Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Joel Langill On His New OT Security Training Class And More
Pub date: 2024-11-13

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Dale Peterson speaks with Joel Langill, the SCADAHacker, about his new training course entitled Conducting Threat, Vulnerability, and Risk Assessments For ICS. A two day version of this course will be offered prior to S4x25.

Of course Dale and Joel jump around a bit on training, the workforce and other items. Take a listen.

The podcast and artwork embedded on this page are from Dale Peterson: ICS Security Catalyst and S4 Conference Chair, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Hackers and the Holidays: Strengthening Industrial Cybersecurity
Pub date: 2024-11-12

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

As the holidays approach, manufacturing and critical infrastructure organizations face unique cybersecurity challenges due to reduced staffing and associated increased vulnerabilities.

This episode delves into practical strategies for senior leaders and plant managers to secure their operational technology (OT) environments without disrupting production.

By adopting continuous monitoring, fostering cross-functional IT-OT collaboration, and engaging OT-specific vendors, organizations can reinforce their cyber resilience.

Through real-life scenarios, the hosts discuss how proactive planning and structured security practices are vital to maintaining operational continuity and mitigating risks in complex industrial settings.

Chapters:

00:00:00 - Introduction to Cybersecurity Challenges During the Holiday Season
00:00:52 - Cybersecurity Missteps Putting the C-Suite at Risk
00:14:06 - Holidays & Hackers: Keeping Industrial Control Systems Safe

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: Hack the Capital 7.0: Building Cybersecurity Connections with Bryson Bort & Tom Van Norman
Pub date: 2024-11-12

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode, host Derek Harp sits down with Bryson Bort and Tom Van Norman, co-founders of ICS Village and creators of Hack the Capital. They discuss the origins and evolution of Hack the Capital, now in its seventh year, and the conference’s unique focus on bridging cybersecurity professionals with policy makers and industry leaders. They dive into the value of hands-on learning, the launch of Workforce Development Day, and the ongoing need for practical cybersecurity education and career opportunities for all. Bryson and Tom also highlight the significance of candor in the field and what attendees can look forward to at future conferences. Tune in for insights into the world of OT and ICS cybersecurity, hands-on training, and the importance of building community partnerships.

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Food Industry Challenges: A Legal Perspective with Mike Delaney
Pub date: 2024-11-11

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode of the Bites and Bytes Podcast, host Kristin Demoranville welcomes her good friend and former colleague, Mike Delaney, a seasoned corporate lawyer and partner with expertise in complex legal matters across industries. With over two decades of experience, Mike has held leadership roles at multinational corporations, where he managed global compliance, risk, and corporate governance.

Kristin and Mike explore the real-world challenges in food cybersecurity, sharing stories from their work together and discussing how industries like food manufacturing and supply chains adapt to meet today’s cybersecurity threats. From legal and compliance perspectives to human and technological considerations, this episode contains practical insights and firsthand experiences.

_______________________________________________

Show Notes:

DISARM Framework:

https://www.disarm.foundation/framework

Beekeeper movie:

https://www.imdb.com/title/tt15314262/

SEC Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies:

https://www.sec.gov/newsroom/press-releases/2023-139

Form 8-K:

https://www.sec.gov/files/form8-k.pdf

_______________________________________________

Episode Key Highlights:

(0:00:00) - Food Memories and Personal Connections

(0:06:50) - Industry’s Push for Modernization in Cybersecurity

(0:21:00) - Key Supply Chain Vulnerabilities in Food

(0:31:28) - SEC’s New Cybersecurity Reporting Rules

(0:43:00) - Rising Cyber Threats Targeting Food Sector

_______________________________________________

Bites and Bytes Podcast Info:

TikTok

Website: Explore all our episodes, articles, and more on our official website. Visit Now

Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now

Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog

Audience Survey: We value your feedback! Help us make the podcast even better. Take the Survey

Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All (LS 24 · TOP 10% what is this?)
Episode: Essential Cybersecurity Strategies for Small and Medium-Sized Enterprises
Pub date: 2024-11-11

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode, host Aaron Crow addresses the pressing issue of cybersecurity for small and medium-sized businesses. With their limited budgets and resources, these enterprises are often prime cyberattack targets.

