Graham Nasby - short biography

Graham Nasby, P.Eng, FS.Eng, PMP, CAP, CISSP, CISM, GICSP is an industry-recognized leader in the OT (operational technology), SCADA and industrial automation sectors for his efforts in cyber security best practices, standards development, alarm management, and operational efficiency. Through his work with the ISA, CSA, ANSI and IEC, he has co-authored international standards on systems design, cyber security, industrial automation, alarm management, and HMI systems. Graham has multi-industry experience, ranging from technical to project/program management, in the rail transport, logistics, pharmaceutical, water/wastewater, nanotechnology, and process industries. His background includes operations, capital projects, construction, program development, and developing long term technology roadmaps. As a technical and thought leader, Graham is a frequent author of industry articles and invited speaker at industry events. Graham currently holds the position of Senior Manager of OT Security Architecture for CN, one of the largest Class 1 railroad and logistics companies in North America. Since 2017, Graham also teaches a night course in engineering law and ethics at McMaster University's Faculty of Engineering. Graham and his wife live in Guelph, Ontario, Canada.

Graham Nasby - chatty biography

I grew up in a medium-sized Canadian city called Guelph. Located near the Canada's famous Great Lakes in the province of Ontario, it meant a childhood that was full of outdoor activities and trips. Summers were spent at the family cottage on a small lake near Lake Nipissing and at a boys' camp in Georgian Bay called Camp Hurontario. As a family, when I was older, we cruised the islands of Georgian Bay on well-worn 31-foot sailboat that was the source of many adventures and stories. It was during these summers that I learned about swimming, canoeing, back country camping, and most importantly, sailing. Childhood sailing experiences included everything from small dinghies to full-sized keel boats that you can sleep on. Though I have to admit I'm not the greatest sailor, I still sail to this day.

After many years of working out of town, I am now very fortunate to be able to both live and work in my hometown. The year 2010 was a year of change for me. It meant switching jobs to find something a little closer to home and taking the leap into home ownership. Since then, I've been a proud owner a 1870s red brick Victorian-era house in downtown Guelph. The work to fix up the place and breathe some life into its many gardens is a seemingly never-ending process. Who knew that home ownership would be so much work!

Over the years I've worked in various jobs. When I was a teenager, I ran a small business installing electrical systems in boats. Then I was off to university, where I worked in their IT department for 8 years while doing a part-time engineering degree. That is when I was not helping people renovate houses or creating websites for additional spending money.

In 2004 with my engineering degree in hand, I somehow graduated into a terrible job market. While we used to have recruiters regularly come to campus when I started my degree, few companies were hiring in the mid 2000's. So instead, I started a small software development company and did programming for hire: websites, databases, php/python, C/C++, microcontrollers, etc. It paid the bills.

After about a year - and after talking to a lot of people - I landed a job at a structural engineering firm (RWDI) where I learned how to do wind loading calculations for buildings. My programming skills came in handy, as part of my job was the automate a lot of the calculations using very large datasets. I spent about a year at RWDI before getting head-hunted, because I knew a (relatively obscure) controls systems programming language from a course I had taken. My next job was a control systems specialist at a firm that designed high vacuum, evaporative coating machines, ion-beam mills, and space simulation chambers. I got to play 'mad scientist' with them for about year, until there was slow-down in the high-vacuum-industry (yes, that is a term).

I then picked up some spot work in various industries. One of these was designing SCADA (supervisory control and data acquisition) systems for the ready-mix concrete industry. Interesting stuff, but it was not steady work, so I needed to find something a little more permanent.

During the time I had started doing some volunteering with the Ontario Society of Professional Engineers. While at an OSPE event, I met a fellow who owned a pharmaceutical engineering firm, who invited me to come work with him for a few years. I spent 3 years in the pharma industry doing process control design, project management and facilities design - it was an interesting job, but there was a lot of paperwork.

In 2010, I made the jump over the municipal water sector. I spent the next five years working for a consulting engineering firm where I did System Integration, PLC/HMI programming, Instrumentation/Control Design, Electrical Design, Project Management, Contract Admin, and various other technical roles. I also got to a bit of business development, which was a fun challenge.

After about five years, I felt it was time to go work for a city where I could shape the long-term development of a waterworks rather than jumping from project to project. So, in the fall of 2015, I joined the City of Guelph as the Water SCADA & Security Specialist in their Water Services Division.

