Sign Up for Our Newsletter
Donate

UnDisruptable27

Critical Effect DC 2025

Event

Start: June 12, 2025 | 9:00 am ET / 6:00 am PT
End: June 13, 2025 | 5:00 pm ET / 2:00 pm PT

The next evolution of Hack the Capitol, Critical Effect DC is a two-day, annual critical infrastructure-focused conference connecting policymakers, members of civil society and academia, and OT/ICS stakeholders. Presented by ICS Village, in partnership with the Institute for Security and Technology, Crowell LLP, and the National Security Institute, this year’s event prioritized timely, solution-driven content with a sense of urgency, focusing on initiatives that can be implemented in the next two years.

The next evolution of Hack the Capitol, Critical Effect DC is a two-day, annual critical infrastructure-focused conference connecting policymakers, members of civil society and academia, and OT/ICS stakeholders.

About Critical Effect '25

Presented by ICS Village, in partnership with the Institute for Security and Technology, Crowell LLP, and the National Security Institute, this year’s event prioritized timely, solution-driven content with a sense of urgency, focusing on initiatives that can be implemented in the next two years.

Why this sense of urgency? 

Agenda

Track I: Critical Mass

Policy, strategy, and governance-focused panels and presentations, including keynotes and fireside chats by leading government officials.

8:30 amNetworking and coffee
9:00 amOpening Remarks
Bryson Bort, ICS Village and Joshua Corman, IST
9:05 amFireside Chat
Representative Nick Begich III (AK) and Bryson Bort, ICS Village
9:35 amWhy Critical Effect? Why Now?
Bryson Bort, ICS Village and Joshua Corman, IST
10:00 amRethinking Cybersecurity: From Volt Typhoon to Resilience by Design

Despite decades of investment—billions spent on cybersecurity tools, training, and advanced hardware—our systems remain fundamentally vulnerable. The Volt Typhoon campaign, a stealthy infiltration of U.S. critical infrastructure attributed to a nation-state actor, is the latest warning sign: our adversaries are outpacing our defenses. Why, after all this effort, are we still broken? This panel brings together leaders from government, industry, and academia to examine the root causes of these persistent vulnerabilities. Is the issue rooted in complexity, poor adoption of best practices, or fundamental design flaws? Have we prioritized compliance at the expense of innovation.

Moderator: Mehdi Tarrit Mirakhor, Associate Professor, Department of Information and Computer Sciences, University of Hawaii
Panel: Kevin E. Greene, Chief Security Strategist at BeyondTrust; Kirk Lawrence, Section Chief, Secure by Design, CISA/DHS; Adam Robbie, Head of OT Threat Research, Palo Alto Networks
11:00 amNo Water, No Hospitals: Emergency Response Under Fire

China’s 2027 intentions toward Taiwan are fast approaching and US Water is in the crosshairs. Volt Typhoon’s credible threat of disruption and destruction of water infrastructure has immediate risks to public safety, human life, and national security. In peacetime, this Public-Private-Partnership’s participation remains a single digit %. As we face hybrid conflict this panel will surface and test assumptions regarding cross-sector, cascading failure. We will also discuss some of the findings and recommendations of UnDisruptable27- focussed on the resilient continuity of operations at the intersections of water and access to emergency care.

Moderator: Josh Corman, Executive in Residence for Public Safety and Resilience, Institute for Security and Technology (IST)
Panel: Jonathan Horowitz, Deputy Head Legal Department, International Committee of the Red Cross (ICRC); Kevin Morley, Manager, Federal Relations, American Water Works Association (AWWA); Blake Scott, Senior Public Health Emergency Preparedness Planner, Coconino County Health and Human Services; Jennifer Lyn Walker, Director of Infrastructure Cyber Defense, WaterISAC
12:00 pmLunch
1:00

Keynote

Congresswoman Robin Kelly (IL-2)

1:15 pm

Practicing for Disaster: MITRE’s Multi-Sector CyberSecurity Exercise

Recently MITRE hosted a groundbreaking exercise bringing together approximately 200 participants from 70 organizations across five metro areas, including federal, state, and local governments, emergency managers, and industry representatives from sectors like pipelines, electricity, IT, communications, and rail. The exercise focused on enhancing national resilience during a protracted cyber conflict affecting multiple critical infrastructures. This presentation will provide an overview of the exercise and then Mark will sit with panelists from Industry and Emergency Management to discuss insights gleaned.