Aaron explains why these businesses are particularly vulnerable, the potentially devastating impacts of a cyber incident, and practical measures they can adopt to strengthen their cybersecurity without incurring significant costs.

Listeners will uncover insights on establishing basic cybersecurity policies, the critical importance of monitoring, and strategies for preparing for potential breaches.

This episode is filled with valuable tips that could ensure the survival and success of your business amid today's escalating cyber threats.

Key Moments;

00:00 Cybersecurity challenges and solutions for small businesses.

03:24 Startups are vulnerable due to inadequate cybersecurity measures.

06:30 Use secure passwords, educate employees, and use tools.

11:26 Segregate networks to protect sensitive data.

14:46 Effective monitoring requires time, effort, and setup.

16:10 DNS filtering blocks malicious sites, prevents attacks.

20:29 Plan proactively to manage events before crises.

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 416 - OT ISAC - Singapore Operational Technology Information Sharing and Analysis Summit 2024
Pub date: 2024-11-08

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

We had the privilege of speaking with Steven Sim, Chair of the OT-ISAC Executive Committee, during the recent summit in Singapore. As a seasoned expert in operational technology (OT) cybersecurity, Sim shared valuable insights into the importance of information sharing, the growing threat of ransomware, and the transformative role of AI in cybersecurity.

Kicking off the podcast, Steven introduced the Executive Committee and its pivotal role in driving OT-ISAC’s mission to foster a collaborative community and promote best practices. By providing advisory support and strategic guidance, the committee ensures OT-ISAC stays at the forefront of cybersecurity initiatives.

Balancing Information Sharing and Confidentiality

One of the most pressing challenges in OT cybersecurity is striking the right balance between information sharing and safeguarding sensitive data. He explained that OT-ISAC has implemented robust measures, such as the Traffic Light Protocol and data anonymization techniques, to protect confidentiality while promoting collaboration. The platform also employs protocols like STIX and TAXII to automate the exchange of cyber threat intelligence, enabling members to quickly share and respond to emerging threats.

Cross-Jurisdictional Collaboration

With cyber threats spanning borders, cross-jurisdictional collaboration is essential. Sim highlighted that OT-ISAC allows members to share threat intelligence across different regions without breaching data sovereignty regulations by anonymizing the information sources. This approach strengthens global defenses against transnational cyberattacks.

The Growing Threat of Ransomware

Ransomware remains a significant risk to OT environments. Steven urged organizations to avoid paying ransoms, citing the risks and long-term consequences. Instead, he emphasized the importance of investing in strong business continuity and incident response plans. By focusing on resilience and preparedness, organizations can minimize their exposure to future attacks.

AI’s Role in OT Cybersecurity

He also discussed the potential of AI in OT cybersecurity, noting its ability to streamline incident response and improve threat detection. However, he cautioned that while AI offers powerful advantages, it must be implemented with human oversight to manage the risks associated with automated systems.

Steven Sim has worked for more than 25 years in the cybersecurity field with large end-user enterprises and critical infrastructures, undertaken global CISO role, driven award-winning CSO50 security governance and management initiatives and headed incident response, security architecture, technology, awareness and operations at local, regional and global levels. He leads cybersecurity across large MNC, heading 8 direct reports at Group Cybersecurity Department as well as indirect reports across regional offices and local business units in 42 countries.

He oversees both IT and OT Security Governance, Global Cybersecurity Technology Management and Incident Response as well as Cyber Security Masterplan Office.

Always keen to give back to the community, he also volunteers at the ISACA Singapore Chapter (which won ISACA Global Outstanding Chapter Achievement in 2022) as the President (from 2021 to 2022) and OT-ISAC (since 2021), the second key thrust of the SG's OT Cybersecurity Masterplan 2019, as Chair Executive Committee, as well as member of Geneva Dialogue Technical Community, and holds Masters in Computing, CCISO, CGEIT, CRISC, CISM, CISA, CDPSE, CISSP as well as technical certifications GICSP, GREM, GCIH and GPPA.

