity terminology ra - Kill chain — the staged sequence of an attack (recon → exploit → install/persist → escalate privileges → move laterally → achieve objective). - MITRE ATT&CK — a public catalogue/matrix of real-world adversary tactics and techniques, organized by attack-lifecycle stage; the industry's shared reference vocabulary for describing attacker behavior. - Lateral movement — moving from an initially compromised host to other hosts within the network. +- Pivoting / SSH tunneling — using an already-compromised, dual-homed host as a relay to reach a network it can see but the attacker otherwise couldn't. Practically done via SSH port forwarding: `-L` forwards one local port to one specific internal target through the existing SSH session; `-D` opens a local SOCKS proxy so any tool's traffic gets relayed through that session. Chaining several compromised hosts this way (device A tunnels into network B, from which device C tunnels into network D...) is how a single credential compromise on the edge can reach deep into an otherwise-segmented internal network — the actual mechanism behind lateral movement, not just the goal. - Living-off-the-land (LOTL) — using legitimate built-in OS tools (PowerShell, WMI, psexec) to carry out an attack instead of custom malware, to blend in and evade detection. - Exfiltration — the act of stealing data out of a compromised network. - Ransomware-as-a-Service (RaaS) — a ransomware operator provides the toolkit/infrastructure; affiliates carry out the actual intrusion and split the ransom revenue. @@ -34,9 +35,13 @@ Running, quiz-ready glossary built up during Aner's cybersecurity terminology ra - CVSS (Common Vulnerability Scoring System) — the standard severity score (0-10) for a CVE. - Red team / Blue team / Purple team — red = offense, simulates real attackers; blue = defense, detection & response; purple = collaboration between the two to improve detection. - Pentest vs. vulnerability scan — a vuln scan is automated, passive, matches known signatures/CVEs; a pentest is human-driven, actively attempts real exploitation/chaining to validate actual risk. +- Port scanning — probing a range of IPs on a set of TCP/UDP ports to see which are open, as a quick way to fingerprint what services/devices are present without yet having to speak each protocol correctly (e.g. nmap). A scan that starts at a specific, already-known-valuable IP suggests prior reconnaissance; a scan hitting every address in a range sequentially suggests an untargeted automated sweep. +- Shodan — a search engine that continuously scans the entire public internet and indexes what it finds on open ports (banners, service metadata, sometimes screenshots), searchable by service type, port, geography, or organization. Unlike Google (indexes web page content), Shodan indexes *devices/services themselves* — webcams, routers, databases, and notoriously, internet-exposed ICS/SCADA devices (PLCs, HMIs) that were never meant to be reachable from the public internet. The standard first move in OT recon/research for finding exposed ICS protocols (Modbus/502, S7/102, DNP3/20000) in the wild — and the reason "don't scan real internet-facing ICS, keep it in your own lab" is a real ethical/legal line, not just caution for its own sake. - CNA (CVE Numbering Authority) — an organization authorized to mint CVE IDs for a defined scope (its own products, a coordinator role, etc.). Most CVEs today are assigned by vendor CNAs or bug-bounty-platform CNAs (HackerOne, Bugcrowd), not by MITRE directly. - CNA-LR (CNA of Last Resort) — MITRE's role: assigns CVE IDs via a request form when no vendor/coordinator CNA covers the affected product. Slower than going through a dedicated CNA. - CERT/CC (CERT Coordination Center, Carnegie Mellon) — a third-party coordinator CNA, useful when a vendor is unresponsive, has no security contact, or an issue spans multiple vendors. +- CSIRT (Computer Security Incident Response Team) — generic term for an organizational incident-response team; CERT Polska carries out this function at Poland's national level (as "CSIRT NASK"). +- PSIRT (Product Security Incident Response Team) — a vendor's internal team handling vulnerability reports and incident support for its own products; e.g. Siemens calls theirs "ProductCERT". - Coordinated disclosure — reporting a vulnerability privately to the affected vendor first (rather than publishing immediately), giving them time to patch before any public CVE/details are released; the norm the whole CVE submission process assumes. - CWE (Common Weakness Enumeration) — the taxonomy of vulnerability *types* (e.g. "CWE-79: Cross-Site Scripting"). A CVE identifies one specific instance of a flaw in a specific product; CWE classifies what *kind* of flaw it is. - NVD (National Vulnerability Database) — NIST's database that enriches published CVEs with a CVSS score and structured metadata after a CNA assigns the ID. @@ -59,6 +64,25 @@ Running, quiz-ready glossary built up during Aner's cybersecurity terminology ra - GOOSE (Generic Object Oriented Substation Event) — peer-to-peer protection-relay messages requiring single-digit-millisecond delivery, with essentially no authentication due to the speed requirement; a known attack surface (used in the 2016 Ukraine grid attack, Industroyer malware). - IEC 60870-5-104 ("IEC 104") — DNP3's rough European/Middle-East equivalent protocol. - OPC-UA — a newer IT/OT bridging protocol (e.g. historian-to-cloud) that, unlike the field-level protocols above, was built with authentication and encryption from the start. +- S7 — Siemens' proprietary ICS protocol for communicating with SIMATIC PLCs (S7-300/1200/1500 etc.), port 102/TCP; like Modbus/DNP3, a frequent target for ICS network scanning. +- CODESYS — the IEC 61131-3 engineering/runtime environment (port 11740/TCP) underlying many different vendors' PLCs, including WAGO's — a shared software base means a CODESYS vulnerability can cross vendor lines. +- VFD (Variable Frequency Drive) — a device that controls motor speed by varying the frequency/voltage of its power supply; common ICS target (pumps, fans, compressors) alongside PLCs. +- CHP (Combined Heat and Power) — a plant that generates electricity and useful heat from the same fuel source (cogeneration); a common critical-infrastructure target since it serves both the grid and district heating. +- DER (Distributed Energy Resources) — small-scale generation/storage assets connected to the distribution grid rather than centralized transmission-level generation (e.g. wind, solar, battery storage). +- DSO (Distribution System Operator) — the utility entity operating the local distribution grid (as distinct from a Transmission System Operator); DSOs typically run their own private telemetry networks reaching down to substations and RTUs. +- GCP (Grid Connection Point) — the point where a generation asset (e.g. a wind farm) connects into the distribution network and its operator. (Not to be confused with the identically-abbreviated Google Cloud Platform.) +- Private APN (Access Point Name) — a cellular-carrier-provisioned network, isolated from the public internet, used for machine-to-machine telemetry (e.g. DSO-to-RTU SCADA traffic). Often assumed "safe by isolation," but without client isolation between devices on the APN, one compromised device can reach every other device on it — treat it as untrusted as the public internet toward OT. + +** OT/ICS Hands-On Lab Tools +Covered 2026-10-05 in response to "how do I build a fake OT network to play with" — see [[just-talking/cyber-terminology-ramp]] for progress tracking. +- pymodbus — Python library implementing a full Modbus TCP/RTU client and server; fastest way to stand up a fake "PLC" (a Modbus server with custom registers) in a few lines and point nmap/Wireshark at it. +- opendnp3 — open-source C++ DNP3 protocol stack (with Python bindings) for simulating a DNP3 master or outstation (DNP3's term for the field-device side); the DNP3 equivalent of pymodbus. +- OpenPLC — open-source IEC 61131-3 soft-PLC runtime: a real PLC, not just a protocol stub. Runs real ladder logic/structured text and serves it over genuine Modbus and DNP3 slave interfaces. Dockerized/Raspberry-Pi friendly; the accepted standard open-source PLC for ICS security training and CTFs. +- GRFICS (Graphical Realism Framework for Industrial Control Simulations) — Georgia Tech project providing a full prebuilt virtual plant (simulated chemical process + HMI + PLC logic + documented attack scenarios) as VMs, built explicitly for cybersecurity teaching/research. Closest thing to an "accepted standard" fake OT environment to attack. +- Conpot — low-interaction ICS honeypot, defaults to impersonating a Siemens S7-300 PLC; speaks Modbus, S7comm, BACnet, SNMP, HTTP simultaneously. Good for observing what scanning/exploitation traffic looks like against a fake device; not meant for realistic control logic. +- T-Pot — docker-compose bundle of Conpot plus a dozen other honeypots (IT + OT), with a Kibana dashboard of all captured attack traffic. Useful for the "SOC watching attacks land" view rather than the device-builder view. +- MiniCPS — Mininet-based framework for simulating networks of multiple PLCs/RTUs with physical process models; used in academic SWaT/WADI-style water-treatment-plant research. Heavier/academic, overkill unless specifically doing network-topology-level ICS research. +- ScadaBR — open-source HMI/SCADA software, commonly paired with OpenPLC to get a realistic-looking operator dashboard on top of real PLC logic. ** OT Attack Case Studies - Stuxnet (2010) — malware delivered via USB to Iran's Natanz facility, targeted Siemens PLCs to physically destroy uranium centrifuges by subtly altering their speed, while feeding operators falsified "everything normal" readings. Canonical example of an OT *integrity* attack — not data theft, not an obvious outage, just making the physical process do the wrong thing while lying to the humans monitoring it. Widely attributed to a US/Israel joint operation, never officially confirmed. @@ -66,6 +90,7 @@ Running, quiz-ready glossary built up during Aner's cybersecurity terminology ra - TRITON / TRISIS (2017) — targeted a Saudi petrochemical plant's Safety Instrumented System (SIS) — the independent emergency-shutdown layer that exists to prevent physical catastrophe (explosion, toxic release). Reprogrammed Schneider Electric SIS controllers; a bug in the attacker's own code accidentally triggered a shutdown, likely preventing serious harm. The case study proving OT attacks carry real physical/safety risk, not just theoretical danger. - SIS (Safety Instrumented System) — an independent hardware/software layer that triggers automatic emergency shutdown if a process becomes physically dangerous, separate from the normal control system. - Metcalf sniper attack (2013) — attackers shot up a PG&E transmission substation in California, knocking out 17 transformers. Physical, not cyber, but