As a business owner or executive of any organization, there is only so much time, money, and people to reduce risk across an organization. Most organizations have years of policy and data to measure against to understand risks concerning human capital, traditional corporate IT systems, physical security, natural events, and environmental events. Organizations must incorporate a way to measurably understand and compare OT systems, Facility Related Control Systems, and other systems that are mission critical to their functioning of their organization. However, all risks must be holistically looked at and prioritized to meet the unique situation of each organization.  

Topics include:

Holistic look at competing organizational risks…Importance of a business impact analysis to define all risks and make enterprise decisions on how to prioritize.

Innovation to implementation…How can industry and organizations speed up this process?

Regulations, standards, and frameworks…Importance of using existing controls to assist in organizational risk reduction and how best to include in contracting language.

System design and defense in depth…

Supply chain security

SEL OT SDN

SEL Blueframe

SEL UTM

SEL Ambassador

Balancing cybersecurity against cost, time, complexity, useability

Elastic Stack

Add to Calendar

• 

  Tim Watkins

  Lead Application Engineer

  SEL
• 

  Dennis Gammel

  R&D Director

  SEL

Sponsors

The frequency and intensity of cyber-attacks targeting the power grid have increased since the first confirmed blackout caused by hackers in the Ukraine in 2016. Substations represent a critical attack vector within the power grid. Commonly located in remote locations, unmanned and visited infrequently by a transient workforce increasingly comprised of contractors the substation LAN presents unique challenges not found in traditional IT or OT networks. Policies and procedures cannot eliminate the possibility of the inadvertent introduction of malware onto the network. The more sophisticated malware is designed specifically to perform tasks such as network and traffic reconnaissance to lay the groundwork for more sophisticated attacks. Gateways and firewalls located at the substation LAN perimeter, cannot prevent the transmission of unauthorized network traffic within the cyber defense perimeter. The question then arises as to how can potentially malicious traffic be detected beyond the firewalls? This paper examines the benefits of securing substation LANs thorough the complementary security features of a Software Defined Network and a Functional Security Monitoring IDS.

Add to Calendar

There is a variety of threat information from many different sources. The format and range of value varies for this information. There is a challenge to get machines to read and understand some of this information to create actionable defenses. As part of the Geo-Threat Observables project at Idaho National Laboratory, funded by the Department of Energy Cybersecurity, Energy and Emergency Response (DOE-CESER), we investigate ways in which we can take unstructured threat information reporting and produce a test corpus of structured threat - Structured Threat Information Expression (STIX) in which a computer and security tools can ingest, use advance analysis like machine learning to identify common areas where cyber defenders can reuse mitigations.

As part of the Workshop, we will describe our history with structured threat information: from automated threat response to acquiring and generating actionable information we can ingest with a computer and various security tools.  We will describe our current and future research goals behind STIX.

Add to Calendar

With cyber-attacks on the rise, information is one of the first lines of defense. Now more than ever, security experts and developers need efficient ways to know if their software may be outdated or vulnerable to emerging threats. By generating a Software Bill of Material based on STIX2/JSON bundles, security experts and developers can ensure that they know where to find what can go wrong with their systems before the hackers do. As part of the Infrastructure Expression project, Idaho National Laboratory (INL) is currently working on ways that can aid in the development of efficient SBOMs using Structured Threat Information Expression (STIX). Doing so can provide an efficient first line of defense for detection and monitoring that can be easily used by cyber personnel from beginners to highly skilled experts.

Add to Calendar

Attack surfaces are critical to understanding your systems and devices and protecting them from cyber-attacks. An attack surface is the sum of all the attack vectors or points of entry in and out an unauthorized user can take to get into and potentially compromise your system or device. The smaller the attack surface, the less attack vectors and the more secure the system. Creating an attack surface is challenging because there is no standard process, are limited resources and documentation, and even for software or a small system can become very complex very quickly. Idaho National Laboratory (INL) is using structured threat to describe attack surfaces. Structured Threat Information Expression (STIX) is an industry standard language and serialization format for describing and sharing threat information. When represented in structured threat, researchers can use the Structured Threat Intelligence Graph (STIG) application to provide a visual depiction of the machine-readable code in a graphical nature. Researchers at INL use STIX and STIG to break down complex systems into three main layers: hardware, firmware, and software to best understand and visualize all of the different types of components creating a well-rounded, complete attack surface. This method and combination of STIX and STIG will make attack surfaces shareable, enrichable, and actionable.

Add to Calendar

This presentation will discuss and compare two different capabilities currently in development at Idaho National Laboratory on the Firmware Command and Control (FC2) and Deep Learning Malware (DLM) projects. One capability is developed using open-source components and the other leveraging API’s to commercial reverse engineering tools.

Both capabilities combine machine learning, reverse engineering, and graph concepts to seek to answer how we can better understand binaries, whether they are firmware images of questionable origin, or malicious malware samples targeting industrial control systems.

For this presentation we will show how binaries can be disassembled and translated into various intermediary formats, how we can capture the expected flow of execution along with underlying data, and use that in conjunction with machine learning to find similarities across different binaries as well as perform other analyses.

