BSides Vancouver 2026

In any complex environment where industrial systems and traditional IT networks meet, we rely on digital signals to tell us the status of physical hardware. We trust our security dashboards to show that a system is running within safe parameters, essentially treating the digital display as the absolute truth. However, as these systems become more integrated, a new challenge emerges where the digital reality becomes optional. Attackers have shifted from simply breaking things to manipulating the very data we use to monitor them. By interfering with communication protocols, a compromised system can be coached to report a perfectly healthy heartbeat to the security team even while the physical equipment is being tampered with in the background.

This session explores the lifecycle of these integrity attacks and how an analyst can spot a lie told by a machine. We will look at how automated status checks are hijacked and discuss the forensic mindset needed to identify the gap between what the network reports and what the hardware is actually doing. By moving away from a total reliance on digital dashboards and focusing on forensic verification, we can better secure environments that mix legacy hardware with modern connectivity. This talk is designed to be accessible for students and practitioners alike, focusing on investigative logic and the reality of securing modern infrastructure without getting lost in vendor jargon.