Agenda

We’ve connected everything, everywhere, all the time, so how DO we more efficiently interact with a digital realm that continually measures our pulse in the real world? Let’s talk about some attack vectors that I’ve spent the last few years researching and helping others work on. And then let’s talk about what we CAN do about things. You’ll never look at your lights the same way again.

Building control systems have been around since the late 1970s. These systems were digitally controlled and proprietary. The building staff could run the building, but the logic/programming required the system service provider’s knowledge to maintain. Over time, the building staff’s reliance on the service provider grew to the point that the service provider not only has unrestricted local access but also unrestricted remote access. And in most cases, the service provider provides and controls remote access. When you take this into account and multiply it by the number of building control systems per building, the number of service provider technicians that currently have access, and former employees that possibly have access, and then multiply this by the number of buildings owned, this number can be huge. Now take into consideration that most of the service providers are not bound to cybersecurity service provider agreements. These buildings are a high degree of risk exposure for building owners.

Learning Objectives:

• Participants will be exposed to the current state of the building control system cybersecurity.
• Participants will be walked through some real-world examples of results when service provider management does not exist and/or breaks down.
• Participants will learn the basic concepts of managing service providers using ISA 62443.

With a marked increase RaaS, APT, and nation-state sponsored attacks in the industrial cybersecurity sector over the last 18 months, it is more critical than ever for organizations to build effective incident response capabilities for their Operational Technology (OT) and Industrial Control Systems (ICS) environments.

Often when the OT process is down, so is the revenue stream. The pressure to get back operational is high. Having a solid practiced plan, the right tools in place, and an effective decision-making process are critical to restoring production.

Are you interested in the state of cybersecurity jobs in our current economy? In this discussion, we will dive into the latest data on cybersecurity job trends in the U.S over the past 6 months. With an average of 190,000 cybersecurity jobs posted each month, this comprehensive data set will provide valuable insights into the ever-evolving world of cybersecurity.

Phishing is one of the leading cyberattacks worldwide, resulting in numerous social engineering training exercises to train average users to defend against these attacks. This discussion focuses on research that took a pool of users with three different phishing campaigns. Each campaign progressively has a phish that should be more advanced to spot than the previous phish presented. The research shows the psychological reasoning behind why a user will interact with a phish, regardless of educational awareness. Results include why a 0% or 100% report rate is unrealistic and how to use phishing metrics to quantify risk in a business.

Third-party cyber risk is a pressing concern for manufacturers. 70% have experienced breaches stemming from overprivileged vendor access, making them ripe targets for ransomware. This session will explore the brand, operational, and legal dangers of poor vendor management. It will provide best practices for securing third parties, including thorough vetting, access controls, and monitoring of privileged sessions. With third-party reliance increasing, manufacturers must make securing vendor access a top priority to minimize cyber risk.

Keeping the production line running is the number one driver of profitability in manufacturing. Any interruption can lead to unfulfilled orders, angry customers, and supply chain disruptions. Every minute of downtime—especially of the computers that control operational technology (OT)—is money pouring onto the floor. Cybercriminals love to target manufacturers with ransomware, knowing the stakes are high and the victims are likely to pay quickly. So building a defense against ransomware is essential, but not sufficient by itself.

Building cyber resilience into factory floor operations requires a broader view of the risks to OT: not just cyberattacks, but also hardware failures, software bugs, human errors, even natural disasters. Yes, you need to fend off ransomware attacks, but you also need to recover quickly and reliably when an OT outage occurs for any reason.

Join Acronis for this session which explores potential sources of factory floor downtime with a focus on OT control computers, examines both defense and recovery strategies for these failures, and digs into case studies of manufacturers that have successfully built true cyber resilience into their OT environments.

Let’s be honest: people can frustrate us. They don’t always do the things we’d like, and they often do some things we’d rather they didn’t. New research from the National Cybersecurity Alliance reveals insights about the public’s attitudes and beliefs about security.  We’ll explore the 2022 “Oh Behave! Cybersecurity Attitudes and Behaviors Report,” and some of the findings may surprise you! We’ll also give you practical, actionable advice on how you can better communicate to influence the behavior change you want to see.