EnergySec Security & Compliance Summit

Getting the cybersecurity passion into the K12 space | Nate Evans & Jessica Boersma

This summer we will be hosting a version of DOE's CyberForce Competition to engage the K12 audience as a pilot and would like to report out the results as well as ways to potentially grow and engage the pipeline of students at an earlier and earlier age.

Hands-on Operational Technology Cybersecurity Community College Program | Dennnis Skarr | Everett Community College

Launching EnergySec’s Cybersecurity apprenticeship for the electric sector | Steve Parker | EnergySec

Add to Calendar

"Cyber integration and information sharing solutions for small utilities" - Emma Stewart, Chief Scientist, NRECA

Cybersecurity is a booming business, with all sizes of companies seeking to advance in OT/ICS security.  As this business has increased, and our ability to protect and defend has accelerated, with public private partnerships and new research announced and published on a daily basis.  Adversaries respond to this, increase their capabilities – and the business moves forward.  The cybersecurity business creates profit on the adversaries improvements,  and increases our need to defend. The social responsibility falls to the utilities to deploy and upgrade,  but we designed a system in which defending against the latest adversaries, is unaffordable for small and not for profit locations who serve vulnerable communities.   They are uniquely community driven and not for profit and the business models don’t match.  Industry responds with initiatives that provide downsized, or free services – but a small profit driven product, is not the same as something tailored to be used for these entities.  This session will discuss the potential avenues for innovation and information sharing models for small utilities in the future.

Add to Calendar

“Compliance, does NOT mean Security” – Strengthen your network infrastructure with applicable cybersecurity measures 

Hindsight is always at least 20/20, but is the electric sector really learning from the past? Recommendations from influencing organizations like DHS/CISA, down to NERC CIP and IEC62443 often are so watered down lacking both realistic security controls, management capabilities and any actionable intelligence.

This topic will look at the best of both worlds: the NERC CIP standards, specifically those that impact network communications and equipment hardening. Together with complementary ISA/IEC 62443, focusing on the foundational concept of identification and implementation of security Zones and Conduits. The session will showcase hardening recommendations for industrial network infrastructure devices, following Defense in Depth concept and an example of putting it all together in a secure implementation for people, data and networks.

The National Vulnerability Database (NVD) is a consistent and centralized source of vulnerability information, provided in a machine-readable format. Contrast this with vendor advisories, which are rarely machine-consumable and must be manually found and read. While these advisories often contain additional useful information for security analysts and operators, the lack of machine-readable data limits attempts at automation; consequentially, many utilities perform this part of the CIP-007 requirements entirely manually. In this presentation, Kylie will demonstrate the difficulty in processing advisories programmatically, while ultimately making the case for a standardized reporting format.

Baseline Response Capabilities utilizing Structured Threat Information Expression JSON bundles | Manuel Vazquez | Idaho National Laboratory
With cyber-attacks on the rise, information is one of the first lines of defense. Now more than ever, security experts and developers need efficient ways to detect and mitigate emerging threats. By generating a baseline based on custom scripts and open-source tools such as the Volatility Framework, security experts and developers can respond to out of norm activities and generate STIX2/JSON bundles that could be used to share valuable information. Security experts and developers can ensure that they know where to find what can go wrong with their systems before the hackers do. As part of the Infrastructure Expression project, Idaho National Laboratory (INL) is currently working on ways that can aid in the development and defensive response capabilities using Structured Threat Information Expression (STIX). Doing so can provide an efficient first line of defense for detection and monitoring that can be easily used by cyber personnel from beginners to highly skilled experts. 

Automating and Codifying Attack Surfaces with Structured Threat Information Expression | Manuel Maestas | Idaho National Laboratory
Understanding your attack surface is crucial when trying to protect your systems and devices from cyber-attacks. An attack surface consists of all attack vectors and points of entry into a system, in which an unauthorized user can gain access to, and potentially compromise your system. For years, it has been difficult to create an attack surface as there is no industry “standard” as well as very little resources and documentation about how one should be built. This process can be also difficult as it should include software, firmware, and hardware elements, making attack surface creation time-consuming. Idaho National Laboratory (INL) is automating and codifying attack surfaces by expressing them in Structured Threat Information Expression (STIX) and utilizing Structured Threat Information Graph (STIG) and Auto Discover, open-source tools. STIX is an industry standard language and serialization format for describing and sharing threat information. When represented in structured threat, researchers can use STIG to provide a visual depiction of the machine-readable code in a graphical nature. The Auto Discover toolset allows for the automated collection of various networks, hardware, software vulnerabilities, and details from systems on a given network. Researchers at INL combine these tools to break down complex systems quickly, gathering all the necessary components and versions needed to create a well-rounded, complete attack surface. This method and combination of STIX, STIG, and Auto Discover will make attack surfaces shareable, enrichable, and actionable.

Add to Calendar

This afternoon session will be an interactive discussion of issues around supply chain security, including compliance requirements. 

Add to Calendar

Join us for our famous Welcome Reception.  Bring a guest or the whole family to enjoy appetizers and refreshments, networking with friends and peers, and a photo opportunity with special Disney Characters! 

Add to Calendar

Stop by for event check-in, pick up a name badge, and program guide.  

Add to Calendar

Buffet Style Breakfast.  This breakfast is exclusive to Full Conference Pass holders only.  

