This website is for streaming and on-demand access to the 2023 ICS Cybersecurity Conference along with access to the virtual expo hall and resources. For the main conference website, please visit www.icscybersecurityconference.com
October 26, 2023 08:00 Dan Kennison October 26, 2023 09:00 Chuck Tommey October 26, 2023 09:00 Terri Khalil October 26, 2023 09:35 This session will focus on discussing the objectives, challenges, and solution framework that shall be taken in the journey of setting up the OT SOC for Brown Field sites. It shall demonstrate the scoring templates to arrive at the current state of OT security and based on the scorecard different paths organizations have taken to pave the way up to setting up the 24x7 OT SOC. The presentation will revolve around sharing the experiences of having worked on more than 70 ICS/OT security projects in various industry verticals, viz. Pharma, Power Distribution, Manufacturing, Cement, Oil & Gas (Refineries, Crude Pipelines, Midstream), Petrochemicals, and Paper & Pulp. Ramandeep Singh Walia October 26, 2023 09:35 Ryan Ferran October 26, 2023 09:35 Karthik Thumula October 26, 2023 10:10 Jarvis Robinson October 26, 2023 10:10 Eric Byres October 26, 2023 10:45 Yenting Lee October 26, 2023 10:45 Stuart Powell October 26, 2023 11:15 Please visit our sponsors in the exhibit hall and view their resources. They're standing by to answer your questions now. October 26, 2023 11:30 Otorio - Yair Attar October 26, 2023 11:30 Ron Fabela October 26, 2023 12:05 Threat Informed Defense and MITRE Detection Engineering – A Practical Guide to Improve the Security Posture with CTI & MITRE ATT&CK for OT • What is Threat Informed Defense and how does it help in the daily work as an IT/OT specialist? • What is the MITRE ATT&CK and D3FEND and what advantages do companies get from the two frameworks? • What is Holistic Threat Modeling and MITRE Detection Engineering and how is good Detection Engineering defined to effectively use CTI? • What level of maturity do companies have regarding Threat Informed Defense (maturity level)? • What could be the goals/starting points for the audience to get more visibility, find gaps and analyze Cyber Threat Intelligence successfully? Simone Kraus October 26, 2023 12:05 In the dynamic world of offshore drilling, demand for secure systems from Original Equipment Manufacturers (OEMs) has never been greater. However, OEMs working with deepwater drillships face a unique set of challenges around constraints of limited space, tight budgets, minimal cloud connectivity, and varying external interfaces to customer systems. This presentation will explore these challenges and provide practical solutions that empower OEMs from all industries to navigate the complex cybersecurity landscape. Join this session to: Aaron Blinka October 26, 2023 12:40 SZ Lin (林上智) October 26, 2023 12:40 Curtis Yanko October 26, 2023 13:20 We've unleashed our dark allies from the nightmare dimension on an unholy crusade to demonstrate cyberattacks for your enlightenment. If you love seeing devices compromised as much as we do, join us for some hacking demonstrations, detailed security research findings, and threat mitigation techniques that will disappoint bad actors. Share your new knowledge around the water cooler, apply these preventative security strategies within your own organization, and become the cool person at the office party everyone wants to hang out with regardless of that cat sweater you insist on wearing. We'll demonstrate several hacks against xIoT, or Extended Internet of Things, devices. For those who would say, But theyre just security cameras monitoring the parking garage, wireless access points in the cafeteria, PLCs controlling robotic welding arms, or our OT devices arent at risk like our IT devices are; what harm can they cause? - this will illuminate that harm. We'll share stories from the trenches involving cybercriminals, nation-state actors, and defenders. Our presentation will detail findings from over six years of xIoT threat research spanning millions of production devices in critical infrastructure and industrial environments around the world. Well identify various steps organizations can take to mitigate risk while embracing a Things-connected world. xIoT encompasses three disparate but interrelated device groups that operate with purpose-built hardware and firmware, are typically network-connected, and disallow the installation of traditional endpoint security controls. The first group contains enterprise IoT devices such as VoIP phones, security cameras, and printers. The second group includes operational technology such as PLCs, building automation systems, and industrial control systems. The third group consists of network gear such as switches, load balancers, and wireless access points. There are over 50 billion xIoT devices in operation worldwide. Most of these devices run well-known operating systems like Linux, Android, BSD, and various real-time operating systems like VxWorks. In addition to common operating systems, many xIoT devices have open ports, protocols, storage, memory, and processing capabilities similar to your laptop. But there is a major difference. Even though most industrial and enterprise environments have tens to hundreds of thousands of these devices in production, they go largely unmanaged and unmonitored. These xIoT devices typically operate with weak credentials, old, vulnerable firmware, extraneous services, and problematic certificates. This massive, vulnerable xIoT attack surface is being successfully exploited by bad actors engaging in cyber espionage, data exfiltration, sabotage, and extortion, impacting xIoT, IT, and cloud assets. And this is especially true in the case of operational technology as businesses gain powerful business benefits but increase their risk as OT and IT infrastructures converge. Cybercriminals have shifted their focus to xIoT attacks. Why? Because they work. Military-grade xIoT hacking tools are in use, cybercrime for hire thats predicated on compromised xIoT devices has been monetized, and organizations worldwide are already compromised without even knowing it. Bad actors are counting on you being passive. They want you to fail so they can continue to evade detection and maintain persistence on your xIoT devices. Disappoint them! Take your xIoT devices back by understanding how to hack them, recognizing where theyre most vulnerable, and employing strategies to successfully protect them at scale. John Vecchi October 26, 2023 14:10 Kyle Miller Pia Capra October 26, 2023 15:00 This session will not be streamed and only available to onsite attendees at the in-person conference in Atlanta. October 24, 2023 08:00 Industrial Control Systems (ICS) are critical to the functioning of various industries such as energy, manufacturing, transportation, and water supply. These systems are vulnerable to cyber-attacks which can lead to disruption of operations, financial losses, and even endanger human safety. As a result, it is crucial for organizations to have a strategy in place to ensure operational cyber resilience in ICS environments. This session will provide a comprehensive understanding of the concept of operational cyber resilience and its importance in ICS environments. Attendees will learn about the current threat landscape for ICS and the potential risks these systems face. The session will then delve into the strategies and best practices for achieving operational cyber resilience in ICS environments. This will include implementing a risk management framework, establishing a robust cybersecurity defense, and developing an incident response plan. Attendees will also gain insights into the latest tools and technologies available to secure ICS environments and how to integrate them into their existing systems. The session will also cover the role of governance, compliance, and employee training in maintaining operational cyber resilience. Moreover, real-world case studies and examples will be shared to illustrate the consequences of cyber-attacks on ICS and how effective cyber resilience strategies can mitigate their impact. By the end of this session, attendees will have a clear understanding of the key elements required to achieve operational cyber resilience in ICS environments. They will also be equipped with practical knowledge and tools to assess their organization's current cybersecurity posture and develop a roadmap towards resilience. In conclusion, this session is a must-attend for anyone responsible for the security and operations of ICS environments. It will provide valuable insights and guidance on how to proactively protect against cyber threats and maintain the critical functioning of these systems. Carlos Buenano October 24, 2023 09:05 In a global landscape increasingly fraught with cyberwarfare and kinetic conflicts that leverage cyber capabilities, professionals defending OT environments face an unprecedented array of challenges. Alerts and advisories are no longer just digital concerns but have immediate real-world implications, especially as advanced nation-state threat actors increasingly target critical infrastructure installations like gas and water pipelines. In this timely fireside chat, John Hultquist, Chief Analyst at Mandiant Intelligence, will explore the upsurge in threat actor activity with a focus on nation-state adversaries that put critical infrastructure systems at risk. Expect a robust discussion on threat actors from Russia, China, North Korea and Iran, the US government’s national cybersecurity strategy, and aspects of cyberwarfare that require urgent attention. Ryan Naraine John Hultquist October 24, 2023 09:40 We face an unprecedented amount of change in OT security as IT, OT and AI all converge. This super-charges Industry 4.0 initiatives but creates new cybersecurity risks and operational challenges across people, processes and technology. Join Del Rodillas, Sr. Director of Product Management for Industrial