the case study behind NERC CIP-014 (mandating physical security planning for critical substations) — cited to make the point that critical-infrastructure risk isn't purely digital. +- Private-APN CHP plant incident (Poland, 29 Dec 2025; CERT Polska follow-up report) — attacker pivoted from a compromised wind-farm FortiGate VPN/firewall, through a Teltonika cellular router's SSH tunnel, across a DSO private APN lacking client isolation, into a WAGO PFC200 gateway PLC reachable via default web-admin credentials, then via a further SSH tunnel into an unrelated CHP plant's OT network — stopping Siemens S7-300/1200/1500 PLCs and shutting down a steam turbine and water treatment system. First known real-world attack to use a private APN as a lateral-movement path between otherwise-unconnected facilities; the attacker also destroyed the WAGO device's partition table as anti-forensics. ** OT Vendor Landscape - Dragos — pure-play OT threat detection & intel vendor; known for naming/tracking specific ICS-targeting threat groups (e.g. XENOTIME, linked to TRITON), similar to how CrowdStrike names IT-side APT groups. @@ -101,3 +126,11 @@ Running, quiz-ready glossary built up during Aner's cybersecurity terminology ra ** Networking / Crypto Primitives - TLS (Transport Layer Security) — the standard encryption/authentication protocol behind HTTPS; assumes a reliable, ordered, connection-based transport (TCP). - DTLS (Datagram Transport Layer Security) — TLS adapted to run over UDP instead of TCP, adding handshake retransmission and tolerance for packet loss/reordering/duplication since UDP gives none of that natively. Used wherever "HTTPS-grade" security is needed over a latency-sensitive, connectionless channel — VPN tunnel modes (e.g. Cisco AnyConnect), WebRTC, CoAP for constrained/IoT devices. Most classic field-level ICS protocols (Modbus, DNP3, GOOSE) predate DTLS and don't use it natively. +- VLAN (Virtual Local Area Network) — a logical, software-defined subdivision of a physical network, used to segment traffic without separate physical cabling; segmentation by VLAN alone doesn't stop an attacker who already has administrative access to a device that bridges multiple VLANs. +- SSH (Secure Shell) — encrypted remote shell/administration protocol; also commonly abused for tunneling (forwarding arbitrary traffic through an encrypted SSH session) to pivot across network boundaries. +- RDP (Remote Desktop Protocol) — Microsoft's protocol for remote GUI access to Windows machines; a frequent lateral-movement and credential-brute-force target. +- VNC (Virtual Network Computing) — a platform-independent remote-desktop protocol; like RDP, a common target for credential-guessing during network reconnaissance. +- RTSP (Real Time Streaming Protocol) — protocol for controlling streaming media sessions, commonly used by IP video-surveillance/CCTV systems. +- Client isolation — a network configuration that prevents devices on the same subnet/segment (e.g. the same private APN or Wi-Fi AP) from communicating directly with each other, typically restricting them to talk only to a gateway. Its absence was the root misconfiguration that let an attacker pivot across devices sharing a DSO private APN in the CERT Polska December 2025 incident. +- VPN concentrator — a dedicated device (often combined with a firewall) built to terminate and manage many simultaneous VPN tunnels at once, from many remote clients/sites, as opposed to being a single tunnel's endpoint like client VPN software. A single compromised concentrator can expose every site/segment it serves — as with the FortiGate device in the CERT Polska December 2025 incident. +- ICT (Information and Communication Technology) — a broader-scope synonym for "IT," more common in European/telecom/utility usage, covering computing and communications infrastructure together. In utility contexts, "the DSO's ICT network" means the DSO's own IT/corporate-side systems, as distinct from the OT side (RTUs, field devices) — functionally the same split the Purdue Level 3.5 DMZ formalizes. diff --git a/just-talkingcyber-reading-list.org b/just-talkingcyber-reading-list.org index 36c2119..c5c6fbd 100644 --- a/just-talkingcyber-reading-list.org +++ b/just-talkingcyber-reading-list.org @@ -10,8 +10,4 @@ #+title: just-talking/cyber-reading-list #+filetags: :project: :knowledge: :cybersecurity: :reading: -Curated, high-quality cybersecurity resources Aner has found worth reading (and referring others to), surfaced during his [[just-talking/cyber-terminology-ramp]]. Distinct from the daily RSS feed habit (see the 2026-09-28 entry in [[just-talking/conversations]] for that list) — this node is for standalone reports/articles worth keeping, not a recurring feed. - -** OT/ICS Security -- [[https://www.sans.org/blog/top-takeaways-from-the-dragos-ot-cybersecurity-report-2026][SANS: Top Takeaways from the Dragos OT Cybersecurity Report 2026]] — free, ungated, substantial summary of Dragos's annual OT threat report. Covers 8 key 2026 OT threat shifts (adversaries staging environments months ahead, targeting HMIs/VFDs/meters/gateways to map process dependencies, initial-access-as-a-service mirroring IT ransomware ecosystems, disruption without ICS-specific payloads, engineering firms/integrators/MSPs as supply-chain targets, hacktivist groups going destructive) and names three threat groups: KAMACITE, SYLVANITE, BAUXITE. Recommended by Aner (2026-09-29) as genuinely good reading — worth recommending to others, not just personal reference. -- [[https://www.dragos.com/ot-cybersecurity-year-in-review][Dragos 2026 OT Cybersecurity Year in Review]] (full 91-page report + exec summary) — the primary source the SANS writeup above is based on. Gated behind a lead-gen form requiring a phone number; the SANS summary covers the substance without it. Worth going to the full report only if going deeper than the summary. +MIGRATED 2026-10-06 to [[ot-ics-security-ramp/reading-list]] (new project at ~/projects/tutorials/ot-ics-security-ramp). See there for current content; this node is kept only so old links/backlinks aren't dead ends. diff --git a/just-talkingcyber-terminology-ramp.org b/just-talkingcyber-terminology-ramp.org index 21abfa1..ac09327 100644 --- a/just-talkingcyber-terminology-ramp.org +++ b/just-talkingcyber-terminology-ramp.org @@ -4,26 +4,5 @@ #+title: just-talking/cyber-terminology-ramp #+filetags: :project: :knowledge: :cybersecurity: -Tracking Aner's month-long cybersecurity terminology/domain ramp-up before starting the Index-backed OT/ICS security startup (~2026-10-28). See [[just-talking/user-profile]] for the job context, [[just-talking/conversations]] for full session logs, [[just-talking/cyber-glossary]] for the running quiz-ready term glossary, and [[just-talking/cyber-reading-list]] for standout resources worth keeping/sharing. +MIGRATED 2026-10-06 to [[ot-ics-security-ramp]] (new project at ~/projects/tutorials/ot-ics-security-ramp) — the cyber ramp-up outgrew just-talking's general-chat scope into a standalone educational project. See there for current content; this node is kept only so old links/backlinks aren't dead ends. -** Key Context -- Startup secures networks of utility companies — this is OT/ICS/critical-infrastructure security, not general enterprise security. -- Trigger: interview process surfaced that Aner didn't know "RAT" or "C2" despite solid underlying concept knowledge (8200 SDR, Gita WiFi/Bluetooth security research) — a terminology/lingo gap, not a concept gap. -- Daily RSS reading habit already established (Krebs, SANS ISC, CISA Advisories, etc. — see 2026-09-28 conversation entry for full list). - -** Self-Assessment Results (2026-09-29) -Full results and corrected misconceptions (IOC/IOA swap, Kerberoasting) logged in [[just-talking/cyber-glossary]]. Biggest blanks going in: APT, TTP, living-off-the-land, exfiltration, most of the defensive stack (EDR/XDR/SIEM/SOAR/NDR/etc.), cloud security beyond self-taught k8s, IR/forensics entirely, frameworks/compliance entirely, vendor landscape partial only. - -** Methodology (decided 2026-09-29) -Hybrid approach, not one-size-fits-all: -- Conceptually rich + currently blank domains (OT/ICS fundamentals, IR/forensics, frameworks/compliance, defensive stack) → conversational deep-dive, one section at a time, discuss before moving on. -- Pure vocabulary/naming gaps (vendor landscape, acronym expansion, APT/TTP-style terms) → quick reference pass, no deep discussion needed. -- Priority reorder given the utility-company detail: OT/ICS fundamentals first, ahead of generic defensive-stack coverage. -- **Standing workflow preference: auto-update [[just-talking/cyber-glossary]] and [[just-talking/cyber-reading-list]] with every new term/resource covered, without asking first or narrating "I'll add this" — just do it.** - -** OT/ICS Deep-Dive Progress (started 2026-09-29) -Covered so far (full definitions in [[just-talking/cyber-glossary]]): IT-vs-OT / AIC triad; Purdue Model levels 0-5 + Level 3.5 DMZ; ICS protocols (Modbus, DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA); canonical attack case studies (Stuxnet, Ukraine grid/Industroyer, TRITON/SIS, Metcalf sniper attack); OT vendor landscape (Dragos/Claroty/Nozomi "big three" plus Tenable.ot, MS Defender for IoT, Forescout, Armis, vendor-native); 2026 threat landscape from the Dragos Year in Review (KAMACITE/SYLVANITE/BAUXITE, MSP/GIS as supply-chain targets — see [[just-talking/cyber-reading-list]]); NERC CIP compliance (NERC/FERC/BES scope, electric-only vs water/gas, CIP-002/005/007/008/010/013/014). -Not yet covered: IR/forensics (queued next), general frameworks/compliance beyond NERC CIP (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms (EDR/XDR/SIEM/SOAR/NDR/NGFW/IDS/IPS/DLP/ZTNA), cloud security beyond k8s (CSPM/CWPP/CIEM). - -** Status -OT/ICS deep-dive in progress. Next: IR/forensics. diff --git a/just-talkingtodos.org b/just-talkingtodos.org index 1245a69..1eb759f 100644 --- a/just-talkingtodos.org +++ b/just-talkingtodos.org @@ -1,12 +1,9 @@ -:PROPERTIES: -:ID: b65e1b4e-40c9-4229-9b82-62412d9cc7ff -:END: - -#+title: just-talking/todos -#+filetags: :project: :todo: - * TODO Read and deep-dive CERT Polska Energy Sector Incident Follow-up Report 2025 (https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Follow_up_Report_2025.pdf) — research any unfamiliar topics it raises -* TODO Deepen SNMP, Modbus, and related ICS/OT protocols (continuing from [[just-talking/cyber-terminology-ramp]] — Modbus already covered, SNMP not yet) +* TODO Deepen SNMP, Modbus, DNP3, and related ICS/OT protocols (continuing from [[just-talking/cyber-terminology-ramp]] — Modbus and DNP3 already covered, SNMP not yet) * TODO LangGraph deep dive * TODO Python — refresher/deepening pass (already strong, per will-be-manager's pointers) * TODO Node.js refresher (weaker area, needs review) +* TODO Watch "The #1 Skill Every Forward Deployed Engineer Needs (It's NOT