Add to Calendar

Information Sharing can be simple, informal, and effective. In this panel, we will hear from those on the front-line of defense about how their daily interactions and information exchanges with peers across industry benefits their organizations’ security efforts. 

Add to Calendar

As shown through multiple high-profile cybersecurity attacks this year, organizations have to shut down operations when their mission-critical assets are breached. New cyber threats are increasingly targeting OT infrastructure because 1) it has the most severe impact on uptime and revenue, and 2) legacy and geographically dispersed systems are harder to defend. Traditional IT solutions are often too slow and heavy for today's sophisticated and rapidly evolving attack techniques. This presentation will provide practical advice to enable organizations to adapt and recover faster from cyber threats based on a detailed review of thousands of network architecture assessments. The discussion will introduce the 3 foundations of an efficient cyber resiliency program: compliance verification, cybersecurity visibility, and operational velocity.

Add to Calendar

Targeted ransomware has emerged as a major threat to industrial operations / OT systems. The Colonial Pipeline and JBS shutdowns are only the latest incidents - in 2020, 53 industrial sites were shut down by targeted ransomware. The trend is likely to worsen - today's targeted attacks use tools and techniques comparable to those used exclusively by nation-states only a half-decade ago.
Operational Technology (OT) cyber risk manages cyber threats to physical operations. Some enterprise security mechanisms are very costly to apply in OT systems because of extended safety, equipment protection, and other OT risk management programs. We see emergency risk avoidance mechanisms that are unique to the OT space but are under-utilized by enterprise risk management and security practitioners.
This presentation highlights three such innovative cyber risk management approaches and examines their effectiveness against the pervasive threat of targeted ransomware with particular attention to the operational risk. The presentation will outline a simple and robust approach to managing OT cyber risks, including Security PHA Review (SPR), Consequence-Driven, Cyber-Informed Engineering (CCE), and Secure Operations Technology (SEC-OT). Secure sites in the industry are improving protection for their operations by cherry-picking techniques from these new methodologies. Join us for a whirlwind tour of trends in OT and industrial operations attacks and defenses.

Add to Calendar

The burden of vulnerability management grows heavier every year. Machine learning and artificial intelligence can provide powerful insights and time savings, but these should not come at the cost of reliability or CIP compliance, nor should recommendations be followed blindly. Electric utilities have a particularly high potential for time savings for two reasons: highly structured vulnerability data and the repetitive and cyclic nature of vulnerability assessment. This talk will provide a brief overview of machine learning, including a realistic look at its limitations, and will discuss how these techniques can be used to automate sections of the vulnerability and patch management process, such as predicting an optimal remediation action, while providing compliance documentation and maintaining user trust.

Add to Calendar

Join us at our famous Welcome Reception for light food, drinks, and plenty of networking with your friends and peers. 

Add to Calendar

For the last four years Dragos has published annual trend reports of our observations from the field and the adversary. This talk puts the trends into a different perspective: what are our errors over the years as a community? Where are our biases? Understanding these helps understand where we may be headed as both an industry and community.

Add to Calendar

• 

  Ben Miller

  VP, Professional Services and R&D

  Dragos, Inc.

Sponsors

Join your peers in the Expo Hall for a beverage break and conversation.

Add to Calendar

North American power systems are currently undergoing a period of significant technological change. Increased integration of renewables, cloud infrastructure, and smart edge devices will inherently reshape the fabric of power systems over the next decade and beyond. These shifts will require forward-looking threat modeling for power systems of the future. Specifically updating threat models to reflect power systems becoming more edge-connected, distributed, and transactional in nature. These new threat models must include, not only of large APT-style incidents, but also how all these factors may affect grid stability against less obvious threats. Timely examples of this could include ransomware against ancillary systems such as billing in increasingly transactional power systems of the future.

Add to Calendar

Conversations with the experts on the cutting edge of defense tactics and technology.

Add to Calendar

 The Zero Trust (ZT) concept for securing information networks is gaining popularity in the energy system industry. The very name implies the complete lack of trust within a system. However, trust underpins all security, and the notion that trust can be excluded entirely from the calculus of network security is misguided. Instead, while applying zero-trust principles as described by NIST SP800-207, security professionals are well served by continually evaluating three questions:

Add to Calendar

Defining the CIP baseline can have hidden challenges.  Options will be clarified with a spotlight on best practices.  Building on the baseline topic, a CIP solution maturity model using Tripwire will be introduced.

Add to Calendar

• 

  Ted Rassieur

  Senior Engagement Manager

  Tripwire

Sponsors

Join your peers for a catered lunch.

Add to Calendar

Fireside Chats: Conversations with the experts on the cutting edge of defense tactics and technology.

Add to Calendar

You can’t protect what you can’t see: Network visibility provides the foundation for Industrial security | Eric Floyd | Keysight Technologies

As cybersecurity attacks escalate against critical infrastructure, electric utilities increasingly need to monitor their remote assets and to be able to test and validate their cybersecurity posture on an on-going basis. Network monitoring and security tools need to see the whole picture. Anything less and you risk disastrous consequences that can cause unexpected outages, delay troubleshooting, increase costs, and threaten public safety. The White House and critical agencies are introducing more and more mandates and directives asking electric utilities to implement specific mitigation measures to protect against ransomware attacks and other known threats to both IT & OT. 

