Monday, October 04 2021 10:00 AM - Wednesday, October 06 2021 3:00 PM [PDT]
1600, Disneyland Drive, Anaheim, CA, 92802, United States
Sales end on 10/04/2021
Access to all 3-days of the event
Grand Californian Hotel & Spa, 1600, Anaheim, CA, 92802, United States.
Our DRAFT Agenda is ready. The schedule section below will be updated as selected speakers are confirmed.
Our Annual Security and Compliance Summit returns for our 16th Anniversary! We are still the premier security conference for critical infrastructure and one of the longest running events of its kind in the nation.
The unique qualities of our Summit reside in the vast array of industry leaders and experts we invite to participate in the event. Attendees benefit from a diverse collection of perspectives, knowledge, and experience as our presenters and panelists journey from destinations all around nation and globe! With such a concentration of thought leadership and talent, the stage is set for passionate discussion and debate on a variety of topics that highlight the burning issues and evolving needs of our industry.
Navigate our Summit page to learn more about this year's exciting topics and speakers. Registrations and rooms go fast so start planning your educational experience and relaxing fun in the sun today!
Attendees will have the benefit of accessing discounted pricing for rooms at the Grand Californian Hotel and theme park tickets. Details will be emailed to the attendee after the purchase of registration.
Anyone with an interest in security or related compliance requirements in the energy sector should consider attending. This includes the following roles, and more.
Chief technology officers (CTO)
Chief security officers (CSO)
Chief information officers (CIO)
General Managers (municipal, coops, power plants, etc)
NERC Compliance managers and staff
Compliance managers and staff
IT & security architects
Cyber risk managers
Auditors
Security analysts
Program and Project managers
State regulatory commission staff
Government agency repreentatives
National Lab personnel
Cancellation policy Refunds available up to 30 days prior to the event.
Refunds available up to 30 days prior to the event.
energysec.org
The Energy Sector Security Consortium, Inc. (EnergySec) is a United States 501(c)(3) non-profit corporation formed to support energy sector organizations with the security of their critical technology infrastructures. Through our membership program, we support collaborative initiatives and projects that help enhance the cybersecurity resiliency of these organizations Today, our community includes individuals from a broad range of utilities, industry product and service vendors, academic institutions, national labs, regulatory organizations, and government entities, with formal membership representing 160 electric utilities having headquarters in 25 states and operations in several others. In addition to our formal membership, numerous other utilities participate in our community events and educational programs. Our membership and participation ranges from the largest utilities in North America to small local utilities with less than 250 employees.
Kylie McClanahan is a doctoral student in the Department of Computer Science and Computer Engineering at the University of Arkansas and a senior software developer at Bastazo, Inc. She has significant background in and knowledge of the electric sector through research, internships, and industry connections. Her research focuses on automating vulnerability and patch management using machine learning techniques. Recently, she published research concerning a strategy to automatically propose mitigation actions when patching is unavailable, and she is currently working on methods to optimize patch scheduling.
Steel McCreery has thirty-six years of application experience in the area of data communication, automation, training, and cyber security. In 1983 after graduating from Humber College of Applied Arts and Science, Steel began his career in the area of factory automation while employed at various automation equipment manufactures such Reliance Electric, Modicon, GE Fanuc, Omron, and Siemens. During this time Steel’s duties included application design and commissioning of PLC’s, variable speed drive systems, multi axis motion control systems and communications networks. Steel work spanned various industrial segments from mining to automotive and his success developing and delivering automation and communications courses and seminars afforded him the opportunity to develop national automation training centers for Siemens and Omron. Steel joined GE Multilin in 1999 to develop their international training center focused on protective relaying and substation automation. Over the 14 years at GE Multilin Steel’s role expanded into marketing and R&D before accepting an automation role at SEL. Shortly after joining SEL, Steel focused on SEL’s communications and cyber security products ranging from multiplexers, traditional Ethernet switches and security appliances to SDN switches. During this time Steel also had the opportunity to develop and deliver many customer communications seminars and courses. Steel joined Omicron in 2020 where his role’s focuse is on utility communications and cyber security.
