John Oyster

About John Oyster

I\'ve been providing industrial control system security expertise for over ten years. I\'ve experienced the aftermath of Stuxnet and continued to lead testing efforts for improving product security. Security by obscurity is gone, and I look to test to defense-in-depth. I lead globally distributed team promoting security training, research, requirements, verification and validation around products for industrial control systems. I am a champion of product security across 100+ product offering around Rockwell Automation\'s software and control product lines. I have over 15 years of ICS experience including receiving an MS in Electrical Engineering for computer and control systems. I have lead multiple aspects of corporate security product testing and continue to push the bar of acceptable product security testing.I am currently working on a Ph.D. in ICS/IoT cybersecurity, and continually disseminate industry findings/research throughout my corporation. My current research efforts are around hardware security and testing methods to detect product issues. I am also currently researching into RISC-V security.Certifications:• Certified CySec Specialist (TÜV Rheinland,# 166/ 18)• GIAC GICSP, GPEN, and GXPN• Currently working towards (ISC)^2 CISSP certificationSpecialties: • Programming Languages/HDL: Assembly (ARM, PIC, x86), C/C++ Java, Python, Javascript, Verilog, VHDL• EDA software: Altera Quartus II, Cadence OrCad/PSpice• IDE software: Eclipse, PyCharm, Microsoft VSCode, Microsoft Visual Studio, RSLogix Operating Systems: Microsoft Windows, Kali, Parrot, Ubuntu, VxWorks• \"Secuity\" Tools: AFL, BurpSuite, Defensics, Ghidra, Metasploit, NMAP, Sysinternals, Wireshark, ZAP and many others• Other Software: Git, JAMA, Jira, Maple, MathCAD, MATLAB, Microsoft Office, qTest, Rational ClearCase, Rational ClearQuest, VMWare• Most common penetration test tools

Experience

1. Security Architect, Project Engineer

   Rockwell Automation

   Jan 2017 — Present · Mayfield Heights, OH, US

   Leading the evolution of security verification and validation activities for Rockwell Automation control solutions ranging from PLCs to supporting development software.• Created, defined, and lead security testing projects around firmware and software products• Research and apply the latest security trends against industrial control products and support product incident response efforts.• Define and support product hardening or Blue Team recommendations and enhance customer facing documentation• Lead security verifications and validations to satisfy IEC 62•••42 certifications• Lead US based penetration testing team for firmware and software products• Champion product penetration testing through corporate process level ownership as well as advocating to globally distributed teams• Recognized business process expert for threat modeling conducting training across multiple business units• Previously lead and currently support DevSecOps efforts through vulnerability analysis and fuzz testing• Passionate about developing world-class product security testing processes and leading teams by technical example

Education

• Cleveland State University

  Bachelor's, Electrical Engineering

  2004 — 2009

• Cleveland State University

  Doctor of Philosophy - PhD, Electrical Engineering

  2018 — 2024

• Cleveland State University

  Bachelor's, Computer Engineering

  2004 — 2009

• Cleveland State University

  Master’s Degree, Electrical Engineering

  2009 — 2014

Skills

• Sequential Function Chart
• Ladder Logic
• Functional Requirements
• Clearcase
• Control Systems Design
• Functional Specifications
• C++
• Programmable Logic Controller (Plc)
• Virtualization
• Computer Architecture
• Wireshark
• Function Block
• Engineering
• Pid
• Clearquest
• Burp Suite
• Testing
• Electrical Engineering
• Programming
• Functional Safety
• Scrum Master
• Iec 62443
• Firmware
• Project Estimation
• Structured Text
• Functional Testing
• Embedded Systems
• Verilog
• Software Design
• Test Automation
• Microchip Pic
• Vxworks
• Python
• Automation
• Multiprocessing
• Computer Security
• Peachfuzzer
• Java
• Devops
• Microsoft Office