Moderator: Mark Bristow, Director, Cyber Infrastructure Protection Innovation Center, MITRE
Panelists: Sharla Artz, AVP, Security and Resilience Policy, Xcel Energy; Charles R. Goodwin, Commissioner, Department of Emergency Communications & Management, Worcester, MA; Tariq Habib, CISO, New York Metropolitan Transit Authority; Robert Morgus, Sr. Adviser, Risk and Resilience, Berkshire Hathaway Energy

2:10 pm

Code in the Combine: Protecting Agriculture in the Age of Cyber Conflict

This panel will examine the growing cybersecurity risks to the U.S. food and agriculture sector, with a particular focus on how increased digital connectivity—spanning AI-powered automation, refrigeration logistics, and supply chain coordination—has created new vulnerabilities with national security implications. This session will also emphasize the importance of public-private information sharing, and how legacy legislative tools—like the Cybersecurity Information Sharing Act of 2015—must be updated and reauthorized to reflect today’s complex and evolving threat landscape.

Moderator: Matt Hayden, Former Assistant Secretary of Homeland Security for Cyber, Infrastructure, Risk and Resilience Policy and Vice President of Cyber and Emerging Threats, General Dynamics Information Technology
Panel: Scott C. Algeier, Executive Director of the Information Technology – Information Sharing and Analysis Center (IT-ISAC) and Founder, President, and CEO, Conrad, Inc.; James Johnson, CISO, John Deere; and Jiwon Ma, Senior Policy Analyst, Center on Cyber and Technology Innovation, Foundation for Defense of Democracies

3:05 pmThe Future of Cybersecurity Policy and Regulations: A Multiverse Approach

The panel will focus on a discussion exploring diverse cybersecurity and privacy regulatory models, conceptualized as potential timelines within the cyber policy multiverse. We will delve into various frameworks, including traditional command-control regulations, impact/performance-based models, outcome-based regulations, and self-regulation standards, to envision the future landscape of cybersecurity policy.

Moderator: Evan Wolff, Partner, Crowell & Moring LLP
Panel: Megan Stifel, Chief Strategy Officer, Institute for Security and Technology; Jeanette Manfra, Global Director of Risk and Compliance, Google Cloud; Randy Sabett, Special Counsel, Cooley LLP; and John Woods, Partner, Sidley Austin LLP.
3:55 pmClosing remarks
5:00 pm – 7:00 pm

Reception

The City Club, 555 13th St NW, Washington, DC 20004.
Light hors d’oeuvres & drink ticket available.

All times listed are in Eastern Time.

8:30 amNetworking and coffee
8:55 amOpening remarks
Bryson Bort, ICS Village, and Josh Corman, Institute for Security and Technology (IST) 
9:45 amKeynote
Representative Rich McCormick (GA-7)
10:00 amPeace through Cyber Strength – What Needs to Change in U.S. Cyber Posture

Moderator: Lucian Niemeyer, CEO, BuildingCyberSecurity.org
Panel: Christopher Cleary, President, Military Cyber Professional Association; Matt Hayden, Former Assistant Secretary of Homeland Security for Cyber, Infrastructure, Risk and Resilience Policy and Vice President of Cyber and Emerging Threats, General Dynamics Information Technology; Michael G. McLaughlin, Co-Leader, Cybersecurity and Data Privacy Practice Group and Principal Policy Advisor, Buchanan Ingersoll & Rooney PC; Mark Montgomery, Senior Director, Center on Cyber and Technology Innovation, Foundation for Defense of Democracies
11:00 am

Conveying the Looming Threat of Critical Infrastructure Hacking

The idea that malicious hackers could cause blackouts, water contamination, food shortages, or healthcare disruptions from their keyboards has gone from a sobering hypothetical to an urgent reality in recent years. With so many news topics competing for public attention, though, how should journalists approach coverage of potentially calamitous digital and cyber physical threats?

