Training Solutions
We create specialized training content for control systems, safety & safety systems, and operational technology focused cybersecurity tailored to your organization’s needs. Whether you're looking to host the content on your own learning management system or prefer us to manage it for you, we offer flexible solutions that empower your team. Our expertly designed materials cover crucial industry topics, from operational technology to advanced cybersecurity, providing practical and engaging training to help your workforce excel.
It Must Be Interesting
We have all sat through hours of boring slide decks. Our courseware is designed to be both practical and engaging, leveraging advanced tools, detailed graphics, and immersive cloud-based lab environments. We focus on providing hands-on experiences that mirror real-world challenges, ensuring your team can directly apply what they’ve learned. With interactive content and cutting-edge technology, we make sure learners stay engaged and gain valuable skills they can immediately use to enhance control systems, safety measures, and cybersecurity strategies.
Lifetime of Learning & Teaching
We have extensive experience writing and delivering lessons for technical control system environments. We bring a deep understanding of aspects from the adjunct faculty perspective to corporate training and accredited environments. Whether developing content for large organizations or highly regulated industries, my lessons are tailored to meet your diverse learning needs. Each course is meticulously crafted to ensure relevance, engagement, and depth, empowering learners to tackle complex challenges with confidence and competence.
In our latest longterm project, we created 144 hours of OT Cybersecurity content for an accredited program.
Frequently Asked Questions
SubSafe Security is a control system or operational technology focused business that offers customized training content services for your learning management system or ours.
- Privately owned consulting firm located in Ohio
- We serve our community by creating the best possible educating available
Our name comes from the SUBSAFE (Submarine Safety) program. It is a rigorous quality assurance initiative established by the U.S. Navy to ensure the safety and integrity of submarine systems, focusing on preventing flooding and ensuring the ability to recover from an emergency. It was instituted in response to the loss of USS Thresher in 1963 and involves strict adherence to design, construction, and maintenance standards. As a submariner, this was one of the first programs that I knew of that was designed to prevent horrible accident and consequently, I thought of it often when working on refineries and chemical plants.
For more information...
Consider this article on cognitive bias and risk analysis challenges:
Operational technology (OT) encompasses the systems that monitor and control physical devices and processes in industries such as manufacturing, utilities, and transportation. It is crucial for ensuring that these systems, which are fundamental to daily operations and safety, remain safe from cyber threats that could disrupt operations and cause physical harm.
For more information...
Consider this article about what is operational technology:
Consider this article about the hidden risk in control systems:
Consider this article device refresh rate challenges in operational technology:
https://subsafesecurity.com/cybersecurity-news/f/replacing-outdated-it-systems-but-what-about-ot
Our cybersecurity assessments for operational technology differ from IT cybersecurity assessments primarily in their focus and expertise. While IT assessments concentrate on data protection, integrity, and confidentiality within corporate networks, OT assessments prioritize the availability, safety, and integrity of systems and processes that have direct effects on physical operations. This requires a specialized understanding of industrial control systems, their deterministic nature, and the unique challenges of devices that might be 30 years old versus modern computers in IT that get patched and upgraded often.
For more information...
Consider this article on key differences:
https://subsafesecurity.com/cybersecurity-news/f/key-it-and-ot-differences
Consider this article about a cybersecurity assessment at a very large refinery:
https://subsafesecurity.com/cybersecurity-news/f/large-facility-case-study
SubSafe Security offers two main areas of service.
- Operational technology cybersecurity assessment
- Safety functions cybersecurity assessment
- Cybersecurity training packages for your internal learning system
- Cybersecurity consulting throughout lifecycle
Our vulnerability assessments are done using passive (non-intrusive) network assessment methods to gather information about a network. This means that it does not require any interaction with the hosts on the network, and it will not generate any alerts or notifications. In terms of impact on control system networks, passive network assessment is generally considered to be safe.
For more information...
Consider this article about operational technology vulnerability assessments:
https://subsafesecurity.com/cybersecurity-news/f/control-system-vulnerability-assessments
Our final report normally contains the following:
- Executive Overview: A brief summary of the key points, findings, and recommendations of the report, aimed at providing a quick understanding to top management.
- Introduction: Sets the context by explaining the background, the objectives, and the importance of the cybersecurity assessment.
- Scope: Defines the boundaries of the assessment including the systems, processes, and geographic locations covered.
- Methodology: Describes the techniques, tools, and processes used to carry out the cybersecurity assessment including risk ranking.
- Findings: Presents the data collected, issues identified, and the analysis of the cybersecurity posture.
- Risk Assessment: Evaluates the potential risks for the vulnerabilities identified, and their potential impact.
