• PDO transformation  journey in managing information security
• Our evolution and education from using the traditional model of securing infrastructure to where we are today
• Adopting a three dimensions model, based on a Risk oriented  approach anchoring  on ISO 27001 standard to identify various types of threats  and vulnerabilities and manage them commensurate with PDO business imperatives
• Insights and learning’s from PDO iSecure campaign

• The breaking down of the traditional silos
• Cyber – the little engineering
• The human perspective

Process manufacturers are tasked to manage open, control systems platforms and use standard networks that are connected to external systems and the enterprise network.  Even systems that are not connected to external systems or the enterprise network require security measures to prevent them from becoming infected by viruses or worms.  New challenges in managing this critical infrastructure arise every day and can include: 

• Process systems that are becoming more integrated with business systems and the reliability of this integration are absolutely critical to production. 
• Cyber security now poses a real threat to operations and updating patches and anti-viruses on the process control network is more critical than ever before. In many plants the anti-virus product supported by the process control vendor is not the same as the anti-virus product supported by the corporate IT department.
• The pace of change in process technologies is now keeping up with technologies traditionally found in IT - creating a challenge to keep these systems updated and reliable. 
• How to structure and staff an organization to support this rapidly changing environment.
 

We will share best practices and provide end users scenarios that illustrate how to balance the needs to integrate process control with IT and ensure system availability and reliability while mitigating the risks of an evolving cyber threat landscape.

Cyber security threats continue to increase in both frequency and sophistication. The industry is getting more automated, integrated and interconnected, creating a real challenge being faced.  To manage risk effectively in our industrial domains, technology, standards, policies and practices are not enough, people are crucial!

• A standardized foundational set of skills, knowledge and abilities for Industrial Cyber Security across the industry is lacking.
• There is a need for a standardized, vendor-neutral, certification program that provides structure and demonstrated competence.
• An ICS professional needs a hybrid set of experience and competencies that can be roughly divided in 4 domains - IT, Cyber Security, Engineering, and Corporate/Industry standards.
• The approach to create this training and certification program is an industry effort, where private-public organizations from different backgrounds work together

Cyber security threats continue to increase in both frequency and sophistication. The industry is getting more automated, integrated and interconnected, creating a real challenge being faced.  To manage risk effectively in our industrial domains, technology, standards, policies and practices are not enough, people are crucial!

• A standardized foundational set of skills, knowledge and abilities for Industrial Cyber Security across the industry is lacking.
• There is a need for a standardized, vendor-neutral, certification program that provides structure and demonstrated competence.
• An ICS professional needs a hybrid set of experience and competencies that can be roughly divided in 4 domains - IT, Cyber Security, Engineering, and Corporate/Industry standards.
• The approach to create this training and certification program is an industry effort, where private-public organizations from different backgrounds work together

The potential impact of a security incident within the oil and gas industry is significant!  Within this sector there are a number of key business areas that have significant security risks.  These include: security of the operational technology e.g. industrial control systems on rigs - where a security incident could have a significant impact on the environment or loss of revenue, sensitivity of core business information around exploration of new oil and gas fields - data loss leading to a loss of revenue, mergers and acquisitions, securing the financial and operational due diligence to ensure share price is appropriate.  Oil and Gas organisations need to identify and protect their assets appropriately in order to ensure they have greater opportunities to maximise their business's potential from emerging technologies and identity new business opportunities. This presentation will outline some of the key security threats and explore how organisations can focus on protecting those assets that really matter, enabling them to combat threats to their organisation.

• Describing the setting of the industrial cyber security: current situation, lacks and needs
• The Actors: description of main stakeholders and supposed roles. 
• The Screenplay: the good, the bad and the ugly. Who is who?
• The Challenge: making a good film (and make the actors happy and rich). How to deal with objectives from different sources could become barriers to the deployment of cyber security measures,
• The Solution: Collaboration as a key aspect of Industrial cyber security.
• The Film:  industrial cyber security centre as a successful case on collaboration in industrial cyber security

• Why is Cyber Security a boardroom issue?
• Regulations: US and EU developments
• Crisis management
• Legal sanctions and legal recourse for victims
 

• Powering offshore oil and gas facilities
• Risks to energy supply and their potential cost
• Cyber vulnerabilities in offshore installations
• Technologies for islanding and  power disruption mitigation

• Security requirements determined by IEC 61508
• Human factors - the weakest link
• A brief history of CHAZOP
• Security management : where your vendor can help

• Security requirements determined by IEC 61508
• Human factors - the weakest link
• A brief history of CHAZOP
• Security management : where your vendor can help

• There have been several attacks targeted at oil and gas firms in the last two years
• Good risk-mitigation strategies can reduce cyber risk, but they cannot eliminate cyber attacks
• Oil and gas companies need to assume a breach will happen and prepare accordingly
• An organisation’s ability to respond to and recover from security breaches – its cyber-resilience – is fundamental to its risk management strategy
• Information security standards are an important element in building a strong, resilient information and communication infrastructure
• This session will examine cyber risk in the oil and gas sector, the pervasiveness of cyber-incidents and the key steps in building a cyber-resilience strategy

• Overview of the last decade of cyber weapons
• What are the specific challenges that cyber weapons pose to the industry
• How do we address these issues and reduce our exposure to future attacks
• How should we strategise when planning our defences?

Focus of this presentation will be intelligence gathered from forensic investigations of recent attacks to Critical National Infrastructure. The presenter where possible will provide details of:
• Insider threats
• Social engineering
• Malware
• Zero day attacks
• Losses
For each of these attack/threat vectors the presentation will include recommended actions and strategies to detect and defend against such threats. The implementation of methods such as SIEM and use of Big Data are discussed as are sources of threat intelligence and information

• Current regulatory landscape in North America and Europe
• National cyber security strategies and the protection of critical infrastructure
• What the changing policy environment means for operators of oil & gas installations
• Adapting to new compliance mechanisms

• Description of the typical approach to cyber security governance in oil and gas companies
• Events and lessons learned from the recent incidents in the sector
• How the governance model should evolve to engage the top management in cyber security decisions
• Examples of approaches adopted by oil & gas companies
• Future challenges