Technical)" — https://www.youtube.com/watch?v=CYF7T2HiLfc +* TODO Watch "This Is How Forward Deployed Engineering Is Actually Done" — https://www.youtube.com/watch?v=AD-EmZ3v6-g +* TODO Read "Great Demo!" by Peter Cohan — standard sales-engineering demo playbook, lead with discovery not features +* TODO Read PreSales Collective demo tips — https://www.presalescollective.com/content/5-demo-tips-from-the-best-in-the-business diff --git a/just-talkingtodos_1.org b/just-talkingtodos_1.org new file mode 100644 index 0000000..5c4fb81 --- /dev/null +++ b/just-talkingtodos_1.org @@ -0,0 +1,13 @@ +:PROPERTIES: +:ID: 4c4ae633-94c3-4a34-bf81-cf8aa89c034b +:END: + +#+title: just-talking/todos +#+filetags: :project: :todo: + +Standing TODOs for [[just-talking]]. + +Cyber ramp-up TODOs migrated 2026-10-06 to [[ot-ics-security-ramp/todos]] (new project at ~/projects/tutorials/ot-ics-security-ramp). + +* TODO Review LangGraph (per manager's instructions) +* TODO Review Node.js — refresher, rusty on it (per manager's instructions) diff --git a/just-talkinguser-profile_1.org b/just-talkinguser-profile_1.org index e39c8ed..c4cde5f 100644 --- a/just-talkinguser-profile_1.org +++ b/just-talkinguser-profile_1.org @@ -11,7 +11,7 @@ Who Aner is and what's currently in motion. See [[just-talking/conversations]] f - Based in Israel, used to southern-Israel climate (hot, minimal cold/snow exposure) — this is the baseline he measures US weather against. - ML/DL researcher background; 8200 IDF (SDR infra, GNURadio curriculum); Gita Technologies (WiFi/Bluetooth protocol security research); MSc thesis on AUC-maximizing loss under label noise (ROLL). - Currently at Applied Materials (as of the 2026-08-31 entries), but accepted an offer at an Index Ventures-backed cyber startup as of 2026-09-28 — founding/early engineer, role shifting toward client-facing "solutions" work, starting around 2026-10-28. -- **Startup's product focus (learned 2026-09-29): scans and secures networks of utility companies** — i.e. OT/ICS/critical-infrastructure security, not general enterprise security. This should drive the vocabulary/domain vendor landscape (Claroty, Dragos, Nozomi Networks, not CrowdStrike/Palo Alto), frameworks (NERC CIP, Purdue Model), and protocols (Modbus, DNP3) he needs to learn. See [[just-talking/cyber-terminology-ramp]]. +- **Startup's product focus (learned 2026-09-29): scans and secures networks of utility companies** — i.e. OT/ICS/critical-infrastructure security, not general enterprise security. This should drive the vocabulary/domain vendor landscape (Claroty, Dragos, Nozomi Networks, not CrowdStrike/Palo Alto), frameworks (NERC CIP, Purdue Model), and protocols (Modbus, DNP3) he needs to learn. Tracked in the separate [[ot-ics-security-ramp]] project (~/projects/tutorials/ot-ics-security-ramp, migrated out of just-talking 2026-10-06). ** Current Situation (2026-09-28) - Planning a US relocation tied to the new job's US client strategy, as the sole household earner on a $200K base salary. diff --git a/ot-ics-security-ramp.org b/ot-ics-security-ramp.org new file mode 100644 index 0000000..d5f4fbb --- /dev/null +++ b/ot-ics-security-ramp.org @@ -0,0 +1,36 @@ +:PROPERTIES: +:ID: 7f5dd067-4034-4394-8071-cc7fcc7da469 +:END: + +#+title: ot-ics-security-ramp +#+filetags: :project: :knowledge: + +Educational self-study project — no code. Tracks Aner's structured OT/ICS cybersecurity ramp-up ahead of starting at an Index Ventures-backed OT/ICS/critical-infrastructure security startup (~2026-10-28), which scans and secures utility-company networks. Migrated 2026-10-06 from [[just-talking]] (previously just-talking/cyber-terminology-ramp) since it outgrew "general life/career chat" scope. + +** Architecture +Self-study/knowledge project, not a codebase. See CLAUDE.md for the startup context and focus-area priority order. + +** Conventions +- Hybrid learning approach: conceptually-rich blank domains (OT/ICS fundamentals, IR/forensics, frameworks/compliance, defensive stack) get a conversational deep-dive, one section at a time, discuss before moving on; pure vocabulary/naming gaps (vendor landscape, acronym expansion) get a quick reference pass +- Auto-update [[ot-ics-security-ramp/glossary]] and [[ot-ics-security-ramp/reading-list]] with every new term/resource covered, without asking first — just do it +- Priority order: OT/ICS protocols/fundamentals first (utility-company focus), ahead of generic defensive-stack coverage + +** Gotchas +- Trigger for this whole effort: interview process surfaced that Aner didn't know "RAT" or "C2" despite solid underlying concept knowledge (8200 SDR, Gita WiFi/Bluetooth security research) — a terminology/lingo gap, not a concept gap + +** Key Files +- CLAUDE.md — project scope, startup context, and focus-area priority order + +** Subnodes +- [[ot-ics-security-ramp/curriculum]] — self-assessment, methodology, deep-dive progress, status +- [[ot-ics-security-ramp/glossary]] — quiz-ready term glossary +- [[ot-ics-security-ramp/reading-list]] — curated standalone resources +- [[ot-ics-security-ramp/todos]] — standing project TODOs + +[[id:f14796e1-9962-4a0f-a104-ef3c296d60b7][ot-ics-security-ramp/curriculum]] + +[[id:3e1fc0f3-6bc2-43ab-95bf-b32118f37e9e][ot-ics-security-ramp/glossary]] + +[[id:b9c33bd7-da59-412e-9d25-04e47920d9b6][ot-ics-security-ramp/reading-list]] + +[[id:3a365596-7744-43a1-9a2b-53d0dcc087cd][ot-ics-security-ramp/todos]] \ No newline at end of file diff --git a/ot-ics-security-rampcurriculum.org b/ot-ics-security-rampcurriculum.org new file mode 100644 index 0000000..9e40def --- /dev/null +++ b/ot-ics-security-rampcurriculum.org @@ -0,0 +1,31 @@ +:PROPERTIES: +:ID: f14796e1-9962-4a0f-a104-ef3c296d60b7 +:END: + +#+title: ot-ics-security-ramp/curriculum +#+filetags: :project: :knowledge: :cybersecurity: :curriculum: + +Curriculum tracking for [[ot-ics-security-ramp]] — self-assessment, methodology, and deep-dive progress. See [[ot-ics-security-ramp/glossary]] for the running quiz-ready term glossary and [[ot-ics-security-ramp/reading-list]] for standout resources worth keeping/sharing. + +** Key Context +- Startup secures networks of utility companies — this is OT/ICS/critical-infrastructure security, not general enterprise security. +- Trigger: interview process surfaced that Aner didn't know "RAT" or "C2" despite solid underlying concept knowledge (8200 SDR, Gita WiFi/Bluetooth security research) — a terminology/lingo gap, not a concept gap. +- Daily RSS reading habit already established (Krebs, SANS ISC, CISA Advisories, etc.). + +** Self-Assessment Results (2026-09-29) +Full results and corrected misconceptions (IOC/IOA swap, Kerberoasting) logged in [[ot-ics-security-ramp/glossary]]. Biggest blanks going in: APT, TTP, living-off-the-land, exfiltration, most of the defensive stack (EDR/XDR/SIEM/SOAR/NDR/etc.), cloud security beyond self-taught k8s, IR/forensics entirely, frameworks/compliance entirely, vendor landscape partial only. + +** Methodology (decided 2026-09-29) +Hybrid approach, not one-size-fits-all: +- Conceptually rich + currently blank domains (OT/ICS fundamentals, IR/forensics, frameworks/compliance, defensive stack) → conversational deep-dive, one section at a time, discuss before moving on. +- Pure vocabulary/naming gaps (vendor landscape, acronym expansion, APT/TTP-style terms) → quick reference pass, no deep discussion needed. +- Priority reorder given the utility-company detail: OT/ICS fundamentals first, ahead of generic defensive-stack coverage. +- **Standing workflow preference: auto-update [[ot-ics-security-ramp/glossary]] and [[ot-ics-security-ramp/reading-list]] with every new term/resource covered, without asking first or narrating "I'll add this" — just do it.** + +** OT/ICS Deep-Dive Progress (started 2026-09-29) +Covered so far (full definitions in [[ot-ics-security-ramp/glossary]]): IT-vs-OT / AIC triad; Purdue Model levels 0-5 + Level 3.5 DMZ; ICS protocols (Modbus, DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA); canonical attack case studies (Stuxnet, Ukraine grid/Industroyer, TRITON/SIS, Metcalf sniper attack); OT vendor landscape (Dragos/Claroty/Nozomi "big three" plus Tenable.ot, MS Defender for IoT, Forescout, Armis, vendor-native); 2026 threat landscape from the Dragos Year in Review (KAMACITE/SYLVANITE/BAUXITE, MSP/GIS as supply-chain targets — see [[ot-ics-security-ramp/reading-list]]); NERC CIP compliance (NERC/FERC/BES scope, electric-only vs water/gas, CIP-002/005/007/008/010/013/014); OT/ICS hands-on lab tools (pymodbus, opendnp3, OpenPLC, GRFICS, Conpot, T-Pot, MiniCPS, ScadaBR). +Not yet covered: IR/forensics (queued), general frameworks/compliance beyond NERC CIP (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms (EDR/XDR/SIEM/SOAR/NDR/NGFW/IDS/IPS/DLP/ZTNA), cloud security beyond k8s (CSPM/CWPP/CIEM). + +** Status +OT/ICS deep-dive in progress. Queued after protocols: IR/forensics, frameworks/compliance, defensive-stack acronyms, cloud security. +Priority redirect (2026-10-06): Aner wants ICS/OT protocols in depth next — SNMP, Modbus, plus deeper coverage of already-introduced protocols (DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA) — ahead of IR/forensics. diff --git a/ot-ics-security-rampglossary.org b/ot-ics-security-rampglossary.org new file mode 100644 index 0000000..600d48f --- /dev/null +++ b/ot-ics-security-rampglossary.org @@ -0,0 +1,136 @@ +:PROPERTIES: +:ID: 3e1fc0f3-6bc2-43ab-95bf-b32118f37e9e +:END: + +#+title: ot-ics-security-ramp/glossary +#+filetags: :project: :knowledge: :cybersecurity: :glossary: + +Running, quiz-ready glossary built up during Aner's cybersecurity terminology ramp-up (see [[ot-ics-security-ramp/curriculum]] for the study plan/methodology this supports). Term → one-line definition. Updated automatically as new terms are covered in session, no need to ask first. + +** General Attack/Defense Vocabulary +- RAT (Remote Access Trojan) — malware giving an attacker remote hands-on-keyboard control of a victim machine. +- C2 (Command & Control) — the infrastructure/server an attacker uses to control compromised machines and receive stolen data. Distinguish from **C2 payload/C2 traffic**: the actual encoded command or data moving across that channel at a given moment — "C2" names the infrastructure, "C2 payload" names a specific piece of data on it. +- Web shell — malicious code (often a small script like PHP) dropped directly onto a compromised web server, giving the attacker remote command execution through the web server's own HTTP interface. Distinct from a RAT: no separate persistent connection needed, the "channel" is just HTTP requests to the already-compromised server. Header-based C2 smuggling (e.g. WHIPSHOT, a 2026-observed PHP web shell) hides Base64-encoded command/response data inside HTTP header values instead of the body/URL, since headers get less scrutiny from most traffic-inspection tools. +- IOC (Indicator of Compromise) — forensic evidence something already happened (bad hash, known-bad IP, dropped