Last week to get a GIAC Certification Attempt Included with Online Training - Ends Soon!

Webcasts

To attend this webcast, login to your SANS Account or create your Account.

New Threat Vectors for ICS/SCADA Networks -- and How to Prepare for Them

  • Tuesday, June 27th, 2017 at 1:00 PM EDT (17:00:00 UTC)
  • Michael Assante and Phil Neray
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

Sponsor

  • CyberX

You can now attend the webcast using your mobile device!

Overview

Industroyer/CrashOverride malware and the WannaCrypt/WannaCry ransomware are having their immediate effects across industry right now. Both help us recognize that sophisticated attackers are constantly building new capabilities to work around security controls to disrupt and damage industrial systems and hold critical operations hostage. Don't miss your opportunity to learn what you can do to prepare and better-protect your ICS from these and other cybersecurity threats.

Another key target for cyberattackers is corporate intellectual property. In fact, according to the Verizon DBIR, cyber-espionage is by far the most predominant attack vector in the manufacturing sector -- and trade secrets are the #1 data type breached in manufacturing companies. Sensitive details about proprietary manufacturing processes, product formulas, and engineering designs can often be inferred from HMIs, data historians, and PLC ladder logic. In this case, the cyber-adversaries include nation-states and competitors intent on improving their competitive edge, as well as cybercriminal organizations seeking to sell corporate secrets to the highest bidder.

While regular patching is undisputably good advice for IT networks -- as in the WannaCry example -- it's not always that easy for critical infrastructure environments that run 24x7 and rely on legacy systems that have been running without interruption for years. These systems are also more likely to be vulnerable to non-targeted "nuisance" threats that disrupt day-to-day operations, such as the the 2016 malware infestation at the Gundremmingen nuclear plant. Additional threat vectors include single issue activists that target energy, pharmaceutical, chemical, and food production companies (such as eco-hacktivists and GMO activists).

In this educational webcast, we'll explore how to:

  • Evaluate the relative risk to your organization from diverse ICS threat actors including cybercriminals, competitors, and hacktivists
  • Engage effectively with business leaders and OT personnel to help them understand the threats -- and allocate resources to defend against them
  • Implement new risk-based controls that move beyond simple patching to include asset discovery, continuous monitoring, and behavioral-based anomaly detection

Speaker Bios

Mike Assante

Michael Assante is currently the SANS lead for Industrial Control System (ICS) and Supervisory Control and Data Acquisition (SCADA) security and Co-founder of NexDefense an Atlanta-based ICS security company. He served as Vice President and Chief Security Officer of the North American Electric Reliability (NERC) Corporation, where he oversaw industry-wide implementation of cyber security standards across the continent. Prior to joining NERC, Mr. Assante held a number of high-level positions at Idaho National Labs and served and as Vice President and Chief Security Officer for American Electric Power. Mr. Assante's work in ICS security has been widely recognized and was selected by his peers as the winner of Information Security Magazine's security leadership award for his efforts as a strategic thinker. The RSA 2005 Conference awarded him its outstanding achievement award in the practice of security within an organization.

He has testified before the US Senate and House and was an initial member of the member of the Commission on Cyber Security for the 44th Presidency. Before his career in security served in various naval intelligence and information warfare roles, he developed and gave presentations on the latest technology and security threats to the Chairman of the Joint Chiefs of Staff, Director of the National Security Agency, and other leading government officials. In 1997, he was honored as a Naval Intelligence Officer of the Year.


Phil Neray

Phil is VP of Industrial Cybersecurity for CyberX, a Boston-based OT cybersecurity company founded in 2013 by IDF cyber experts. Recognized as a "Cool Vendor" by Gartner, CyberX is the only industrial cybersecurity firm selected for the SINET16 Innovator Award sponsored by the US DHS and DoD. Prior to CyberX, Phil held executive roles at enterprise security leaders such as IBM Security/Q1 Labs, Guardium, Veracode, and Symantec. Phil began his career as a Schlumberger engineer on oil rigs in South America and as an engineer with Hydro-Quebec. He has a BSEE from McGill University, is certified in cloud security (CCSK), and has a 1st Degree Black Belt in American Jiu Jitsu.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.