Cybersecurity, to explore how aligning IT and OT missions and establishing collaborative teams bolster defense, how Board-level prioritization and role clarity foster leadership cohesion, and how streamlined processes merge security controls, procedures, and Zero Trust for nimble threat response. Finally, delve into how a unified IT-OT platform fed by the latest AI innovations can help increase operational efficiency and proactively address OT-targeted threats. Featuring the latest research and best practices from Palo Alto Networks and its customers, this session will help you enhance your cyber defenses across your enterprise. Robert Albach October 24, 2023 10:25 In today's interconnected world, industrial control systems (ICS) are increasingly susceptible to cyber threats that can compromise the integrity of critical infrastructures. One of the key vulnerabilities lies in the external network connections that link ICS networks with the broader cyberspace and 3rd party support providers. ExxonMobil has thousands of external connections that are managed through policy and security reviews across its global operations. This presentation highlights the importance of securing these external network connections and outlines the critical measures required to safeguard ICS networks. Join this seession as we share valuable insights into the risks associated with unsecured connections and outlines practical strategies to fortify these connections, safeguard critical infrastructures, and protect against the evolving landscape of cyber threats. By prioritizing the security of external network connections, organizations can take a proactive stance in ensuring the integrity and reliability of their ICS networks. Blake Gilson Bradley Nash October 24, 2023 10:30 Rick Kaun October 24, 2023 11:05 Please visit our sponsors in the exhibit hall and view their resources. They're standing by to answer your questions now. October 24, 2023 11:20 Greg Maciel Mike Spear Travis Cornett October 24, 2023 11:20 Karthik Thumula October 24, 2023 12:05 Jon "McFly" McEllroy October 24, 2023 12:05 Unlike industries where service interruptions can cause mostly minor inconveniences, the impact of an attack on critical infrastructure can have devastating effects that should be avoided at all costs. That's why organizations in this sector need a solid OT/ICS security program. Attend this session to find out: Jeff Rotberg October 24, 2023 12:45 Ronny Fredericks October 24, 2023 13:45 Francesco Trama October 24, 2023 13:45 Yair Attar Christopher Moore October 24, 2023 14:35 Mackenize Morris October 24, 2023 14:35 Carlos Buenano October 24, 2023 14:35 Benjamin Stirling October 24, 2023 15:10 Mark Brosseau October 24, 2023 15:10 Thomas Pace October 24, 2023 15:50 David Formby October 24, 2023 15:50 Michael Mulcare October 24, 2023 16:25 Randy Petersen October 24, 2023 16:25 Sam Chanoski October 25, 2023 09:00 John Link October 25, 2023 09:40 Dave Barlin Chris Wiwczaroski Adam Robbie Bradley Nash October 25, 2023 09:45 Roya Gordon October 25, 2023 10:25 Brian Schleifer October 25, 2023 10:25 Kam Chumley-Soltani Anastasia Mills October 25, 2023 11:00 Please visit our sponsors in the exhibit hall and view their resources. They're standing by to answer your questions now. October 25, 2023 11:15 Retina Turner October 25, 2023 11:15 Mitch Rappard October 25, 2023 11:50 Scott McNeil October 25, 2023 11:50 With the increase of digitization of the manufacturing sites growing OT security threats are emerging. Many asset owners turn to the IEC62443 standard as the reference for designing their OT Security controls. However this standard is quite extensive with 100+ Security Requirements and quite a complex process for assessing your Security Level vs the Security Level Targets. Ilan Barda Ilker Sahin October 25, 2023 12:45 Debbie Lay October 25, 2023 13:30 Blaine Jeffries October 25, 2023 13:30 Tom Sego October 25, 2023 14:10 Jason Ortiz October 25, 2023 14:10 Alan Raveling October 25, 2023 14:10 Benjamin Stirling October 25, 2023 14:45 Mark Bernardo October 25, 2023 14:45 Gerard Vidal October 25, 2023 14:45 Omar Jasso Jake Marullo October 25, 2023 15:20 Vivek Ponnada October 25, 2023 15:20 Yair Attar October 25, 2023 15:20 Chuck Tommey October 25, 2023 16:00 William Malik October 25, 2023 15:55 Saranachon Iammongkol Ding-Jie Huang October 25, 2023 16:00 Trae Mazza OT assets in industrial organizations are vulnerable and exposed. Gartner predicts that by 2025, 30% of organizations in the industrial sector will experience a security breach that will halt operations or impact mission-critical cyber-physical systems. View this demo to see Palo Alto Networks Industrial OT Security secures your OT assets and networks. Join us for a compelling customer case study featuring OTORIO's game-changing platform. In this session, uncover strategies to optimize your OT security operations for enhanced resilience. Learn how to harness existing controls for a stronger security posture, involve maintenance teams effectively, explore innovative vulnerability mitigation approaches, and seamlessly unify diverse security controls. Don't miss this chance to revolutionize your OT security approach with real-world insights from OTORIO's exceptional journey. Securing Remote OT Assets from cyber threats requires addressing multiple threat vectors while overcoming environmental, computing and network challenges. Personnel constraints and modern cyberthreats require a solution that is easy to deploy, provides an automated response including threat containment, and doesn't generate false positives or cause unplanned outages or disruptions. Discover how the use of deceptive techniques and multi-layer context filtering, combined with static and dynamic defense policies can be implemented to generate and immediately apply organic threat intelligence to defend remote locations. Walk through various parts of the Nozomi Networks platform including the Guardian sensor and Vantage SaaS components. Learn how to quickly identify assets and their vulnerabilities, as well as tracking abnormal behavior and activities. See how our multi-protocol IDS engine parses and decodes traffic in real time to extract data for analysis. You will also see how dashboards and reporting can be tuned and customized to suit the various user types of the platform. As Digital Transformation initiatives diminish the use of air gaps, industrial networks are more integrated with IT or corporate networks opening the door for bad actors to move laterally from IT into operational technology (OT). This expanding attack surface reinforces the need to act before a breach disrupts production. Deploying a deception capability that can run relevant lures and decoys spanning across IT and OT environments can distract the malicious actors as they move about in these environments. Deception can address two key challenges for industrial organizations. The first challenge is “too many” false positives presented in other anomaly detection offerings. The second challenge is the difficulty deploying other security controls and enhancements in sensitive OT environments. During this webinar, we will address the pros and cons of deploying deception in OT and provide an approach that can yield low false positives. From this session, you will hear uses cases for deception and understand the: Tenable OT Security Demo Verve Demo highlighting Verve's security center TXOne Networks Demo: Portable Inspector This demo goes over Cisco Cyber Vision. Learn about its unique deployment architecture and how it can help you gain in-depth view of your OT security posture so you can extend IT security tools to your industrial environment. Airgap Case Study: Segment and Secure Biopharma and Healthcare Industry with Agentless Segmentation
Agenda
Building a Resilient OT & ICS Defense
In a rapidly evolving threat landscape, OT and industrial control systems (ICS) can't afford to lag in cybersecurity measures. Join airgap.io as we provide a compact and practical guide to elevating your OT cybersecurity through industry best practices. Key Takeaways for Creating Defensible Network Architecture East-West Visibility: Understand why intra-OT network visibility is vital for pinpointing and neutralizing threats in SCADA and ICS systems. Multi-Factor Authentication (MFA): Learn the value of extending MFA protocols to every device within your OT network for robust identity verification. OT-IT Segmentation: Explore why segmenting OT from IT environments is non-negotiable for mitigating risks and improving overall security. Enforcement: Discover how pre-configured, instant-on containment within your OT network is essential in the chaos of a breach Beyond VPNs: Uncover modern alternatives to VPNs and jump servers for secure, segmented access to OT systems. By the end, youll have actionable strategies to enhance your OT and ICS security posture, aligned with the road to Zero Trust and Defensible Architecture. Ideal for network engineers, architects, OT engineers, and CISOs.
Airgap Networks, Head of Sales
Let's Learn to SOAR in OT Environments
Security Orchestration, Automation, and Response (SOAR) is assisting IT cyber teams to combat the enormous information overload and alert fatigue experienced when implementing comprehensive cybersecurity defenses. Security Information & Event Management (SIEM), Intrusion Detection Systems (IDS), Next Generation Firewalls (NGFW) are excellent tools, but they must be monitored and managed. Typically, when SOAR has been tried in an OT environment it fails due to the "black box" nature from the plant-floor staff perspective. Engineers and operators are nervous, at best, about a system that can effect their ability to produce quality products without any status information or control over what it will do. Come learn how to implement SOAR in an OT-focused and OT-friendly way to maximize plant-floor cyber-situational awareness while giving engineering full control of what will happen and when.