Keysight Technologies offers a unique combination of network test and network visibility solutions to help utilities to achieve their IT and OT cybersecurity compliance and defense objectives. Gaps remain for most utilities, so we will share best practices where utilities have deployed solutions to achieve end-to-end visibility across IT and OT. Our Breaking Point test solution helps electric utilities to test their perimeter defenses in the lab against the latest threats, our network visibility solutions feed optimized packet data to all of the leading OT security tools, and our ThreatSim Breach and Attack Simulation solution helps companies to simulate the kill chain with real-world malware and techniques. We worked closely with one of the largest Investor-Owned Utilities recently to develop a ruggedized, “Tough series” of products for NERC CIP monitoring requirements at substations that lack environmental controls.

Pipeline Insecurity: Do Attackers See a Bullseye on Your IoT Devices? | Jeanette Sherman & Nicholas Vidovich | Finite State

From routine monitoring to predictive analytics, IoT devices hold great promise for creating more reliable, secure pipelines and energy grids. But as security gets beefed up after Colonial Pipeline, one area is being overlooked: device firmware.

Typical component-built IoT device firmware uses 80-95% third-party code, often with vulnerabilities including hard-coded credentials, memory corruptions, and CVEs that can act as a backdoor. With IoT devices more accessible to malicious users than traditional network infrastructure and increasingly connected to critical assets, they represent an attractive vector to attackers seeking to exploit the weakest link in your network.

In this presentation by Finite State Principal Product Manager for Device Composition Analysis Nicholas Vidovich and Director of Product Marketing Jeanette Sherman, learn how a perfect storm of regulation, prioritization, and complex supply chains painted a target on device firmware -- and why ensuring supply chain integrity is more critical than ever before.

Add to Calendar

• 

  Robin Berthier

  CEO

  Network Perception
• 

  Eric Floyd

  Director of Industrial Solutions, Network Applications & Security Group

  Keysight Technologies
• 

  Jeanette Sherman

  Director of Product Marketing

  Finite State
• 

  Nicholas Vidovich

  Principal Product Manager

  Finite State

Sponsors

Join your peers for refreshments in our Expo Hall and explore solutions to your security and compliance needs.

Add to Calendar

Sponsors

The early bird gets the prize! We will kick off Wednesday morning with drawings for prizes from EnergySec and our Sponsors.

Add to Calendar

The proposed changes to the NERC CIP Standards as part of Project 2016 are shaping up to be the most disruptive changes in the NERC landscape since CIPv5. Join the former WECC CIP audit manager who oversaw the v3 to v5 transition efforts to explore changes to terminology, applicability, and overall interpretation challenges. This presentation offers a peek behind the regulatory curtain to explore the proposed changes, leveraging that v5 experience to share insight as to where the pitfalls may manifest along with the many complexities to be found. The presenters will also address changes required by utilities to assure CIP program documentation and performance evidence are adequately updated.

Add to Calendar

• 

  Brent Castagnetto

  Managing Partner CISSP, MABR

  Archer

Sponsors

Traditionally, the implementation of NERC-CIP 007 and NERC-CIP 010 has been challenging for utilities. After multiple attempts to easily identify tools to implement these requirements, Tacoma Public Utilities leveraged the CimTrak Integrity Suite to roll out a reliable and repeatable process for implementing these requirements. In this session, the discussion will focus on the journey many organizations face to implement the NERC CIP Baseline requirements, enforce secure configurations, and roll out a clear and well-documented change management program. A one-of-a-kind demonstration will take place, highlighting unique reporting used for the implementation of NERC-CIP 007 and NERC-CIP 010, consistently, and across multiple operating systems and devices.

Add to Calendar

The Building Apprenticeship Programs in Cyber Security (BASIC) initiative is funded by a U.S. Department of Labor grant to establish cybersecurity apprenticeships in clean energy and advanced manufacturing. This presentation will present the case for the apprenticeship model in expanding the cyber workforce, detail progress to date, and offer opportunities to participate.

Add to Calendar

Take a break and explore solutions in the Expo Hall.

Add to Calendar

Enjoy a catered lunch with your peers.

Add to Calendar

The Department of Energy’s Cybersecurity for Operational Technology Environments (CyOTE^TM) program provides a methodology for energy sector asset owner-operators to combine network-based sensor data with local context to recognize faint signals of malicious cyber activity before an adversary can cause higher-impact effects. This presentation covers the history of CyOTE to explain how the key insights came about, and then walks through the methodology as a way to put those insights into practice, showing how it complements other high-priority investments and activities in the energy sector OT cybersecurity

Add to Calendar

...Weeks, months, years. What is ahead for cybersecurity in our industry and what should organizations be doing now, next year, and in the future. New attacks, new technology, new regulation, new incentives, new expectations. Join this interactive discussion as we closeout this year’s Summit with an eye to the future.

Add to Calendar