Moderator: Lily Hay Newman, WIRED
Panel: Maggie Miller, POLITICO; Andy Greenberg, WIRED

12:00 pmLunch
1:00 pmCyber Policy Shark Tank
Beau Woods, I Am the Cavalry, Hackers on the Hill, and Stratigos Security
Learn more and apply at https://hackersonthehill.org/critical-effect/.
2:00 pmClosing remarks
Bryson Bort, ICS Village, and Josh Corman, Institute for Security and Technology (IST) 

All times listed are in Eastern Time.

Track II: Strategic Effect

A series of half-hour individual sessions, each of which will dive deep into leading issues in ICS security. Topics include the corporate, legal and regulatory environment, and specific technical or operational details.

8:30 amNetworking and coffee
10:00 am

A Typhoon in a Teacup? Critically Evaluating Reporting on High Profile Threats

For over two years, US and “Five Eye” entities have focused significant attention on the threat posed by an activity cluster initially identified by Microsoft as “Volt Typhoon.” Linked to People’s Republic of China (PRC) cyber operations, Volt Typhoon is notable for effective, persistent use of living off the land behaviors via proxied command and control (C2) infrastructure to target civilian and dual-use critical infrastructure entities. The entity has been described as the most concerning threat to US infrastructure and interests by multiple commercial and government entities – yet for all this attention specifics on the group and their operations remain maddeningly scarce in public, available reporting.

Joe Slowik, Dataminr

10:30 am

Cybersecurity Threats and Policy Implications for Battery Energy Storage Systems

The integration of battery energy storage systems (BESS) across critical infrastructure is a cross-sector resilience issue with direct implications for national security, industrial stability, and public safety. BESS now supports communications towers, hospitals, military installations, data centers, and electric vehicles, making its security a strategic imperative. As these systems become deeply embedded in critical operations, cyber vulnerabilities in BESS can create cascading disruptions across multiple sectors, threatening infrastructure reliability and operational continuity.

Dr. Emma Stewart, Idaho National Laboratory (INL)

11:00 am

“When the well is dry, we know the worth of water”: A firsthand account of a DEF CON Franklin volunteer supporting water utility critical infrastructure

This presentation features the firsthand experiences of a DEF CON Franklin volunteer, supporting a small town’s water utility critical infrastructure.  This ongoing ethnography of communication documents my first 6 months exploring conceptual deception models with this water utility, to deter attackers and influence attackers’ real and imagined perceptions of the vulnerability and defense of this water utility’s critical infrastructure.  This rare account reflects the growing efforts to find alternative ways to protect critical infrastructure, especially for local and state critical infrastructure network teams that often lack resources and support. 

Tim Pappa, Walmart Global Tech

11:30 am

Fortifying DoD Operational Technology: Securing the Cyber Battlefield Against Nation-State Threats

Nation-state and cyber adversaries are exploiting operational technology device vulnerabilities, including trojanized hardware embedded in critical infrastructure, DoD facilities, and supply chains, undermining military readiness before kinetic conflict begins. From ransomware crippling pipelines to malware in industrial safety systems, cyber threats now shape the battlefield. To maintain dominance, federal and industry enterprises must secure OT with Zero Trust architectures, tamper-resistant firmware, and continuous monitoring. Supply chain integrity checks and intelligence-sharing with industry and allies are critical to countering embedded threats. This talk will analyze real-world intrusions and outline strategies to harden OT—because in modern warfare, securing OT is mission-critical. 