Recorded 5th Sept 2.30pm. Singapore Operational Technology Information Sharing and Analysis Summit 2024

otcybersecurity #mysecuritytv #cybersecurity #singaporecybersecurity

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 3/4 Acciones desplegando el acceso remoto en un entorno OT
Pub date: 2024-11-11

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se presenta como diseñar y desplegar de forma efectividad el acceso remoto en entornos OT. Herramientas y plataformas para gestionar el acceso remoto y configuraciones seguras.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 26 · TOP 10% what is this?)
Episode: EP 49: Hacking Android-Based ICS Devices
Pub date: 2024-11-05

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Cybercriminal tactics against ICS include direct threats against individuals for MFA credentials, sometimes escalating to physical violence if they won’t share. Jim Coyle, US Public Sector CTO for Lookout, warns about the increasing use of Android in critical Industrial Control Systems (ICS), such as HVAC systems, and how stealing MFA tokens from mobile devices could affect critical services like healthcare, finance, and water supply, depending on the goals of the attackers.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: IoT Security Podcast
Episode: Guarding the Gateways: Tackling IoT Vulnerabilities in Critical Systems with Joel Goins
Pub date: 2024-11-05

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Businesses and government organizations have seen threats to critical US infrastructure on the rise in recent years, particularly within IoT and OT systems, posed by cyberattacks, notably from state actors like Iran. With that context, Joel Goins, a veteran of manufacturing, oil and gas, and OT security at large, talks with John Vecchi about the critical need for enhanced security measures for data centers and other vital components, the vulnerabilities present in IoT devices, and the essential steps companies must take to safeguard against both traditional and emerging cyber threats.

Let’s connect about IoT Security!

Follow John Vecchi at https://www.linkedin.com/in/johnvecchi

The IoT Security Podcast is powered by Phosphorus Cybersecurity. Join the conversation for the IoT Security Podcast — where xIoT meets Security. Learn more at https://phosphorus.io/podcast

The podcast and artwork embedded on this page are from Phosphorus Cybersecurity, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: Shaping the Future of OT Security with Dale Peterson
Pub date: 2024-11-06

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode, the conversation centers on the critical role of operational technology (OT) security and the unique contributions of the S4 Conference. Dale Peterson shares his journey and insights into the challenges of underrepresentation in cybersecurity, especially for women and other groups, and highlights innovative scholarship initiatives aimed at bridging this gap. The discussion also delves into the evolving landscape of AI in cybersecurity, addressing both its potential and the complexities it brings. Listeners will gain valuable perspectives on managing cybersecurity risks, prioritizing investments, and developing effective recovery strategies in OT environments. As we look forward to S4 2025 in Tampa, Florida, this episode offers a glimpse into the future of cybersecurity and the importance of resilience in our systems

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Joe Saunders on Advanced Cyberattacks Against Critical Infrastructure
Pub date: 2024-11-07

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Runsafe Security CEO and Cofounder Joe Saunders joins the Nexus Podcast to discuss the strategic shift from certain APTs toward destructive cyberattacks targeting U.S. critical infrastructure. Groups such as Volt Typhoon and Sandworm have aggressively focused their efforts on hacking OT, IoT, and healthcare organizations, opening new fronts that asset owners and operators, as well as manufacturers of embedded systems must now contend with.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: The Future Looks Bright : Insights & Advice for Next Gen Cybersecurity Leaders
Pub date: 2024-11-05

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

OT Cybersecurity Engineer, Noah Duckworth, joins Dino Busalachi for this episode. They discuss the challenges and nuances of industrial cybersecurity, as he shares insights from his experience working in the OT (Operational Technology) cybersecurity space.

Noah talks about the complexities of integrating traditional IT cybersecurity measures within industrial networks, the specific tools and practices used, and the importance of safe, industry-specific approaches to vulnerability management.

He also provides a perspective on various industrial sectors, such as food and beverage and transportation, and how cybersecurity requirements vary across different verticals and environments.

