SANS ICS Cybersecurity Summit 2024 – Selected Notes, Reactions and Reflections

Situational Awareness - June 2024

SANS Founder and wonderful-beyond-measure human being Alan Pallor’s gone but SANS goes on. Similarly wonderful and indispensable SANS ICS founder and Allan’s likely heir apparent Mike Assante is also gone. But his voice still haunts the halls here. Pardon the cliché, but these two were the giants upon whose shoulders the entire edifice still stands.

Mike’s wife Christina and their 3 kids go on. And one, the eldest son Alex Assante, was an attendee this year and administered an award I'll describe below. Tim Conway goes on as does his globe-trotting, Pelican-case toting family comprised of wife Ellen and 3 junior Conways ... one of whom is summer interning on ICS cyber at INL at this very moment.

Rob Lee has since become a titan of global industry, but back in 2013 he showed a zest for living and a certain finger, figuratively speaking, to a multi-starred USAF general with his seminal paper, “The Failing of Air Force Cyber,” which included truth-to-power tough-love zingers like:?

“All of the personnel wear the badge and identify themselves, some cynically so, as part of the cyber community. This faux community creates problems when trying to identify the personnel needed for a mission.”

Rob too is doing his best to organically grow the OT security population with 2 offspring sprung already, and a third eager to arrive.

Meanwhile plenty of others from the inaugural SANS ICS gathering 19 years ago are gone as well, both from the community as well as from SANS itself. It’s everyone remaining’s great good fortune that Tim and Rob endure and lead with an alchemical mix of charisma, humor and humility. And Dad jokes.

Zach Wins the Award of a Lifetime

Zach Tudor was honored this year for the very many things he’s done (and continues to do from his lofty perch as an INL associate lab director. In my early days (ten years or so ago) at the lab I was a regular at the SANS ICS Summit, but in recent years drifted. But thanks to getting pre-notice of Zach receiving SANS ICS Lifetime Achievement Award this year, I felt I had to attend and am so glad I did.?Now no one, and particularly me, is calling Zach old, and Rob and Tim emphasized that advanced age is not a prerequisite for this LIFETIME achievement award. But scan Zach’s LinkedIn page, or talk with someone who’s known him for a while and you’ll get a sense for how many OT Security mountains he’s moved in the interstices of government, industry and academia, and you’ll begin to sense the gravity of what he’s accomplished and as well as what he still might yet accomplish.

Full Disclosure re: “Exposure to Closure”

One of my earliest and best SANS ICS Summit memories was arriving on a pre-conference Sunday afternoon in 2014 in time to catch a play by the ICS-not-ready-for-primetime players called “Exposure to Closure.” Buried in the actorial ineptitude were some gems of cyber and public-private information sharing insight, and I believe - though the series was discontinued before Netflix could pick it up - it always had a happy ending, aka closure.

?Playwright and Dragos’s first hire, erstwhile NERC E(S)-ISACer Ben Miller was director, Tim Roxey was narrator/emcee/action translator, Mark Fabro played a Russian cyber Dr. Evil, and a younger Rob Lee was ... an FBI agent? Bill Lawrence was in the house (on the stage) too I recall. Plenty of others too had their moments on and behind and beside those Sunday night stages.

SANS ICS Summit Roll Call

Please allow me to wallow in a moment of (perhaps Disney inspired) nostalgia conjuring up all the fine folks I’ve had the pleasure to meet, sometimes work with, and always learn from in the house that Allan and Mike built. In addition to those already named above, and in no particular order they are:

Justin Searle (my ICS 410 trainer and falconer par excellence), Marty Edwards, Art Conklin, Bryan Owen, Andrew Ginter, Jeff Shearer, Lior Frankel, Eric Byers, Chris Sistrunk, Paul Forney, Chris Blask, Monta Elkins, Mark Bristow, Jason Christopher, Jason Dely, Brian Proctor, Dean Parsons, Joe Slowik, Mike Hoffman, Ted Gutierrez, Ron Fabela, Nadya Bartol, Derek Harp, Tomomi Aoyama, Kai Thompson, and still some others whose names I apologize for not recalling at this moment.

This year also brought new friends and colleagues into view, but for brevity will just name two. NREL’s Anthony Wallace, with whom I roamed EPCOT and who gave an outstanding preso titled “Hacking the Power Grid in a Virtual City at Scale,” and Gabriel Agboruche of Jacobs nee Accenture who held forth with “Answering the Big Question: Has my OT been Compromised?” I thanked Gabe for hearing me out on the book I’m working for a 2025 publication: Defending Civilization – Notes from the Front Lines, and in particular for sharing what could be shared and not sharing what could not be shared about a certain pipeline incident he was proximate too.?Tuesday morning saw these two perform stellar talks back-to-back and set the content and delivery bars high for the rest of the day.

Walking and Talking Around the World

Re: roaming with Anthony Monday night, the gang that formed also included: Alex and his sig other, marketing super genius Kate Bould, Kylie McClanahan, and the Conways: Tim, Helen, daughter Viv, son Jake, and last and really first if you think about it, Lucy, Tim’s mom. We sipped a few things, ate a few things, bought a few things, and one got her face painted. Found a decidedly non-French group pic (thanks Kylie) ...

And here’s a shot of 3 of us following procurement of legendary croissants (possibly overhyped, though infinitely better than so-called “pretzel croissants” we were subjected to the next morning).

Looking Ahead with Hope in Our Hearts

It’s always great to know the time and place of the next event even before you walk out the door, and such was the case this year – great job SANS business and logistics folks! Same dates (nearly), same place, and though this year’s attendance with 400-500 in the seats and 4 or so thousand on-line was a high-water mark, the next one, given that we mark the passing of time according to our Base 10 numbering system, Monta ;) will be an even bigger deal for sure. INL’s lone speaker, Megan Culler presented brilliantly this year, but for next year, the BIG 20th ANNIVERSARY SHOW, I vow to return, along with Zach, Megan and bring a herd of INL ICS cyber researchers with us ... just like the good old days. Hope you can make it too!

La Fin

?

?

?

?