Kathryn Wang, SandboxAQ, and Alison King, Forescout Technologies

12:00 pmLunch
1:15 pm

All hands on deck needed for Everything Everywhere All At Once

With increasing reconnaissance from APTs into critical infrastructure there is a clear disconnect in OT incident response planning from a wide scale (Everything Everywhere All At Once) attack on American infrastructure.  Join Andrew Dettmer as he discusses how he prepares a utility for such an attack, and how vendors, nonprofits (such as the Civilian Reserve Information Sharing and Analysis Center), and government are all needed to prepare better defenses and build a nationwide incident response plan. 

Andrew Dettmer, Black and Veatch and Katrina Rosseini, CR-ISAC

1:35 pmThe Volt-Bolt: UnDisruptable27 & The work to be done over the next 18 months

Josh Corman, Institute for Security and Technology (IST)
2:05 pm

No Sector is an Island

While the focus for most entities has been to look inward when improving their cybersecurity posture, Sectors, Regions, and Communities also need to understand how critical infrastructure sectors impact each other. More and more, the critical lifeline sectors rely on each other to have robust risk and resiliency programs. This conversation will discuss some of these dependencies from a Water Sector perspective, and ask the attendees to think more strategically about cyber resilience.

Andrew Krapf, Loudoun Water

2:35 pm

Military Mobility Depends on Secure Critical Infrastructure

A direct military engagement between the United States and a near-peer adversary would require the swift mobilization and deployment of a sizable U.S. military force. Moving troops and equipment efficiently over land, sea, and air is essential to America’s ability to project power, support partners and allies, and sustain forces to fight and win wars. Alongside the U.S. military’s own assets, commercially owned and operated critical infrastructure enables this military mobility. Civilian-owned rail networks, commercial ports, and airport authorities will handle transportation of the majority of servicemembers and materiel during a significant, rapid mobilization.

Mark Montgomery, Center on Cyber and Technology Innovation, Foundation for Defense of Democracies

3:05 pmIndividual and Regional Healthcare Impacts of Cyberattack

Natalie Sullivan, George Washington University
3:35 pm

Securing America’s Water Systems: Engineering-Based Approaches to Cyber Resilience

This presentation examines the critical interdependence between US drinking water systems and vital services including healthcare facilities, firefighting capabilities, and other critical infrastructure. We’ll outline practical, engineering-focused approaches to achieve cyber resilience without heavy reliance on traditional cybersecurity technologies that remain out of reach for many utilities. Most community water systems (CWSs) in the US operate with limited funds and technical expertise to implement, maintain, and effectively utilize complex cybersecurity solutions. However, these same utilities typically have access to internal and external resources with deep understanding of water process engineering.

Gus Serino, I&C Secure, Inc

5:00 pm – 7:00 pm

Reception

The City Club, 555 13th St NW, Washington, DC 20004.
Light hors d’oeuvers & drink ticket available.

All times listed are in Eastern Time.

9:00 amNetworking and coffee
10:00 am

What’s the worst that could happen? Cyber Consequence Analysis for Critical Infrastructure

Often, the professionals charged to protect critical infrastructure from cyber-attack aren’t well versed in the operational impacts which could result from such an attack. Without that understanding, the defensive strategy for cybersecurity of these critical functions lacks operational context and key defenses and defenders necessary to successful defense and resilience may be overlooked. This talk will arm attendees with critical insights and questions that can be asked to unlock this awareness and enhance cybersecurity plans into critical function assurance plans. Cyber-Informed Engineering gets cybersecurity defenses and operational resilience working smoothly together. 

Virginia Wright, Idaho National Laboratory (INL)

10:30 amCritical Infrastructure Security as a Key Enabler for Resilience

Critical Infrastructure by definition is deemed important for a Nation. Like with other aspects (hurricanes, earthquakes etc.) that pose a significant risk to Critical Infrastructure, gaps in OT Security can lead to cutting off access to key resources such as Power, Water or Oil, even possibly unacceptable loss of life & property. However, a systematic approach to addressing those gaps would enable resilience, and reduce the severity of the impacts even if other nation-states are waging an active cyber-campaign. This presentation focuses on the low hanging fruit (best practices for reducing risk as well as decreasing impact) to address and resolve the major gaps in OT Security.