Siemens Industry, Inc., Digital Connectivity Executive
ICS Security Can You Set it & Forget It? Establishing an ICS Cybersecurity Compliance Program
This session discusses the elements of a cybersecurity compliance program, whether for a new regulation or to proactively improve your security posture - within the context of both industrial control systems and adjacent IT systems. We will explore the potential impact of regulations on industrial control system environments, and strategies to utilize the regulations or a standards-based framework as a foundation for enhancing security and resilience. Key Takeaways: Participants will gain practical insights for developing a robust compliance program tailored to industrial control systems. How to establish governance structures, engage key stakeholders, and ensure clear communication channels and learning for a coordinated approach Interpreting regulations and defining their scope, ensuring a clear direction for compliance efforts, including selected frameworks when mandatory regulations arent required. Preparing for evidence management to help maintain alignment with compliance requirements. Integrating processes into day-to-day operations and monitoring with cognizance of safety of life, equipment sensitivity and other ICS considerations. Strategies for audit readiness Procedures for addressing non-compliance Sustainability will be the ultimate focus, ensuring long-term success in compliance endeavors across industrial control systems Whether you're an experienced professional in industrial control systems security or IT security, or new to both domains, this session offers practical guidance to reinforce cybersecurity resilience and succeed in compliance efforts, considering the diverse regulatory or other scenarios that may apply.
CyberKaleidoscope, LLC, CEO/Founder
OT SOC for Brown Fields
QOS Technology, Heading OT Security Practice, CEO
How to Physically Protect Critical Networks
Join this session to learn all about physical security in the modern landscape and how it is an often overlooked critical layer of cybersecurity. For organizations of all sizes and types understand the nuances of protecting your equipment, networks, and data from physical attacks. In this presentation Ryan will leverage real world examples and expertise cultivated over his time leading BPM's physical assessment team and show attendees how to examine their organizations' own physical security posture. Learning outcomes : 1) How examine, and harden, analogue and electronic physical security measures 2) Techniques we leverage to bypass network security controls and what controls stop us 3) Examine the ever-increasing target that is critical infrastructure and your role in protecting it
BPM, Manager and Senior Penetration Tester
Industrial OT Security to Protect your OT Assets
OT assets in industrial organizations are vulnerable and exposed. Gartner predicts that by 2025, 30% of organizations in the industrial sector will experience a security breach that will halt operations or impact mission-critical cyber-physical systems. - Simplify and automate at scale leveraging ML-powered asset inventory - Understand your most critical systems and prioritize vulnerabilities with continuous risk monitoring - See asset communication patterns mapped to the Purdue Model - Learn how to protect the OT perimeter with OT network segmentation, without sacrificing process integrity - Secure your OT assets and networks through digital transformation and beyond
Palo Alto Networks, Principal Technical Marketing Engineer
Watershed Moment: Solving cybersecurity in water through shared responsibility
Our modern era of connected industrial control systems (ICS) in the water sector presents opportunities to solve key challenges, which helps utilities, industrials, suppliers and other parties in the ecosystem to transform water systems together. As ICS becomes more connected and integrated, so does the need for cybersecurity protections. In this presentation, we will talk about the digital journeyrelatedto ICS, as well as associatedconsiderationsfor your cybersecurity strategy. We will also cover perspectiveonhow a "shared responsibility" approach can help you in building digital trust.
Xylem Inc., Senior Director, Product Security at Xylem Inc.
Making a Molehill Out of a Mountain of SBOMs
Industrial control system (ICS) industries have been through numerous high-profile supply chain incidents, prompting an 2021 Executive Order mandating the supply of Software Bill of Materials (SBOMs) for all critical software. Now starting in 2024, if you sell systems to the US federal government, you must provide SBOMs with your software. And if you use software in critical industries, you will likely be required to collect and manage the SBOMS provided by your OT suppliers. However, outstanding questions remain on how SBOMs will actually contribute to better security. Will SBOMs just be bureaucratic paperweights? What do they even look like and how can industry use them? Will having SBOMs result in an overwhelming list of vulnerabilities we must deal with? In this talk, well share how to convert the mountains of data inside SBOMs into actionable threat and risk intelligence. Well explain how to make practical use of SBOMs to improve visibility into your software supply chain: your suppliers, their software, and the components they embed in their products. Learning Objectives: * Understand the minimum elements of an SBOM * Learn what additional data is necessary for SBOMs to be truly useful * Discover how industry leaders are using SBOM data today and where they are heading * Hear how the industry can handle the legacy device problem * Understand repercussions and alternatives if a vendor cant (or wont) generate SBOMs for their clients Well close with real world examples of vendors in the Oil & Gas sector that provide SBOMs and how their customers can use them. You will leave this session knowing how to use SBOMs to reduce risk in your industrial control systems.
aDolus Technology Inc., CEO
The Lost Vision in Cyber-Physical Systems - The Anatomy of Programmable Asset Attack Vectors
A programmable asset means that the asset provides a flexible programming function, the asset can execute physical behavior automatically according to the code. In the driven modernized OT environment, we found common programmable assets including PLC, CNC, AM, and industrial robots. However, with the benefit of efficiency and adaptability, it also carries on a more complex lifecycle, leading the assets to be exposed the cyber threats. We believe increased visibility of the threats can reduce cybersecurity risks and the overall cost of asset owners. In light of this, we analyze the lifecycle of programmable assets and survey their cyber threats at all stages. In addition to supplementing currently less-researched threats, we also show novel attack vectors from programmable assets. In this talk, we will share how attackers execute the initial attack according to the character of the programmable asset, having the opportunity to spread malicious code in the OT environment. Finally, we propose a hybrid SBOM and OT zero trust strategy to mitigate the threats.
TXOne Networks, Threat Researcher
The Other IT-OT Networking; Interpersonal Communication Lessons for a Strong OT Security Program
Elanco Animal Health built a global network infrastructure as a landing platform for its compute environment after separating from Elly Lilly. In that process the OT organization was offered to provide input in the design of LAN communication from OT systems within the IT networking environment. We have since taken a seat at the design table to improve the security stance at our manufacturing sites. To implement a secure and stable design we also had to work through the interpersonal communication difficulties inherent with the differences in the IT and OT realms so that we could collaborate. The lessons we learned in this journey included: Build relationships with OT champions in the IT team. Communicate the differences in business priority between the two teams. Share how their technical dictionary is different from ours. Wrestle through the complexities that they don't understand our requirements, capabilities, and limitations. Invite their team to work in our spaces.
Elanco Animal Health, OT Security Engineer
BREAK
Shared Responsibility in DCS/SCADA: Challenges & Actionable Strategies
In the realm of Industrial Control Systems, particularly in DCS/SCADA environments, the concept of shared responsibility among stakeholders for different security aspects poses significant challenges. This session aims to explore the complexities that arise from blurred accountability and responsibility by discussing real issues uncovered through our research on common DCS & SCADA systems, including SIEMENS PCS 7, GE CIMPLICITY, and ABB 800xA. Through various examples, we will examine gaps in secure deployment, auditing, secure communication, and SBOM management, shining a light on the unclear responsibilities for some security aspects within these systems. The session will delve into how the approach of IEC 62443 can contribute to defining responsibilities for different security aspects while highlighting loosely defined and easily overlooked responsibilities in the context of DCS/SCADA. Practical recommendations and tools will be offered in this session to assist asset owners, service providers, and product suppliers in addressing similar gaps, better understanding their role in shared responsibility, and enhancing the security posture and resilience of ICS environments. Key Takeaways: - Challenges associated with shared responsibility in securing DCS/SCADA systems, illustrated by real examples of related security gaps. - Shared responsibility according to the IEC 62443 standard, and areas of oversight. - Practical recommendations and tools to enhance the security of these systems and address uncertainties in shared responsibility.