While at the City of Guelph, I looked after automatic control systems that keep the city's waterworks operating. This included the long-term planning of upgrades, supervising improvement work, developing system standards, supervising the SCADA team, and ensuring the operations team had access to the tools they needed to do their jobs efficiently/effectively. I also got to work closely with the capital projects team, to help them coordinate all the SCADA aspects of numerous facility upgrade projects. It was a fun job.

I ended up spending 7 years with the city from 2015 to 2022. During my time there I was able to document the existing system, develop a technology roadmap, create a 25-year capital renewal/investment plan for the SCADA system, and then put the renewal plan in motion. It also got to try out some new IIoT technology (we built a datalogging system out of raspberry PI microcontroller, MQTT, Node Red, Cassandra, and Unbuntu Linux VMs), use some interesting protocols like DNP3, WITS and JSON/XML, and try out some new ways of doing data analytics.

With the city's conventional SCADA hardware, I also had a chance to develop a new set of programming templates and tools for our PLC hardware and HMI software platforms to effect 75% labour savings for programming work. And then was able to replicate the same savings with standardized PLC Panel designs, motor starter designs and instrument wiring/installation standards. It was an fun challenge of how to work to reduce the amount of (expensive) custom design/programming work as much as possible.

My time at the city also give me a chance to give something back to the profession by running at college/university co-op student program, publishing papers, and frequently speaking at conferences. I also got a chance to build the business case for investment in SCADA system, grew the utility's annual SCADA Budget from $20K/year to $1.5 million/year, grew the team from 1 person to 5, and put in place workflows to support two $30million/year large capital programs in the water and wastewater divisions. It was busy time but a lot of fun.

In early 2022, I had the good fortune to be head-hunted by CN Rail to take on the role of senior manager of OT security architecture as part of their cybersecurity team. It's a 100% remote (home office) job, so means I get try something new without having to commute. I also get the benefit of joining a well-established team that has both a challenging and forward-looking mandate from CN's CISO (chief information security officer) and board. I'm very much looking forward to my new role at CN Rail.

In addition to my day job, I'm quite active with the International Society of Automation (www.isa.org), of which I have been a member since 2004 and active as a volunteer since 2010. They are a volunteer organization comprised some 36,000 technicians, engineers and facility owners who have common interest in industrial automation. During the past 15 years or so, I've been involved with the local section, technical divisions, standards committees, and in various volunteer leader roles at the international level. It's a great organization.

The year 2011 was exciting time for me professional. In 2011, I gave my first talk at an international conference, and also appeared in print for the first time. The May/June 2011 issue of ISA InTech magazine included article on SCADA Standardization that I co-wrote with a friend of mine from the City of Guelph's Water Services department. We also presented a talk on the same project at that year's 2011 ISA water/wastewater and automatic controls symposium in St. Louis, Missouri, USA. In a way it was foreshadowing, as I would later become the volunteer general chair of that symposium in 2012 and 2013. Since then, I have been fortunate to have the opportunity to be involved several other conferences and publish a number of technical papers.

Though I finished my engineering degree a long time ago, I do have to admit I still like studying. At present I am slowly working towards a B.A. in history, one course at a time. As a part-time student at the University of Guelph, I try to take one night course year. I think of it as having a weekly documentary where I can ask questions. Working on the arts courses is also a nice break from the engineering work I do during the day. Long term education goals? I'm not sure, but I'm not going to rule out doing a part-time MBA or MSc at some point.

Recently, I have been doing some teaching at both the college and university level. In 2017-2018, I was fortunate to be a guest instructor at Fleming College's municipal water operator program (aptly titled: AWSOM - Advanced Water Systems Operations & Management). Since then, I've taught hands-on evening classes at Mohawk College and Conestoga College. At the University level, I also now teach an evening course on engineering law and ethics at McMaster University. As 2024, I will have taught my McMaster law/ethics course about a dozen times - I'm not sure why, but I still get nervous before the first class of each semester.

I have been playing musical instruments since I was about five years old. My first instrument was recorder, which I played quite seriously up until I was in high school. Not familiar with recorder music from the Baroque Period (1600-1750)? The repertoire is actually quite extensive with many notable composers such as Bach, Handel, Cornelli, Telemann and Vivaldi. Two of my favourites are Cornelli's Concerto in C, and Telemann's Suite in A-minor. At fifteen I made the decision that I did not want to study Baroque/Early Music in university, so I stopped what had been my regime of practicing two hours a day. I don't play much recorder anymore, mostly because I can't seem to find the time.