This episode offers valuable insights into the evolving field of OT cybersecurity and practical advice for professionals interested in protecting critical infrastructure as well as entering the field of industrial cybersecurity.

Chapters:

00:00:00 - Introduction to Engineering Problem-Solving in Cybersecurity
00:00:46 - Guest Introduction: Meet OT Cybersecurity Engineer & Expert Noah Duckworth
00:00:58 - Noah’s Path into OT Cybersecurity and His Industry Experience
00:02:13 - Key Differences Between OT and IT Cybersecurity
00:03:01 - Addressing Common OT Cybersecurity Challenges and Tools
00:06:22 - Navigating Cybersecurity Across Industrial Sectors
00:08:06 - Insights for New Professionals in Industrial Cybersecurity
00:10:13 - The Evolving Landscape of OT Cybersecurity
00:15:22 - Inspiring the Next Generation of Cybersecurity Leaders
00:16:35 - Closing Thoughts: Practical Advice for Early-Career Professionals

Links And Resources:

Velta Technology
Noah Duckworth on LinkedIn
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All (LS 24 · TOP 10% what is this?)
Episode: Navigating Cybersecurity Challenges: AI, Tabletop Exercises, and Operational Technology
Pub date: 2024-11-04

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode, host Aaron Crow is joined by Clint Bodungen, Director of Cybersecurity Innovation at Morgan Franklin Cyber and founder of Threatgen, alongside Michael Welch, Managing Director at Morgan Franklin Cyber. Together, they delve into the ever-evolving world of cybersecurity in honor of Cybersecurity Awareness Month.

Aaron kicks things off by discussing the importance of iterative processes and tabletop exercises in enhancing decision-making and preparedness. The conversation then shifts to the exciting yet complex role of AI in cybersecurity, particularly in operational technology (OT) and critical infrastructure. The experts emphasize the potential of generative AI for data analysis while underscoring the need for human oversight to avoid biases and misinformation.

Clint introduces an “engineering informed cyber” approach to better integrate OT and IT in managing cybersecurity risks, while Aaron stresses the importance of collaboration between cybersecurity professionals and engineers. The episode also tackles balancing convenience and security, the intricacies of password management, and the critical role of communication and trust.

Listeners will gain valuable insights into AI’s role in enhancing security operations, the consequences of system failures, and the debate between compliance and true security. This episode offers expert opinions, real-world examples, and practical advice for navigating today’s cybersecurity challenges. Join us for a comprehensive discussion on protecting our digital world.

Key Moments:

04:20 Generative AI aids efficient GRC and cybersecurity management.

08:40 AI lacks context for verifying asset information.

11:38 Generative AI creating and automating malware tools.

15:58 Building data centers using decommissioned power plants.

17:14 Regulation growing in infrastructure for compliance security.

22:09 Compliance is binary; partial compliance isn't sufficient.

24:33 Prioritize "engineering informed cyber" for OT resilience.

28:14 Collaboration between IT and OT is essential.

33:54 Frustration with excessive video game security measures.

34:49 Cybersecurity fails due to over-engineering complexity.

40:49 Make security easy with password managers, authenticators.

42:31 AI improves tabletop exercises for comprehensive insights.

45:31 Generative AI augments human capabilities and creativity.

48:08 Automated injects streamline engagement and business continuity.

53:46 Executives misunderstand risk, leading to false security.

54:29 Strong IT security, but vulnerable weak points.

About the Guests :

Clint Bodungen:

Clint Bodungen is a globally recognized cybersecurity professional and thought leader with 30 years of experience (focusing primarily on industrial cybersecurity, red teaming, and risk assessment). He is the author of two best-selling books, "Hacking Exposed: Industrial Control Systems" and “ChatGPT for Cybersecurity Cookbook. Clint is a United States Air Force veteran and has worked for notable cybersecurity firms like Symantec, Booz Allen Hamilton, and Kaspersky Lab, and is currently the founder of ThreatGEN and Director of Cybersecurity Innovation at Morgan Franklin Consulting. Renowned for his creative approach to cybersecurity education and training, he has been at the forefront of integrating gamification and AI applications into cybersecurity training; he created ThreatGEN® Red vs. Blue, the world's first online multiplayer computer designed to teach real-world cybersecurity. His latest innovation is AutoTableTop, which uses the latest generative AI technology to automate, simplify, and revolutionize IR tabletop exercises. As AI technology continues evolving, so does his pursuit of helping revolutionize the cybersecurity industry using gamification generative AI. Connect Clint at - https://www.linkedin.com/in/clintb/

