Shell's Approach To ICS Security

Shell has a large number of industrial control systems (ICS) that monitor and control their upstream, midstream and downstream operations. After a multi-year journey to try to find an effective way to secure these ICS, Shell has found an approach that they are finding effective.
William Alyea goes over how Shell has identified a set of Core Security Controls that they require all ICS to meet a minimum security level that can be met in a measurable and standardized way.
The key slides on Shell's view of the threats and controls are shown at 10:18 and 17:40 in the video.

[@HackMyControlSystem]

I really enjoyed the ICS-specific​ story around mapping the solution to the business, as well as the disciplined approach to reducing threat modeling to manageable use cases.