Christian O. Hunt has a technical career spanning over 30 years. He has developed security solutions for various private sector and government organizations. He is a former vulnerability researcher and long-time hacker specializing in reverse-engineering, malware analysis and esoteric hardware security with a focus on RF-based side-channel attacks. Based on his interest in RF, side-channel attacks, and signals analysis, he performed successful research for the DARPA Cyber FastTrack program involving the effects of electro-magnetic injection on imaging devices. . He has presented at various industry conferences such as Borderless Cyber, Bulletproof Hosting and Botnet Conference (Germany) BAE Systems (stuxnet), and Remote Monitoring and Control. The latter involved a talk on security in automated industrial systems (SCADA) and concluded with a demonstration of a custom-built microcontroller-based demonstration system showing the potential hazards of insecure automated processes. Mr. Hunt helped to create several fraud analysis and security monitoring systems while a member of the Technical Staff of the Global Information Security organization at eBay. Mr. Hunt is currently a Principal Security Engineer with Copado. He served as a subject matter expert on the California Energy Systems for the 21st Century project (CES-21) which was overseen by the Department of Energy, Department of Homeland Security, Idaho National Labs, Lawrence Livermore National Laboratory, and the California Public Utilities Commission.He is actively involved in several OASIS standards as well as advanced cybersecurity research and development projects in the critical infrastructure domain. He currently resides in a laboratory in Northern California with his wife, two dogs, three cats, seven chickens, multiple faraday cages, and a growing aluminum farm.
Maggie Morganti is a Product Security Researcher at Schneider Electric where she works on vulnerability handling, supply chain security, and secure product development for power systems. She also serves as the Director-Elect of the ISA Communications Division (COMDIV). She previously held roles as a Cyber Technical Staff member for Oak Ridge National Laboratory’s Power & Energy Systems team and as a Threat Intelligence Analyst for FireEye Mandiant’s Cyber-Physical team. She holds a M.S. in Intelligence Studies with a focus on cybersecurity from Mercyhurst University.
Colin Gordon is a senior research engineer with over a decade of experience at Schweitzer Engineering Laboratories. He is currently active in its Infrastructure Defense division. Colin’s work experience includes the engineering and implementation of cybersecure communication networks and the research and design of embedded cryptographic security controls for risk mitigation and regulatory compliance purposes. Colin joined SEL in January 2008 and holds a bachelor’s degree in computer engineering from the University of Idaho.
Michael Colao has been the Manager of Data Protection and Assurance within Arizona Public Services’ (APS) Cybersecurity group since 2014. His team is responsible for the governance of internal controls framework supporting the protection of APS’ personally identifiable information of customers and employees, Critical Infrastructure Protection (CIP), Sarbanes Oxley (SOX) and Export Compliance. The ongoing monitoring and evolving of a data protection program, along with its training and awareness are focal points to the success of his team. Data Loss Prevention (DLP) has become a major pillar in his team’s multi facet approach to protecting highly confidential information in APS’ inventory, in both on-prem and cloud infrastructure. Prior to joining APS, Colao spent the better part of 15 years in operational business and finance roles beginning with Deloitte, LLP. He holds a certification as a certified information privacy professional (CIPP/US) from the International Association of Privacy Professionals (IAPP). Originally from upstate New York, Michael has a BBA from Niagara University.
Steven Parker, CISA, CISSP, is a founding director of EnergySec. He has been engaged in critical infrastructure protection within the electric sector for more than 14 years, including eight years as a senior security staff member at a large west coast utility. He was also one of the original NERC CIP auditors for the WECC region. He has been with EnergySec full-time since 2010.
Dr Robin Berthier is the co-founder and CEO of Network Perception. He has over 15 years experience in the design and development of network security technologies. He was part of the University of Illinois research team that originally developed the technology that drives the Network Perception Platform. He received his PhD in the field of cybersecurity from the University of Maryland College Park before joining the Information Trust Institute (ITI) at the University of Illinois at Urbana-Champaign (UIUC) as a Research Scientist.
