Cyber Defense Initiative^® 2014

Attacking and Defending Building Automation Systems at Scale: A Case Study

• Billy Rios
• Saturday, December 13th, 7:15pm - 8:15pm

Modern facilities (such as corporate headquarters) are marvels of engineering. These buildings employ numerous embedded and software systems to help ensure convenience, business efficiency, and even security. The door that unlocks after you swipe your badge is managed by an access control system. The lights and energy flowing to your building are managed by an energy management system. The HVAC systems that keep your data center cool are controlled by an environmental control system. These invisible embedded and software systems make modern life in the corporate facility efficient, convenient, and comfortable. Given the importance and of these systems, how do we secure a modern smart building? What about a corporate campus full of thousands of automation systems? Let's take a look how building automation systems are hacked and explore approaches to secure building automation systems at scale.

Billy's Bio:

Billy is an accomplished author and speaker. Billy is recognized as one of the world's most respected experts on emerging threats related to Industrial Control Systems (ICS), Critical Infrastructure (CI), and, medical devices. He discovered thousands of security vulnerabilities in hardware and software supporting ICS and critical infrastructure. He has been publically credited by the Department of Homeland Security (DHS) over 50 times for his support to the DHS ICS Cyber Emergency Response Team (ICS-CERT). Billy has led several prestigious security teams including security teams at Microsoft and Google. Billy was a Lead at Google where he led the front line response for externally reported security issues and incidents. Prior to Google, Billy was the Security Program Manager at Internet Explorer (Microsoft). During his time at Microsoft, Billy led the company's response for several high profile incidents, including the response for Operation Aurora. Before Microsoft, Billy worked as a penetration tester, an intrusion detection analyst, and served as an active duty Marine Corps Officer.

Billy currently holds an MBA, Master of Science in Information Systems, and a Master of Military Operational Arts and Sciences. He was a contributing author for several publications including: Hacking, the Next Generation (O'Reilly), Inside Cyber Warfare (O'Reilly), and The Virtual Battle Field (IOS Press).