SAN FRANCISCO — Employees are the weakest link when securing industrial control systems that run power plants, municipal water supplies, electric grids and other pieces of critical infrastructure, a professional hacker said at the RSA conference here Friday (Feb. 28). Andrew Whitaker, director of the Cyber Attack Penetration Division at the Reston, Va.-based Knowledge Consulting Group, is paid by companies to penetration test or pen test their own systems — to try to break into corporate computers, just as a malicious attacker would. The objective is simple — to gain access, Whitaker told the audience of information-technology professionals.