Michael Welch :

Michael Welch has over twenty-five years of expertise in Governance, Risk Management, Compliance and Cybersecurity. In his role as Sector Lead, Michael will focus on the importance of cybersecurity in Utilities and Industrial Manufacturing. Michael understands that robust cybersecurity measures are not just a regulatory requirement but are pivotal in safeguarding the resilience of organizations, safety of its people, and overall economic stability. Michael has worked for organizations such as NextEra and Duke Energy as well as engineering firm Burns & McDonnell. In addition, he was the Global CISO for the food manufacturing firm OSI Industries.Some of the certifications he has obtained through his career are Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Security Auditor (CISA), Global Industrial Cyber Security Professional (GICSP), Certified Data Privacy Solutions Engineer (CDPSE) and CMMC - Registered Practitioner Advanced (RPA). Connect Michael Welch at : https://www.linkedin.com/in/michael-welch-93375a4/

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4 Análisis desplegando Acceso Remoto en Entorno OT
Pub date: 2024-11-04

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se analizan cuáles son las principales opciones de acceso remoto, sus ventajas y desventajas. Requisitos en el acceso remoto.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: The Security Sandbox at the ICS Cybersecurity Conference
Pub date: 2024-11-01

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Hosts Vivek Ponnada and Sandeep Lota share their insights on and exploring topics such as:

✅ Emerging threats to ICS over the next 12-18 months

✅ Evolving strategies for integrating IT and OT cybersecurity

✅ The future role of AI in ICS cybersecurity

✅ Fostering collaboration between IT and OT teams

Visit Our Website

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Automation Chat (LS 26 · TOP 10% what is this?)
Episode: Tips for Complying with the NIS2 Compliance Framework
Pub date: 2024-10-29

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

** 3 Consecutive Awards for Best Podcast, 2022 - 2024 APEX Awards of Publication Excellence.

In this episode, The Journal’s Digital Editor Maggie MacHale brings the written word to life by reading the article,“Tips for Complying with the NIS2 Compliance Framework.” It’s written by Meghna Subramani, Commercial Product Manager, Network & Cybersecurity, and Andreu Cuartiella, Lifecycle Services Commercial Manager EMEA at Rockwell Automation.

You’ll learn 7 steps to help you comply with this directive for increasing cybersecurity for industrial firms, utilities and other entities across the European Union.

Resources from this episode:

Read the article online: “Tips for Complying with the NIS2 Compliance Framework.”
Data Bridge Market Research on the European market for operational technology (OT).
To subscribe to our 4 print magazines (Feb., May, July and Oct.), e-mail Anna Hicks at ahicks@endeavorbusinessmedia.com.
Subscribe to our 4 digital magazines at http://rok.auto/thejournal-subscribe.

Hit the “Share” symbol to share this episode with your colleagues who would benefit from this information. And please give us a 5-star rating and a review.

Brought to you by The Journal From Rockwell Automation and Our PartnerNetwork magazine.

The podcast and artwork embedded on this page are from The Journal From Rockwell Automation and Our PartnerNetwork, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: CISA’s Role in Supporting Asset Owners & Government Sectors with Cybersecurity
Pub date: 2024-10-29

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

This episode we dive into the critical strategies necessary for securing operational technology (OT) environments, with OT/ICS Strategy Lead at CISA, Danielle Jablanski.

Danielle explores the evolving role of CISA in assisting asset owners and government sectors, emphasizing the importance of collaboration and understanding in cybersecurity.

From building resilience against "shiny object syndrome" to prioritizing effective incident response and vendor relationships, this conversation provides valuable insights into crafting an actionable, sustainable OT security strategy.