- Regulations & Standards: Highlights the relevant regulatory and standard frameworks and compliance.
- Recommendations: Provides actionable advice to address the identified issues and to improve the cybersecurity posture.
- Conclusion: Summarizes the key takeaways from the assessment and emphasizes the importance of implementing the recommendations.
- References: Lists the documents, standards, and other materials consulted during the assessment.
- Appendices: Contains supplementary material such as detailed data, technical information, and other relevant documentation that supports the main text of the report.
Safety functions are designed to put a system or process in a safe state if something goes wrong. There are safety functions associated with mechanical safety regions like the area around moving equipment like a robot and safety functions associated with process control. In the process area, specialized teams perform a Process Hazards Analysis (PHA) to identify the safety functions necessary to protect a process. Assessments for safety functions are essential because cyber threats can manipulate or disrupt these safety mechanisms, leading to potential safety hazards, environmental damage, or even catastrophic failures. We use several methods to assess safety functions for cybersecurity vulnerabilities including the Security PHA Review method which reviews PHA reports for attack vectors and makes recommendations.
For more information...
Consider this article about a Security PHA Review:
https://subsafesecurity.com/cybersecurity-news/f/security-pha-review
SubSafe Security uses defense-in-depth strategies discussed in the IEC 62443 standard to protect your physical assets from cyber threats. Defense-in-depth encompass strategies like segmentation, access control, whitelisting, patch management, physical security, system hardening, monitoring and detection, incident response, and recovery.
Our team of experts works closely with you to assess your security needs and develop a customized plan that fits your unique requirements that your team can manage.
The areas below represent that specific industries where we are well qualified control system and cybersecurity experience.
- Manufacturing: This includes automotive, chemical, industrial, consumer goods, pharmaceutical, food and beverage, metal, and paper.
- Oil and Gas: Midstream including transportation, storage, and initial processing of crude oil and natural gas, typically through pipelines, tanker ships, and storage facilities. Downstream including refining of crude oil into usable products like gasoline, diesel, and other petrochemicals.
- Additional Critical Infrastructure: This includes commercial facilities, critical manufacturing, government facilities, nuclear reactors, transportation control systems, and water/wastewater.
Contact SubSafe Security
Have questions or need more information? Just email us about anything, seriously you can ask questions about cybersecurity, our services, OT Cybersecurity News articles, even the news. We are here to help.
Office Hours: M-F 8:00am - 5:00pm Eastern Time
We are located near Columbus, Ohio USA.
Click on the Contact Us button below and your email will open.
We will not spam you, sell, or share your email address.
Privacy Policy
Your privacy is important to us and we take it seriously. This policy outlines how we collect, use, protect, and handle your personal information on https://subsafesecurity.com.
Information Collection and Use
We collect information from you when you fill out a form or sign up for our newsletter on our site. The collected information includes your email address only for the newsletter and your name, email address, and message details if you submit a contact form (there are some optional fields and we protect that information also).
Your information is ONLY used by us to respond to your requests. Your information will NEVER be shared or sold!
Information Protection
Your personal information is contained behind secured networks and is only accessible by a limited number of clearly identified people that are required to keep the information confidential.
Information Sharing
Subsafe Security does not sell, trade, or otherwise transfer to outside parties your personally information.
Cookies
Our website uses cookies to enhance your experience by remembering your preferences for future visits and compiling aggregate data about site traffic and interaction only. The cookies are shared with Google Analytics and GoDaddy.
Google Analytics uses cookies to track user behavior and aggregate data about website traffic. The information collected can include:
- User Details: Such as the type of browser and operating system used, screen resolution, language preferences, and the device type.
- Session Information: Duration of the visit, pages visited, and interactions on each page (like clicks and scroll behavior).
- Referrer Information: How the user arrived at the site, such as direct entry, through a link on another website, or via a search engine.
- IP Address: Used to determine the geographic location of the visitor. However, Google anonymizes the IP address within the area of member states of the European Union and other parties to the Agreement on the European Economic Area.
GoDaddy may collect data through cookies to manage and improve its hosting services and for security purposes. This can include:
- System Information: Technical details about the device accessing the website, including operating system, device type, and browser type.
- Log Files: Data automatically collected by servers, such as IP addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data.
- User Interaction: How users interact with the website, which can help in improving site navigation and structure.
Both Google Analytics and GoDaddy use this data for improving service delivery, enhancing user experiences, marketing, and optimizing their own services and technologies.
Consent
By using our site, you consent to our website's privacy policy.
Changes to our Privacy Policy
If we decide to change our privacy policy, we will post those changes on this page. This policy was last modified on 4/19/2024.