Day 2: Thursday, September 28th
8:00 am - 8:10 am Chairperson Opening Remarks
8:10 am - 9:00 am Future Proofing Industrial Control Systems
Industrial control systems serve as an integral part of critical infrastructure, empowering vital sectors including electricity, oil and gas, water, transportation, manufacturing, and chemical manufacturing. Effectively addressing ICS cybersecurity necessitates a comprehensive understanding of current security challenges and available mitigation tools. Defense-in-depth allows a flexible framework to strengthen security posture and help to defend against cybersecurity threats and vulnerabilities. Legacy systems used protocols that were difficult to hack, but with the convergence of IT and ICS architectures, recent high profile breaches have shown the potential risk. Organization must get creative in their defense and apply layered approaches that make targets less attractive and attainable.
•Implementing strategies for securing control system environments
•Investigating how threat actors can carry out attacks and the potential impact on industrial controls
•Evolving control systems management and security practices
9:05 am - 9:35 am All Roads Lead to Rome: Lessons for Critical Infrastructure Security
Prosperous nations sometimes take for granted the safe and reliable critical infrastructures that underpin our economies, governments, and personal well-being; it’s our responsibility to plan and execute key enablers that will secure our future. Similar to how we marvel today at the Roman Empire’s roads and aqueducts, the 3rd millennium will likely do the same with today’s critical infrastructures - that is, if they don’t lead to our downfall. The scope and scale of the critical infrastructure security challenge has frozen ambitions to take on this problem; this presentation will describe a plan and its first several steps.
Key Take-Aways:
•Explore a light-touch governance or orchestration board to establish some enduring procedures where such things are helpful.
•Take on the issue of automated information sharing within and among critical infrastructures. The goal is to enable the sharing of threat intelligence and even best practices, and otherwise get people to start working together to create relationships while simultaneously moving the needle.
•Begin to pilot the most promising strategies and capabilities, such as consequence-based engineering. “Test” capabilities to create the most meaningful increases in security and to enrich partnerships. Promote research and innovation on the right challenges, experiment and push the envelope, and fail fast, but on the most important priorities. This approach helps build institutional muscle memory so that responses to actual attacks are quick and effective.
•Rethink the cyber workforce. This will involve creating an environment in which professionals in IT, OT, and Physical security regularly collaborate and rotate job assignments, in recognition that the design of critical infrastructure solutions cannot separate these professions.
9:40 am - 10:10 am Business Meetings
10:10 am - 10:40 am Business Meetings
10:40 am - 11:10 am Business Meetings
10:40 am - 11:10 am Networking Break
BrainWeave B
11:15 am - 12:00 pm Protecting Critical Assets from Today’s Cyber Threats: Four Key ConsiderationsA discussion of the sources, actors, tools, and tactics threatening operational assets and how to thwart them. This interactive session will offer participants:
•A better understanding of the technical, process, and cultural factors affecting Operational Technology security
•A framework for assessing cyber threat risk
•Four immediate actions to advance toward cyber protection maturity.
Master Class B
11:15 am - 12:00 pm An Industrial Immune System: Using Machine Learning for Next Generation ICS SecurityAs IT and Operational Technology (OT) environments continue to converge, managers of ICS have been faced with the challenge of protecting these crucial systems and data, in spite of inherent security weaknesses and the continual risk of insider threat. While total prevention of compromise is untenable, utilizing automated self-learning technologies to detect and respond to emerging threats within a network is an achievable cyber security goal, irrespective of whether the suspicious behavior originated on the corporate network or ICS.
In this session, learn real world examples of:
•How new machine learning and mathematics are automating advanced threat detection
•Why 100% network visibility allows you to preempt emerging situations of OT threats, in real time, across both IT and OT environments
•How smart prioritization and visualization of threats allows for better resource allocation and lower risk
12:00 pm - 1:00 pm Lunch
1:00 pm - 2:45 pm Strengthening Information Security Risk through Collaboration
Enterprise executives must collaborate together to stay ahead of hackers and cyber criminals. Forward-thinking security executives build and practice their ability to respond with proactive response plans that may lessen the probability of a breach. Leaders examine the divide between existing control and communication systems and backbone corporate IT systems. This is no easy task as the team must flip-flop between contexts and communicate to technology staff and board members to protect corporate security.
In this session explore:
•Balance theory with real world implementation
•Communicate security gaps across IT/OT across levels
•Understanding the evolving nature of the threat landscape
•Improving incident response and disaster recovery
1:45 pm - 2:15 pm Session: Role of FBI in Critical Infrastructure Security
The threat of cyber attacks is increasing daily and many companies have found themselves victimized by criminals and nation state actors. No industry segment is immune. Basic cyber security starts with awareness of who is attacking and what are their intentions. The purpose of this presentation is to provide this information so companies can improve their cyber security posture and protect their critical data.. This session will look at the public-private partnership in fighting cyber crime with the FBI and critical infrastructure companies.
2:20 pm - 2:50 pm Business Meeting
3:50 pm - 4:20 pm Business Meeting
3:20 pm - 3:50 pm Business Meeting
3:50 pm - 4:35 pm Navigating Cyber Security Legislation and Regulations for Critical Infrastructure
The industry is faced with new regulations and legislation, which is often overlapping and ever-changing.
Discuss the impact, effect and next steps from legislation and regulations. Sometimes organizations adopt frameworks with little understanding of what they mean or the implications to the business. In this interactive talk, gain lessons learned from implementing frameworks within critical infrastructure.
•COBIT, DFAR, FAR, NIST, etc.—what does it all mean; how is it audited?
•Balancing the benefits and costs of frameworks
•Compliance with ever-changing global legislation and administrative orders
4:35 pm - 4:45 pm Networking Break
4:45 pm - 5:30 pm Round Tables
Small, targeted discussions enabling open exchange amongst industry peers
A.Harnessing and Harvesting Talent to Retain Strong Security Teams- Speaker Beverly Lanoue, CISO, Kiewit Technology Group
B.Managed Security Service Providers (MSSP)- Opportunities and Challenges- Speaker: Jim Kastle, CISO, Conagra
5:30 pm - 6:30 pm Hurricane Relief Project
Sponsored by: Darktrace
6:30 pm - 7:30 pm Networking Reception
Sponsored by: Darktrace