About this event

Industrial Control Systems play an important role in the monitoring, control, and automation of critical infrastructure such as water, gas, oil, and electricity. Recent years have seen a number of high profile cyber attacks on such infrastructure exemplified by Stuxnet and the Ukrainian Power Grid attacks.

This naturally begs the question: how should we manage cyber security risks in such infrastructure on which the day-to-day functioning of our society relies? In this talk I will discuss insights from three years of research studying cyber security in such settings. The talk will highlight the complexity of managing security in a landscape shaped by the often competing demands of a variety of stakeholders, e.g., managers, control engineers, enterprise IT personnel and field site operators.

I will also discuss how the security decision-making patterns of the various stakeholders contrast, with some surprising (or perhaps not so surprising) insights into the decision patterns of security experts and so-called non-experts.