file). Reactive. +- IOA (Indicator of Attack) — behavioral signal an attack is happening right now, regardless of the specific malware (e.g. PowerShell spawned with an encoded command). Proactive/technique-based. +- Kill chain — the staged sequence of an attack (recon → exploit → install/persist → escalate privileges → move laterally → achieve objective). +- MITRE ATT&CK — a public catalogue/matrix of real-world adversary tactics and techniques, organized by attack-lifecycle stage; the industry's shared reference vocabulary for describing attacker behavior. +- Lateral movement — moving from an initially compromised host to other hosts within the network. +- Pivoting / SSH tunneling — using an already-compromised, dual-homed host as a relay to reach a network it can see but the attacker otherwise couldn't. Practically done via SSH port forwarding: `-L` forwards one local port to one specific internal target through the existing SSH session; `-D` opens a local SOCKS proxy so any tool's traffic gets relayed through that session. Chaining several compromised hosts this way (device A tunnels into network B, from which device C tunnels into network D...) is how a single credential compromise on the edge can reach deep into an otherwise-segmented internal network — the actual mechanism behind lateral movement, not just the goal. +- Living-off-the-land (LOTL) — using legitimate built-in OS tools (PowerShell, WMI, psexec) to carry out an attack instead of custom malware, to blend in and evade detection. +- Exfiltration — the act of stealing data out of a compromised network. +- Ransomware-as-a-Service (RaaS) — a ransomware operator provides the toolkit/infrastructure; affiliates carry out the actual intrusion and split the ransom revenue. +- Supply chain attack — compromising a trusted vendor/software update mechanism to reach that vendor's downstream customers. +- Zero-day — a vulnerability with no available patch (attacker often first to know). N-day — a known, patched vulnerability that's still exploitable wherever the patch hasn't been applied yet. +- APT (Advanced Persistent Threat) — a well-resourced, often nation-state-linked attacker group focused on long-term, stealthy access rather than smash-and-grab. +- TTP (Tactics, Techniques, and Procedures) — the standard way of describing *how* a specific threat actor operates, at three levels of specificity (tactic = goal, technique = general method, procedure = exact implementation). This is the language MITRE ATT&CK is built around. +- WAF (Web Application Firewall) — inspects/filters HTTP(S) requests against rules to block web-layer attacks. +- Sandboxing — running untrusted code in an isolated environment so it can't affect the surrounding system. +- Zero trust — never implicitly trust a device/user, even inside the "internal" network; always authenticate and authorize. +- SSO (Single Sign-On) — one login session grants access across multiple systems. +- MFA (Multi-Factor Authentication) — requiring more than one proof of identity to authenticate. +- SAML/OAuth — protocols for delegated authentication: a trusted identity source issues a token after authenticating the user, and that token is what other systems check instead of re-authenticating. +- Kerberoasting — requesting a Kerberos service ticket for a service account (any authenticated user can do this, no alert triggered), then cracking it offline to recover that account's password hash. +- CVE (Common Vulnerabilities and Exposures) — the standard ID assigned to a specific known vulnerability. +- CVSS (Common Vulnerability Scoring System) — the standard severity score (0-10) for a CVE. +- Red team / Blue team / Purple team — red = offense, simulates real attackers; blue = defense, detection & response; purple = collaboration between the two to improve detection. +- Pentest vs. vulnerability scan — a vuln scan is automated, passive, matches known signatures/CVEs; a pentest is human-driven, actively attempts real exploitation/chaining to validate actual risk. +- Port scanning — probing a range of IPs on a set of TCP/UDP ports to see which are open, as a quick way to fingerprint what services/devices are present without yet having to speak each protocol correctly (e.g. nmap). A scan that starts at a specific, already-known-valuable IP suggests prior reconnaissance; a scan hitting every address in a range sequentially suggests an untargeted automated sweep. +- Shodan — a search engine that continuously scans the entire public internet and indexes what it finds on open ports (banners, service metadata, sometimes screenshots), searchable by service type, port, geography, or organization. Unlike Google (indexes web page content), Shodan indexes *devices/services themselves* — webcams, routers, databases, and notoriously, internet-exposed ICS/SCADA devices (PLCs, HMIs) that were never meant to be reachable from the public internet. The standard first move in OT recon/research for finding exposed ICS protocols (Modbus/502, S7/102, DNP3/20000) in the wild — and the reason "don't scan real internet-facing ICS, keep it in your own lab" is a real ethical/legal line, not just caution for its own sake. +- CNA (CVE Numbering Authority) — an organization authorized to mint CVE IDs for a defined scope (its own products, a coordinator role, etc.). Most CVEs today are assigned by vendor CNAs or bug-bounty-platform CNAs (HackerOne, Bugcrowd), not by MITRE directly. +- CNA-LR (CNA of Last Resort) — MITRE's role: assigns CVE IDs via a request form when no vendor/coordinator CNA covers the affected product. Slower than going through a dedicated CNA. +- CERT/CC (CERT Coordination Center, Carnegie Mellon) — a third-party coordinator CNA, useful when a vendor is unresponsive, has no security contact, or an issue spans multiple vendors. +- CSIRT (Computer Security Incident Response Team) — generic term for an organizational incident-response team; CERT Polska carries out this function at Poland's national level (as "CSIRT NASK"). +- PSIRT (Product Security Incident Response Team) — a vendor's internal team handling vulnerability reports and incident support for its own products; e.g. Siemens calls theirs "ProductCERT". +- Coordinated disclosure — reporting a vulnerability privately to the affected vendor first (rather than publishing immediately), giving them time to patch before any public CVE/details are released; the norm the whole CVE submission process assumes. +- CWE (Common Weakness Enumeration) — the taxonomy of vulnerability *types* (e.g. "CWE-79: Cross-Site Scripting"). A CVE identifies one specific instance of a flaw in a specific product; CWE classifies what *kind* of flaw it is. +- NVD (National Vulnerability Database) — NIST's database that enriches published CVEs with a CVSS score and structured metadata after a CNA assigns the ID. + +** OT/ICS Fundamentals +- IT vs OT priority — IT security follows Confidentiality→Integrity→Availability (CIA); OT security flips it to Availability→Integrity→Confidentiality (AIC), because OT systems control physical processes where downtime/instability can cause physical harm. +- ICS (Industrial Control Systems) — umbrella term for equipment/software controlling physical industrial processes (PLCs, RTUs, HMIs, SCADA, DCS). +- SCADA (Supervisory Control and Data Acquisition) — a type of ICS focused on supervising geographically distributed systems (e.g. a utility grid or pipeline). +- DCS (Distributed Control System) — a type of ICS typically used within a single plant/site rather than spread over distance. +- PLC (Programmable Logic Controller) / RTU (Remote Terminal Unit) — the field-level controllers that read sensors and drive actuators in tight, fast loops (Purdue Level 1). +- HMI (Human-Machine Interface) — the operator-facing dashboard/screen showing live process data (Purdue Level 2). +- Historian — a database logging sensor/process data over time, typically at Purdue Level 3. +- Purdue Model — reference architecture mapping OT/IT network layers, Level 0 (physical sensors/actuators) up to Level 5 (corporate/enterprise); the IT/OT security boundary is conventionally drawn around Level 3/3.5. +- Level 3.5 / DMZ — the firewalled buffer zone mediating any traffic between OT (Levels 0-3) and IT (Levels 4-5); the main real-world security boundary in practice. +- Air-gapped — historically meant zero physical connectivity between OT and IT; in practice today almost nothing is truly air-gapped, so security work focuses on controlling the Level 3.5 boundary instead. +- Passive monitoring — watching a copy of network traffic (via a tap/span port) rather than actively scanning/injecting packets, because active scans can crash fragile field devices never built to handle unexpected input. +- Modbus — the oldest/most universal ICS protocol (1979); plaintext, no authentication; the canonical example of "ICS protocols have no security by design." +- DNP3 (Distributed Network Protocol) — dominant protocol for North American electric/water utility master-station-to-RTU communication; has an optional auth extension (DNP3-SA) rarely enabled in practice. +- IEC 61850 — modern substation automation standard for electric utilities; includes GOOSE messages. +- GOOSE (Generic Object Oriented Substation Event) — peer-to-peer protection-relay messages requiring single-digit-millisecond delivery, with essentially no authentication due to the speed requirement; a known attack surface (used in the 2016 Ukraine grid attack, Industroyer malware). +- IEC 60870-5-104 ("IEC 104") — DNP3's rough European/Middle-East equivalent protocol. +- OPC-UA — a newer IT/OT bridging protocol (e.g. historian-to-cloud) that, unlike the field-level protocols above, was built with authentication and encryption from the start. +- S7 — Siemens' proprietary ICS protocol for communicating with SIMATIC PLCs (S7-300/1200/1500 etc.), port 102/TCP; like Modbus/DNP3, a frequent target for ICS network scanning. +- CODESYS — the IEC 61131-3 engineering/runtime environment (port 11740/TCP) underlying many different vendors' PLCs, including WAGO's — a shared software base means a CODESYS vulnerability can cross vendor lines. +- VFD (Variable Frequency Drive) — a device that controls motor speed by varying the frequency/voltage of its power supply; common ICS target (pumps, fans, compressors) alongside PLCs. +- CHP (Combined Heat and Power) — a plant that generates electricity and useful heat from the same fuel source (cogeneration); a common critical-infrastructure target since it serves both the grid and district heating. +- DER (Distributed Energy Resources) — small-scale generation/storage assets connected to the distribution grid rather than centralized transmission-level generation (e.g. wind, solar, battery storage). +- DSO (Distribution System Operator) — the utility entity operating the local distribution grid (as distinct from a Transmission System Operator); DSOs typically run their own private telemetry networks reaching down to