2021 ICS Cyber Security Conference

The threat to network, control, and physical security systems has never been greater and points to a need for a holistic information technology/operation technology (IT/OT) approach. Environments change constantly, and the magnitude of risk varies by customer. Given the complexity and ever-changing nature of the asymmetric threat, it is possible that traditional IT approaches to resolve cybersecurity issues in critical infrastructure may not identify systemic flaws in certain situations. These flaws may provide openings for attacks, which would then place the client in jeopardy. Client jeopardy in cybersecurity, functionality, and physical security stems from vulnerabilities and threats that capitalize on them. An integrated IT-OT approach needs to be designed to evaluate these areas for weaknesses, but if adequate information is not available, vulnerabilities and threats may escape notice. Further, the very nature of information systems is that the advantage is to the attacker, and in most cases, the network defense is in a constant state of reaction to identified vulnerabilities and new or evolving threats. In addition, critical infrastructure/industrial control system networks have unique characteristics that make them vulnerable to attacks if not secured correctly.

This talk will address the main differences between IT and OT from the perspective of Defense in depth, with real live examples on OT assessments.

This presentation addresses technical areas such as network, software and hardware controls, and administrative policies and procedures to provide a layered security posture.