Bonus Session Registration

SANS ICS Briefing:

• Defending Energy Systems
• Robert M. Lee, Stuart Bailey (Waterfall Security), Nick Cappi (PAS), Jason Farmer (Arbor Networks)
• Thursday, July 13th, 4:00pm - 7:30pm

In conjunction with the ICS - Houston training event, SANS is pleased to offer the 4th Annual Industrial Control Systems Security Briefing. This event provides the opportunity to engage in dialog around Industrial Controls Systems Security and learn about key solution capabilities.

This event is free to Oil & Gas constituents as well as ICS -Houston training event students.

Theme for this yearâs event: Defending Energy Systems

Agenda:

4:00pm - 4:15pm Registration & Coffee Networking

4:15pm - 4:45pm Welcome & Keynote:

CRASHOVERRIDE and Detailing Different Types of Detection

Robert M. Lee, Dragos

Organizations are constantly asked to evaluate new technologies, approaches, and tradecraft largely focused around different ways of detecting threats. However, there is not a standard model for the different types of detection. This presentation is a preview of an upcoming SANS paper on the four types of threat detection, how to leverage them, and the pros and cons of each for your organization. CRASHOVERRIDE will be leveraged as an example so that defenders can leave with actionable recommendations for their environments.

4:45pm - 5:20pm Session by Waterfall Security

Speaker: Stuart Bailey, Director of Industrial Security

5:20pm â 5:55pm Anatomy of an Attack: Two ICS Attack Vectors and How to Defend Against Them

Speaker: Nick Cappi, Director of Global Business Development for Integrity Solutions

What are your blind spots when protecting critical Industrial Control Systems (ICS) from attacks that can impact production and safety? Compromising ICS cyber assets â particularly proprietary ICS â is not difficult for someone with knowledge of these systems.

Traditionally, industrial processing facilities have relied on security by obscurity, system complexity, air gapping, network segmentation, and perimeter-based security protection for process control networks (PCNs). Many organizations have put IT-centric security technologies in place that primarily focus on securing Level 3 and 2 systems within the PCN. This IT-centric approach fails to protect Level 1 and 0 production-centric assets sufficiently, thus leaving them vulnerable. This creates a huge blind spot, which leaves industrial processing facilities vulnerable to common ICS attack vectors.

This presentation provides an overview of two simple Level 1 and 0 attack vectors that challenge most industrial processing facilities to defend proactively against. It provides an in-depth examination of the thought processes used by an attacker, along with detail of each attack. It then discusses the required technical controls needed for defense.

Attendees will learn:

⢠How an attacker approaches an ICS environment

⢠How two real-world attack vectors can lead to process and safety disruption as well as how to defend against them

⢠Security controls that protect against these two scenarios

5:55pm â 6:05pm Networking Break

6:05pm - 6:40pm Session by Cylance

6:40pm - 7:15pm Rise of the Industrial Internet of Things (IIoT)

Speaker: Jason Farmer, Advanced Threat Consulting Engineer

The Industrial Internet of Things (IIoT) promises to change Oil and Gas. Everything from connected barrels to new insight into the hydrocarbon supply chain and marketing to customers will be impacted by the IIoT. These new capabilities and insights into our business also bring new opportunities for malicious actors. This session explores our roles in using, exploiting, controlling, and surviving the hyper-connected world.

7:15pm - 7:30pm Closing Remarks

7:30pm â ?? Networking Reception