Vivek Ponnada, Frenos
11:00 amSecuring Rural America: Supporting Electric Cooperatives of all Sizes

The National Rural Electric Cooperative Association (NRECA) supports electric co-ops of all sizes and varying cybersecurity maturity. NRECA’s cybersecurity program works to implement programs that support each of these co-ops with their unique requirements. Project Guardian, NRECA’s Co-op Cyber Goals, and other initiatives are just some of the ways NRECA meets co-ops where they are to support their cybersecurity programs. This talk will discuss the cutting-edge ways NRECA is delivering for its members.

Adrian McNamara, National Rural Electric Cooperative Association
11:30 am

Understanding Today’s Cyber Threat Landscape

FBI Intelligence Analyst Gabrielle Ma will provide an overview of the current, increasingly complex cyber threat landscape facing a variety of critical infrastructure sectors. She will also discuss the importance of information sharing and partnering in securing operational technology and building resilience.

Gabrielle Ma, FBI

12:00 pmLunch

All times listed are in Eastern Time.

Track III: Tactical Mastery

Also known as the Beer-ISAC, this featured series of half-hour individual sessions is dedicated to peer-to-peer information sharing.

9:00 am

Networking and coffee

10:00 am

Secure By Default: Closing the Loop
Secure by Default in many respects is the ultimate objective for cybersecurity professionals – to have products and systems delivered to the end user in a state without undue risk overshadowing. Recently we have heard from multiple governments around the planet on this topic through such papers as Secure by Design and Secure by Demand. But how do we close the loop? How do we drive the concept of security to be the default state for our ICS solutions? ISA/IEC 62443, the cyber standard for the ICS industry, is addressing this need.
Andrew Kling, Schneider Electric

10:30 am

Impact-Centric Cyber Resilience Quantification (CRQ): Estimating Cyber-Physical Damage at Scale
For multi-site organizations, understanding facility-specific cyber-physical damage risk is critical for making informed investments in security controls and insurance. This session introduces a methodology designed to estimate financial exposure from cyber-induced physical damage at scale. By leveraging property insurance data, AI-driven facility classification, and historical precedent analysis, this approach provides a structured way to assess inherent risk at arm’s length with limited data on security controls in place. Through a case study on poultry production, attendees will explore how targeted cyber-physical risk modeling enhances resilience planning, supports executive decision-making, and ensures smarter resource allocation across geographically distributed assets.
David White, Axio, Daniel Brown, Axio, and Brendan Fitzpatrick, Axio

11:00 am

Stop Applying IT Fixes to OT Problems: The OT Security Wake-up Call
OT environments are not like data centers & trying to secure them with IT tools is like trying to play a vinyl record on a CD player (same goal, ineffective tech). From visibility & vulnerability management to risk response, OT demands specialized strategies that prioritize continuity & control. Join us as we explore how traditional IT security can actually increase risk in ICS environments. You’ll walk away with a clear understanding of why OT requires purpose-built solutions, how to avoid the most common (& costly) missteps, & what it really takes to keep operations running safe & secure.
Debbie Lay, TXOne

11:30 am

Crown Jewels Analysis for Control Systems
To help assess risks to missions from cyber and non-kinetic threats, organizations need repeatable processes to analyze how failure or compromise of an asset could degrade or cause failure of a critical mission. Assets are people, physical entities, or information located either within or outside the United States and employed, owned, or operated by domestic, foreign, public, or private sector organizations. The Crown Jewels Analysis process provides a repeatable approach to capturing knowledge from organizational Subject Matter Experts, documenting known dependencies, and prioritizing assets based on their criticality to mission.
Cedric Carter, MITRE

