OT Cybersecurity Training Consulting

SubSafe Security is a control system or operational technology focused business that offers customized training content services for your learning management system or ours.

• Privately owned consulting firm located in Ohio  
• Our team is global and is comprised of the authors and teachers that are also OT cybersecurity consultants
• We serve our community by creating the best possible educating available 

As an ex-submnariner, safety and security process impress me. I chose our name because of the Submarine Safety program. It is a rigorous quality assurance initiative established by the U.S. Navy to ensure the safety and integrity of submarine systems, focusing on preventing flooding and ensuring the ability to recover from an emergency. It was instituted in response to the loss of USS Thresher in 1963 and involves strict adherence to design, construction, and maintenance standards. As a submariner, this was one of the first programs that I knew of that was designed to prevent horrible accident and consequently, I thought of it often when working on refineries and chemical plants. 

For more information...

Consider this article on cognitive bias and risk analysis challenges:

https://subsafesecurity.com/cybersecurity-news/f/understanding-the-disparity-in-risk-assessment-rationalizing

Operational technology (OT) encompasses the systems that monitor and control physical devices and processes in industries such as manufacturing, utilities, and transportation. It is crucial for ensuring that these systems, which are fundamental to daily operations and safety, remain safe from cyber threats that could disrupt operations and cause physical harm. 

For more information...

Consider this article about what is operational technology: 

https://subsafesecurity.com/cybersecurity-news/f/not-everyone-knows-what-ot-is-and-how-it-compares-to-it 

Consider this article about the hidden risk in control systems:

https://subsafesecurity.com/cybersecurity-news/f/overlooked-cybersecurity-risks-in-operational-technology

Consider this article device refresh rate challenges in operational technology: 

https://subsafesecurity.com/cybersecurity-news/f/replacing-outdated-it-systems-but-what-about-ot

We teach your team how to perform vulnerability assessments using passive (non-intrusive) network assessment methods to gather information about a network. This means that it does not require any interaction with the hosts on the network, and it will not generate any alerts or notifications. In terms of impact on control system networks, passive network assessment is generally considered to be safe.

For more information...

Consider this article about operational technology vulnerability assessments: 

https://subsafesecurity.com/cybersecurity-news/f/control-system-vulnerability-assessments

We teach how to collect the data, perform the risk assessment, create and present the report which normally contains the following: 

• Executive Overview: A brief summary of the key points, findings, and recommendations of the report, aimed at providing a quick understanding to top management.
• Introduction: Sets the context by explaining the background, the objectives, and the importance of the cybersecurity assessment.
• Scope: Defines the boundaries of the assessment including the systems, processes, and geographic locations covered.
• Methodology: Describes the techniques, tools, and processes used to carry out the cybersecurity assessment including risk ranking.
• Findings: Presents the data collected, issues identified, and the analysis of the cybersecurity posture.
• Risk Assessment: Evaluates the potential risks for the vulnerabilities identified, and their potential impact.
• Regulations & Standards: Highlights the relevant regulatory and standard frameworks and compliance.
• Recommendations: Provides actionable advice to address the identified issues and to improve the cybersecurity posture.
• Conclusion: Summarizes the key takeaways from the assessment and emphasizes the importance of implementing the recommendations.
• References: Lists the documents, standards, and other materials consulted during the assessment.
• Appendices: Contains supplementary material such as detailed data, technical information, and other relevant documentation that supports the main text of the report.

Safety functions are designed to put a system or process in a safe state if something goes wrong. There are safety functions associated with mechanical safety regions like the area around moving equipment like a robot and safety functions associated with process control. In the process area, specialized teams perform a Process Hazards Analysis (PHA) to identify the safety functions necessary to protect a process. Assessments for safety functions are essential because cyber threats can manipulate or disrupt these safety mechanisms, leading to potential safety hazards, environmental damage, or even catastrophic failures. We can teach several methods to assess safety functions for cybersecurity vulnerabilities, but we prefer the Security PHA Review method which reviews PHA reports for attack vectors and makes recommendations.

For more information...

Consider this article about a Security PHA Review: 

https://subsafesecurity.com/cybersecurity-news/f/security-pha-review

We teach defense-in-depth strategies discussed in the IEC 62443 standard, and many other documents,  to protect your physical assets from cyber threats. Defense-in-depth encompass strategies like segmentation, access control, whitelisting, patch management, physical security, system hardening, monitoring and detection, incident response, and recovery. 

Our team of experts works closely with you to assess your security needs and develop a customized training plan that fits your unique requirements that your team can manage.

The areas below represent that specific industries where we are well qualified control system and cybersecurity experience.

• Manufacturing: This includes automotive, chemical, industrial, consumer goods, pharmaceutical, food and beverage, metal, and paper. 
• Oil and Gas: Midstream including transportation, storage, and initial processing of crude oil and natural gas, typically through pipelines, tanker ships, and storage facilities. Downstream including refining of crude oil into usable products like gasoline, diesel, and other petrochemicals.
• Additional Critical Infrastructure: This includes commercial facilities, critical manufacturing, government facilities, transportation control systems, and water/wastewater.