Amr Yehia
Board Member at ISA Egypt Chapter
International Society of Automation (ISA)
Amr is board member at International Society of Automation (ISA) Egypt Chapter, he is an OT/IoT Cybersecurity Architecture Expert at sirar by stc where he secures OT/ICS architectures for OT and IoT environments.
An advisor and international speaker on OT, ICS, and energy-sector cybersecurity, his focus areas include IT/OT convergence, Purdue-model security, digital twins for cyber-physical resilience, and AI-driven industrial threats.
Amr has been working in KPMG as OT Cybersecurity Manager at Saudi Levant Cluster, and Senior Cybersecurity Consultant in Schneider Electric. Amr has a massive experience in securing many operational technology industries including oil & gas, petrochemical, water treatment, energy, transportation, and metallurgy.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Zero Trust Layered on the Purdue Model: A Field Use Case for Deploying Zero Trust in ICS
Dragos research reported that 5 out of 10 active threat groups are exploiting public-facing infrastructure, and 4 out of 10 active threat groups exploited external remote services. One of Purdue Model flaws is once you are inside an ICS perimeter, everything trusts everything. Colonial Pipeline proved an IT-side compromise alone can shut down OT.The root cause persists because the Purdue Model was never designed as a security model: it segments by function and level, and for thirty years being on the �right� level has quietly meant being trusted.This session presents real world use case of field lessons from applying �never trust, always verify� to the Purdue architecture: an anonymized Zero Trust rollout across a GCC energy-sector OT environment. I will walk through what worked, what broke, and what had to be redesigned .I will illustrate the Purdue-level control-compatibility map separating where device-native Zero Trust is achievable (Level 3+: historians, HMIs, engineering workstations) from where zone-and-conduit perimeter controls must carry the load (Levels 0�1: PLCs, IEDs, sensors); reuse of ISA/IEC 62443 zones and conduits as the segmentation backbone; explicit fail-open versus fail-closed policy for safety-critical subsystems; and a phased sequence starting at the IT/OT DMZ and control center.Grounded in NIST SP 800-207, CISA's Zero Trust Maturity Model and 2025 OT guidance, Dragos white-paper Guide to Applying Zero Trust Concepts in OT Environments, and NERC electric sector work, attendees leave with a downloadable compatibility matrix and rollout playbook � mapped to the Saudi NCA OT Cybersecurity Controls (OTCC).
- 16:30
- Wed
- 02 Dec
Stage:
Briefing Stage 1
Sessions Type:
Keynote