Danielle also shares how workforce development is crucial in creating a robust cybersecurity posture and discusses CISA’s approach to integrating AI and machine learning into OT security cautiously and strategically.

Chapters:

00:00:00 - Understanding Outsourcing and Effective Incident Management in OT
00:01:21 - Welcoming Danielle Jablanski from CISA to the Show
00:01:47 - CISA’s Expanding Role in Supporting Critical Infrastructure Security
00:03:32 - Key Challenges Facing OT Cybersecurity Today
00:06:27 - Navigating the Convergence of IT and OT Security
00:11:36 - CISA’s Approach to Risk Management and Its Global Impact
00:13:40 - Overview of CISA Services and Regional Cybersecurity Initiatives
00:16:36 - Enhancing Incident Response Capacity and Cross-Agency Coordination
00:17:30 - Fusion Centers: Interagency Collaboration for Better Threat Intelligence
00:18:55 - Guiding Organizations in Reporting and Responding to Incidents
00:21:03 - Developing Effective Incident Response Playbooks for OT Environments
00:22:08 - Opportunities and Risks of AI in OT Cybersecurity
00:24:32 - Emerging Threats: Targeted Attacks on Control Systems
00:27:00 - Final Thoughts on Workforce Development and Building Cybersecurity Resilience

Links And Resources:

Danielle Jablanski on LinkedIn
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Work (LS 42 · TOP 1.5% what is this?)
Episode: How secure is your food: Cybersecurity threats and careers | Guest Jonathan Braley
Pub date: 2024-10-28

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Get your FREE 2024 Cybersecurity Salary Guide: https://www.infosecinstitute.com/form/cybersecurity-salary-guide-podcast/?utm_source=audio&utm_medium=podcast&utm_campaign=podcast

Today on Cyber Work, Jonathan Braley from the Food and Agriculture Information Sharing and Analysis Center (Food and Ag ISAC) delves into the critical security challenges in the food, farming and production sectors. Featuring insights on the evolution of cybersecurity, the role of ISACs, and real-world threats like ransomware and phishing, this episode offers a comprehensive look at how cybersecurity professionals within this industry are working to safeguard vital systems. Braley shares tips on obtaining competitive roles, the convergence of IT and OT security and the importance of continuous learning. Tune in to grasp the latest trends and get invaluable career advice to stay ahead in the ever-evolving field of cybersecurity.

View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast/?utm_source=audio&utm_medium=podcast&utm_campaign=podcast

00:00 - Introduction to cyber work and guest Jonathan Braley
00:53 - The growing cybersecurity job market
02:05 - From biology to cybersecurity
04:48 - Early career and learning at Valley Apps
09:26 - Role and responsibilities at Food and Ag ISAC
17:07 - Understanding cyber threats in food and agriculture
23:23 - The growing connectivity and vulnerabilities in agriculture
23:49 - Cybersecurity challenges for small towns and farms
25:28 - The Reality of cyberattacks on small farms
26:59 - Global implications of cybersecurity in agriculture
28:44 - Insights from a cybersecurity expert in agriculture
33:13 - Career opportunities in food and agriculture cybersecurity
37:37 - Staying informed and prepared in the cybersecurity field
40:04 - Cybersecurity career advice

About Infosec
Infosec’s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ’s security awareness training. Learn more at infosecinstitute.com.

The podcast and artwork embedded on this page are from Infosec, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Grant Geyer on the Business Impact of Disruptions from Cyberattacks
Pub date: 2024-10-28

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Claroty Chief Strategy Officer Grant Geyer joins the Nexus Podcast to discuss the results of a survey of 1,100 cybersecurity leaders and practitioners on the business impact of disruptions from cyberattacks on cyber-physical systems.

The financial losses are steep from these attacks impacting connected systems that are so central to our way of life, as are the recovery costs and operational impacts such as downtime, which is often intolerable in critical industries such as manufacturing and healthcare.

Geyer brings his unique insights to the discussions, including attackers' motivations in targeting CPS, why ransomware continues to impact healthcare delivery organizations, and the risks of unsecured third-party and supply chain connections to the enterprise.