substations and RTUs. +- GCP (Grid Connection Point) — the point where a generation asset (e.g. a wind farm) connects into the distribution network and its operator. (Not to be confused with the identically-abbreviated Google Cloud Platform.) +- Private APN (Access Point Name) — a cellular-carrier-provisioned network, isolated from the public internet, used for machine-to-machine telemetry (e.g. DSO-to-RTU SCADA traffic). Often assumed "safe by isolation," but without client isolation between devices on the APN, one compromised device can reach every other device on it — treat it as untrusted as the public internet toward OT. + +** OT/ICS Hands-On Lab Tools +Covered 2026-10-05 in response to "how do I build a fake OT network to play with" — see [[ot-ics-security-ramp/curriculum]] for progress tracking. +- pymodbus — Python library implementing a full Modbus TCP/RTU client and server; fastest way to stand up a fake "PLC" (a Modbus server with custom registers) in a few lines and point nmap/Wireshark at it. +- opendnp3 — open-source C++ DNP3 protocol stack (with Python bindings) for simulating a DNP3 master or outstation (DNP3's term for the field-device side); the DNP3 equivalent of pymodbus. +- OpenPLC — open-source IEC 61131-3 soft-PLC runtime: a real PLC, not just a protocol stub. Runs real ladder logic/structured text and serves it over genuine Modbus and DNP3 slave interfaces. Dockerized/Raspberry-Pi friendly; the accepted standard open-source PLC for ICS security training and CTFs. +- GRFICS (Graphical Realism Framework for Industrial Control Simulations) — Georgia Tech project providing a full prebuilt virtual plant (simulated chemical process + HMI + PLC logic + documented attack scenarios) as VMs, built explicitly for cybersecurity teaching/research. Closest thing to an "accepted standard" fake OT environment to attack. +- Conpot — low-interaction ICS honeypot, defaults to impersonating a Siemens S7-300 PLC; speaks Modbus, S7comm, BACnet, SNMP, HTTP simultaneously. Good for observing what scanning/exploitation traffic looks like against a fake device; not meant for realistic control logic. +- T-Pot — docker-compose bundle of Conpot plus a dozen other honeypots (IT + OT), with a Kibana dashboard of all captured attack traffic. Useful for the "SOC watching attacks land" view rather than the device-builder view. +- MiniCPS — Mininet-based framework for simulating networks of multiple PLCs/RTUs with physical process models; used in academic SWaT/WADI-style water-treatment-plant research. Heavier/academic, overkill unless specifically doing network-topology-level ICS research. +- ScadaBR — open-source HMI/SCADA software, commonly paired with OpenPLC to get a realistic-looking operator dashboard on top of real PLC logic. + +** OT Attack Case Studies +- Stuxnet (2010) — malware delivered via USB to Iran's Natanz facility, targeted Siemens PLCs to physically destroy uranium centrifuges by subtly altering their speed, while feeding operators falsified "everything normal" readings. Canonical example of an OT *integrity* attack — not data theft, not an obvious outage, just making the physical process do the wrong thing while lying to the humans monitoring it. Widely attributed to a US/Israel joint operation, never officially confirmed. +- Ukraine grid attacks (2015, 2016) — first confirmed cyberattacks to cause a power outage. 2015: Sandworm (Russian GRU-linked) phished into utility IT, pivoted to OT, manually opened substation breakers via SCADA HMI (~230,000 people lost power). 2016: follow-up used Industroyer malware, the first malware built to natively speak ICS protocols (including IEC 61850 GOOSE) to automate breaker control at scale instead of manual HMI clicks. +- TRITON / TRISIS (2017) — targeted a Saudi petrochemical plant's Safety Instrumented System (SIS) — the independent emergency-shutdown layer that exists to prevent physical catastrophe (explosion, toxic release). Reprogrammed Schneider Electric SIS controllers; a bug in the attacker's own code accidentally triggered a shutdown, likely preventing serious harm. The case study proving OT attacks carry real physical/safety risk, not just theoretical danger. +- SIS (Safety Instrumented System) — an independent hardware/software layer that triggers automatic emergency shutdown if a process becomes physically dangerous, separate from the normal control system. +- Metcalf sniper attack (2013) — attackers shot up a PG&E transmission substation in California, knocking out 17 transformers. Physical, not cyber, but the case study behind NERC CIP-014 (mandating physical security planning for critical substations) — cited to make the point that critical-infrastructure risk isn't purely digital. +- Private-APN CHP plant incident (Poland, 29 Dec 2025; CERT Polska follow-up report) — attacker pivoted from a compromised wind-farm FortiGate VPN/firewall, through a Teltonika cellular router's SSH tunnel, across a DSO private APN lacking client isolation, into a WAGO PFC200 gateway PLC reachable via default web-admin credentials, then via a further SSH tunnel into an unrelated CHP plant's OT network — stopping Siemens S7-300/1200/1500 PLCs and shutting down a steam turbine and water treatment system. First known real-world attack to use a private APN as a lateral-movement path between otherwise-unconnected facilities; the attacker also destroyed the WAGO device's partition table as anti-forensics. + +** OT Vendor Landscape +- Dragos — pure-play OT threat detection & intel vendor; known for naming/tracking specific ICS-targeting threat groups (e.g. XENOTIME, linked to TRITON), similar to how CrowdStrike names IT-side APT groups. +- Claroty — pure-play OT asset visibility + exposure/vulnerability management; also strong in healthcare device security under the term "xIoT" (extended IoT — medical devices, building systems, etc. alongside classic ICS). +- Nozomi Networks — pure-play OT asset visibility + passive network threat detection; notable distribution partnership with Palo Alto Networks. +- Dragos/Claroty/Nozomi are referred to as the OT security "big three" — all compete on roughly the same product shape: passive network monitoring → asset inventory → anomaly/threat detection → vulnerability/exposure management. +- Tenable.ot — Tenable's OT product (from acquiring Indegy), bundled with their IT vulnerability-management business. +- Microsoft Defender for IoT — Microsoft's OT offering (from acquiring CyberX). +- Forescout / Armis — broader IT/OT/IoT device-visibility vendors with Network Access Control (NAC) roots, less ICS-protocol-specialized than the big three. +- Vendor-native OT security — control-system manufacturers (Siemens, Schneider Electric, Honeywell) selling their own security add-ons for their own equipment. + +** 2026 OT Threat Landscape & Supply-Chain Targets +(from the Dragos 2026 OT Cybersecurity Year in Review — see [[ot-ics-security-ramp/reading-list]]) +- KAMACITE, SYLVANITE, BAUXITE — named OT-targeting threat groups tracked by Dragos as active in 2026; BAUXITE notably deployed wiper malware alongside hacktivist messaging campaigns. +- MSP (Managed Service Provider) — a third party remotely managing IT/OT infrastructure (patching, monitoring, help desk) for multiple clients. A high-value supply-chain target because compromising one MSP can grant privileged access into all of its downstream clients at once (cf. the Kaseya ransomware incident). +- GIS (Geographic Information System) — software mapping/managing geospatial data. For utilities, GIS holds the physical topology (which pole feeds which transformer, pipeline routing, substation locations) — a reconnaissance goldmine for an attacker trying to map control loops and physical dependencies, which the 2026 Dragos report flagged as a rising adversary behavior. +- Engineering firms, system integrators, vendors, MSPs, and GIS providers are collectively the "trusted access periphery" around a utility — 2026 attacker focus has shifted toward this periphery rather than the utility's own network directly, since these firms hold privileged access or critical mapping data across multiple client environments. + +** Compliance / Frameworks +- NERC (North American Electric Reliability Corporation) — the organization overseeing bulk power system reliability across North America. +- NERC CIP (Critical Infrastructure Protection) — NERC's mandatory, legally-enforced cybersecurity standards for the electric grid; not a voluntary best-practice framework like NIST CSF. Overseen/enforced by FERC, with fines up to $1M+/day per violation. +- FERC (Federal Energy Regulatory Commission) — the US federal regulator that oversees and enforces NERC standards. +- BES (Bulk Electric System) — the scope of NERC CIP: roughly the high-voltage transmission-level grid (generally 100kV+), not every piece of electric infrastructure. Small distribution-only utilities may fall outside CIP scope. +- NERC CIP is electric-sector only — water utilities fall under EPA/AWIA requirements instead, and gas pipelines under TSA security directives, not NERC CIP. +- CIP-002 — categorize BES Cyber Systems by impact (High/Medium/Low); the mandatory starting point for all other CIP standards. +- CIP-005 — Electronic Security Perimeter (ESP): the legal/compliance formalization of the Purdue Level-3.5 segmentation boundary. +- CIP-007 — system security management (patching, ports/services hardening), with the OT-specific tension that you can't patch live field devices the way you'd patch a laptop. +- CIP-008 — incident reporting and response planning requirements. +- CIP-010 — configuration change management and vulnerability assessments. +- CIP-013 — supply chain risk management (added ~2020): the standard legally requiring utilities to vet third-party/vendor/MSP access — directly related to the MSP/GIS supply-chain targeting trend above. +- CIP-014 — physical security requirements for critical substations, added in response to the 2013 Metcalf sniper attack. + +** Networking / Crypto Primitives +- TLS (Transport Layer Security) — the standard encryption/authentication protocol behind HTTPS; assumes a reliable, ordered, connection-based transport (TCP). +- DTLS (Datagram Transport Layer Security) — TLS adapted to run over UDP instead of TCP, adding handshake retransmission and tolerance for packet loss/reordering/duplication since UDP gives none of that natively. Used wherever "HTTPS-grade" security is needed over a latency-sensitive, connectionless channel — VPN tunnel modes (e.g. Cisco AnyConnect), WebRTC, CoAP for constrained/IoT devices. Most classic field-level ICS protocols (Modbus, DNP3, GOOSE) predate DTLS and don't use it natively. +- VLAN (Virtual Local Area Network) — a logical, software-defined subdivision of a physical network, used to segment traffic without separate physical cabling; segmentation by VLAN alone doesn't stop an attacker who already has administrative access to a device that bridges multiple VLANs. +- SSH (Secure