Add to Calendar

Visit for all-day coffee, water, tea.

Add to Calendar

Gaining accurate visibility of OT networks is fundamental to protect critical assets and to ensure that networks are correctly segmented. A comprehensive network visibility solution combines traffic monitoring (what is connecting to what) with network architecture analysis (what can connect to what). This presentation will show a case study to augment traditional intrusion detection with firewall review in order to eliminate blind spots and develop relevant contextual information to better mitigate cyber threats.

Add to Calendar

• 

  Robin Berthier

  CEO & Co-Founder

  Network Perception

Sponsors

Visit the exhibitor hall for light refreshments and snacks.

Add to Calendar

95% of cyber incidents causing physical downtime in the last two years were ransomware. This presentation introduces the ICSStrive OT incident repository and series of incident analysis reports. We dig into the three ways that ransomware can trigger shutdowns and other consequences. And we look at how cybersecurity programs can prevent these consequences when ransomware hits IT networks.

Add to Calendar

The Russian invasion of Ukraine has resulted in significant physical damage to Ukrainian critical infrastructure and has impacted the global supply chain.  It has also resulted in an uptick in sophisticated and destructive cyberattacks against Western nations, including attacks against the energy sector. In this session, attendees will learn about current and potential Russian cyber threats and how to defend against them. Mr. Nelson will provide an overview of the Operational Resilience Framework (ORF) that provides a roadmap and set of rules for immutable recovery of data, systems, networks, devices, and applications resulting from destructive wiperware attacks that have been launched by Russian adversaries.

Add to Calendar

This presentation will talk about the Cybersecurity & Infrastructure Security Agency (“CISA”).  How it came to be, its role in the defense of critical infrastructure, and its interactions with the energy sector.  Detailed information will be shared about information sharing offered to the energy sector by CISA,  the new Joint Cyber Defense Collaborative, and what cybersecurity precautions the sector needs to take now.

Add to Calendar

If there has been one constant in the cybersecurity and critical infrastructure space it is how quickly and increasingly the threats continue to evolve.  The consistent interest from advanced persistent threat actors in critical infrastructure and industrial control systems, the growing interconnectivity of operational environments, and the current geopolitical tensions have elevated government focus on the national security impacts from attacks on utility systems. Over the past couple of years, there has been considerable public private partnership activity – from the White House 100 Day Initiative, from TSA Security Directives, to joint collaborative environment developments.  Add in legislation on Capitol Hill and regulatory developments at the federal and state level, and it becomes a tremendous amount of activity that impacts business plans, investment decisions, and security priorities.  During this session, Xcel Energy’s Security and Resilience Policy Area Vice President will share information regarding current government policies, interests, and trends, utility efforts to support those activities, and how suppliers and asset owners are working together to reduce risk.  Attendees will learn how they can help shape these activities in order to enhance our collective, strategic path forward in protecting critical infrastructure from all hazards.     

Add to Calendar

The shifting geopolitical landscape creates additional risks and threats that can impact business continuity. Geopolitical risks include political upheaval, economic instability, corruption, natural disasters and wars. How do you determine the degree to which they pose a threat to business continuity? Which of your suppliers have manufacturing and other physical locations, ownership, or even cyber presence in the affected countries or regions? How do you respond to them? How do you prepare for compliance regulations emerging in reaction to them? How do you digest the data you have and present it in a way that is actionable for your organization’s stakeholders and leadership?

Add to Calendar

• 

  Tobias Whitney

  VP of Strategy and Policy

  Fortress Information Security

Sponsors

Enjoy coffee and tea served in the exhibitor hall.

Add to Calendar

To keep a boiler from blowing up in your face, which would you prefer? A longer  password for the PLC? Or a spring-loaded over-pressure valve? And - if a cyber attack works once, and exactly the same attack is launched at exactly the same target a second time, will it work again? If attacks are deterministic, then what, really, does "likelihood" mean in our cyber risk matrices? OT cyber risk management is maturing as a discipline - likelihood is going away, and eliminating consequences and attack vectors entirely is becoming easier to justify than a continuous spend on cybersecurity . "Due care" expectations from insurance providers are following suit. Join us to look at how our industry is evolving - both in terms of understanding risk and of doing something about it.

Add to Calendar

• 

  Andrew Ginter

  VP Industrial Security

  Waterfall Security Solutions

Sponsors

Dr. Jacob Benjamin will provide an update on emerging cyber threats to the energy sector and industrial control systems. The session will discuss threat activity groups targeting the energy sector and recent lessons learned from the front lines of service engagements in the energy sector.

Add to Calendar

Have you struggled with building and sticking to an effective exercise routine? Ever wanted to participate in a large coordinated exercise like GridEx but didn’t know where to start? Join Nick Weber as he walks attendees through tried and true tactics to developing a holistic security exercise program that will challenge participants and drive visible results in your security program.

Too often security response and recovery exercises rely on notional components, rehash the same scenarios, only work in a vacuum, and leave participants more confused than they started. A well-planned security program includes a variety of exercise type, scope, and duration with capability-driven scenarios and objectives. Nick will lay out the foundation for this program and discuss ways to take your exercises from a “necessary evil” to a critical value adding component of your security program. 

You’ll leave this session with the knowledge and tools to make your security exercise the next “can’t miss” event!

Add to Calendar