When I was twelve, I picked up the clarinet and have been playing ever since. I am pretty much self-taught -- back in Grade 7, I asked school music teacher for a fingering chart and never looked back. While I was in high-school I played in the senior band, a jazz band that I directed, and a number of other ensembles. Ever since high school, I have been quite active on the community music scene and have played with various different community bands and orchestras over the years. How much I play depends on how busy work gets, but I usually try to play with at least one group. In addition to playing the usual Bb/A clarinets, I also play several "harmony" clarinets including: Eb clarinet, bass clarinet and contrabass clarinet. I also occasionally noodle around on saxophone, trumpet and bassoon. Though I must admit, I'm pretty lousy at playing the trumpet.

When I turned 40, my wife decided it was time that I became a "Real Engineer" and arranged for me be "Engineer for the Day" on a steam railway. Fortunately, there was one such steam locomotive on a small heritage narrow-gauge railway at the Muskoka Heritage Park (Huntsville, Ontario, Canada). So, at 40 years old, I finally learned how to drive a steam locomotive. Hence the photo on the right side of this page. Driving a train is (actually) a lot harder than it looks.

While on the subject of trains: As part of my duties at CN Rail, I have gotten the opportunity to be trained as a backup "freight train conductor". (In the winter-time, freight trains often get delayed due to weather. CN has a program where a small group of managers get qualified as backup conductors, and then sign-up for 1-2 weeks to be on-call each winter for "service protection" to help-out when needed. It's a volunteer program for me, and I enjoy it since it gets me out in the field 2-3 weeks a year. It also reminds you of the dedication of folks that do this every day as part of their job.)

For those who are not aware, most freight trains are staffed by 2 crewmembers: the engineer and the conductor. The engineer drives the train. However, it's the conductor who keeps track of the cars, paperwork, where they are going, train traffic signals, and coordinating everything with rail traffic control over the radio. It's also the conductor who has to get out of the cab to set switches, check cars, and "protect the point" of the train when reversing. Protecting the point can consist of: standing on the ground (so you can watch the back end of a train), coordinating with a yard master to watch the train with a camera, or actually riding the last car using it's ladder/platform. There are a number of other duties for a freight train conductor, but let's just say they keep you pretty busy. Actually, both roles, engineer and conductor, will keep you very busy. The two work together as a team. I personally think the conductor job is a bit more fun, but my engineer colleagues do keep reminding me that the locomotive cab is pretty comfortable when it's pouring rain outside. The engineers are the ones who get the blow the horn as well.

So, what does it take to get a freight train conductor qualification? Short answer, it's pretty involved process that usually takes at least 6 months, and upwards of 2 years. To start my training, in the summer of 2022 I had to go to Winnipeg for 5 weeks of "train school" to learn the railway operating rules and take several qualification exams. Then it was around 60 hours of web training/exams, followed by another 150 safety bulletin reviews/quizes. Then the next step was to complete about twenty 12-hour training shifts with actual train crews, followed by a 6 hour hands-on practical exam. This is what I had to do as a "backup conductor" - the folks work as freight train conductors on a full-time basis do more training than this.

I completed my freight train conductor training in February 2023. Not wanting to miss a beat, I was then assigned 8-days of backup service protection duty the following month. This included being called out to work outside during a freak March snowstorm with -35 DegC temperatures and blowing ice - it was special. Fortunately, my next deployment, which was in November 2023 was much nicer: I spent 8 days running freight trains up/down the mountains between Vancouver and Kamloops, BC. The scenery was amazing. I liked it so much, I went back out for a second helping in Dec 2023. As a backup conductor of last resort (only used if the regular crews were not available, or had hit the legal maximum work hours), I spent 8 days helping run trains up/down the mountains and in the port area. I look forward to getting a chance to help out again next winter.

Do I still like trains? Very much so. But it's also a profession I now have a newfound respect for. Railroading is a serious business which requires a significant investment in training and safety procedures. My hat goes off the train crews who do this every day. It also serves as a reminder why my day of of protecting these folks from cyber threats is so important.

I enjoy getting out of the city whenever possible. I still get up to the family cottage and try to travel whenever I can. On the water I still sail dinghies, and next summer I am considering joining a community sailing club that is nearby. Other hobbies include European history, English/French literature, canoeing, sailing, mountain biking, going to the opera, and chasing a little white ball (golf).

Photos: headshot - larger | headshot2 - larger | engineering - larger | process plant - larger | process plant2 - larger | speaking - larger | steam locomotive - larger | diesel locomotive - larger | informal overalls - larger | teaching - larger | formal headshot - larger | UofG mid-career award - larger |