The increasing focus on the security of critical infrastructure has driven a large amount of effort toward securing key control systems.  A key component of this effort has been the application of IT based tools and techniques to the control systems environment.  While many of these tools and techniques can be applied directly to production control systems, some common IT cybersecurity practices may require customization to minimize risk of negative impacts.  Additionally, an understanding of specific control system vendor management applications and common communications protocols can assist in customizing cybersecurity controls to the control system environment.  In this presentation, John Stewart will share experiences applying cybersecurity controls to power grid control systems and discuss ongoing security research developed through collaboration with electric utilities.

John Stewart is a Senior Technical Leader with EPRI’s Program 183 focused on Cyber Security. Prior to joining EPRI, John was the Senior Program Manager for Grid Information and Communications Technologies at the Tennessee Valley Authority (TVA) in Chattanooga, TN, where he led several network and control systems infrastructure projects as Principle Engineer for Systems Engineering & Architecture, and served as the subject matter expert for substations in NERC CIP audits.  In addition to his primary roles with TVA, John also served as a Principle Investigator on a number of DOE Cyber Security for Energy Delivery Systems (CEDS) projects focused on securing and protecting grid control systems.  Since joining EPRI, he has focused on cyber security issues in electric utility operations and control systems infrastructure.