Building Control Systems Conference

Thanks to the folks at the SCADASEC listshare I heard about an interesting 3-day cybersecurity conference being put on by the Department of Commerce of all folks. The “Cyber Resilience of Building Control Systems” workshop is being sponsored by the Federal Facilities Council on November 17^th, 2015 in Washington, DC and it is being webcast (something I would like to see more conferences doing, at least with select, high-profile presentations).

Some presentations of potential interest to readers of this blog include:

• Federal Perspective Keynote – Global/National Landscape: Former Congressman Steve Stockman – Overarching commentary on cyber legislation and challenges (privacy, encryption, information sharing);

• DHS - NPPD/Office of Cyber and Infrastructure Analysis - Susan Stevens – National Protection and Programs Directorate (NPPD) efforts to address the needs of all 16 Sectors to understand and manage cybersecurity risks for the multitude of facility and building types;

• DHS - NPPD/Office of Cybersecurity and Communications/ICS-CERT - Marty Edwards – • Building Control System cyber threats and vulnerabilities; role of ICS-CERT;

• USCYBERCOM – Bob Leverton – Overview of Joint Base Architecture for Secure ICS (J-BASICS) Tactics, Techniques & Procedures (TTPs);

• Whole Building Design Initiative: Rick Tyler, US Navy – Overview of draft Unified Facility Criteria 4-010-06 CYBERSECURITY OF FACILITY-RELATED CONTROL SYSTEMS;

• Cyber Ranges - DoD National Cyber Range – Dr. Robert Tamburello – Overview of Control System Test and Evaluation Events at the DoD National Cyber Range;

• Billy Rios – WhiteScope – Overview of Building Automation Systems continuous monitoring solutions, enumeration of internet-facing BAS using Shodan;

• Jason McHuen – Parsons – Hands-on demonstration of Kali Linux, Metasploit targeting and attacking Building Control Systems; and

• Alex Tarter – Ultra Electronics, 3eti – Cybersecuring Control System End-Point devices.

There will also be presentations and then separate hands-on workshops by ICS-CERT (CSET) and NSA (GrassMarlin) on the optional 3^rd day of the workshop. It is not clear if the hands-on workshops will be webcast (my guess – not).

You can register on-line (also required for web cast) here. I’ll be there via the webcast; no travel budget, you know.

BTW: The agenda for this workshop indicates that there is a GrassMarlin module that can be downloaded with the ICS-CERT CSET. Nothing about that on the ICS-CERT pages. Again, ICS-CERT does a poor job in talking about the capabilities of their tools.