Ilan Shaya
Control-systems designer and OT cyber-security consultant for critical infrastructure. Worldwide experience: twenty years of plants, grids and governments; OT defense since 2013.
Get in touchI design the control systems that run power stations, water plants, campuses and supermarket chains, and the cyber-security architecture that keeps them running. Since 2013 I have also been defending them.
Who. Founder and CEO of SmartLogic (control and automation) and of ICS Security (OT cyber defense). B.Sc. in computer science and mathematics with honours, MBA studies, Certified SCADA Security Architect, Belden IEI certified.
What. Control-system design from a single machine to three hundred sites; OT defense architecture to NIST SP 800-82, NERC CIP and ISA/IEC 62443; risk assessments with tools I built; and two patented products, SPARTA and GRAPHENE.
Where. Israel's Ministry of Defense, ICL, the Weizmann Institute, Shufersal and Delek at home; EnerjiSA in Turkey; the Ministry of Home Affairs in Singapore and the police cyber units of Japan, who bought my course; nine substations in Ghana that run GRAPHENE.
Reach. mail@ilanshaya.com or +972 54 777 7772. Classified work is discussed in person. A first call is free and takes half an hour.
By the numbers
- 20
- years designing control systems for plants, campuses, bases and chains.
- 2013
- the year I moved from building control systems to defending them.
- 300
- supermarkets run by one central control and energy system I designed.
- 500+
- controllers across the Weizmann Institute's campuses.
- 9
- electricity substations in Ghana watched by GRAPHENE.
- 84
- police cyber officers in Japan trained on my course.
Design it.Defend it.
Then prove it to the regulator. Five services, one person: the engineer who draws the control network also signs the defense plan and the risk report.
All servicesHarden a plant, one layer at a time
This is the order I add defenses to a control network. Drag the slider, or press a step, and watch the plant change.
- A flat network Office PCs, the HMI server and the controllers all share one network. One phished laptop can write to a PLC.
- Separate IT from OT The plant gets its own network and a DMZ between it and the office. Nothing from the enterprise side talks to a controller directly.
- Industrial firewalls and a data diode Traffic into the control network passes a firewall that understands Modbus; data leaves the plant through a one-way diode only.
- Passive intrusion detection A GRAPHENE sensor on every VLAN learns normal traffic and raises an alert on a port scan, a firmware change or an unknown asset, without touching the process.
- Protect the HMI itself SPARTA sits on the HMI server and confirms every command came from a human operator, not from malware already inside.
- Rehearse the incident A seven-step response plan, backups that restore, and a drill with the people who will run it at three in the morning.
Where I have worked
Different processes, the same problem: equipment built to run for decades, connected to networks that were never meant to reach it.
- Power and gridsPower stations in Israel, hydro plants in Turkey, substations in Ghana
- DefenseMinistry of Defense facilities, IDF bases, test facilities and wind tunnels
- WaterWater, desalination and RO plants; Singapore's national water agency
- Oil, gas and portsA Delek gas facility; SPARTA at Ashdod Port
- Campuses and researchOver 500 controllers at the Weizmann Institute
- Retail and buildingsOne control and energy system for 300 Shufersal branches
- Pharma and processISA-88 batch control with FDA and GAMP requirements
How a project runs
Every engagement follows the same four moves, whether the site is one pumping station or a national grid. You talk to the engineer who does the work from the first call to the last drill.
Listen
A free half-hour call about the site, what worries you and what the regulator expects. If the site is classified we meet in person, and an NDA comes first.
Map
A site visit and a full inventory: every controller, HMI, historian, switch, firewall and remote link, and every path an attacker could take between them. Nothing is installed and the process is never touched.
Design
The control architecture, the segmentation and the controls, written as specifications a contractor can price and build, mapped clause by clause to NIST SP 800-82, NERC CIP or IEC 62443.
Deliver and drill
I supervise the implementation, train the operators and the IT team, and run the first incident drill with the people who will be on call when something happens.
Selected work
- Ministry of Defense facilities and bases Control, communications, architecture
- Defense industry test facilities Control and communications design
-
SIIRD attack-and-defense test range
R&D, Israel–Singapore
2019
-
Nine substations, Ghana
GRAPHENE deployment
2018
- ICL power stations Risk assessment 2018
- EnerjiSA hydro-electric plants, Turkey Risk assessment after an attack 2017
- Delek gas facility Risk assessment 2016
- Singapore Ministry of Home Affairs Three-week ICS security course 2015
- Japan, police cyber units via DNP Two-week ICS security course
- Weizmann Institute of Science Senior control consultant, 500+ controllers
- Shufersal, 300 branches Central control and energy system
Years are shown where they can be published. Every project in detail.
