I attended the RSA Security Conference February 13-16, 2017 actually starting with an American Bar Association meeting on IOT Security on Sunday February 12th.
My general observations were:
- RSA is, first and foremost, an IT security conference and that was its focus. There were vendors that provided ICS cyber security solutions and several sessions that addressed ICS cyber security including an RSA keynote session. There was even an ICS stage at the Marriott that had a series of 30 minutes discussions of ICS cyber security.
- IOT was a major item of discussion. The IOT discussions were more about “fitbits and refrigerators” than “power plants and substations”.
- There were some interesting sessions that discussed ICS cyber security and ICS issues such as the power grid. Many of the discussions were very good but there were some that were actually more harmful than helpful.
- What was missing at RSA: No major ICS vendors exhibited (e.g., GE, Siemens, ABB, etc). Cyber security was primarily about protecting IP networks not serial “networks”, sensors, controllers, and actuators. Additionally, there were minimal discussions about the need to develop the requirements for standards-based, secure-by design industrial control systems. This need was identified by Exxon-Mobil resulting in a new initiative that now has some of the largest industrial companies in the world participating including Dow Chemical, BASF, Georgia-Pacific, PraxAir, Chevron, Aramco, and Merck.
On the plus side, there are more discussions of ICS cyber security at RSA which is important as RSA is the mainstream of cyber security. On the other hand, some of the discussions were misleading with some speakers unaware of control system issues – an all too common problem.
Joe Weiss
