Philip Sobol - Senior Security Consultant for Corporate Risk Solutions

About Us

Philip S. Sobol

CISSP, CISA, C|EH, CSSA, IAM, CNA, Has Successfully Completed the Fundamentals of Auditing for NERC Compliance Training Course
Senior Security Consultant

Professional Experience

Phil Sobol joined Corporate Risk Solutions in March 2002 as a Senior Security Consultant specializing in cyber security, penetration testing and technology-based computer forensics investigations. Mr. Sobol is also a recognized expert in critical infrastructure security in the area of NERC CIP Compliance.

Mr. Sobol’s responsibilities include: NERC CIP Compliance; Security Risk Assessments and Analysis; Development of Security Risk Mitigation Strategies; Development and Implementation of Cyber Security Standards; Penetration Testing and Assessments; Computer Forensic Investigations; Cyber Security Governance Programs; Sarbanes-Oxley IT Security Compliance; Computer and Security Systems Audits; Technical Business Continuity Planning; Corporate Information Security Programs; Security Awareness Training Programs; IT Systems Risk Assessments and Policy and Practices Research and Development.

Credentials

29 years of experience in providing NERC CIP compliance, cyber security, penetration testing and technology-based computer forensics investigations for designated U.S. Critical Infrastructures including electric utilities, gas utilities and telecommunications
Has completed NERC CIP consulting projects for numerous electric utilities
Has completed numerous Cyber Security Vulnerability Assessments and Penetration Testing for various electric utilities and organizations
Serves as an Independent Consultant on NERC CIP Spot Audits for various Regional Entities
Has completed numerous NERC CIP-002 reviews on behalf of a Regional Entity
Participates as a Technical Cyber Expert for a Regional Organization’s Critical Infrastructure Protection Working Group
Serves as a Member of the ES-ISAC Process Working Group
Drafting Team Member for the NERC CIP 002-1 Thru CIP-009-1 Standards
Drafting Team Member for the NERC Violations Risk Factors
Drafting Team Member for the NERC UA-1200 Standards
Drafting Team Member of the ES-ISAC Working Group

Certifications / Education / Training

Has Successfully Completed the Fundamentals of Auditing for NERC Compliance Training Course
Certified Information Systems Security Professional (CISSP)
Certified Information Systems Auditor (CISA)
Certified SCADA Security Architect (CSSA)
Certified Ethical Hacker (C|EH)
NSA Certified InfoSec Assessment Methodology (NSA-IAM) Professional
Certified Novell Administrator (CNA)
Certified ProWatch Security System Programmer & Administrator
Certified Lenel Security Systems Programmer & Administrator
Has Attended Various NERC Cyber Security Standards Workshops
Has Attended Various Regional Entity NERC CIP Standards Workshops
On-Going Participation in the current NERC CIP Standards Revisions Team
On-Going Participation in several NERC Security Guidelines Drafting Teams, such as Physical Security, Risk Analysis, and ES-ISAC Reporting
Trained in Project Management, AutoCAD and Computer Forensics

Professional Associations

Information Systems Security Association (ISSA)
International Information Security Certification Consortium (ISC2)
Information Systems Audit and Control Association (ISACA)
FBI InfraGard program
High Tech Crimes Investigation Association of Kansas City (HTCIA)
Kansas Critical Infrastructure Protection Working Group

Selected Speaking Engagements

Critical Aspects of Cyber Security (Midwest Council Security Forum, Kansas City, Missouri, 2008)
NERC CIP Compliance (FERC and NERC Compliance Forum, Atlanta, Georgia, 2009)
Information Protection Management (Southwest Power Pool NERC CIP “How-To” Workshop, 2009)
Auditor’s Perspective on NERC CIP Compliance (RMEL, 2010)

“I found CRSI’s intimate knowledge of the electric industry, thorough understanding of the NERC CIP requirements, and professional cyber security expertise to be invaluable in performing an annual cyber vulnerability assessment that resulted in a set of deliverables directly addressing the associated CIP requirements.”

Larry Craddock
Senior Network Security Coordinator
Western Farmers Electric Cooperative

“Both Philip Sobol and Susan Tibbs were excellent in the role and expertise and it showed very well to both the SMEs and the management team. They both provided the full audit experience as well as insights on how to ensure the layer of compliance was thick enough to be above reproach. They also provided great coaching and had the necessary experience to back up what they taught. (On-Site NERC CIP Audit and SME Testimony Training Program)

Electric Utility Within NPCC Region
Company Name Undisclosed Due to Confidentiality Restrictions

“CRSI performed an onsite gap analysis of PPL’s CIP compliance program in advance of the required compliance date of 12/31/09. Consultants Mike Tibbs and Phil Sobol provided outstanding consulting service in a highly professional manner. They worked extremely well with the various PPL Subject Matter Experts and Counsel staff, patiently answering many questions and educating the staff on various CIP issues. Their knowledge and understanding of the CIP standards and related industry implementation issues enabled them to guide PPL in improving our CIP implementation strategies and our evidence of compliance to the many CIP requirements.

CRSI provided a detailed report of the gap analysis, providing PPL the opportunity to review the draft report and provide comments, prior to finalizing the report. CRSI also separately provided written responses to numerous written observations documented by Counsel and internal auditing during the course of the gap analysis. This was an unexpected benefit and was very helpful in addressing these internal comments. PPL is highly satisfied with the results of this CIP gap analysis and with the conduct and professionalism of the CRSI staff.”

Robert Hoopes
Senior Director of FERC / NERC Compliance
PPL Corporation