Conference Schedule

Welcoming & Remarks

​

Eric Goldstein | Executive Assistant Director for Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA)

Cybersecurity - Taking it Up a Notch, Slightly More Technical

SESSION VII - TRACK I

Baseline Cross-Sector Cybersecurity Performance Goals

CISA in collaboration with NIST and other organizations and individual subject matter experts, has created a document for voluntary use by critical infrastructure sectors that identify a prioritized list of recognized risk reduction measures. Known as the Baseline Performance Goals (BPGs), they are consistent with the NIST Cybersecurity Framework.

​

Speaker

Daniel Bardenstein | New Tech and Cyber Strategy Lead, Cybersecurity and Infrastructure Security Agency (CISA)

SESSION VIII

MITRE ATT&CK® Framework for Industrial Control Systems – Common Knowledge for Communicating Malicious Behaviors

The MITRE ATT&CK® Framework provides a repository of common terminology for network defenders to communicate about real-world attacks. ATT&CK® for Industrial Control Systems builds on ATT&CK® by describing specific post-compromise actions and behaviors unique to attacks on ICS environments.

​

Speaker

Otis Alexander | Principal Cyber Security Engineer, MITRE

Break

SESSION IX

Secure Remote Access for ICS/OT/SCADA – When You Absolutely, Positively Can’t Live Without It

While it’s preferable to prohibit remote access into an OT network, that’s often not the practical choice. For those times when you absolutely, positively need remote access, learn pragmatic, low-cost methods for doing it securely and about the risks when you don’t.

​

Speaker

Gus Serino | Principal ICS Security Analyst, Dragos

SESSION X

The Importance of ICS/OT Monitoring – Just Because We Can’t See Them, Doesn’t Mean They Aren’t There

Presently, we have much more visibility on our IT networks, but threat actors aren’t just attacking IT. In order to know who is after our OT environments, we need better visibility into them.

​

Speaker

Michael Toecker | Cybersecurity Advisor, Department of Energy (DOE)

Physical Security - Round Two and TTX

SESSION VII - TRACK II

Recognizing and Responding to the Early Indicators of Hostile Events
As conference attendees will already have learned, water and wastewater utilities face physical security threats from a range of actors, including external entities like domestic violent extremists and common criminals but also insiders from within their own organizations. No matter where they come from, one thing all threat actor have in common is that they typically display early indicators suggesting they’re planning to or might conduct a hostile act. For this session, a team of speakers from DHS will review the indicators and other suspicious activities to look out for and how to respond to them, including by reporting them to the appropriate authorities. Don’t miss this opportunity to receive important information that can help your utility prevent and mitigate what could otherwise become a very impactful incident.

Break

TTX on Physical Security* - Preparing for Hostile Events

At this TTX we will be discussing and preparing for hostile events. Hostile Events include active shooter incidents, workplace violence and workplace attacks, lone actor and low-tech terrorism, complex coordinated terrorist attacks, fire as a weapon, weapons of mass destruction, and other related activities. The hostile event attack cycle incorporates the seven phases threat actors utilize when planning and conducting attacks.

During the TTX, players will participate in a discussion-based scenario that concerns hostile events occurring in the water sector. WaterISAC staff will facilitate discussion on the hostile event and players will have the opportunity to voice mitigation strategies or recommend best practices for preventing or mitigating threats. The TTX will provide attendees with the skills needed to recognize types of hostile events, to better prepare for and react to an event; identify indicators of potential violence to possibly avert a hostile event from occurring; identify the phases of a hostile event; and provide mitigation strategies to help develop a training program for your organization.

​

*Additional registration will be required. There is no fee for already registered H2OSecCon Attendees.

Closing Remarks