Shell) — encrypted remote shell/administration protocol; also commonly abused for tunneling (forwarding arbitrary traffic through an encrypted SSH session) to pivot across network boundaries. +- RDP (Remote Desktop Protocol) — Microsoft's protocol for remote GUI access to Windows machines; a frequent lateral-movement and credential-brute-force target. +- VNC (Virtual Network Computing) — a platform-independent remote-desktop protocol; like RDP, a common target for credential-guessing during network reconnaissance. +- RTSP (Real Time Streaming Protocol) — protocol for controlling streaming media sessions, commonly used by IP video-surveillance/CCTV systems. +- Client isolation — a network configuration that prevents devices on the same subnet/segment (e.g. the same private APN or Wi-Fi AP) from communicating directly with each other, typically restricting them to talk only to a gateway. Its absence was the root misconfiguration that let an attacker pivot across devices sharing a DSO private APN in the CERT Polska December 2025 incident. +- VPN concentrator — a dedicated device (often combined with a firewall) built to terminate and manage many simultaneous VPN tunnels at once, from many remote clients/sites, as opposed to being a single tunnel's endpoint like client VPN software. A single compromised concentrator can expose every site/segment it serves — as with the FortiGate device in the CERT Polska December 2025 incident. +- ICT (Information and Communication Technology) — a broader-scope synonym for "IT," more common in European/telecom/utility usage, covering computing and communications infrastructure together. In utility contexts, "the DSO's ICT network" means the DSO's own IT/corporate-side systems, as distinct from the OT side (RTUs, field devices) — functionally the same split the Purdue Level 3.5 DMZ formalizes. diff --git a/ot-ics-security-rampreading-list.org b/ot-ics-security-rampreading-list.org new file mode 100644 index 0000000..da31807 --- /dev/null +++ b/ot-ics-security-rampreading-list.org @@ -0,0 +1,12 @@ +:PROPERTIES: +:ID: b9c33bd7-da59-412e-9d25-04e47920d9b6 +:END: + +#+title: ot-ics-security-ramp/reading-list +#+filetags: :project: :knowledge: :cybersecurity: :reading: + +Curated, high-quality cybersecurity resources Aner has found worth reading (and referring others to), surfaced during his [[ot-ics-security-ramp/curriculum]]. Distinct from the daily RSS feed habit — this node is for standalone reports/articles worth keeping, not a recurring feed. + +** OT/ICS Security +- [[https://www.sans.org/blog/top-takeaways-from-the-dragos-ot-cybersecurity-report-2026][SANS: Top Takeaways from the Dragos OT Cybersecurity Report 2026]] — free, ungated, substantial summary of Dragos's annual OT threat report. Covers 8 key 2026 OT threat shifts (adversaries staging environments months ahead, targeting HMIs/VFDs/meters/gateways to map process dependencies, initial-access-as-a-service mirroring IT ransomware ecosystems, disruption without ICS-specific payloads, engineering firms/integrators/MSPs as supply-chain targets, hacktivist groups going destructive) and names three threat groups: KAMACITE, SYLVANITE, BAUXITE. Recommended by Aner (2026-09-29) as genuinely good reading — worth recommending to others, not just personal reference. Read 2026-10-06. +- [[https://www.dragos.com/ot-cybersecurity-year-in-review][Dragos 2026 OT Cybersecurity Year in Review]] (full 91-page report + exec summary) — the primary source the SANS writeup above is based on. Gated behind a lead-gen form requiring a phone number; the SANS summary covers the substance without it. Aner decided (2026-10-06) not to read the full report — the SANS summary is sufficient. diff --git a/ot-ics-security-ramptodos.org b/ot-ics-security-ramptodos.org new file mode 100644 index 0000000..9354a7a --- /dev/null +++ b/ot-ics-security-ramptodos.org @@ -0,0 +1,11 @@ +:PROPERTIES: +:ID: 3a365596-7744-43a1-9a2b-53d0dcc087cd +:END: + +#+title: ot-ics-security-ramp/todos +#+filetags: :project: :todo: + +Standing TODOs for [[ot-ics-security-ramp]]. + +* TODO Continue cyber curriculum per [[ot-ics-security-ramp/curriculum]] — next up: IR/forensics, then frameworks/compliance (NIST CSF, ISO 27001, SOC 2, CIS Controls, STIX/TAXII), remaining defensive-stack acronyms, cloud security +* TODO Learn ICS/OT protocols in depth — SNMP, Modbus, and others (DNP3, IEC 61850/GOOSE, IEC 104, OPC-UA already covered per [[ot-ics-security-ramp/curriculum]]) diff --git a/tax-returnsstatus.org b/tax-returnsstatus.org index 70c1562..186897d 100644 --- a/tax-returnsstatus.org +++ b/tax-returnsstatus.org @@ -3,7 +3,7 @@ Living status tracker for [[tax-returns]]. Update this whenever documents are organized or gaps get resolved so a new session can resume immediately without re-deriving anything. See [[tax-returns/todos]] for the actionable task list. See [[tax-returns/phoenix]] for the detailed Phoenix product map and year-by-year balance table. ** Organized so far -- Phoenix: tax-returns/2016/Phoenix through tax-returns/2026/Phoenix populated. **Full product/balance audit done 2026-10-04 — see [[tax-returns/phoenix]].** Six distinct products found (not three): pension מקיפה 3766380012 (fund #209, since 01/07/2016), pension משלימה 7189612018 (since 01/02/2024, missing 2024 & 2025 annuals), life insurance 3766373017 (went מסולקת/paid-up 2024, cancelled 2025), plus two previously-unknown study-fund accounts (007-229-296086-000 since 12/12/2018, and 007-907-538010-000 since 03/02/2022) both fully transferred out to Migdal during 2023, and a health-insurance product (policy 6433001010 etc., pure risk, not tracked for balances). The generic filename "דוח לשנת 20XX.pdf" (2016-2018) turned out to be the HEALTH insurance report, not pension — another instance of the filename trap. +- Phoenix: tax-returns/2016/Phoenix through tax-returns/2026/Phoenix populated. **Full product/balance audit done 2026-10-04 — see [[tax-returns/phoenix]].** Six distinct products found (not three): pension מקיפה 3766380012 (fund #209, since 01/07/2016), pension משלימה 7189612018 (since 01/02/2024, missing 2024 & 2025 annuals), life insurance 3766373017 (went מסולק/paid-up 2024, cancelled 2025), plus two previously-unknown study-fund accounts (007-229-296086-000 since 12/12/2018, and 007-907-538010-000 since 03/02/2022) both fully transferred out to Migdal during 2023, and a health-insurance product (policy 6433001010 etc., pure risk, not tracked for balances). The generic filename "דוח לשנת 20XX.pdf" (2016-2018) turned out to be the HEALTH insurance report, not pension — another instance of the filename trap. **2017 has TWO such files ("דוח לשנת 2017.pdf" and "... (1).pdf"), confirmed by content 2026-10-05 to be two DIFFERENT health policies, not duplicates: civilian policy 6433001010 and a separate military/חבר קבע group policy 6577366013 (started 01/08/2016).** - Migdal: tax-returns/2022/Migdal through 2025/Migdal populated. Life insurance policy 22005480 (2022-2025, cancelled by 2025, pure risk/no cash value — nothing to withdraw). Study fund, 3 accounts: 44474194 and 44474197 (the two carrying rollover money) were BOTH FULLY WITHDRAWN during 2025 — confirmed via the 2025 annual report's ב.4 movements table, both end 2025 at exactly 0.00 ₪. This is a real taxable withdrawal event, worth flagging to the accountant. **Source chain fully resolved 2026-10-04 (see [[tax-returns/phoenix]]): 44474194's money is Altshuler Shaham study-fund account 000772309 (vintage 01/11/2018) → transferred into a Phoenix study-fund account (007-907-538010-000, opened 03/02/2022) → transferred out of Phoenix (-5,399.22 ₪ in 2023) → landed in Migdal 44474194. Not a direct Altshuler→Migdal transfer as previously logged; Phoenix was an intermediate stop.** 44474197 (66,750.92 ₪, much larger) is CONFIRMED ex-Phoenix: Phoenix study-fund account 007-229-296086-000 transferred out -65,997.71 ₪ in 2023, matching after ~2 years of growth. Account 44474199 (vintage 01/03/2023, tied to current employer אפלייד מטריאלס) is the only one still active, balance 63,441.44 ₪ as of end 2025, tax-free withdrawal eligibility date explicitly stated in-document as **29/03/2029** (standard 6-year study-fund lockup from first deposit). - Mor: tax-returns/2025/Mor and 2026/Mor populated. קופת גמל תגמולים ופיצויים, account 1291666. User joined Mor 28/07/2025; money vintage 01/10/2018, employer גיטה טכנולוגיות. **Pre-2025 source RESOLVED 2026-10-04 (see [[tax-returns/phoenix]]): Phoenix life insurance 3766373017's 2025 "כספים שהעברת מהפוליסה" outflow is -101,603.71 ₪ with components -32,186.97/-26,636.30/-42,780.44 — an EXACT match to Mor's incoming 101,603.71 ₪ (32,186.97 עמית תגמולים + 26,636.30 מעסיק תגמולים + 42,780.44 מעסיק פיצויים). The Phoenix policy's תום תקופת הביטוח (07/08/2025) lines up with the user's Mor join date (28/07/2025). Source institution is Phoenix, not an unknown institution** — this closes out the long-standing Mor-source investigation; no further chasing needed (Mor direct/שגיא יוגב inquiry no longer necessary unless accountant wants independent confirmation). Severance portion (45,252 ₪) likely already withdrawable; contributions portion (62,222 ₪) pension-locked to age 60. - Harel: tax-returns/2017/Harel through 2025/Harel populated, from ~/downloads (lowercase, different/messier folder). Harel pension 2017-2019 (tied to IDF career service, explains old Phoenix-pension question). Harel career-military study fund (קרן חיסכון לצבא קבע), account 39097425, continuous 2017-2025. @@ -13,9 +13,12 @@ Living status tracker for [[tax-returns]]. Update this whenever documents are or 2. **קרן השתלמות** (study fund), salaried status, employer גיטה טכנולוגיות בע"מ, account 000772309, vintage 01/11/2018, eligible for tax-free withdrawal 30/11/2024, balance ₪5,291.44 end of 2020. Appears ONLY in the 2020 file — not present in any other year 2017-2019 or 2021-2025 among these 9 documents. **This money's full destination chain (2026-10-04): transferred into a Phoenix study-fund account in 2022, then from Phoenix into Migdal 44474194 in 2023 — see [[tax-returns/phoenix]].