Keysight Technologies
AssurX
SIEMENS
Network Perception
Finite State
Dragos
Archer
Tripwire
Waterfall
Schweitzer Engineering Laboratories
SEL OT Holistic Risk Presentation
As shown through multiple high-profile cybersecurity attacks this year, organizations have to shut down operations when their mission-critical assets are breached. New cyber threats are increasingly targeting OT infrastructure because 1) it has the most severe impact on uptime and revenue, and 2) legacy and geographically dispersed systems are harder to defend. Traditional IT solutions are often too slow and heavy for today's sophisticated and rapidly evolving attack techniques. This presentation will provide practical advice to enable organizations to adapt and recover faster from cyber threats based on a detailed review of thousands of network architecture assessments. The discussion will introduce the 3 foundations of an efficient cyber resiliency program: compliance verification, cybersecurity visibility, and operational velocity.
CEO
Targeted ransomware has emerged as a major threat to industrial operations / OT systems. The Colonial Pipeline and JBS shutdowns are only the latest incidents - in 2020, 53 industrial sites were shut down by targeted ransomware. The trend is likely to worsen - today's targeted attacks use tools and techniques comparable to those used exclusively by nation-states only a half-decade ago.Operational Technology (OT) cyber risk manages cyber threats to physical operations. Some enterprise security mechanisms are very costly to apply in OT systems because of extended safety, equipment protection, and other OT risk management programs. We see emergency risk avoidance mechanisms that are unique to the OT space but are under-utilized by enterprise risk management and security practitioners.This presentation highlights three such innovative cyber risk management approaches and examines their effectiveness against the pervasive threat of targeted ransomware with particular attention to the operational risk. The presentation will outline a simple and robust approach to managing OT cyber risks, including Security PHA Review (SPR), Consequence-Driven, Cyber-Informed Engineering (CCE), and Secure Operations Technology (SEC-OT). Secure sites in the industry are improving protection for their operations by cherry-picking techniques from these new methodologies. Join us for a whirlwind tour of trends in OT and industrial operations attacks and defenses.
Director of Industrial Solutions
The frequency and intensity of cyber-attacks targeting the power grid have increased since the first confirmed blackout caused by hackers in the Ukraine in 2016. Substations represent a critical attack vector within the power grid. Commonly located in remote locations, unmanned and visited infrequently by a transient workforce increasingly comprised of contractors the substation LAN presents unique challenges not found in traditional IT or OT networks. Policies and procedures cannot eliminate the possibility of the inadvertent introduction of malware onto the network. The more sophisticated malware is designed specifically to perform tasks such as network and traffic reconnaissance to lay the groundwork for more sophisticated attacks. Gateways and firewalls located at the substation LAN perimeter, cannot prevent the transmission of unauthorized network traffic within the cyber defense perimeter. The question then arises as to how can potentially malicious traffic be detected beyond the firewalls? This paper examines the benefits of securing substation LANs thorough the complementary security features of a Software Defined Network and a Functional Security Monitoring IDS.
Utility Communications Application Engineer
The burden of vulnerability management grows heavier every year. Machine learning and artificial intelligence can provide powerful insights and time savings, but these should not come at the cost of reliability or CIP compliance, nor should recommendations be followed blindly. Electric utilities have a particularly high potential for time savings for two reasons: highly structured vulnerability data and the repetitive and cyclic nature of vulnerability assessment. This talk will provide a brief overview of machine learning, including a realistic look at its limitations, and will discuss how these techniques can be used to automate sections of the vulnerability and patch management process, such as predicting an optimal remediation action, while providing compliance documentation and maintaining user trust.
Ph.D. Student
Information Sharing can be simple, informal, and effective. In this panel, we will hear from those on the front-line of defense about how their daily interactions and information exchanges with peers across industry benefits their organizations’ security efforts.
Historically, sharing of actionable intelligence in the information security domain has been haphazard, time consuming, and fraught with bad information. Moving towards more machine readable formats and open communications models can help improve our ability to respond and prevent incidents in a more efficient and automatable way. This talk will examine the beneficial changes made over the last several decades in regards to information sharing of actionable cybersecurity information, it’s importance, and where it still needs to go.
Principal Security Engineer
Join us at our famous Welcome Reception for light food, drinks, and plenty of networking with your friends and peers.
Senior Grid Strategist
Join your peers in the Expo Hall for a beverage break and conversation.
