12-09, 16:40–17:25 (Europe/London), Track 3
With chemical plant contributing $5.4 trillion to the global economy annually, and the control systems having an average age of 20 years, the prospect of a full or partial breach by threat actors is of great concern to owners, customers and wider stakeholders (the latter including anyone downwind).
We cover the development of chemical plant and their control systems, some historical attacks and incidents involving chemical plant and their impacts, and what existing Laws already cover how plant safety and cybersecurity should be considered. We then delve into using Adversarial Reinforcement Learning to both develop new ways for the Red Team to attack, modelling both different threat actor capabilities and intents - with the Blue Team attempting to identify, respond to and recover from attacks. With the plant we tested, the Red Team enjoyed a decided advantage at forcing plant shutdown - particularly if given fine-grained control - leaving operators with just under three minutes to respond.
This talk is suited for engineers of all stripes. A brief amount of mathematical theory will be taught along the way, but attendees should bring own HAZMAT or HEV suit. The speaker has only been involved in an industrial lawsuit once, you'll probably be fine.
Now a doctoral researcher at Brunel University and security analyst at ThreatSpike Labs, martyn studied materials science and metallurgy and worked in the chemicals industry across various parts of the UK, mainly writing Excel macros, before moving into infosec.