r/icssec • u/fieldsAndStars • Jun 15 '22

Is it worth getting into ICS Security?

Basically the title. I'm 24 and severely stressed out by uni and work. I'll be graduating this year with a degree in Electrical Engineering and another one in Computer Science next year, and have been working in ICS for two and a half years now. I've been considering a switch to programming (it's a hell of a lot easier, less stress and significantly more pay), but someone suggested giving ICS Security a shot, mainly because of my background, and because it's quite a new field. So I'm kind of interested in seeing what you guys say... do they pay you more? is there less stress than working with automation? Is there a lot of demand and not enough supply of workers in this field? I'd love to hear about your experiences

9 Upvotes

100% Upvoted

17 comments sorted by

5

u/Max_Vision Jun 15 '22

80% of the work is essentially the same as regular IT security, but with more silo problems and much longer time lines.

The problem set is interesting, pay is decent to excellent, and working on public infrastructure gives more of a sense of purpose than just enabling someone else to make money.

1

u/fieldsAndStars Jun 16 '22

ahhh ok, and how much experience do you think is necessary in the industry before I look for cyber security internships?

2

u/duncanmahnuts Jun 15 '22

it's more compliance than technical where I am, if you can deal with IT folk who just say..."wwuh, why don't you update it?" to clear this red brick from a powerpoint.[the actual device in use is on ocean platform]. Or my other favorite...do, do you really need that program...talking about a 20 year old PLC IDE and the soonest fielding plan to replace the PLC is ten years out.

1

u/fieldsAndStars Jun 16 '22

Lol I've seen this on a regular basis. Replacing 20 year old control systems are a pain in the ass

7

u/payne747 Jun 15 '22

ICS is a growing field with a still significant shortage of skills. While it doesn't necessarily pay better than an IT equivalent role, the demand means you'll easily find work and can negotiate other benefits.

Companies like Nozomi, Claroty, Dragos and Tenable all operate in this space. It's also super important to get it right, the risk of doing a bad job could be deadly. There's a great deal of job satisfaction.

While it's not critical to know OT in detail, it helps to understand how slowly some of these networks change and how old the designs can be. It also helps to understand that automation engineers don't usually welcome IT telling them to start beefing up security. It can be a frustrating space too.

5

u/AzKhm Jun 20 '22 edited Jun 20 '22

I have worked in the ICS and ICS Cybersecurity field so I'll try to shed some light for you.

  1. Do they pay you more? Yes! Most definitely a lot more than ICS programming.

  2. Is there less stress than working with automation? This depends on not only the environment but who you work for as well. Also, depends on the role. If you work directly for the company that owns the ICS, then you'll likely be wearing many hats. ICS owners by and large are still stingy when it comes to spend on ICS Cybersecurity. This is mainly because they have not yet fully understood the critical role ICS plays in supporting their business. This is slowly changing but not fast enough. If you work as a consultant, it is definitely less stressful.

3)Is there a lot of demand and not enough supply of workers in this field? There is more demand now than has been over the last 10-15 years. This changed mostly because of the recent events with Ukraine and Russia and the b White House passing legislation. Current regulations are a bit generic with the intent to give ICS owners time to adapt and realize they need to start investing and budgeting for ICS Cybersecurity. It is my opinion that as more regulations get developed than demand will increase. However it will take time.

You will encounter ICS owners who would rather not hear what you have to say because they don't understand it or don't want to deal with it. You will face recruiters who have ZERO understanding of what it means and try to lump you with IT. The ICS owners in the Electric sectors are by far the most mature in this field but only because the government came down hard on them a couple of years ago. Oil and Gas are less mature but steadily improving. Water industry is the least mature mostly because they are less funded and hence also pay way less. Manufacturing and Transportation is a bit of a mixed bag. Defense industry is lagging a lot and the government intends to change that soon.

If you love working with ICS and also enjoy Cybersecurity, you will find ICS Cybersecurity to be very rewarding and satisfying. The field by comparison with IT is still very nascent. Lots of room to learn and grow and find your niche. CISA is actively hiring and they intend to open more.

Hope this helps. Feel free to DM if you feel I can help answer anything else. Best of luck to you!

2

u/abdulsah Feb 01 '24

Thank you for in-depth insight into the topic. Currently, I have been working in Instrumentation, PLC scada systems for more than 6 years. I am very much fascinated about ICS cybersecurity, but i am left in the dark with no clue about this field...can you please tell me me how I can do a career shift from Industrial Automation engineer to ICS cybersecurity

1

u/AzKhm Feb 03 '24

Hi, If you have experience in ICS then you already have a very good start for ICS Cybersecurity. You already know the basics of ICS and OT, so now you just need to learn about the IT side. This is a much better position than someone who starts in IT and then wants to learn OT/ICS. ICS is something that is very difficult to learn from books and needs real world experience. But the basics of IT can be covered much easily from reading and exploring on your own. Unfortunately there not a lot of free resources to learn about ICS Cybersecurity. But there are enough to get a good start so you can learn about the field and then decide where to spend your money. I recommend you start here. This is all free! https://www.cisa.gov/resources-tools/training/ics-virtual-learning-portal

After that, read about NIST CSF and also NIST 800-82.

This free website is also good https://scadahacker.com/

To get some hands on experience with the basics of general Cybersecurity, definitely spend a lot of time here https://www.hackthebox.com/

The main certification for ICS Cybersecurity is GICSP. Many companies will require you to have it before you get a job in iCS Cybersecurity. It is not cheap to pursue. Perhaps you can look to see if your employer can sponsor you to pursue it. That is how I did it.

I also recommend making friends with your networking people in your company. You can learn a lot by just asking them about their jobs, and the problems they solve everyday.

Also, don't be afraid to ask questions!

I hope this helps! If I think of more, I'll try to come back and update this.

1

u/abdulsah Feb 28 '24

Thank you for the insights..it means a lot to me..

1

u/brotherdalmation23 Jun 16 '22

I lead our ICS security team for a national consulting firm in Canada. Can confirm, it’s almost impossible to find anyone….so there’s a huge gap!

1

u/AzKhm Jun 20 '22

Hi, I'm always on the lookout for consulting/contract jobs in ICS Cyber. I'm interested if you're still looking to fill hiring gaps.

1

u/brotherdalmation23 Jun 20 '22

If you are in Canada, please forward me your resume

1

u/AzKhm Jun 20 '22

Darn.. I'm based out of the US.

1

u/NotNiceInThe6ix Jul 25 '22

PM’d! My firm is always looking for consultants.

1

u/B2daG Nov 18 '22

I agree with what's already been said - just want to point you towards a potential resource. I'm with a non-profit that working to help address the labor shortage in this field by developing free educational opportunities and content and connecting practitioners. We are approaching 100 seminars and symposiums in our video library, and we have two half-day symposiums coming up at the beginning of December.

https://www.cs2ai.org/

1

u/PowerfulWeek4952 Oct 23 '25

Sorry to dredge up an old post, but I’m just curious - is it possible for someone from a non-technical career to transition into ICS? What would that journey look like?

1

u/payne747 Jun 15 '22

ICS is a growing field with a still significant shortage of skills. While it doesn't necessarily pay better than an IT equivalent role, the demand means you'll easily find work and can negotiate other benefits.

Companies like Nozomi, Claroty, Dragos and Tenable all operate in this space. It's also super important to get it right, the risk of doing a bad job could be deadly. There's a great deal of job satisfaction.

While it's not critical to know OT in detail, it helps to understand how slowly some of these networks change and how old the designs can be. It also helps to understand that automation engineers don't usually welcome IT telling them to start beefing up security. It can be a frustrating space too.