2021 ICS Cyber Security Conference

The Department of Energy’s Cybersecurity for the Operational Technology Environment (CyOTE) program provides a methodology for energy sector asset owner-operators to combine network-based sensor data with local context to recognize faint signals of malicious cyber activity before an adversary can cause higher-impact effects. By leveraging this methodology with existing commercial monitoring capabilities and manual data collection from broader but informative sources in operations and even in the business domain, asset owners can better understand relationships between multiple observables which could represent a faint signal of an attack requiring investigation. Visibility is necessary but the importance of visibility is in the understanding and decisions it drives – complicated by infrastructure changes, new technologies, and determined and sophisticated adversaries. Independently getting to the point of making a risk informed business decision on whether to respond to an incident or fix a reliability failure sooner and with more confidence is the promise of CyOTE.  

While CyOTE is an energy sector program, the insights and takeaways are broadly applicable to other industrial sectors. This presentation covers the history of CyOTE to explain how the key insights came about, and then walks through the methodology as a way to put those insights into practice, showing how it complements other high-priority investments and activities in energy sector OT cybersecurity.