Business Continuity Management / Disaster Recovery , Critical Infrastructure Security , Cybercrime

Enhancing the Cyber Resilience of Critical Infrastructure

"All too often we hear that our industrial control systems have no security. That's not true," says Kevin Jones, group CISO of Airbus. In fact, he states, "some of these systems have been designed with security encapsulating them and security around them."

See Also: Core Elements of Modern Workforce Identity Security

He says the advent of cloud technologies and digital transformation bring "even more risks to what were traditionally isolated systems and environments."

"One area that's still somewhat lacking globally is the ability to have experts who are able to respond to a cyberattack in an industrial environment," Jones says. He adds that doing so requires the ability to "understand what needs to be done to bring an industrial environment back online, to understand how the operational side of the activity has to come first and how to do forensics in an industrial environment."

In a video interview with Information Security Media Group, Jones discusses:

• Building critical infrastructure security and resilience;
• The threat of ransomware and how Airbus' detection and response capabilities have evolved to keep pace;
• Where threat intelligence fits into a mature security practice and how to act upon it quickly.

As group CISO at Airbus, Jones is responsible for the digital security program, including risk management, enterprise security architecture, red team, detection and response, and cybersecurity research innovation across IT, ICS, people and product security domains. He has extensive experience in both offensive and defensive cybersecurity and is an expert in cybersecurity for industrial control systems and safety critical systems. Jones is also the industry chair of the Industrial Control System Community of Interest - a part of the U.K.'s National Cyber Security Center that helps build CNI expertise across the U.K.