Industrial Cybersecurity Needs to Be in Front of Regulators

Estimated reading time: 4 minutes

At the 2019 IEEE Rising Stars conference, I spent some time with Chris Humphreys, principal at Anfield Group, a cybersecurity firm consulting with numerous industrial and infrastructure clients. Humphreys taught a cybersecurity course for college student attendees to the conference. Afterward, we talked about cybersecurity, the dynamics of regulation, and the responsibilities that manufacturers have to the greater good above and beyond simply adhering to regulation. If your company is online at all (and who isn’t?), your IT department needs to be competent in cybersecurity. Humphreys gives insight into the knowledge, training, and expertise you will need on-site simply to keep your customers’ intellectual property safe.

Nolan Johnson: Chris, can you start by telling us about your company and role?

Chris Humphreys: Sure. I started the Anfield Group about 10 years ago—a cybersecurity and regulatory compliance and consulting firm based out of Austin, Texas. It brings together my regulatory experience with my cybersecurity and operations experience. It has blossomed into technology advisement, regulatory compliance mitigation, and program architectures from processes to tools including everything you need from cybersecurity, specializing in the industrial control systems space, to critical infrastructure, oil and gas, electric utilities, hydrochemical, and anybody in state industrial control systems.

Johnson: Would electronics manufacturing be out of your box?

Humphreys: No, it would not, especially since manufacturing involves the supply chain component that is becoming more and more prevalent here in North America now on the regulatory side. Regulation continues to be a huge growth area. Let’s just say business is good.

Johnson: I can imagine. The IEEE Rising Stars Conference is largely organized to help young professionals, college students who are still active students, and recent graduates just moving out into the industry around IEEE make that transition and be successful. You ran a workshop here yesterday.

Humphreys: Yes, it was very interesting. This is my first real exposure to this component of IEEE. Man, it made me feel old, but it just seemed like just the other day I was in their seats. I was telling some of the students in the competition that we were in, which I’ll get into in a little bit, that they are very fortunate to have undergraduate academic programs now that can give them these skill sets. I’m prior military and a product of being in the right place at the right time. There wasn’t that conventional academic route to career paths that we’re in right now. I find that really refreshing, and the kids I saw yesterday were extremely intelligent.

I think the one thing I was trying to instill in them is having street smarts as well. It’s good to have book smarts, but there’s a skill set to be able to translate the technical stuff they’re doing every day to an executive and keep it at a third-grade level, I joked. That’s a skill set that they should definitely work on. I think they found that very rewarding and never thought about it, but I could see a lot of their eyes light up seeing how that would be important. That was my great partition of wisdom, if you will, to the younger generation.

The competition I mentioned earlier also went really well. It was based on a national-level exercise that I participated in earlier this year, which simulated a major natural disaster with a cyberattack—a time where we would be very vulnerable while recovering from the disaster. We did some injects from that scenario with them to not only think from the tactical perspective of hands-on keyboards getting systems back up but also the strategic idea around what capabilities exist that they could leverage to help them in that kind of a scenario. Thinking through the big picture scenario was something they hadn’t seen before, and I think they got a lot out of it.

Johnson: Interesting. What do you think some of their key takeaways were based student feedback?

Humphreys: The feedback I received from students has been before the competition yesterday and before they were exposed to me, I think they tended to put themselves in a box career-wise such as, “I want to be an engineer that works on this system,” or, “I want to be an expert in this singular system.” I think my exposure showed them that their skill set is much broader than what they might think they want to do. It’s great to have a singular scope if you’re passionate about one thing and do it well, but don’t get stuck in that rut because you might plateau. Then, 20 years later, you may be the expert on one system, but you could have done so much more with that skill set. I think for college kids especially, that was refreshing to hear because they might be on one track and not realize what opportunities are out there for them.

To read the full article, which appeared in the March 2019 issue of SMT007 Magazine, click here.