Two letters apart
In IT, confidentiality comes first and a server can be patched tonight. In OT, availability and safety come first, a controller may run for twenty years, and a reboot can stop a plant. Every design I make starts from that difference.
Information technology: confidentiality first.
Operational technology: availability first.
Teaching the people who guard the grid
I wrote the Critical Infrastructure Protection course over a year and a half and sold it to governments. Singapore's Ministry of Home Affairs runs the three-week version. In Japan, a two-week version trained the officers who then trained 84 cyber police from every prefecture.
Each student spends the labs attacking a real controller and then defending it. The certificates on the wall in Japan belong to the officers who went on to teach the course themselves.
The course and syllabus
Two products I built, one patent
GRAPHENE is a passive, agentless intrusion-detection sensor for SCADA networks. It sits on every VLAN, learns what normal looks like, and alerts on a port scan, a firmware change, an unknown device or a denial of service, without ever touching the process.
SPARTA, patent US 11,621,972 B2, lives on the HMI server itself. It combines intrusion prevention and detection with AI to confirm that every command came from a human operator and not from malware, with nothing new installed on the control network.
Products and patents
In printand on stage
| Year | Title | Publication | Kind |
|---|---|---|---|
| 2024 | A breakthrough in protecting critical infrastructureA trial of the Aurelius AI system, which caught anomalies in industrial commands and protocols that traditional systems missed. | TheMarker, Cyber magazine | Feature |
| 2023 | AI as a cyber shield for critical infrastructureUsing AI to detect threats, malicious traffic and malware in control systems. | TheMarker, Cyber magazine | Op-ed by Ilan Shaya |
| 2022 | How control-system companies became high-tech companiesOn the digital transformation of control companies, hiring technical staff and the need for cyber defense. | TheMarker, Cyber supplement | Interview |
| Cyber magazine 2022A special issue on cyber defense, control systems and critical infrastructure. | Haaretz | Magazine | |
| 2021 | A breach in the Tax Authority computersA flaw that exposed the records of hundreds of thousands of taxpayers. | Ynet | News |
| Cyber experts: we broke into most Israeli universitiesICS Security researchers found serious flaws in 17 of 20 academic institutions: exposed data, editable exams and grades, access to passwords. | Ynet | News | |
| Hackers are targeting control systems; Ashdod Port is getting readyAshdod Port chose SPARTA to protect its control system; how it detects and blocks attacks from inside the HMI servers. | TheMarker, Cyber magazine | Feature | |
| 2020 | The 10 commandments of cybersecurityTen practical principles for protecting SCADA networks and industrial assets, based on a talk by Ilan Shaya. | Automation World | Article |
| 10 commandments of protecting your network and assetsThe defense challenges of control systems, steps for plant owners and integrators, and a look at SPARTA. | Inductive Automation, ICC 2020 | Conference talk | |
| Protecting your control system from cyber attacksOT network risks, common paths of intrusion, prevention, and SPARTA. | Inductive Automation | Podcast | |
| 2018 | Cyber defense for substations in GhanaGRAPHENE deployed in nine substations to monitor the control networks, detect intrusions and analyse industrial protocols. | Israel Defense | Feature |
| 2015 | Guest of honour | GovWare, Singapore | Conference |
Questions clients ask
Do you design control systems, or only secure them?
Both, and that is the point. I have designed control systems for twenty years and defended them since 2013, so the security design fits the process instead of fighting it. Many clients hire me for one and keep me for the other.
Can you work on classified or defense sites?
Yes. I have designed control and communications systems for Israel’s Ministry of Defense, IDF bases and the defense industry. Details of that work are discussed in person, within the limits of classification.
Will you sell us your own products?
Only if they are the right answer. SPARTA and GRAPHENE are mine and I will say so when they fit; the design itself is written so that any qualified vendor can bid on it.
Which standards do you work to?
NIST SP 800-82, NERC CIP and ISA/IEC 62443 (formerly ISA99), and in pharma ISA-88 with FDA and GAMP requirements. Each recommendation in a report points to the clause it satisfies.
Do you work outside Israel?
Yes. Projects and courses have taken me to Singapore, Japan, Turkey and Ghana, and I work in English. Remote work covers the reading and the writing; site visits are part of every assessment.
What does a first conversation cost?
Nothing. A first call takes about half an hour, and by the end of it you will know whether I am the right person and what a sensible first scope would be.
- mail@ilanshaya.com
- Phone and WhatsApp
- +972 54 777 7772
- linkedin.com/in/ilanshaya