OT After Hours · Jun 27, 2025 · 33 min

Lightweight Forensics With Verve Reporting

In this episode, we take a look at how Verve Reporting, and in particular its ability to search and filter logs, can be useful for high-level forensic investigation. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Dustin Gogue (Technical Account Manager), Andrew Wintermyer (Team Lead, Device & Integration Research) and Zach Woltjer (ICS Security Specialist) as they dive into how Verve Reporting helped identify user account management and authentication issues. Key Takeaways Proper user account hygiene (especially timely user off-boarding) is a key component of a robust security strategy. Maintaining named user accounts for key personnel is important for non-repudiation during investigations. OT software is sometimes installed in a way that binds its services or application authentication to a particular user account, which can present a challenge when and if that user needs to be off-boarded. The ability to collect, filter, and search event logs quickly and easily is a key component of forensic and incident investigation. Timestamps 00:00 – Introduction and sound check 00:27 – Welcome to Season Two of OT After Hours 00:37 – Guest introductions: Dustin, Andrew & Zach 01:30 – Quick overview of what logs are 02:19 – Why logs are important to digital forensics 04:43 – Dustin steps through the process of investigating an influx of logs and discovering key issues 12:50 – Identifying an improperly off-boarded user account within the authentication logging data 13:30 – The complexities of user off-boarding in OT environments 16:32 – Zach on incorporating user account privileges and user employment status into risk calculations 24:15 – Value of the Verve Reporting platform and roundtable discussion 32:33 - Outtro and thank yous Guest Information Dustin Gogue: Technical Account Manager at Verve Industrial Andrew Wintermyer: Device & Integration Research Team Lead at Verve Industrial Zach Woltjer: ICS Security Specialist at Verve Industrial Subscribe Follow and Subscribe Get in Touch LinkedIn | YouTube | Twitter/X | Contact Verve I Listener Q&A

0:00-33:33

Play in

transcript

No transcript — this publisher did not publish one.

show notes

Key Takeaways

Proper user account hygiene (especially timely user off-boarding) is a key component of a robust security strategy.
Maintaining named user accounts for key personnel is important for non-repudiation during investigations.
OT software is sometimes installed in a way that binds its services or application authentication to a particular user account, which can present a challenge when and if that user needs to be off-boarded.
The ability to collect, filter, and search event logs quickly and easily is a key component of forensic and incident investigation.

Timestamps

00:00 – Introduction and sound check

00:27 – Welcome to Season Two of OT After Hours

00:37 – Guest introductions: Dustin, Andrew & Zach

01:30 – Quick overview of what logs are

02:19 – Why logs are important to digital forensics

04:43 – Dustin steps through the process of investigating an influx of logs and discovering key issues

12:50 – Identifying an improperly off-boarded user account within the authentication logging data

13:30 – The complexities of user off-boarding in OT environments

16:32 – Zach on incorporating user account privileges and user employment status into risk calculations

24:15 – Value of the Verve Reporting platform and roundtable discussion

32:33 - Outtro and thank yous