Attachment 22 Trip Report Guidance.pdf

Navy ManTech Program

REV A NOV24

Trip Report Guidance

Attachments:

1. Trip Report Example

A. PURPOSE

Trip reports prepared by Centers of Excellence (COEs) will be used by Navy ManTech Program Officers to record the intent of the trip, observations noted from the event (conference, symposium, meeting, technology demonstration, etc.) and any applicable conclusions or recommendations based on the results of the trip. Specifically, Navy ManTech is looking to better understand current technologies to address Navy needs, determine whether follow-up or site visits to technology providers are merited, and assess the readiness of existing technologies. Trip reports should focus on meaningful content of discussions and/or descriptions of manufacturing technologies reviewed / demonstrated that have potential benefit to Navy or Marine Corps applications. See the trip report example for the level of detail and type of information that should be included in the trip report.

B. FREQUENCY

Trip reports are not required for every trip. Trip reports are mandatory for all conferences, symposiums, trade shows, and similar events, as well as for all OCONUS trips (regardless of nature) unless directed otherwise by the Program Officer. Trip reports for other types of travel are at the discretion of the Program Officer.

If multiple employees from the same COE attend the event, only one trip report is required. However, the observations and recommendations of all COE attendees are required to be captured in the trip report.

C. PROCESS / REQUIRED TIMELINE

Trip reports are due to the COE Program Officer two weeks after the event. A copy is also required to be submitted to the COE’s Contracting Officer.

D. FORMAT

Contractor format is acceptable. However, all trip reports should be submitted in Microsoft Word format and include the following content:

1. Name of all COE employees attending the event

2. Date(s) of trip / event

3. Location / Site visited

4. Objective / Purpose of trip / event

5. Names and points of contact information for key personnel met or interacted with during trip

6. Relevant observations / discussions during the trip

7. Relevant conclusions / recommendations based on the trip focusing on Navy needs and issues, technologies, and manufacturing processes

8. Agenda and attendees, if applicable

E. FILE NAME

1. File name convention:

File names for trip reports should be in the following format: {COE acronym} Trip Repot {name of event} {dates of trip} i.e., CNM Trip Report FABTECH 15-17 Oct 2024.docx

Attachment 1: Trip Report Example

Trip Report Cybersecurity for Manufacturing Workshop – September 25-26, Chicago, IL

NAME OF PERSON(S) TRAVELLING: Doug Girard

DATE(S) OF TRAVEL: September 25-26, 2018

DESTINATION: Cybersecurity for Manufacturing Workshop

INFORMATION SOURCES:

OBJECTIVE/PURPOSE OF TRAVEL:

Gain additional knowledge of technology and processes for small/medium manufactures as it relates to Cybersecurity

SUMMARY OF MEETING/EVENT:

General overview:

From the conference website <https://www.eventbrite.com/e/cybersecurity-for-manufacturing-workshop-tickets-48071223323?aff=website>:

Organizers

Digital Manufacturing and Design Innovation Institute (DMDII) is where innovative manufacturers forge their futures. In partnership with UI LABS and the Department of Defense, DMDII provides factories with the digital tools and expertise they need to begin building every part better than the last. As a result, our more than 300 partners increase their productivity and win more business.

UI LABS is driving the digital future of manufacturing and cities by leveraging a network of hundreds of partners from university + industry (represented by the “UI” in our name), along with startups, government, and community groups, to address problems too big for any one organization to solve on its own.

Our mission is to transform industries using digital technologies. Our existing innovation platforms

– the Digital Manufacturing and Design Innovation Institute, and City Tech – focus on manufacturing and infrastructure respectively. We drive value for our partners and help make the U.S. economy and workforce the most productive in the world. By giving our partners access to new approaches, technologies, testbeds, and relationships, we guide them toward solutions that will drive innovation in their industries.

The Critical Infrastructure Resilience Institute (CIRI) conducts research and education that enhances the resiliency of the nation’s critical infrastructures and the businesses and public entities that own and operate those assets and systems.

CIRI is funded by a $20 million five-year grant from the Department of Homeland Security. It is led by the University of Illinois at Urbana-Champaign with collaborators from other U.S. universities and national labs.

With an emphasis on outputs-oriented research, education and workforce development, and early and continuous engagement with end users and homeland security practitioners, CIRI will explore the organizational, policy, business, and technical dimensions of critical infrastructure’s dependence on cyber assets. CIRI will examine how computer hardware and software both contribute to and threaten resiliency and how industry makes decisions about cyber assets which contribute to resilience.

A significant focus of the CIRI will be on transitioning research outputs for use by DHS operational components, other homeland security end users, policymakers, decision makers across all levels of industry and government, and community leaders.

