The nation’s buildings are increasingly relying on building control systems (otherwise known as operational technology) that are Internet-enabled. These systems provide critical services that allow a building to meet the functional and operational needs of building occupants, but they can also be easy targets for hackers and people with malicious intent. Attackers can exploit these systems to gain unauthorized access to facilities; cause physical destruction of building equipment; be used as an entry point to the traditional informational technology (IT) systems and data; and expose an organization to significant financial obligations to contain and eradicate malware or recover from a cyber event.
This Introductory Workshop, sponsored by the National Institute of Building Sciences, is intended for those professionals new to the world of cybersecurity, including facility, engineering, physical security, information assurance and other professionals involved with the design, deployment and operation and cybersecuring of building control systems. It will provide a combination of classroom learning modules to teach control system basics, protocols, how to use the information assurance risk management framework and hands-on laboratory exercises using tools and methods to inventory, diagram, identify, attack, exploit, contain and eradicate a cyber event.
The Workshop is built around Executive Order 13636—Improving Critical Infrastructure Cybersecurity, issued on February 19, 2013; the National Institute of Standards and Technology (NIST) Cybersecurity Risk Management Framework, issued on February 12, 2014; the draft NIST Special Publication (SP) 800-82 Rev. 2 Industrial Control Systems Security Guide, to be issued in April 2014; and the draft U.S. Department of Homeland Security (DHS) Interagency Security Committee “Securing Government Assets through Combined Traditional Security and Information Technology” White Paper. These new requirements will have a transformational impact on the traditional building design, construction, operation and protection of building control systems and will require facility and information assurance professionals to learn building control system cyber skills. For more information, see the Whole Building Design Guide Cybersecurity Reference page.
Students will need a laptop with administrative privileges to load software. Course content, tools and lab exercises will be provided on a CD at the beginning of the Workshop.
The Workshop will be held May 27 at the National Institute of Building Sciences, 1090 Vermont Ave NW, Suite 700, Washington, DC 20005-4950.
Because the Institute is offering this Workshop for the first time, participants who attend the “trial run” of the Workshop will receive a discounted rate of $500 (50% off the full Workshop price of $1,000) when they enter the discount code CYBER50. The Workshop is limited to 20 students.
Classroom: Overview of Control Systems and Protocols
Classroom: Defense in Depth, Enclaves, System Boundaries, Model Operations Center, Test and Development Environment, Continuous Monitoring
Lab: Using the DHS CSET and network mapping tools to create an Inventory, Enclave and Network Diagram, System Security Plan
Classroom: Drivers, Standards, Guides, Publications
Classroom: System Security Plan, Plan of Action and Milestone, CONOPS, Incident Response Report
Lab: Introduction to Google Hacking, Shodan, VMWare, Kali Linux, SamuraiSTFU tools
Classroom: Attacking and Defending, Response and Recovery, Reporting
Instructors: Michael Morris and Michael Chipley, PhD, GICSP, PMP, LEED AP