SANS Survey on Control Systems Security
- Tuesday, April 01, 2014 at 1:00 PM EDT (17:00:00 UTC)
- Matthew Luallen, Derek Harp, Marc Blackmer, Paul Asadoorian, Jason Ostermann and Billy Rios
You can now attend the webinar using your mobile device!
Results for the SANS 2014 SCADA Survey will also be presented at the 9th Annual ICS/SCADA Security Orlando Summit & Training to be held March 17 and 18, 2014. More information on the summit, including agenda, pre-summit courses, and exciting bonus events can be found at the following link: http://www.sans.org/event/north-american-ics-scada-summit-2014
This second survey on the state of security in control systems will follow key trends introduced in our first survey on SCADA security published in 2013. In that survey, responses from nearly 700 participants revealed the following:
- Slightly greater than 40% of respondents had their control systems hacked, suspected they were hacked and couldn't prove it, or didn't know.
- Their biggest concerns were targeted malware like Stuxnet, followed by insider threat and hacktivism.
- Most were protecting computer assets (80%) and network devices (81%), while only 35% were focusing security on inherently vulnerable control system protocols
- NIST was the most used guide for industrial control systems security, whereas NERC CIP placed third.
Our 2014 State of Control Systems Security Survey examines new risks and threats that control system operators are concerned about today and what progress has been made in education, awareness and risk management.
Register for this webcast and be among the first to receive the associated survey report developed by SANS Analyst and SCADA/ICS expert Matthew Luallen.
Click here to view the associated whitepaper.
Matthew E. Luallen is cofounder and president of CYBATI, a critical infrastructure and control system cybersecurity consulting, awareness and training company. He has written, consulted and trained extensively on process control and SCADA security issues and continues to work with electric utilities in the U.S. and Canada on the NERC CIP reliability standards. He has also presented and consulted on ICS cybersecurity within critical infrastructures to the FBI Infragard, FBI, ISA, NERC RROs, USSS, NNSA, DOE National Labs, U.S. Army Central Command, FAA, European Union, RCMP, and at the request of specific asset owners. Mr. Luallen holds a bachelor's degree in industrial engineering from the University of Illinois-Urbana, a master's degree in computer science from National Technological University and is a 13-year Cisco Certified Internetwork Expert (CCIE). He serves as adjunct faculty for DePaul University's capstone cybersecurity and control system courses, as a certified instructor for Cisco Systems and as a certified instructor for the SANS Institute. He is also the author of a hands-on, control system cybersecurity course promoted by CYBATI.
Derek Harp is currently the business operations lead for the Industrial Control System (ICS) programs at SANS. He has served as a founder, CEO and advisor of early-stage companies for the last 16 years, with a focus on cybersecurity. Derek is also a co-founder and a board member of NexDefense, Inc., a company focused on the security technology needs of ICS asset owners. Previously, he was the CEO and co-founder of LogiKeep, Inc., where he was the co-inventor of Intellishield™, a pioneer IT security product that was subsequently acquired.
Marc Blackmer has spent more than fifteen years assisting some of the world's top energy producers, financial institutions, and governments worldwide defend their critical assets from cyberthreats. His technical background in information technology engineering, security operations and IT governance, risk, and compliance brings a unique perspective to addressing the threats facing critical infrastructure today.
Paul Asadoorian is the founder of PaulDotCom (http://pauldotcom.com), an organization responsible for publishing award-winning podcasts, blogs and videos on the topics of information security and hacking. Paul's day job as the product evangelist for Tenable Network Security, keeps him busy showcasing cool vulnerability scanning technology through blogs, podcasts and videos. Paul has a background in penetration testing, embedded device hacking, and is the co-author of two books: WRT54G Ultimate Hacking and the latest publication titled Offensive Countermeasures: The Art Of Active Defense.
Jason Ostermann, chief engineer–transfer solutions at Raytheon Cyber Products, holds a TS clearance with current SSBI and graduated from Texas Tech with a BS in computer science. He has 14 years of overall experience in the high-tech industry including network and systems administration, 10 years of experience in guard development, software security engineering and system administration. Jason leads multiple cross domain solution projects and holds CISSP, ISSEP certifications. As the High Speed Guard chief engineer, Jason was responsible for the maturation of a high speed cross domain solution supporting 90% of theoretical line speed throughput for secure data transfers.
Billy Rios currently serves as the director of vulnerability research and threat intelligence at Qualys. Billy studies emerging threats with a focus on embedded devices, medical devices, industrial control systems (ICS), and critical infrastructure (CI). Before joining Qualys, he was a Lead at Google, where he led the front-line response for externally reported security issues and incidents. As the security program manager at Internet Explorer (Microsoft), Billy led the company's response for several high profile incidents, including the response for Operation Aurora. Billy has also worked as a penetration tester, an intrusion detection analyst, and served as an active duty Marine Corps officer. An accomplished author and speaker, Billy currently holds an MBA and a master of science degree in information systems.