Official website links end with .gov.sg

Government agencies communicate via .gov.sg websites (e.g. go.gov.sg/open). Trusted websites

Secure websites use HTTPS

Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.

OTCEP 2022 Programmes

12 JUL 2022

12 JULY 2022

Time	Agenda
09:00- 09:05	Welcome Remarks Mr David Koh, Commissioner of Cybersecurity & Chief Executive, Cyber Security Agency of Singapore
09:05- 09:20	Keynote Address Mrs Josephine Teo, Minister for Communications and Information and Second Minister for Home Affairs Minister-in-charge of Smart Nation And Cybersecurity
09:20- 10:45	Presentation and Panel Discussion - The Latest Industrial Control System Malware Robert M. Lee, CEO & Founder, Dragos, Inc Synopsis: Pipedream emerges as the latest ICS Malware that is tailored to target specific Programmable Logic Controller (PLC) commonly found in Industrial Control System (ICS) that could be expanded to other similar targets in the Operational Technology (OT) sectors. Though this threat (seem to target U.S. Liquid Natural Gas and Key Electric Power Site) have not employed their capability for its intended disruptive in nature, there is still potential of the capabilities being deployed in Singapore.
10:45- 11:15	Break
11:15- 12:45	Presentation and Panel Discussion - Security Truth or Consequences Dale Peterson, Founder & Program Chair, S4 Events Founder & Chief Executive Officer, Digital Bond Inc Synopsis: Security professionals tend to address only the likelihood half of the risk equation. While reducing likelihood is important, it cannot be reduced to zero given human error and technology fails. In this session, Dale focuses on reducing the consequence side of the risk equation. Consequence reduction, unlike deploying more security controls, is a game you can win.
12:45- 14:00	Lunch
14:00- 15:30	Presentation and Panel Discussion – Introducing Incident Response Framework for Embedded System Joel Thomas Langill, Founder & Managing Member, Industrial Control System Cyber Security Institute (ICSCSI) LLC Founder, SCADAhacker Synopsis: Cybersecurity Incident responding is commonly unheard in the OT environment, and the main responders to issues are typically OT engineers/operators or vendors, often resetting the devices or process to restore operations which may deny a discovery of a cyber breach. These may be caused by user interaction with Real-Time Operating System (RTOS) or software is not always simple and are limited in scope, and caused a lack of visibility or centralised data aggregation. Therefore, it is important to combine Engineering "Forensics" with Digital Forensics in such instances.
15:30- 16:00	Break
16:00- 17:30	Presentation and Panel Discussion – Securing PLC Code Practices Sarah Fluchs, CTO, admeritia GmbH Synopsis: For many years, Programmable Logic Controllers (PLCs) have been insecure by design. Several years into customising and applying best practices from IT gave rise to secure protocols, encrypted communications, network segmentation etc. However, to date, there has not been a focus on using the characteristic features in PLCs (or SCADA/DCS) for security, or how to program PLCs with security in mind. In 2021, the Top 20 Secure PLC Coding Practices were published as the result of a community project. One year later, this session will give an update on the project, clarify what “the Top 20” are (and what they are not!), and what’s important to know when implementing them.

13 JULY 2022

Time	Agenda
9:00- 11:00	C-Suite Conversation* Closed-Door (By Invitation Only)
9:00- 10:30	Technical Conversation: OT Cybersecurity in Secured Engineering Synopsis: OT system was originally designed on a flat communication network for "stuff" to work, not for security. Adversary had create real-life cases that disrupt/destruct on these unsecured system, and had defenders scrambling to protect their system to prevent re-occurrences. Furthermore, OT system is susceptible by emerging cyber threat vectors, standardization, and interoperability issues, bridging the gaps at the IT/OT ICS (industrial control systems) level. Defender is trying very hard to level up their capabilities to secure the OT environment, combining the engineering concepts with security methodology for a better secured OT system.
10:30- 11:00	Break
11:00- 12:00	Technical Sharing: Hidden Code on Field Controller Sharon Brizinov, Director of Security Research, Claroty Synopsis: Stealthy exploits of programmable logic controllers are among the rarest, most time-consuming, and investment-heavy attacks. The ability to conceal malicious bytecode on a PLC and give engineers the appearance of operations running as normal is highly sophisticated, and poses extreme risk to process safety and reliability. Without advanced forensics utilities, the execution of such malicious code cannot be discovered. In this presentation, it will cover the research into such stealthy exploits and how we were able to attack PLCs manufactured by leading ICS vendors including Rockwell Automation, and Siemens.
12:00- 14:00	Lunch
14:00- 17:30	Sectoral Breakout Discussions* Closed-Door (By Invitation Only)