Workshop Details

The Critical Infrastructure Resilience Institute (CIRI) and the Digital Manufacturing and Design Innovation Institute (DMDII) in collaboration with the Department of Homeland Security (DHS) and the Department of Defense (DoD) held a workshop focused on cybersecurity in the manufacturing sector. At this event, the manufacturing and cybersecurity communities will intersect to explore threats faced by manufacturing companies of all sizes and discover efforts underway to measurably improve the cybersecurity practices of manufacturers. The intent of this workshop was to promote industry-wide adoption of the NIST CSF Manufacturing Profile, increase cybersecurity awareness, focus on workforce development, and develop low-cost, easy-to-use solutions geared toward small manufacturers. The workshop featured panel discussions and interactive breakout sessions aimed at collaboratively improving the security and resilience of manufacturing supply chains nationwide.

Agenda

Tuesday, September 25

7:30 am: Registration 8:00 am: Welcome & Introductions

Kevin McDunn, Chief Technology Officer, UI LABS Randy Sandone, Executive Director, CIRI

8:15 am: Overview of the Day, Objectives, & Vision 8:45 am: Cybersecurity Threats in Today's World 9:30 am: A Pulse on the State of Cybersecurity in Manufacturing

Marie Gilbert, Director, Consumer Insights and Market Planning, ISACA 10:15 am: Break 10:30 am: Call to Action: The Importance of Collaboration and Standards in Securing U.S.

Manufacturing 11:00 am: Panel Discussion: State of Security for Manufacturers

Moderator: Koushik Subramanian, Director of Manufacturing Cybersecurity, DMDII Mary Kate Frazier, Security Strategy Officer for North America & Defense, Rolls Royce Joel Neidig, Director of Research & Development, ITAMCO

Eric Soll, Program Director - Manufacturing Cybersecurity, The Dow Chemical Company 12:00 pm: Lunch and Networking 1:00 pm: Panel Discussion: Cybersecurity Resources for Manufacturers

Moderator: Pat Toth, Cybersecurity Program Manager, NIST MEP Elliot Forsyth, MMTC Dr. David Boulay, Illinois Manufacturing Center (IMEC) Jeff Orszak, CONNSTEP Shannon Jackson, Acting Director, Office of Small Business Programs Department of

Defense 1:45 pm: Addressing Manufacturing Cybersecurity Challenges

Koushik Subramanian, Director of Manufacturing Cybersecurity, DMDII 2:00 pm: Breakout Session 1:

Group A: ISACA Training Lab Group B: Manufacturing Floor Demonstration Group C: Cyber Secure Dashboard

3:00 pm: Exhibitor Introductions 4:00 pm Technology Showcase & Networking Reception

Wednesday, September 26

8:00 am: Welcome & Overview of the Day 8:15 am: Panel Discussion: The Mindset of an Attacker

Moderator: Koushik Subramanian, Director of Manufacturing Cybersecurity, DMDII Kate Vajada, Senior Security Consultant, Secure Ideas Josh Wyatt, Director of Attack and Pen, Optiv Johnny Xmas, Director of Field Engineering for North America & Europe, Kasada

9:00 am: Breakout Session 2 Group B: ISACA Training Lab Group C: Manufacturing Floor Demonstration Group A : Cyber Secure Dashboard

9:45 am: Break 10:00 am: Breakout Session 3:

Group C: Workforce Development: ISACA Training Lab Group A: Awareness Building: Manufacturing Floor Demonstration Group B: Low Cost Tool Development Cyber Secure Dashboard

10:45 am: Insurance & Risk Management Professor Jay Kesan, Professor of Law, University of Illinois College of Law Elizabeth Case, Managing Director, Marsh USA, Inc.

11:30 am: Conclusion & Closing Remarks Tracy Frost, Director, DoD Manufacturing Technology (ManTech), Office of the

Secretary of Defense, Department of Defense

Breakout Sessions ISACA Training Lab

Description: Web based training portal for individual, hands-on labs, focused on continuous training and skills development for cybersecurity.

ISACA - Is an independent, nonprofit, global association, ISACA engages in the development, adoption and use of globally accepted, industry-leading knowledge and practices for information systems. ISACA provides practical guidance, benchmarks and other effective tools for all enterprises that use information systems. Through its comprehensive guidance and services, ISACA defines the roles of information systems governance, security, audit and assurance professionals worldwide. The COBIT framework and the CISA, CISM, CGEIT and CRISC certifications are ISACA brands respected and used by these professionals for the benefit of their enterprises.

Comment: The training environment was well setup using “live” virtual machines for that “hands-on” type experience. The lab guidance was helpful for less experienced students but seemed too prescriptive for more senior students. To explore costs you would have to contact the training branch of ISACA.