Exposed Industrial Control System Remote Services: A Threat to Critical Infrastructure
Industrial control systems (ICS) are critical to the operation of many essential services, including power grids, water treatment plants, and transportation systems. These systems are often connected to the enterprise, which opens the door for potential cyber-attacks. In ICS environments, access equals control, with exposed remote services being one of the most common attack vectors. Remote services are software applications that allow users to connect to an ICS from a remote location. These services can be used for various purposes, such as troubleshooting, maintenance, and updates. However, if these services are not properly understood or secured, they can be used by attackers to gain unauthorized access to ICS systems. In this presentation we will explore with the audience a deeper understanding of the attack surface challenge for industrial environments, how to identify remote services exposures, and recommendations on how to gain control of your remote logical access.
XONA, Field CTO
Threat Informed Defense and MITRE Detection Engineering
Orange Cyberdefense, Security Analyst
Securing Cloud-Disconnected, Small-Scale Systems for Offshore Drillships: Challenges and Solutions
HMH Pressure Control Systems, Principal Software Engineer
Secure ICS Open Source Supply Chain: Common Pitfalls and Best Industry Practices
With the increasing use of open source software in ICS, it is vital to understand the common pitfalls and implement best practices to ensure a secure open source supply chain. This session will shed light on the common pitfalls that arise in the open source supply chain for ICS, such as visibility gaps, conflicts between open source licenses and security capabilities, challenges in vulnerability management, and supply chain security issues. It emphasizes the importance of adopting effective practices to manage open source supply chain, considering the inclusive nature of open source software where anyone can contribute. By addressing these pitfalls, attendees will gain a deeper understanding of the associated risks and the critical need to mitigate them. Furthermore, the session will present best industry practices for establishing a secure open source supply chain in ICS with the three pillars of cybersecurity - People, process, and technology. These practices include comprehensive component management, license clearing, effective vulnerability management, collaboration with the open source community, and supply chain security assurance. Attendees will learn about software composition analysis tools and secure development processes that can enhance the security of the open source supply chain. Real-world case studies and examples will be shared to illustrate successful implementations of these best practices. By attending this session, participants will learn the best industry practices that can be implemented to establish a secure open source supply chain. Ultimately, attendees will be empowered to strengthen the security of their ICS deployments and mitigate risks associated with the open source supply chain.
Bureau Veritas
SBOMs, Regulations and Time Bombs in Legacy Devices
SBOMs (Software Bill Of Materials) are crucial for securing ICS environments. Just as every company maintains an inventory of ICS devices, SBOMs provide an inventory of software contained in operational technology (OT) products, while aiding in vulnerability identification. While SBOMs are mandatory for some OT systems, the focus of regulations on new products neglects the large contingent of legacy devices in ICS environments. In this session, we'll discuss the role of SBOMs in securing ICS environments from vulnerabilities lurking in software components embedded in OT devices. Attendees will: - Learn the unique challenges associated with generating SBOMs for legacy ICS products - Understand the regulatory demand for SBOMs in ICS environments - Find out how to implement a comprehensive SBOM process using different types of SBOMs for new and legacy devices
CodeSecure, Principal Solutions Architect
xIoT Hacking Demonstrations to Disappoint Bad Actors
Phosphorus Cybersecurity, CMO
Operational Technology (OT) Cybersecurity Transformation as a Business Enabler
In todays increasingly competitive business environment, organizations seek to boost productivity, increase resilience, and gain an advantage. Many companies are transforming their operations from the ground up to achieve these lofty goals, converging OT and IT more than ever. While these initiatives can bring tremendous opportunities, the hyper-connectedness that they create also opens the door to cyber adversaries looking to impact the most critical areas of the business. This is a fantastic opportunity for cybersecurity teams to become business enablers breaking down silos, bridging the divide between the cyber and business teams, and delivering cyber solutions at scale all while not impacting plant operations. We will discuss best practices and lessons learned from our experience implementing large-scale OT cybersecurity programs. This will include stories from the trenches, starting with building a successful business case, scaling OT cybersecurity controls, and changing hearts and minds.
Booz Allen Hamilton, VP, Infrastructure Cybersecurity
Booz Allen Hamilton, Principal – OT Cybersecurity Capability Lead
Closing Panel @ 2023 ICS Cybersecurity Conference
Securing ICS Environments: Achieving Operational Cyber Resilience
Armis, CTO for OT
Fireside Chat: John Hultquist, Chief Analyst, Mandiant Intelligence
SecurityWeek, Editor-at-Large
Mandiant, Google Cloud, Chief Analyst of Mandiant Intelligence
IT-OT Security Convergence: Navigating the Journey to Industrial Cyber Resilience
Palo Alto Networks, Director of Product Management
Consequences of Compromised External Network Connections (ExxonMobil)
ExxonMobil, Industrial Cybersecurity Ops Manager
ExxonMobil, IIT Perimeter Security and External Connections Supervisor
How to Build A Successful Business Case for OT Cybersecurity
One of the biggest challenges organizations face is developing a robust business plan that creates the right momentum, focus and budget required to protect against cyber-related threats. A successful business plan in OT cybersecurity includes making demonstrable and measurable improvements in an organizations OT security posture and aligns organizational resources and team buy-in. In this session, Verve CEO, John Livingston will share how to: Define overall expectations and set measurable goals Identify key stakeholders and successfully secure cross-department buy-in Gather data on potential threats and risks Create a risk remediation roadmap and vendor-agnostic management solutions
Verve Industrial, VP Solutions
BREAK
Panel: Risks and Rewards of Cyber Resilience | Securing Industrial Control Systems
Recent cyberattacks have demonstrated increased risk to both IT and operational technology (OT) environments. Cybercriminals are maximizing their opportunity by exploiting vulnerabilities given the expanding attack surface. Strategic readiness should be underpinned with the notion that eventually an attack will happen, and when it occurs, you are proactively ready to respond. During this session, we will explore security considerations for developing cyber resilience covering security fundamentals and readiness planning to protect your IT and OT environments.
Fortinet, Director, OT Automation & Control Alliances
Honeywell Connected Cyber & Industrials, General Manager, OT Industrial Cyber
Toyota Material Handling, Director, Cybersecurity and Compliance
Beyond Purdue 3.5: Strategies for Zero Trust within the ICS Core
Attacks on manufacturing, energy, transportation and other critical infrastructure are on the rise and governments and boards of directors are requiring comprehensive compliance and inspection. But downtime is unacceptable and a single mistake can be catastrophic. A Zero Trust approach in the core of your ICS can increase your security while reducing the risk of downtime. But the path to implementing Zero Trust requires the right architecture and rollout. Join Palo Alto Networks for an overview of how a Zero Trust approach to OT Security can help. In this session you will learn how to get complete visibility and insights into all your devices and deploy a Zero Trust security approach to your OT environments.
Palo Alto Networks, Principal Technical Marketing Engineer
OT Insights From a Weapon Systems Pentester: Culture and Candy Shells
Having spent decades as both an operator and tester of operational technology (OT) systems, Jon "McFly" McEllroy offers his unique perspective, historical trends, and common themes found through pentesting weapon systems. Through the use of examples the speaker hopes to draw attention to the need for OT to refocus on design, requirements, and attack surface minimization before deployment to realize a greater ROI regarding Cyber investment across the acquisition lifecycle.
MTSI, Lead Offensive/Defensive Weapon Systems Cybersecurity (WSC) group
5 Essentials of a Solid OT/ICS Security Program for Critical Infrastructure Sectors
Tenable, Inc., Director of Business Development
Lunch Workshop: The Evolution of OT Monitoring
ICS networks were traditionally created without security in mind. As technology advanced, so have threat-actors; forcing the industry to adapt. To prevent against cyber threats stemming from human error, accidents, and acts of physical sabotage, security monitoring became a priority. The increasing integration of OT with business networks and internet-based applications has vastly increased the prevalence and complexity of cyber threats to ICS networks. As a result, passive-only monitoring does not guarantee a full picture and massive amounts of data can become a burden to monitor. To defend against a diverse set of cyber threats, you need a comprehensive and flexible ICS security strategy that aligns with industry 4.0 Join our lunch and learn session to learn how to go beyond segmentation and bring your OT security strategy to the next level. Well cover: Trends from the field of deployments and how that has changed in the recent years How to get a clear understanding of all the assets in on your networks and how to identify blindspots through the use of passive, active, and agent monitoring. Advanced threat detection and vulnerability assessment to identify and prioritizes security risks How to predict and detect OT process and stability issues giving you early warning signs of possible downtime using data analytics in the cloud
Nozomi Networks, Field CTO
Threat Containment and Risk Mitigation at Remote OT Facilities
Securing Remote OT Assets from cyber threats requires addressing multiple threat vectors while overcoming environmental, computing and network challenges. Personnel constraints and modern cyberthreats require a solution that is easy to deploy, provides an automated response including threat containment, and doesn't generate false positives or cause unplanned outages or disruptions. Find out how the use of deceptive techniques combined with additional static and dynamic policies can be implemented to generate organic intelligence that is immediately applied at wire speed.