12:00 pm

Lunch

1:15 pm

Blowing up gas stations for fun and profitSince the war(s) broke loose last year, a lot has been said about cyberwarfare, attacks on critical infrastructure, ICS/OT vulnerabilities, you name it. In this talk, we are going to talk about a specific set of ICS: Automated Tank Gauging (ATG) systems. These systems control the safe storage and management of fuel in critical infrastructures like gas stations, military bases, airports and hospitals. We will discuss multiple (10) zero-day vulnerabilities that expose these systems to catastrophic risks, from environmental hazards to significant economic losses. Despite past warnings, thousands of ATG systems remain online, unprotected, and vulnerable to exploitation. This track will talk about past ATG research, the new vulnerabilities found and their technical details, demonstrating how they can be exploited to gain unauthorized control over ATG systems. In the end, we will dive into our quest to cause physical damage remotely, in hopes of blowing up (our) gas station.


Pedro Umbelino, Bitsight

1:35 pm

Better Attack Surface Management: What Attackers See That You Don’t
Attack Surface Management is the foundation upon which ICS security stands. Drawing from both real-world threats and attack emulation exercises against critical infrastructure environments, we’ll examine the ICS attack surface from an attacker’s perspective and uncover common gaps they abuse, as well as actionable steps to identify and reduce those risks. Learning how to truly define your attack surface now is crucial to protecting our critical infrastructure.
Ray Blasko, BreakPoint Labs

2:05 pm

Defending the Digital Core: Cyber Ranges and the Future of Operational Technology Security

Cyber Range

2:35 pm

Bridging the Gap: ICS Cybersecurity Awareness and Public Education

Laura Scherling, Columbia University

3:05 pm

Resilience Now: Translating How Different Sectors Mitigate the Risk of Legacy Infrastructure

Matthew Rogers, CISA

3:35 pm

Hunting the Intruder: Detecting and Mitigating Rogue Master Devices in ICS
Industrial environments have many assets, sensors, actuators, controllers, and PLCs. How can we ensure new assets are monitored to prevent errors, espionage, and sabotage? This talk explores these threats and solutions. You’ll learn about master-slave roles, rogue masters, and how to detect them.
Andre Vianna, Norsk Hydro

5:00 pm –7:00 pm

ReceptionThe City Club, 555 13th St NW, Washington, DC 20004.
Light hors d’oeuvers & drink ticket available.

All times listed are in Eastern Time.

9:00 amNetworking and coffee
10:00 amCyber-Physical Digital Twins for Intrusion Detection

This presentation will provide an update on ongoing research on digital twins (DTs) for better cyber intrusion detection. DTs are detailed physics-based models of real systems, enhanced with historical data to improve accuracy. They predict equipment failures, optimize performance, and analyze new conditions. By adding data layers from control systems and cyber-communications interactions, these enhanced DTs offer insights into equipment responses to control signals. Creating an attack library and comparing it with DT responses helps cyber defenders quickly identify potential attacks.

Jason Hollern, Electric Power Research Institute (EPRI)
10:30 amOperationalizing MITRE EMB3D: Threat Modeling to Create and Acquire Secure-by-Design Devices

How can threat modelling be used to make more secure device acquisition decisions, build more secure devices, and conduct and communicate research findings? In this talk we will explore how MITRE EMB3D, recently updated to include technical Mitigations, is being used by security practitioners across multiple sectors to better secure the embedded device and operational ecosystems.

Jack Cyprus, MITRE and Wyatt Ford, Red Balloon Security
12:00 pmLunch

All times listed are in Eastern Time.

Download the full agenda

Stream Critical Effect DC '25 on YouTube

See more

Critical Effect may be over…but our work to secure our critical infrastructure is just beginning!

Panelists

Joshua Corman

Executive in Residence for Public Safety & Resilience

Bryson Bort

Adjunct Senior Technical Advisor

Megan Stifel

Institute for Security and Technology
Pillar Future of Digital Security
Project UnDisruptable27

Event Type

Topics

Share

Facebook
Twitter
LinkedIn
Print
MENU

HOME PAGE

GET IN TOUCH

Email: [email protected]
Send us a message: Contact

JOIN THE CATALINK MAILING LIST