This event has ended. Visit the official site or create your own event on Sched.
Welcome to the Interactive Agenda for SecurityWeek’s 2017 ICS Cyber Security Conference! (View the full conference website here)  (You can register for the conference here)
View analytic
Tuesday, October 24 • 2:15pm - 3:00pm
Encryption in ICS: Is the Juice Worth the Squeeze?

Sign up or log in to save this to your schedule and see who's attending!

We all know ICS protocols lack security; no authentication, no integrity, no confidentiality. For the past decade ICS asset owners have been leveraging common IT communication methods such as IPSEC, TLS/SSL to assist them in securing these protocols over untrusted networks such as the Internet or 3rd party WAN circuits. In 2017 we are now seeing ICS/DCS manufacturers incorporating encryption features into their field devices (PLCs, controllers) offering end to end encryption capabilities.  Some ICS security professionals see this as one of the first steps to "secure by design" while others have said this now signals the death to deep packet ICS inspection technologies.             

This talk will focus on how end to end encryption can negatively affect an asset owners' security posture while also creating administrative overheads and introducing new cybersecurity challenges to deal with.  Encryption is a double-edged sword no matter whether you are on the plant floor or the substation LAN; and should only be used where appropriate.  End to end encryption in ICS isn't worth the squeeze; long live clear-text protocols!            

avatar for Brian Proctor

Brian Proctor

Business Development Manager, SecurityMatters
Brian’s entire career has been focused on securing electric utility systems, networks, and assets. He spent the majority of his career (13+ years) as a ICS/SCADA cybersecurity engineer and cybersecurity team lead working for two progressive California Investor Owned Utilities (IOUs). In February of 2017 he joined SecurityMatters as their Business Development Manager to help promote passive ICS/SCADA network security monitoring, asset inventory, and situational awareness within the industrial control system security community. | | Brian holds a variety of technical certifications including the Global Industrial Control System Professional (GISCP), Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), and is certified in project management from University of California at Irvine. In 2013, Brian was presented with the Critical Infrastructure Private Sector award from Securing our eCity a San Diego based Cybersecurity non-profit organization. In 2016, Brian was a co-inventor of a... Read More →

Tuesday October 24, 2017 2:15pm - 3:00pm
Windsor DE

Attendees (22)