August 12th, the Silicon Valley Leadership Group (SVLG) hosted the 2014 Silicon Valley Cyber Security Summit at HP in Palo Alto. The attendance was very high level with 2 US Senators, 2 US Representatives, senior leadership from McAfee, Symantec, RSA, etc. The agenda can be found at http://svlg.org/wp-content/uploads/2014/08/2014-Cybersecurity-Summit-Agenda-DRAFT-41.pdf. The theme of the Conference was the importance of cyber security and that it needed more attention. I was told the SVLG invited PG&E, Santa Clara Valley Water District, and other large industrial companies. However, the only participation from the industrial control systems community was one water company and an industrial control system software vendor. As can be seen from the agenda, the focus was on privacy, industrial espionage, and traditional IT security - there were no sessions devoted to control system cyber security. Consequently, there is a “chicken and egg” scenario that continues to be played out. If there are no sessions that are of interest to industrial companies, why attend? If the industrial companies won’t attend, why have the sessions?
The discussions on critical infrastructures were focused on finance and even doctor’s offices. There were just a few mentions of industrial critical infrastructure such as power grids but no detailed discussions. There were many discussions about information sharing with DHS being the lead. One wonders what will happen with industry’s desire to share information with DHS after the recent declassification of the Aurora information. DHS’s Bobbie Stempfley stated to me the release of the Aurora information was OK as it had been requested since 2009. This despite the fact there is yet to be an installed base of Aurora hardware mitigation by the electric utilities.
I did show the Senators and Representatives the declassified slides on the targeted facilities that were declassified. They were surprised that information is public and have asked for further discussions.
Joe Weiss