PacketViper, CEO
Why Most OT Vulnerability Approaches Fail: A Risk-Based Strategy with the Delek US Case Study
As the digital wave reshapes industries, many OT security methods come up lacking, often relying too heavily on isolated fixes. This talk sheds light on the importance of a risk-based strategy in OT security. By zeroing in on exploitation vectors, high-impact vulnerabilities and using existing security tools, companies can maximize ROI and cut down on distractions from minor threats. This focused approach aids in making clear, business-centered choices. Explore why many OT tactics fall short and how a risk-centered shift offers a stronger defense for our digital operations. Join us as Delek US, a downstream energy company with assets in petroleum refining, logistics, convenience stores, asphalt, and renewables, provides an insightful case study, offering a real-world application of these strategies. Witness firsthand how the adoption of a risk-based approach has transformed their operational resilience, providing tangible results and actionable insights for other organizations aiming to bolster their OT security.
Otorio, CTO & Co-founder
Delek US
Better, Not Best, Practices
A common theme that has been extracted from the lessons learned of consulting on ICS cybersecurity for dozens of organizations has been that better practices beat out best practice recommendations with feasibility, cost, likelihood of implementation and improvement in security posture. Year over year of recommending best practices is met with reevaluating unchanged environments because lofty ambitions can lead to decision paralysis. This is a flaw in best practices, while they are theoretically the community agreed upon baseline for security, they leave something to be desired in the roadmap of an organizations maturity. We have tried to remedy this with maturity roadmaps like C2M2 or CMMC but these too leave something to be desired as they offer abstract qualifications about practices that can be self-diagnosed into maturity class. In the meantime, all discrete and published security controls surround best practice implementation. Instead, lets focus on the better practices. A showcase of lessons learned from a few instances where a better practice to the current was a superior recommendation than a more often quoted best practice.
Dragos, Senior Industrial Consultant
Cyberwarfare on the Rise: How to Operationalize Cyber Resiliency of the Oil and Gas Industry
Accelerating operational technology (OT) resiliency program implementations has become a priority given the expanding attack surface, an ever-growing number of significant attacks affecting OT organizations hitting the news almost daily, and increased cyberwarfare threats from nation-state actors. The threat of cyberwarfare, in particular, is so significant that The Armis State of Cyberwarfare and Trends Report: 2022-2023 found that 74% of global IT and security professionals responsible for critical OT infrastructure surveyed agree that boards of directors are changing the organizational culture towards cybersecurity in response to the threat of cyberwarfare. However, because it's a new frontier for most organizations, the path forward is commonly unclear and can be daunting for many. In this session, Carlos Buenano, Principal Solutions Architect of Operational Technology at Armis, will discuss best practices for deploying a rapidly enabling and continuously maturing OT-oriented cyber resiliency program at scale. In this session, Carlos will highlight recent attack trends, share industry research and offer actionable insights for attendees to implement immediately and to help organizations in the oil and gas industry increase cyber resiliency right away.
Armis, CTO for OT
Living off the Land: An Intruders Approach to Inventory
It is critical to think and work as an intruder to enumerate your ICS environment. As it is not possible to secure what you are unaware of, the importance of a complete inventory cannot be understated. It is the basis from which you will build your cybersecurity program and strategy, and it will be the most critical tool you will need to respond to any potential or actual incident. The enumeration of assets on a network and their component can be difficult to impossible in an environment where active and authenticated scanning is an unacceptable risk. This leaves the OT practitioner to rely on the systems and tools at hand. How to boot strap an inventory using native tools common to ICS systems will be the first topic of this presentation. We will discuss key considerations for a complete inventory: assets in scope, configurations, ports and services, installed and portable software, and methods to boot strap your inventory. While most programs will consider a basic inventory and then the automation of it the first priority; I argue that an expanded and augmented inventory is required before automation. Before automating inventory collection, additional information is needed to defend the ICS environment. Critical security and operational logs must be identified and their retention understood. This triage is critical if an incident happens before a: complete, automated, and mature security programs is in place. Additionally, backups operational health and other basic security controls must be in place before considering automation. Understanding and ranking both system and component criticality is imperative to building a security program. Knowing the impact of a system or component on production and/or regulatory compliance are all prerequisites to automation. Finally, we will discuss the next steps in automating and maintaining inventory and log collection, the methods of doing so and the pros and cons, including passive vs active. Furthermore, we will discuss how to monitor and maintain this automation. Unnoticed failure is not an option.
ABS Group, Global Director ICS Cybersecurity
Adventures in Establishing an OT Cybersecurity Framework
As the leader of a team responsible for the water control system infrastructure serving over a million people, cybersecurity is taken seriously and is an important aspect of our yearly operational requirements. In what some might have considered the good old days, the board of directors didnt know the name of the OT ICS leader but that has certainly changed as quarterly cybersecurity reports and yearly visits to the boards cybersecurity audit committee are now well established. This session will outline the journey and some of our experiences and learnings related to establishing an OT cyber secure environment. The items to be covered include: > Definition of the objectives for the OT environment. > Stories from our searches for OT tools which included events at previous ICS conferences. > Criteria used to evaluate vendors and our experiences with them. - this will include CyberX, Nozomi, SCADAFence, Rapid7, McAfee SIEM, QRadar [named only as an OT security vendor] > Our view on todays vendors and our vision > Addressing Supply chain management > Transition and support from a Managed Security Service Provide > Evaluation of cybersecurity maturity > Addressing issues with vendors requiring remote access for support > Cybersecurity risk analysis using process methodology as a basis The focus will be to share with other end users our experiences but it will also include some end user perspectives that vendors could learn from.
EPCOR Water, Mark Brosseau, Senior Manager, EPCOR Water Control & Automation Engineering
Identifying Non-CVE Risks Within OT & ICS
The need to identify pressing, exploitable vulnerabilities beyond CVEs has never been more urgent. NetRise CEO Thomas Pace presents a session on the disparity between device vulnerabilities and our understanding of risk, focusing on often overlooked non-CVE risks. Vulnerabilities catch the headlines and rightfully so, but there is a gross misconception that a device with 0 CVEs is risk free. This could not be further from the truth, especially for ICS and OT devices. Non-CVE vulnerability arising from public/private key pairs, authentication accounts, plaintext passwords, cloud API keys, and misconfigurations is the rule, not the exception. This discussion will cover the causes and effects of unaddressed risk, as well as steps available for direct mitigation and ongoing management of all vulnerabilities not just those which are publicly available. Tom will present his findings from looking at hundreds of thousands of firmware images running on OT and ICS devices, and share the data driven output from this analysis in identifying non-CVE risks for these critical devices.
NetRise, CEO
Analysis of Vendor Support for Secure PLC Coding
PLC programmers can build in a layer of defense at the PLC itself by writing code that validates inputs and improves monitoring, among other things laid out in the Top 20 Secure PLC Coding Practices. However, the implementation of these practices can differ from PLC vendor to PLC vendor and even from family to family inside the same vendor, making it difficult for PLC programmers to know where to start. In this talk we will walk through a systematic analysis of the documentation from top PLC vendors and families, summarizing the support and implementation guidelines for following the Top 20 secure coding practices, and introducing an open source repository to serve as a collaborative reference for programmers to follow for their PLCs.