Get the full survey results here.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4 Contexto desplegando Acceso Remoto en Entorno OT
Pub date: 2024-10-28

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se presenta el contexto del caso: datos de los entrevistados, las particularidades del acceso remoto en su entorno y las diferencias con el entorno IT.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All (LS 24 · TOP 10% what is this?)
Episode: Bridging IT and OT in Cybersecurity for Power Plants with Jori VanAntwerp
Pub date: 2024-10-28

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In Episode 29, host Aaron Crow is joined by cybersecurity expert Jori VanAntwerp to delve into Power Grid Security and Redundancy.

This episode explores the segmented design of the US power grid, addressing the challenges and necessary upgrades to mitigate cyber vulnerabilities. Jori highlights security monitoring gaps, the impact of hardware updates, and the cost implications of modernizing infrastructure. The discussion also emphasizes the importance of asset inventory and collaborative efforts between IT and OT professionals.

Real-world incidents, such as unexplained power plant reboots, illustrate the critical role of operator awareness and system maintenance. The potential of AI in cybersecurity, alongside the need for a collaborative, learning-focused approach, is also discussed.

Tune in to gain expert insights on balancing modernization, cost, and operational efficiency to ensure the stability and security of our power infrastructure. Join us for a packed episode to learn how to "Protect It All."

Key Moments:

05:30 Restoring power grids involves complex, staged processes.

11:01 Centralizing data improves efficiency, introduces vulnerabilities.

17:47 Network segmentation essential for security, mitigates risks.

26:12 Cybersecurity tools revealed crucial system issues.

32:15 Understanding systems fully prevents unintended negative impacts.

36:31 Understand OT environment before implementing IT solutions.

41:24 Equip must survive extreme heat, unlike typical data centers.

54:28 Strict access control in nuclear power plant.

57:48 Assess likely risks for protecting plant operations.

01:00:59 Rushed training weakens foundational cybersecurity skills.

About the guest :

For nearly two decades, Jori has enabled industrial and IT organizations to be successful in reducing risk, increasing compliance, and their overall security efforts. Jori has the ability to quickly evaluate situations and determine innovative solutions and possible pitfalls due to his diverse background in security, technology, partnering and client-facing experience. Approaching situations with intuitive insight and methodology, leveraging his deep understanding of business and technology, ranging from silicon to the cloud. He had the pleasure of working with such great companies as Gravwell, Dragos, CrowdStrike, FireEye, McAfee, and is now Founder and Chief Executive Officer at EmberOT, a cybersecurity startup focused on making security a reality.

How to connect Jori :

Website : https://emberot.com/

Linkedin : https://www.linkedin.com/in/jvanantwerp/

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: AI, Global Trends, and More: A Glimpse into the Future of OT Cybersecurity with Claroty
Pub date: 2024-10-22

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this week's episode, Dino Busalachi is joined by Gary Kneeland from Claroty. With over nine years of experience at Claroty, Gary discusses the evolution of OT security, the convergence of IT and OT, and the growing importance of cybersecurity in protecting critical infrastructure.

The conversation touches on how regulatory changes, ransomware threats, and AI advancements are shaping the industry.

Whether you’re dealing with outdated systems or navigating complex industrial environments, this episode provides practical insights into the challenges and opportunities ahead.

Chapters:

00:00:00 - Pandemic's Impact on Critical Infrastructure
00:01:08 - Introduction to Gary Neelan and Claroty
00:01:41 - Gary's Role in OT Cybersecurity
00:02:49 - Evolution of OT Cybersecurity: From Compliance to Strategy
00:05:23 - IT and OT Convergence: Securing Cyber-Physical Systems
00:09:46 - Addressing Complex Challenges in OT Cybersecurity
00:11:56 - OT Cybersecurity Talent Shortage and Managed Services
00:13:01 - Future of OT Cybersecurity: Adapting to New Threats
00:14:36 - Modernizing Manufacturing Systems for Enhanced Security
00:15:52 - Global Cybersecurity Trends in Critical Infrastructure
00:18:01 - Regional OT Cybersecurity Challenges and Responses
00:25:01 - The Role of AI in Defending OT Environments
00:28:19 - Final Thoughts on OT Cybersecurity's Future

Links And Resources:

Gary Kneeland on LinkedIn
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Caffeinated Risk (LS 26 · TOP 10% what is this?)
Episode: Deviance Normalization & Risk Management with Marco Ayala
Pub date: 2024-10-24

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Technological change is inevitable and often one of the aspects that attracts people toward careers in information and operational technology. Although risk management is a part of navigating advancement in any area, the fundamental flaw in any management system is our human tendencies.