Manufacturing Floor Demo Description: Live demo on the anatomy of a breach. Watch it unfold in real time as we discuss the cyber risks manufacturers’ face.

Comment: While the demo was at times a little contrived, it did show how easily spear phishing can be used to trick someone into clicking on a link in an email – or worse as the demo showed, saving a “must have application update” to a shared drive and then running the update on the factory floor machines. The pen testers demonstrated how easy it could be to exploit the human and once the update was run how easy it was to steal any data on the shared drive and to take down the factory machines. The claim for the demo was the pen testers had nothing previously setup and everything they did was on the fly. Their tool of choice for this situation was Empire (https://www.powershellempire.com/).

Cyber Secure Dashboard by CIRI

Description: Demonstration of an existing compliance-focused software-as-a service (SaaS) available to small and medium manufacturers to monitor compliance with NIST 800-171 as well as the NIST CSF Manufacturing Profile.

Comment: The Cyber Secure dashboard demonstrated was very thorough in its referencing documents (up to date versions), which made it easy to work in the tool versus having to jump around finding all the supporting documents. This would be an excellent tool for a small to mid-size company that needs to comply with NIST 800-171 and doesn’t necessarily have a large IT staff or any cybersecurity resources. I reached out to CIRI to see what the cost of a yearly subscription was, the response was $1,500/year for one dashboard. The onsite version is tailored to how many dashboards, for a single dashboard the first year is $4,000. Second year and beyond is $2,500.

Panel discussions General observations:

Common theme was manufacturers need to be doing the same as the IT operations team when it comes to general cybersecurity; however, the constraints on the factory floor make this “hard” to do. One of the reasons being availability, that machine producing that widget cannot be taken down for patching. Another reason is what one of the panelists called “technology debit”. This is defined as factory floor machines are controlled by obsolete hardware and operating systems (think DOS, Windows 3.11, 95, XP, etc.) that no longer are supported and no patches are available.

Even the larger manufacturers (Northrop Grumman, Rolls Royce, and Dow Chemical) haven’t figured this out, this was somewhat surprising to hear considering their resources.

While somewhat hard to measure, employee training was mentioned many times. The presentation from ISACA had a lot of statistics on this. The pen testers also said if the employees are trained properly it makes their job a lot harder – which in turn makes the “bad guys” job a lot harder.

The panel on “Cybersecurity Resources for Manufacturers” offered a lot of resources that are available; however, it was unclear what the cost of the programs were (except for the Office of Small Business Programs DoD which are free online resources).

The panel on “The Mindset of an Attacker” focused on the main vector in which they start their engagement – the human. Today’s attackers are very skilled at crafting Phishing emails and social engineering, this combination was displayed during the “Manufacturing Floor Demo”.

Conclusion

If ATI were to help others establish a manufacturing facility/shop floor cybersecurity it would be to encourage them to engage the CIRI Cyber Secure Dashboard. If they are unable to utilize this tool because of cost or lack of cybersecurity resources there is an option for ATI to establish a cloud instance of the Cyber Secure Dashboard and have them participate through this portal. I would caution as this could lead to a considerable amount of time from the IT Security Manager’s group to assist them with the NIST SP 800-171 compliance as this is not an easy task – especially for small manufactures with little or no cybersecurity resources.

The training presented by ISACA could also be a recommendation if they have resources that would be willing to participate. The hands-on aspect of this training seems to be far better than just book work and taking a certification test.

I don’t believe there was enough technical content that someone in the IT Security Manager’s group needs to attend again; however, someone from the program side could attend as an information gathering event. The panel discussions and demonstrations were fairly high level and should not be an issue for a non-cybersecurity person.

The threats discussed focused on the medium/small manufactures and how they are very much a target from a range of adversaries but mostly from nation state actors and unethical competitors (from FBI presentation, which was not included in the workshop package). From the panelists who survey this sector, they indicated that the medium/small manufactures still considered themselves “non-value” targets. Today this is no longer the case as shown by many breaches of downstream supply chain vendors.

The three main issues I heard for the medium/small manufactures where: (1) the ability to update shop floor machines because of availability for down time, (2) this notion of “technology debit” which was explained earlier and (3) lack of training/resources. To further expand on number (3), from a presenters slide (p.12): “There are many governmental activities working on the problem of cybersecurity and there are myriads of commercial tools available, but manufacturers, especially small to medium ones, lack sufficient motivation, and access to tools and training tailored to their needs”.

Update: The National Institute of Standards and Technology, NIST, is racing to publish a second revision of a draft guidance document on protecting "controlled unclassified information" prior to Feb. 15, 2019. The new revision of 800-171 will include an appendix that will be focused on "enhanced security requirements" to assist in mitigation against advanced persistent threats, or APT, the requirements in the appendix will only apply to "contracts or agreements" associated with "high-value assets."