Fortiphyd Logic Inc, CEO/CTO
Disaster Recovery Planning for Critical Infrastructure
As part of a robust defense in depth strategy, cybersecurity planning for critical infrastructure and water systems should not only consider defensive measures, but recovery measures as well. The likelihood of a cyber-related incidents, especially on critical infrastructure, is increasing steadily. Attack vectors are constantly changing and protecting your water treatment facilities and systems is becoming more complicated and complex, increasing the likelihood of a cyber incident. Many attacks now include ransomware that can hold systems hostage or compromise their integrity for malicious or even foreign strategic reasons. Preparing a disaster recovery plan can quickly return critical infrastructure systems to service to a known and safe state. Carefully preparing a disaster recovery plan is crucial to the integrity of your water treatment plant or system. This presentation focuses on the technologies, methods and policies that can help a water treatment facility recover from a cybersecurity attack. The presentation will outline how to prepare a disaster recovery plan with particular considerations for water treatment systems. The outline will help answer questions such as: Who needs to be involved? What documentation needs to be developed? What cyber assets, control equipment and software needs backup? What are common methods for backing up software? How should backups be stored? and finally, How and are disaster recovery plans implemented? A disaster recover plan is often overlooked or not considered because some do not realize it is needed or perhaps more focus is placed on protection. Unfortunately, cybersecurity has limitations on what it can protect. Given the likelihood of an attack and consequential damage, a disaster recovery plan is an essential part of cybersecurity planning.
Mott MacDonald, Principal Project Manager - Smart Infrastructure
Network Asset Visibility Fundamental for OT Cybersecurity
Events throughout the past few years have highlighted the need to protect critical infrastructure, such as water and wastewater. The number of attacks against operational technology (OT) networks has increased and has been subject to both targeted attacks and indiscriminate attacks. There has been significant advancement in the knowledge and tools used by those wanting to disrupt or damage critical infrastructure. Additionally, the changes to the work environment, caused by a global pandemic, have created more connections between traditional enterprise networks and the OT networks. In this connected landscape, one of the fundamental needs to building a strong OT cybersecurity program is asset visibility. With asset visibility an organization is better able to identify all the devices connected to the OT network. This includes the assets that are vital for maintaining the water and wastewater, distribution, and collection processes. It also includes the assets that are unknown, such as a smart meter connected long ago and forgotten about. The other reason that asset visibility is so important is that it helps the organization to visualize the traffic flows into, within, and out of the OT network. Organizations can see what network traffic is normal and what is unusual, where network traffic is crossing trust boundaries and firewalls, and even where there is an unknown communications path. The identification of these network traffic patterns shows the normal vertical and lateral traffic movements and exposes the unknown network traffic communication paths that bypass certain network trust zones. Once this data can be seen and visualized, other protections can start to be put in place. Asset Visibility give an organization the solid foundation needed to build a robust and secure OT network.
San Jacinto River Authority, SCADA Superintendent
Cyber-Informed Engineering Principles: What's in it for me?
CIE is an emerging method to integrate cybersecurity considerations into the conception, design, development, and operation of any physical system that has digital connectivity, monitoring, or control. CIE complementsbut does not replacethe application of cybersecurity standards or practices currently in place within an organization. Rather, it expands cybersecurity decisions into the engineering space, not by asking engineers to become cyber experts, but by calling on engineers to apply engineering tools and make engineering decisions that improve cybersecurity outcomes. CIE examines the engineering consequences that a sophisticated cyber attacker could achieve, and drives engineering changes that may provide deterministic mitigations to limit or eliminate those consequences. Engineers and technicians that design critical energy infrastructure installations can integrate the 12 principles of CIE into each phase of the engineering lifecycle, from concept to retirement. These principles are aimed at system or design engineers, operators, and technicians, rather than software engineers or operational cybersecurity practitioners, because the engineers who design, build, operate, and maintain the physical infrastructure are best positioned to leverage a systems engineering design to diminish the severity of cyber attacks or digital technology failures. This approach creates new opportunities for engineering teamsand not just cybersecurity teamsto secure the system using the physics and mechanics of engineering controlsnot just digital monitoring and controls.
Idaho National Laboratory, Technical Relationship Manager
A Day in the Life of a Military Security Tester
The modern battlefield is not solely physical but digital, a labyrinth of interconnected systems, from tactical military hardware to national critical infrastructure. This session provides an in-depth look at "A Day in the Life of a Military Security Tester" by weaving through an expansive list of topics that are essential to both military and national security. Participants will gain valuable insights into the methodologies, practices, and challenges in maintaining robust security stances across diverse operational environments.
United States Marine Corps, Cyber Analyst
PANEL: Best Practices for Converging IT/OT Security Operations
As IT and OT come together, attacks can come from any direction. Hear the latest OT threat research from Palo Alto Networks and dive deep on first hand insights from industry experts on how IT and OT can work together in the SOC and beyond. You will discover best practices and lessons learned, covering the people, processes, and technologies that make finding and protecting against threats possible. This is a chance to gain valuable insights and shape the future of an integrated and harmonious OT Security strategy.
Palo Alto Networks, Sr. Director of Product Marketing, Growth Security Services
Metropolitan St. Louis Sewer District, SCADA, DCS & OT Cybersecurity Administrator Supervisor
Palo Alto Networks, Senior Security Researcher
ExxonMobil, IIT Perimeter Security and External Connections Supervisor
The Inside Job: Assessing the Risks of Insider Threats to Industrial Environments
The focus of industrial cybersecurity has predominantly been about defending against external cyber criminals and Advanced Persistent Threats (APTs). While those efforts are indeed valid, a growing body of evidence indicates that insiders - witting/unwitting employees and third-party contractors - also pose a significant threat to OT environments. Due to their privileged access and technical know-how, attacks launched by malicious/non-malicious insiders have the potential to cause the same level of damage, disruption, safety hazards, and financial loss in comparison to external threat actors. Threat actors often have to obtain network access, escalate privileges once in the network, then create lines of code that targets specific vendor devices, versions, etc. which, although achievable, can make launching a sophisticated attack time consuming with a high chance of failure. In this presentation, we will discuss the growing threats insiders pose to industrial environments, how dark web threat actors are leveraging insiders to carry out attacks, and recommendations on how you can counter insider threats within your organization.
Hexagon’s Asset Lifecycle Intelligence Division, Executive Industry Consultant for OT Cybersecurity
How Cyber Techniques From Weapons Systems and Other Industries Can Help Protect ICS
Working the array from IT perspective to weapons systems and studying cyber physical systems in other industries has led to the awareness of a needed collaborative effort in understanding the limitations, commonalities, and differences in cybersecurity techniques among multiple industries. Digital engineering is a methodology that can help bring sustainability and an authoritative source of truth for the lifecycle of the systems and infrastructure. The information of cybersecurity techniques from cyber physical systems (OT) from one industry can cross pollinate to be implemented across industries including industrial control systems.
Modern Technology Solutions Inc. (MTSI), Senior System Security/Cybersecurity Engineer and Analyst
OT/ICS Security: Where Do I Start?
Protecting your industrial operations from cyber threats is a priority. But where should you start? As you go through the journey, you might be wondering which capabilities to prioritize to effectively secure your ICS/OT environment. In this session, well highlight best practices for a stepped approach towards a mature OT security strategy: How can IT and OT teams collaborate to define and enforce security policies in the industrial environment? How can you gain visibility beyond the industrial DMZ to understand your OT security posture? How to drive OT network segmentation to implement ISA/IEC62443 zones and conduits? What is zero-trust and how does it apply to industrial networks?
Cisco, Technical Solutions Architect, Industrial Internet of Things
Cisco, Sales leader, Industrial IoT
BREAK
Dependency Mapping Within the Marine Corps: A Risk-based Approach to Securing Critical Missions
The pandemic has emphasized the importance of supply chain mapping to analyze strategic planning and mitigate operational risk. This critical process requires businesss understand what infrastructure is essential to meet organizations critical missions. For three years, Marine Corps clients have further required each installation to complete the facility-related control system dependency-mapping task before beginning a mitigation action plan. Map your control systems like the Marine Corps to secure your businesss critical missions. Why? In an environment with hundreds of control systems, and thousands of buildings the Marine Corps must make prioritization decisions to deploy resources effectively. In this session, you will learn how: - The Marine Corps uses dependency mapping to articulate the relative importance of its control systems / critical assets. - The Marine Corps approach to ensuring mission readiness can help you identify your critical assets and ensure your organizations ability to prioritize revenue. - Leverage dependency mapping as part of a risk-based approach to prioritize investments, optimize remediation schedules, and thereby strengthen your organizations ICS cybersecurity posture.