North American power systems are currently undergoing a period of significant technological change. Increased integration of renewables, cloud infrastructure, and smart edge devices will inherently reshape the fabric of power systems over the next decade and beyond. These shifts will require forward-looking threat modeling for power systems of the future. Specifically updating threat models to reflect power systems becoming more edge-connected, distributed, and transactional in nature. These new threat models must include, not only of large APT-style incidents, but also how all these factors may affect grid stability against less obvious threats. Timely examples of this could include ransomware against ancillary systems such as billing in increasingly transactional power systems of the future.
Product Security Researcher
The Zero Trust (ZT) concept for securing information networks is gaining popularity in the energy system industry. The very name implies the complete lack of trust within a system. However, trust underpins all security, and the notion that trust can be excluded entirely from the calculus of network security is misguided. Instead, while applying zero-trust principles as described by NIST SP800-207, security professionals are well served by continually evaluating three questions:
What do I trust?
Why do I trust?
When should I no longer trust?
This presentation explores the concept of ZT, its application to Industrial Control System security, and suggestions for mechanisms to employ ZT while considering the unique requirements of energy system infrastructure.
Senior Research Engineer
President
Join your peers for a catered lunch.
(A)Awareness and Change Management, Is your Organization’s Maturity in Place for Cloud Collaboration of Highly Confidential Data?
(B)Access and Roles, Determining Your Users in Cloud AppsMichael Colao as Presenter
(C)Data Inventory, Where is Your Stuff? How Will You Protect It?
(D)Sharing Types, Internal Only vs. External with Cloud Apps
(E)Data Protection Tools – DLP, Encryption, and Quarantine
(F)Transparency, Working with your Regulators, Law team and IT
Manager of Data Protection and Assurance
Join your peers for refreshments in our Expo Hall and explore solutions to your security and compliance needs.
The early bird gets the prize! We will kick off Wednesday morning with drawings for prizes from EnergySec and our Sponsors.
Presentation TBA
Take a break and explore solutions in the Expo Hall.
TBA
Enjoy a catered lunch with your peers.
The Summit concludes with additional presentations and a lively panel discussion on a topic to be announced.
Integer nulla lorem, pellentesque eget eros malesuada, semper bibendum felis. Proin quis est egestas, ultrices purus tempor, aliquet erat. Nullam molestie, neque at hendrerit semper, dui lacus eleifend arcu, quis mattis augue leo condimentum dui. Nunc vehicula eleifend risus vitae luctus. Sed sed sem nibh. Nam sit amet massa ullamcorper, iaculis felis id, ullamcorper libero. Aenean aliquet orci quis nisi interdum faucibus. Maecenas sollicitudin, nunc vitae tempus feugiat, arcu elit egestas diam, sit amet maximus neque turpis ac quam. Curabitur at ligula eget turpis pellentesque vestibulum eu id ante. Cras eget turpis mauris. Vestibulum vitae quam elit. Suspendisse bibendum at ipsum nec tempor. Ut in tristique nibh. Aliquam erat volutpat. In hac habitasse platea dictumst.
Vivamus tempor viverra enim, commodo faucibus quam porta sed. Sed et varius nunc. Fusce cursus sem nec tellus accumsan, sed laoreet nisi vulputate. Praesent varius quis turpis in aliquam. Phasellus nisl velit, porttitor eget risus sed, interdum elementum nibh. Praesent eget ante bibendum quam suscipit accumsan sit amet eu nisi. Ut eget facilisis risus. Proin molestie lorem ut interdum finibus. Sed pretium ut sapien at dictum. Sed sit amet dolor tincidunt turpis tincidunt ultricies et et neque.
Nam non augue a lorem tempor sodales. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; Quisque ullamcorper lobortis rhoncus. Morbi nec dui vitae odio ultricies posuere ac nec turpis. Vestibulum efficitur lectus sem, sed volutpat quam congue at. Nulla quis aliquam ex. Vestibulum eget felis consectetur, efficitur risus non, dapibus tellus. Aliquam ac gravida dui. Donec vel est a arcu tristique egestas id vitae neque. Nullam varius odio eget leo porttitor, pharetra rhoncus quam dignissim..
Please enter below, the secure invite code provided to you by the event organizer in order to proceed...