Cybersecurity Risks for Engineers

The United States energy sector and critical infrastructure landscape are currently confronting sophisticated cyber threats that traditional safety engineering cannot adequately address. Cybersecurity Risks for Engineers is a comprehensive course designed to bridge the gap between engineering design and cybersecurity, moving beyond the reactive practice of adding security measures after deployment. By exploring the paradigm of Cyber-Informed Engineering (CIE), professionals will learn how to integrate security considerations directly into the conception, design, and operation of physical systems, ensuring that critical infrastructure is intrinsically hardened against intelligent adversaries.

This training emphasizes the strategic shift toward Secure by Design and Consequence-Focused Design principles. It addresses the limitations of standard risk management and outlines the National Cyber-Informed Engineering Strategy. Participants will dive deep into organizational and design principles, examining how to engineer out cyber risks, manage supply chain vulnerabilities, and foster a robust cybersecurity culture. From understanding the nuances of Zero Trust architecture to mastering specific methodologies like Consequence-driven Cyber-informed Engineering (CCE), this course provides the essential knowledge required to protect industrial control systems.

Key topics covered in this course include:

• The fundamentals of Cyber-Informed Engineering (CIE) and the shift from IT-centric security to engineering-centric risk management.
• Core design principles such as Consequence-Focused Design, Engineered Controls, Design Simplification, and Resilient Layered Defenses.
• Organizational strategies including Interdependency Evaluation, Cyber-Secure Supply Chain Controls, and Digital Asset Awareness.
• Identification and mitigation of specific threats including phishing, ransomware, insider threats, and mobile device vulnerabilities.
• In-depth exploration of the National CIE Strategy pillars: Awareness, Education, Development, Current Infrastructure, and Future Infrastructure.
• Application of frameworks like Consequence-driven Cyber-informed Engineering (CCE) and Cybersecurity for the Operational Technology Environment (CyOTE).

Ideal for engineers, technicians, and operational leaders, this course equips learners with the tools necessary to prevent catastrophic failures caused by cyberattacks. By integrating these practices, professionals can contribute to a resilient energy sector where security is a foundational element of every engineering decision.