Risk Mitigation Consulting, Principal, Cyber Risk
Zero Trust Security for 5G Connected Devices and Zero Operational Downtime
The addition of 5G connections to OT Environments accelerates industrial transformation. But this cutting-edge technology creates cutting edge risks. A Zero Trust approach can increase your 5G security while reducing the risk of downtime. Join Mitch Rappard, Principal Solution Architect from Palo Alto Networks for an overview of how a Zero Trust approach to 5G Security can help. In this session you will learn how to get complete visibility and insights into all your 5G connected devices and how to deploy Zero Trust security for them.
Palo Alto Networks, Principal Solution Architect
Securing Industrial Wireless Infrastructure / Owning your Industrial Airspace
Industrial Wireless is more than just WiFi. It is wireless MESH systems for sensors and wireless connectivity for remote I/O, many of which are running multiple specialized protocols like ISA100 and WirlessHART built upon the 802.15.4 standards, but is it secure? This session will discuss standards and best practices for securing a variety of industrial wireless deployment scenarios within a facility as well as understanding what can interfere with wireless communications.
Global Process Automation (GPA), Industrial Network and Security Architect II
Using IEC62443 With Data-Driven Simulation – A Case Study with Brisa Tire Manufacturer
In this session we will describe how to use automated tools to assess the risk scoring using attack flow simulation on a digital image of the OT network and construct a data-driven risk posture report. We will also present how to use such automated processes to run What-IF scenarios to optimize your security road-map as well to get a quarterly update on your risk posture in view of the dynamic threat landscape.
In this session the CIO of BriSA, a tires manufacturer that is a joint venture between BridgeStone and Sabanci, will present together with Radiflow CEO their risk assessment process that was conducted by Radiflow analysts.
The presenters will describe how the assessment was done step-by-step - from the initial discovery phase and the mapping of the business importance per loss scenario, through the analysis of the attack flows and up to the construction of a security road-map that can be presented to the board with the solid data-driven risk posture justifications.
Radiflow, CEO & Founder
Brisa Bridgestone Tire Manufacturer, Director of Information Technology
Choosing the Right Security Partner for Your OT Network Infrastructure
In the era of heightened cyber threats, securing Operational Technology (OT) networks is a top priority for organizations. This presentation delves into the crucial process of selecting the optimal security partner for safeguarding your OT network infrastructure. It outlines the distinct challenges posed by OT environments, offers insights into key considerations for choosing the right partner, and emphasizes the significance of a well-informed decision. By aligning your organization with a capable security partner, you can enhance the resilience and protection of your OT network infrastructure in an increasingly interconnected world.
TXOne Networks, Senior Solutions Architect
Emulating Adversary Actions in the Operational Environment with Caldera for OT
Utilizing the Caldera Core, Caldera for OT is a cybersecurity framework and associated software that is designed to easily run autonomous breach-and-simulation exercises that are specifically targeted against Operational Technology (OT) / Industrial Control Systems (ICS). Caldera OT enables the creation of plug-ins that can be tailored for specific environments or a generalized system of OT devices and protocols. Like Caldera, Caldera for OT is built upon the MITRE ATT&CK framework. Caldera for OT will enable multiple types of engagements including compliance & certifications, detection engineering support (blue team), adversary emulation support (red team), and as a training tool for both blue and red teams (purple team). Using a standardized tool, users will achieve the benefits of reduced operator workload, consistency in OT, and the ability to develop and capture standard testing metrics. Attendees can expect an overview of the Caldera for OT software including plug-in structure, operating requirements, and a deployment tutorial. This will be followed by a demonstration of Caldera for OT in a simulated OT system. Actionable takeaways will include an understanding of the extensive capabilities of Caldera for OT as well as potential use cases in the individual attendees environment.
MITRE Corporation, Senior Operational Technology Security Engineer
For OT/ICS, it's not CIA, but AAA
Critical Infrastructure and ICS/SCADA systems prioritize Availability far higher than Enterprise IT. The CIA triad for OT has become AAA - Availability, Availability, Availability. For manufacturing, energy, and water, unplanned downtime is the kiss of death and can cost $10,000 per minute or more. This session will address the differences between IT and OT that drive the shift. It will also discuss root causes that can impact availability in OT environments. Finally, the session will explore possible solutions (without mentioning specific vendors) to minimize the various sources of unplanned downtime and deliver AAA protection for critical infrastructure.
BlastWave Inc., CEO
If I Get An SBOM, Whats Next?
How can you leverage SBOMs to assess vulnerabilities in modern ICS software supply chains and convince device manufacturers to mitigate them? How do SBOMs deliver exploit intelligence, bolster our response to new threats, and ensure weve addressed dangerous OT exposures? In this talk hosted by Finite State Engineering Manager Jason Ortiz, we will examine why attackers love the huge attack surface presented by OT and the key challenges facing stakeholders charged with protecting todays ICS amidst the rising complexity of modern software supply chains and the exploits that threaten them. In this session, Jason will also explore how dynamic SBOM management can inform repair versus replace decisions, maximize reduction of risk, and act as a starting point for productive discussions with upstream supply chain partners.
Finite State, Engineering Manager
Quantitative Method for Determining Risk Severity
Addressing cybersecurity risks is primary responsibility within any organization and the risks associated with OT systems are even more significant. It can be challenging to determine which risks have the largest potential impact to operations when many of the methods for performing assessments result in a qualitative or binary output with respect to compliance. This presentation will introduce a different approach to leveraging OT cybersecurity controls from the NIST Cybersecurity Framework and takes into consideration the unique factors which exist in every facility. The result is a quantitative output that can enable organizations to compare multiple locations against one another or generate a more detailed set of metrics for plotting progress year-over-year. Attendees will walk away from this presentation equipped with the skills and knowledge to evaluate their OT environments and quickly identify areas of operation where the severity of the risks require additional resources and even areas which have been historically over-emphasized.
Interstates, OT Architect
Chemical Processors Risks in a Cyber/Physical environment
Chemical processors are no strangers to assessing and ameliorating risk, but the emerging connectivity of todays facilities is exacerbating the issue. While regulators and operators efforts to mitigate risk in chemical businesses have successfully reduced the frequency and severity of physical hazards, the chemical industry still lacks tailored and comprehensive guidance on the growing threat posed by industrial cyber attacks.
ABS Group, Global Director ICS Cybersecurity
Redefining the Rules: Harnessing Risk Intelligence for Fortified ICS Security
This presentation aims to address the challenges organizations with exposure to industrial control systems (ICS) face while developing operational technology (OT) strategies to counter the escalating velocity of cyber attacks. With the convergence of information technology (IT) and OT, the emergence of the Industrial Internet of Things (IIoT), virtualization, and cloud computing, companies are grappling with complex technological shifts. Moreover, many organizations are still in the process of transitioning from on-premise solutions to more advanced and secure alternatives. Mark Bernardo, SVP of Customer Success at Flashpoint, will present a holistic framework demonstrating how the collection, analysis, and dissemination of actionable risk intelligence across the cyber and physical sphere can augment ICS security strategies. Bernardo will also review how analysts can navigate data-overwhelm while maintaining exhaustive approaches through workflow optimization, prioritization, and platform consolidation. Attendees will gain practical recommendations, industry-specific guidance, and a deeper understanding of the evolving threat landscape in the context of industrial control systems (ICS). They will be equipped to build more resilient OT strategies, navigate the transition to more secure solutions, and proactively strengthen their defenses against cyber and physical threats.
Flashpoint, Senior Vice President, Customer Success at Flashpoint
Is the Cryptopocalypse Coming for OT?