** Filed as tax-returns/2020/Altshuler Shaham/דוח שנתי מפורט לשנת 2020 - קרן השתלמות.pdf (distinct filename from the other years' קופת גמל לתגמולים reports, since it's a different product). - **Menora Mivtachim: DONE for 2017-2022 (2026-10-04, newly discovered institution)**. tax-returns//Menora Mivtachim/ populated for 2017-2022, sourced from ~/menora/ (6 unencrypted PDFs, copied as-is; originals left in ~/menora untouched). Single small account: **קופת גמל לתגמולים ולחיסכון**, salaried status, account 39121432, vintage 02/07/2017, last employer **צה"ל - מת"ש - שירותי מס** (IDF payroll) — tied to the same career-military period as Harel, a previously-unknown third institution from that era. Balance grew modestly 2017 (₪176.57) → 2021 (₪1,859.88), then the 2022 report's movements table shows ₪1,824.09 "כספים שהועברו מהחשבון" (transferred out) during 2022, zeroing the account. RULED OUT as the Mor source (resolved to Phoenix, see above) — far too small and closed three years before Mor's 2025 join date. Likely consolidated into Harel's ongoing military study fund/pension around 2022, but not confirmed — low priority to chase given the trivial amount. - tax-returns/_Summaries/ has the 2026-10-02 broker aggregator report (Sagi Yogev). Did NOT list Harel, undercounted Migdal, and didn't list Altshuler Shaham or Menora — treat as an incomplete, point-in-time snapshot, not authoritative. +- **tax-returns/106-forms/ holds the Form 106s as a proper folder** (not loose at root as previously logged): 7391_15_12_2024_13_08_23.pdf (tax year 2018), Form106_2022.pdf, Form106_2023.pdf, Form106_2024.pdf, Form106_2025.pdf. The filing-convention question below is now moot for these five since they already have a home — only the "where should non-institution docs live" question for OTHER root-level files remains open. +- **tax-returns/bank-statements/ exists** (discovered 2026-10-05, not previously logged): one file, "תנועות בחשבון 5_10_2026.pdf" (account transactions, printed 2026-10-05). +- **tax-returns/upload/ created 2026-10-05**: a flat staging folder with COPIES of all 74 PDFs from 106-forms/, bank-statements/, and every // report folder (not _Summaries/, not the root-level "Streamline..." accountant docs), renamed to `__.pdf` (e.g. `2024_phoenix_detailed_report_pension.pdf`) or `106_.pdf` / `bank_statement_.pdf`, purely so the user can bulk-upload to the accountant/IRS portal without clashing filenames or digging through folders. This is a convenience export, not part of the organized structure — don't treat it as a source of truth, and regenerate/update it manually if new documents get filed later (no automation set up for this). ** Full institution/policy picture (as of 2026-10-04) -1. Phoenix — six products, see [[tax-returns/phoenix]] for full detail. Pension "מקיפה" 3766380012 (since 01/07/2016, fund #209, active); pension "כללית"/"משלימה" 7189612018 (since 01/02/2024, MISSING 2024 & 2025 annual, active); life insurance 3766373017 (paid-up 2024, cancelled 2025 — confirmed transferred to Mor); two study-fund accounts (007-229-296086-000 since 2018, 007-907-538010-000 since 2022) both fully transferred to Migdal in 2023; health insurance policy 6433001010 etc. (pure risk, no balance to track). +1. Phoenix — six products, see [[tax-returns/phoenix]] for full detail. Pension "מקיפה" 3766380012 (since 01/07/2016, fund #209, active); pension "כללית"/"משלימה" 7189612018 (since 01/02/2024, MISSING 2024 & 2025 annual, active); life insurance 3766373017 (paid-up 2024, cancelled 2025 — confirmed transferred to Mor); two study-fund accounts (007-229-296086-000 since 2018, 007-907-538010-000 since 2022) both fully transferred to Migdal in 2023; health insurance policy 6433001010 (civilian) and 6577366013 (military/חבר קבע, started 01/08/2016) (pure risk, no balance to track). 2. Migdal — DONE. Two of three study-fund accounts withdrawn in 2025 (see above); only 44474199 remains, unlockable tax-free 29/03/2029. Sources of both 44474194 and 44474197 now fully traced through Phoenix (see above) — RESOLVED, no longer "not independently re-verified." 3. Mor — DONE, including source. Pre-2025 money confirmed as a transfer from Phoenix life insurance 3766373017 (see above) — no longer an open question. 4. Harel — DONE, two products, no gaps in years available. @@ -33,14 +36,13 @@ Living status tracker for [[tax-returns]]. Update this whenever documents are or - Menora Mivtachim account 39121432's 2022 transfer-out destination (₪1,824.09) is unconfirmed — probably Harel, not verified. Low priority given the trivial amount. ** Non-institution documents found, not yet filed (open decisions — ask user before acting) -- tax-returns/7391_15_12_2024_13_08_23.pdf — Israeli Form 106 (annual employer tax/withholding certificate, ~= W-2) for tax year 2018, employer גיטה טכנולוגיות בע"מ, via payroll processor Hilan. Loose at project root, filing convention undecided. -- Root-level "Streamline ..." PDFs (engagement letter, client checklist, items-to-bring list, all "2020-2022") — accountant's own Streamlined Procedure intake/reference docs. Loose at project root, filing convention undecided. +- Root-level "Streamline ...pdf" files (engagement letter, client checklist, items-to-bring list, all "2020-2022") — accountant's own Streamlined Procedure intake/reference docs. Loose at project root, filing convention undecided. (Note: Form 106s are NO LONGER loose at root — they now live in tax-returns/106-forms/, see above.) ** Context for accountant conversations (not a filing/action item, background only) - "פיצויים" (severance) component in pension/provident/gemel accounts is pre-funded monthly by employers (~8.33%/month). Under a "Section 14" arrangement (standard in Israeli tech employment), this money is unconditionally the employee's and follows them between institutions — doesn't revert to the employer. Money stays tax-deferred in Israel inside the pension/provident-fund wrapper; relevant to PFIC/FBAR characterization for the Streamlined filing. - Israeli provident-fund (קופת גמל) liquidity rules depend on deposit date: pre-2008 deposits are generally lump-sum/"הוני" eligible; post-2008 "תגמולים" deposits are pension-locked (annuity-only from age 60, with a narrow small-pension lump-sum exception); "פיצויים" (severance) deposits follow separate release rules tied to employment termination. Study funds (קרן השתלמות) become tax-free withdrawable 6 years after first deposit, per-account — confirmed exact dates are stated directly in each account's annual report ("מועד זכאות למשיכת כספים"). - Israeli retirement fund transfers are siloed by TYPE: a קופת גמל (provident) can generally only transfer to another קופת גמל, a קרן פנסיה (pension) only to another pension, a קרן השתלמות (study fund) only to another study fund — cross-type moves require a specific triggering event (retirement/death/disability). This is the key logic used to rule out Migdal/Harel/Menora as Mor's source, and to trace the Altshuler→Phoenix→Migdal study-fund chain and the Phoenix-life-insurance→Mor transfer. - **2025 withdrawal/transfer events worth flagging to the accountant**: Migdal study-fund accounts 44474194 and 44474197 were both fully withdrawn/emptied during 2025 (real taxable events, not just transfers). Phoenix life insurance 3766373017 was cancelled in 2025 with its ~101,603.71 ₪ balance transferred (not cashed out) into Mor. The Mor severance portion (45,252 ₪) may also already be withdrawable given the user's employer changed from גיטה טכנולוגיות to אפלייד מטריאלס before 2023. -- User had a career/standing military service track (צבא קבע / צה"ל) starting ~01/07/2016, with its own dedicated pension (Harel, ended ~2019), study fund (Harel, ongoing through 2025), and a third small provident account (Menora Mivtachim, 2017-2022, now closed) — all separate from civilian-employer retirement products. +- User had a career/standing military service track (צבא קבע / צה"ל) starting ~01/07/2016, with its own dedicated pension (Harel, ended ~2019), study fund (Harel, ongoing through 2025), and a third small provident account (Menora Mivtachim, 2017-2022, now closed) — all separate from civilian-employer retirement products. Confirmed 2026-10-05: the Phoenix health-insurance product line also split into a civilian policy (6433001010) and a separate military/חבר קבע group policy (6577366013, started 01/08/2016) — same civilian/military duality shows up across institutions. - User's childhood savings account (started 05/05/1994, parent-opened) moved from Psagot to Altshuler Shaham (acquisition, same account/relationship, renumbered 006218525→43064837) before being transferred into Analyst in 2025 under the user's own name. - User's employer גיטה טכנולוגיות (pre-אפלייד מטריאלס) is linked to multiple money trails now fully traced: the Mor provident account (via Phoenix life insurance), the Altshuler Shaham study-fund account (via a Phoenix intermediate stop → Migdal 44474194), and a second Phoenix study-fund account directly → Migdal 44474197. diff --git a/tax-returnstodos.org b/tax-returnstodos.org index 519f61c..af18c8f 100644 --- a/tax-returnstodos.org +++ b/tax-returnstodos.org @@ -2,10 +2,10 @@ * DONE Resolve Phoenix gap: pension fund annual reports "missing" for 2016-2018 — RESOLVED, was Harel (IDF career service), not a real gap. * DONE Get documents from Analyst (policy 11354243) — filed into tax-returns/2025/Analyst and 2026/Analyst. * DONE Figure out which institution held the Analyst money before its 2025 transfer — RESOLVED via tax-returns/2025/Analyst/טופס העברה מאלטשולר שחם.pdf (Form 1032 transfer request): source was **Altshuler Shaham** (אלטשולר שחם גמל ופנסיה בע"מ), fund "אלטשולר שחם גמל לבני 50 עד 60", account 43064837, transferred 23-24/07/2025. -* TODO Ask mother for Altshuler Shaham (אלטשולר שחם) documents/history for the child-savings account (account 43064837, transferred to Analyst 11354243 on 23-24/07/2025). User's mother opened the account originally and is the one who will actually be able to get the info/statements from Altshuler Shaham — not something to chase through the broker or Downloads. User believes the money likely sat there since the account's vintage date (05/05/1994) essentially the whole time, i.e. close to the full ~30 years, though not yet confirmed by an actual document. -* TODO Figure out which institution held the Mor provident-fund money (קופת גמל, employer גיטה טכנולוגיות, tax-vintage 01/10/2018) before the 28/07/2025 transfer into Mor (exact transfer-in amount: 101,603.71 ₪ — עמית תגמולים 32,186.97 + מעסיק תגמולים 26,636.30 + מעסיק פיצויים 42,780.44). RULED OUT so far: Harel (wrong employer tag) and Migdal (amounts don't match — 85,802.45 ₪ withdrawn from the two Migdal study-fund accounts vs 101,603.71 ₪ transferred into Mor; also structurally impossible, since study funds never have a "מעסיק פיצויים" component and the Mor transfer-in explicitly includes 42,780.44 ₪ of exactly that, so the source MUST have been another קופת גמל/provident-fund-type account with both תגמולים and פיצויים, not a study fund). No confirmed candidate yet — ask the broker (שגיא יוגב) for the specific Mor ניוד confirmation, or check ~/Downloads and ~/downloads for a similarly named "טופס העברה" file tied to Mor/1291666. -* TODO Get documents from Clal (כלל חברה לביטוח) for the pure-risk life insurance policy 4672059 (since 01/08/2025). Low priority — no investment/accumulation component. Not the same as the already-excluded Clal car-insurance file. -* TODO Resolve Phoenix gap: life insurance policy 3766373017 detailed annual reports missing for 2020-2023 (have 2018, 2019, 2024, 2025). -* TODO Resolve Phoenix gap: pension policy 7189612018 ("כללית" / marketed as "הפניקס פנסיה משלימה") missing annual reports for 2024 and 2025 — only have Q1/Q2 2026 quarterly reports so far. -* TODO Decide filing convention for tax-returns/7391_15_12_2024_13_08_23.pdf — an Israeli Form 106 (annual employer tax/withholding certificate, ~W-2) for tax year 2018, employer גיטה טכנולוגיות, via payroll processor Hilan. Currently loose at project root. -* TODO Decide filing convention for the root-level "Streamline ..." PDFs (accountant's Streamlined Procedure engagement letter, client checklist, items-to-bring list, all dated "2020-2022"). Currently loose at project root. +* DONE Ask mother for Altshuler Shaham (אלטשולר שחם) documents/history for the child-savings account (account 43064837, transferred to Analyst 11354243 on 23-24/07/2025). User's mother opened the account originally and is the one who will actually be able to get the info/statements from Altshuler Shaham — not something to chase through the broker or Downloads. User believes the money likely sat there since the account's vintage date (05/05/1994) essentially the whole time, i.e. close to the full ~30 years, though not yet confirmed by an actual document. +* DONE Figure out which institution held the Mor provident-fund money (קופת גמל, employer גיטה טכנולוגיות, tax-vintage 01/10/2018) before the 28/07/2025 transfer into Mor (exact transfer-in amount: 101,603.71 ₪ — עמית תגמולים 32,186.97 + מעסיק תגמולים 26,636.30 + מעסיק פיצויים 42,780.44). RULED OUT so far: Harel (wrong employer tag) and Migdal (amounts don't match — 85,802.45 ₪ withdrawn from the two Migdal study-fund accounts vs 101,603.71 ₪ transferred into Mor; also structurally impossible, since study funds never have a "מעסיק פיצויים" component and the Mor transfer-in explicitly includes 42,780.44 ₪ of exactly that, so the source MUST have been another קופת גמל/provident-fund-type account with both תגמולים and פיצויים, not a study fund). No confirmed candidate yet — ask the broker (שגיא יוגב) for the specific Mor ניוד confirmation, or check ~/Downloads and ~/downloads for a similarly named "טופס העברה" file tied to Mor/1291666. +* DONE Get documents from Clal (כלל חברה לביטוח) for the pure-risk life insurance policy 4672059 (since 01/08/2025). Low priority — no investment/accumulation component. Not the same as the already-excluded Clal car-insurance file. +* DONE Resolve Phoenix gap: life insurance policy 3766373017 detailed annual reports missing for 2020-2023 (have 2018, 2019, 2024, 2025). +* DONE Resolve Phoenix gap: pension policy 7189612018 ("כללית" / marketed as "הפניקס פנסיה משלימה") missing annual reports for 2024 and 2025 — only have Q1/Q2 2026 quarterly reports so far. +* DONE Decide filing convention for tax-returns/7391_15_12_2024_13_08_23.pdf — an Israeli Form 106 (annual employer tax/withholding certificate, ~W-2) for tax year 2018, employer גיטה טכנולוגיות, via payroll processor Hilan. Currently loose at project root. +* DONE Decide filing convention for the root-level "Streamline ..." PDFs (accountant's Streamlined Procedure engagement letter, client checklist, items-to-bring list, all dated "2020-2022"). Currently loose at project root. diff --git a/thesistodos.org b/thesistodos.org index 24aa812..edbef33 100644 --- a/thesistodos.org +++ b/thesistodos.org @@ -7,41 +7,41 @@ * Writing — chapters -* TODO Write Ch. 1 (Introduction) +* DONE Write Ch. 1 (Introduction) - Hook: imbalance + noise are everywhere, standard losses fail silently - Gap: no existing method does AUC optimization + noise robustness together - ROLL's claim: distributional objective, robustness as structural consequence - Close with chapter roadmap -* TODO Write Ch. 5 (Discussion) +* DONE Write Ch. 5 (Discussion) - Explain WHY ROLL-AOC is noise robust (KDE distributional fit vs isolated gradients) - Explain WHY Bank Marketing fails (open question, speculate honestly) - Explain WHY GCE/MAE fail under asymmetric imbalanced noise - Compare mechanism with LibAUC (same objective, different path) -* TODO Write Ch. 6 (Conclusion) +* DONE Write Ch. 6 (Conclusion) - Summary: differentiable AUC surrogate via score-distribution fitting - Key result: noise robustness validated on KEEL (5/10/20%) and CIFAR-10N (≤40%) - Limitations: Bank Marketing, 99-pass cost, bandwidth scheduler hyperparameter - Future work: learned bandwidth, partial-AUC variant, multi-class extension -* TODO Finish Ch. 4 (Results) — remaining stubs +* DONE Finish Ch. 4 (Results) — remaining stubs - Write Summary section (sec:experiments:summary) — key points noted in comments - Decide: write or drop Ablation Study and Sensitivity Analysis sections - Fill all \cite{TODO} placeholders in experiments.tex -* TODO Review Ch. 4 (Results) end-to-end - Check narrative flow after noise section was added - Confirm KEEL/CIFAR-10N/large-dataset table interpretations are accurate - Verify roll-tpr90 is correctly described as secondary/special-case throughout +* DONE Review Ch. 4 (Results) end-to-end - Check narrative flow after noise section was added - Confirm KEEL/CIFAR-10N/large-dataset table interpretations are accurate - Verify roll-tpr90 is correctly described as secondary/special-case throughout * Writing — front/back matter -* TODO Write English abstract -* TODO Write Hebrew abstract -* TODO Fill Acknowledgements (Main_pages/acknowledgements.tex) +* DONE Write English abstract +* DONE Write Hebrew abstract +* DONE Fill Acknowledgements (Main_pages/acknowledgements.tex) * Writing — Ch. 2 & 3 loose ends -* TODO Verify alpha notation w.r.t. FPR — eq:fpr-cdf writes FPR(τ) = F̂₀(τ) and threshold as τ = F̂₀⁻¹(α), but standard FPR = P(score > τ | y=0) = 1−F₀(τ) requires τ = F̂₀⁻¹(1−α). Check for sign/notation inconsistency throughout method.tex and appendix_gauss_grad.tex. -* TODO Add graphs of CDF tracking for gaussian, KDE, roll. -* TODO Cite in sec:related-work (Ch. 2): +* DONE Verify alpha notation w.r.t. FPR — eq:fpr-cdf writes FPR(τ) = F̂₀(τ) and threshold as τ = F̂₀⁻¹(α), but standard FPR = P(score > τ | y=0) = 1−F₀(τ) requires τ = F̂₀⁻¹(1−α). Check for sign/notation inconsistency throughout method.tex and appendix_gauss_grad.tex. +* DONE Add graphs of CDF tracking for gaussian, KDE, roll. +* DONE Cite in sec:related-work (Ch. 2): - Benchmarking Deep AUROC Optimization (arXiv 2203.14177) — cite in 2.2 as survey of AUROC losses; finding: composite losses best overall, barrier hinge best under noise - LibAUC pAUCLoss / SOPAs (arXiv 2203.01505) — cite in 2.3 as partial AUC baseline - "Closing the Approximation Gap" (arXiv 2512.01213, Dec 2025) — cite in 2.3 as recent concurrent work on partial AUC @@ -49,8 +49,8 @@ * Experiments — open questions -* TODO Debug banking dataset — results unexpectedly low (roll-aoc 0.511 vs GCE 0.746), investigate root cause -* TODO Check if LibAUC pAUCLoss (one-way partial AUC / SOPAs) should be added as baseline +* DONE Debug banking dataset — results unexpectedly low (roll-aoc 0.511 vs GCE 0.746), investigate root cause +* DONE Check if LibAUC pAUCLoss (one-way partial AUC / SOPAs) should be added as baseline - Already have LibAUC as dependency; low-cost to add - Most direct competitor to roll-tpr90 (both target a fixed FPR region) - See: https://docs.libauc.org/examples/pauc.html @@ -149,13 +149,13 @@ - Beta fix (user's proposal, verified before writing up): replace $f_\theta(\mathbf{x}) \to -f_\theta(\mathbf{x})$ with $f_\theta(\mathbf{x}) \to 1-f_\theta(\mathbf{x})$ — stays in (0,1), and is already computed in the Beta forward pass as the complementary score $t^{(k)}=1-s^{(k)}$ (appendix_beta_roll.tex eq:beta-denom/eq:beta-params). - Verified with sympy/numpy before writing anything (never trusted mentally, per usual convention): (1) numerically confirmed $X\sim\text{Beta}(a,b) \Rightarrow 1-X\sim\text{Beta}(b,a)$ exactly (sympy's symbolic beta() didn't auto-cancel $B(a,b)$ vs $B(b,a)$, so checked numerically instead — matched to 1e-9 across 5 random parameter draws); (2) confirmed the log-moment estimator $D_k$ (eq:beta-denom) is exactly symmetric under swapping which vector is called $s^{(k)}$ vs $t^{(k)}$, so applying the estimator to $1-s^{(k)}$ exactly swaps $\hat a_k \leftrightarrow \hat b_k$ (numerically exact, not approximate); (3) end-to-end check that the same "target rate complemented to $1-\alpha$" recovery claim used for the Gaussian/negation case holds identically for the Beta/$1-s$ case — built both a Gaussian direct-vs-transform check (sanity check of the *existing* thesis claim, confirmed exact match) and a Beta direct-vs-transform check using scipy.stats.beta (also confirmed exact match to float precision) using the swapped $(\hat b,\hat a)$ params as the "new" class parameters. - Rebuilt thesis clean (nix build exit 0), footnote renders correctly with the appendix_beta_roll.tex cross-references (\Cref{appendix:beta-roll}, eq:beta-params) resolving. -** TODO Remove/soften claim that gradient balance implies noise robustness or population FPR control (general, throughout Ch. 3 prose) — these require additional statistical assumptions/arguments or appropriately scoped empirical evidence; should not be presented as direct consequences of the audited identities. +** DONE Remove/soften claim that gradient balance implies noise robustness or population FPR control (general, throughout Ch. 3 prose) — these require additional statistical assumptions/arguments or appropriately scoped empirical evidence; should not be presented as direct consequences of the audited identities. * Final pass -* TODO Build full PDF and proofread end-to-end -* TODO Check all cross-references (\Cref, \label) are consistent after restructuring -* TODO Verify Hebrew ToC entries match English section titles +* DONE Build full PDF and proofread end-to-end +* DONE Check all cross-references (\Cref, \label) are consistent after restructuring +* DONE Verify Hebrew ToC entries match English section titles * DONE [#A] Rerun keel noised experiments — data exists in results-final/keel-noise-05/10/20 * DONE Restructure thesis per mentor guidelines (2026-08-17) @@ -165,5 +165,5 @@ - [x] Ch. 3 restructured: AUC as primary objective, ROLL-AOC promoted - [x] Noise results table added to Ch. 4 * DONE Get rid of TPR results -* TODO re-integrate results for banking -* TODO integrate food101n results when done +* DONE re-integrate results for banking +* DONE integrate food101n results when done diff --git a/workplate.org b/workplate.org new file mode 100644 index 0000000..099517c --- /dev/null +++ b/workplate.org @@ -0,0 +1,17 @@ +:PROPERTIES: +:ID: ee7a8d23-c0c3-4977-abac-5bb253614435 +:END: + +#+title: workplate +#+filetags: :workplate: :planning: + +* Today (2026-10-06 Tue) +** TODO [half-day] (ot-ics-security-ramp) ICS/OT protocol deep-dive — SNMP, Modbus, and refresher on DNP3/IEC 61850 GOOSE/IEC 104/OPC-UA + +* This Week (2026-10-05 to 2026-10-11) +** TODO [few-hours] (just-talking) Review LangGraph (per manager's instructions) +** TODO [few-hours] (just-talking) Review Node.js — refresher, rusty on it (per manager's instructions) + +[[id:3a365596-7744-43a1-9a2b-53d0dcc087cd][ot-ics-security-ramp/todos]] + +[[id:4c4ae633-94c3-4a34-bf81-cf8aa89c034b][just-talking/todos]] \ No newline at end of file