Quantum computing has the potential to undermine the very foundations of much of cybersecurity: certificates, key exchanges, and digital signatures. This session will explain how quantum computing could impact computer security generally, and OT in particular. Dr. Gerard Vidal will explain the key quantum algorithms that make quantum computing a threat, the aspects of security that they imperil, and how they apply to OT. Finally, Gerard, who has implemented post-quantum solutions on the industrial shop floor, will provide some recommendations on what OT practitioners should be doing to prepare. While quantum computing might not be an immediate threat especially when many OT environments are so poorly secured but, given the longevity of OT equipment, it most certainly should be addressed as part of any cybersecurity roadmap. What you are deploying today is tomorrows legacy. Attendees will leave the session with: 1) An overview of quantum computing and its threat to OT environments and cybersecurity 2) Frameworks for addressing their own specific situations and roadmaps 3) Techniques for increasing the longevity of the cybersecurity solutions they are currently implementing in light of the effects of quantum computing
Opscura, CTO
Enabling Cybersecurity for Agile Manufacturing
The journey of protecting consumers from cyber threats starts when they initiate order/preservation online. With a wide range of choices for personal customization, agile manufacturing is the answer as it allows flexibility, adaptability, and quick turn-around to meet dynamic consumer demands. To maximize decisions in optimizing the agile manufacturing process, there is an increase in information/data sharing between the shopfloor, corporate management, and suppliers. This increases online exposure of manufacturing systems to various cyber threats, including ransomware attacks, intellectual property theft, and disruption of production processes. To realize the benefits of agile manufacturing and ensure adequate cyber protection efforts, automakers need to gain visibility into shopfloor networks by deploying OT passive monitoring tools and prioritize manufacturing network segmentation and endpoint security. Network and endpoint events should be ingested into a central repository for correlation and orchestration. Last but not least is a robust ongoing awareness engagement with shopfloor staff to ensure adequate training for responding to potential cyber alerts. By prioritizing cybersecurity protection efforts for the manufacturing shopfloor, automakers can build a reputation that their cars are safe to be on the road.
Booz Allen Hamilton, Senior Lead Engineer
Toyota, Head of OT Security
Historical Parallels of Intractable Challenges - What OT Security Can Learn From Safety
We all have known or heard of this for years - that OT is insecure by design, tons of proprietary & unsupported systems make vulnerability management a distinct problem than in IT, cybersecurity is still not a focus for the ICS personnel, and that OT attacks are increasing exponentially but risk mitigation is painfully slow. Even when it comes to critical infrastructure, we see asset owners struggling with lack of appropriate funding, skills & resource gaps, and having to deal with increasing and confusing "goals and objectives" from industry & government agencies. It is frustrating for a lot of practitioners to see avoidable problems cropping up repeatedly in solution design. Further, it's still a Wild West when it comes to various product capabilities and consulting services to be able to measure objectively what's working and what's not. In this talk, I'm going to leverage lessons learnt from other verticals where fundamental improvements happened over time, and built on top of significant events (particularly three in Construction & building safety, Automotive & industrial safety, financial regulations) to postulate how OT Security can likely transform and improve.
Nozomi Networks, Technical Solutions Director
Reinforcing Defense in Depth (DID) in OT environments
This talk explores the concept of Defense in Depth (DID) and its relevance in OT environments. Our team conducted a comprehensive analysis on leading papers (For ex. Improving ICS security using DID strategies by the DHS) but also analyzed how our customers implement these strategies, if at all. There is a common claim in the ICS security community that the demilitarized zone (DMZ), once breached, the game is over. By examining the security features of Distributed Control Systems (DCS) and other Industrial Control Systems, we will highlight their role in the layers of defense provided by DID. The talk also explores the detection and protection mechanisms that suit the unique characteristics of OT environments, ensuring robust cybersecurity in the face of the latest threats discovered (Case studies with the latest malware will be included). Furthermore, we address the practical aspect of prioritizing Defense in Depth strategies within OT networks. With limited resources, the audience is encouraged to critically analyze their cybersecurity investments to the most effective utilization of their budget. If you had only one dollar to allocate, what would be the most impactful step to take? Key Takeaways: Understanding Defense in Depth (DID) and its relevance in OT environments. Rethinking OT DMZ and exploring additional protective measures. Leveraging DCS and other ICS security features to enhance DID effectiveness. Tailoring detection and protection mechanisms to suit the uniqueness of OT environments. Prioritizing defense strategies with limited resources for optimal cybersecurity outcomes.
OTORIO, CTO & Co-founder
Be a Catalyst for Plant-Wide Cybersecurity Advancement... Yes, You!
Identifying opportunities for improvement can be easy. Finding solutions can be challenging. Executing solutions within an organization that has many competing priorities and limited resources requires strategic determination. This discussion will talk about practical actions, steps, and skills to help you advance cybersecurity at your organization from the perspective of someone in your corner thats been fighting those same battles. Well talk about why more than technical knowledge is needed to achieve results and how to enhance those skills to protect your operation.
Siemens Industry, Inc., Digital Connectivity Executive
Small Step or Giant Leap? Cyber and Policy Progress Towards Satellite Security
Already a vital part of both the internet of things and the critical infrastructure of the internet, satellites are set to take on a more significant role with the expansion of 5G and IoT. But many satellites with primitive security could become threat vectors for cybercriminals. This session will provide three satellite attack scenarios that could occur without increased cyber security measures and discuss viable solutions to this threat. The speaker will also share some of the steps that policy makers are taking to try to prevent these scenarios from happening, including the newly proposed law would enhance cybersecurity for commercial satellites to protect them from getting hacked by bad actors, and how the Department of the Air Force in collaboration with the Air Force Research Laboratory, or AFRL, and Space Systems Command created a satellite hacking contest hosted for an on-orbit satellite. Attendees will Decide whether technologies such as blockchain, AI or ML could be the key to lowering the risk of attack on satellites. Learn how to determine whether your organizations networks are at risk. Understand the policy and technology changes that could help minimize the risk from the commercial satellite industry.
Trend Micro, VP of Infrastructure Strategies
Solving ICS Security Knowledge Gap Using Digital Twins Concepts
The more educated, experienced, and productive employees provide much better results in every business. However, the gap between fresh graduated capability and the industry requirements is enormous in ICS security. One of the result of the knowledge gap is the ICS security staff shortage. Although there are many standards for cybersecurity career development framework to help us tackle this problem, the human resource department still have hard time to acquire or develop the right person for ICS security task. To address this problem, we propose the idea of using the NICE framework and Digital Twins to solve the workforce capability gap problem. The framework divides competency into sets of knowledge, skills, and abilities (KSA) which could be translated into sets of challenges provided by Digital Twins system. We created the automatic MODBUS, DNP3, or IEC61850 protocol Digital Twins generator to support competency training. Next, we demonstrate penetration testing and security policy evaluation against both generated digital twins and the original physical testbed, and lastly, we compared and evaluated both results on how each system can improve staff capability according to NICE framework. We also provide the Digital Twins similarity evaluation metric to show that this system can provide realistic education and training for ICS systems.
Institute for Information Industry, Security Researcher
Institute for Information Industry, Section Manager
Exploiting Smart City Deployments
The widespread adoption of smart city technology promises improved operational efficiencies and demand management for utilities, and benefits to consumers and communities overall. However, the deployment of these technologies can create significant security risks. In this presentation, we will discuss the Wi-SUN wireless communication protocol at a high-level, which is widely used in smart city deployments to support services such as street lighting, smart metering, public safety, and environmental monitoring. We will explore various security weaknesses I have seen in Wi-SUN networks, specifically focusing on a high-value target; the border router devices that aggregate communications locally and provide the backhaul link. We will then demonstrate how attackers can exploit these weaknesses to gain unauthorized access to sensitive data, disrupt network operations, and even take control of critical infrastructure. Finally, we will discuss best practices for securing smart city deployments and protecting against these attacks. Attendees will gain a deeper understanding of the security challenges associated with smart city technology and learn how to mitigate these risks to protect their own deployments.
Securicon, LLC, Senior Security Consultant
[ON-DEMAND] Zero Trust Security for Zero Operational Downtown Demo (Palo Alto Networks)
[ON-DEMAND] Elevating OT Security: A Dive into OTORIO's Success Story
[ON-DEMAND] Active Cyber Defense and Threat Containment for Remote OT/ICS Facilities (PacketViper)
[ON-DEMAND] Nozomi Networks Platform Demo
[ON-DEMAND] Protecting Critical Infrastructure with Deception by Design (Fortinet)
[ON-DEMAND] Tenable OT Security Demo
[ON-DEMAND] Verve Demo highlighting Verve's security center
[ON-DEMAND] TXOne Networks Demo: Portable Inspector
[ON-DEMAND] Cisco Cyber Vision Demo
[ON-DEMAND] Airgap Case Study: Segment and Secure Biopharma and Healthcare Industry with Agentless Segmentation