This episode explores how organizations can make slow, steady migration from first principles to risky undertakings without noticing. Marco Ayala, an operational technology cybersecurity expert and current Houston InfraGard president, joins this episode to further explore the reasons behind this normalization of deviance, a concept first introduced to OT cyber specialists at S4 in 2024.

Mr. Ayala is also CCE proponent and facilitator leading to a discussion on possible options for course correction back off the normalization path. Although solutions must always be tailored to work within organizational constraints, the early contributors to catastrophic outcomes associated with the Challenger space shuttle and Boeing 737 Max warrant exploration or we will inevitably repeat.

The podcast and artwork embedded on this page are from McCreight & Leece, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Driving Change - Cloud Systems and Japanese CCE [The Industrial Security Podcast]
Pub date: 2024-10-21

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Tomomi Ayoyama translated the book Countering Cyber Sabotage - Consequence-Driven, Cyber-Informed Engineering - to Japanese. Tomomi recalls the effort of translating CCE to Japanese and looks forward to applying CCE and OT security principles to industrial cloud systems at Cognite.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All (LS 24 · TOP 10% what is this?)
Episode: Elevating Cybersecurity: Importance of Relationships, Mentorship, and Honest Feedback with Ken Foster
Pub date: 2024-10-21

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

This episode delves into the world of cybersecurity with the esteemed guest, Ken Foster. With over 30 years of experience and a career that began in the Navy, Ken has comprehensive expertise in managing firewalls and antivirus systems and addressing today’s complex cybersecurity challenges.

This episode, hosted by Aaron Crow, explores the evolving cybersecurity industry, emphasizing the crucial roles of mentorship and networking. Ken and Aaron discuss the strategic importance of aligning security with business goals, the impact of leadership training and honest feedback on developing better leaders, and the necessity of balancing technical skills with effective communication.

Ken shares his insights on the dangers of over-relying on AI, the essential need for disaster preparedness and business continuity, and the importance of continuously evaluating business investments to avoid unnecessary expenses. The episode highlights the value of informal networks and mentorship in overcoming industry challenges and fostering personal growth.

Listeners will gain practical strategies and invaluable lessons to navigate the ever-changing cybersecurity landscape while ensuring their personal and professional development.

Key Moments:

06:59 Translate tech leadership into business risk communication.

11:51 Integrating expertise, technical skills, and communication effectively.

18:13 No disaster recovery plan; business disrupted by flood.

25:36 Building relationships and listening are crucial successes.

31:39 Simplify explanations for effective cross-team communication.

33:53 Realized technical focus limited career growth.

42:12 Networking is crucial for finding senior roles.

44:06 Produced content led to advisory board roles.

50:06 Who supports post-handover? Security can't do it alone.

57:44 Translate work into clear business value requirements.

01:04:11 Ensure clarity and continuity for cybersecurity's future.

About the guest :

Ken Foster is a cybersecurity leader with over 25 years of experience in risk management, global team development, and IT infrastructure. As Head of Global Architecture at Adient, Ken oversees global teams to align technical initiatives with business goals, driving innovation while managing risks. His career includes key roles at Fleetcor and Fiserv, where he built large-scale cybersecurity programs and led risk governance and cloud security efforts. With a strong focus on client trust and board-level advisory, Ken brings deep expertise in navigating regulatory landscapes and developing risk-based, business-aligned strategies.

Connect Ken Foster : https://www.linkedin.com/in/kennethfoster/

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 4/4 Acciones de Seguridad Ofensiva en ICS
Pub date: 2024-10-21

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se muestran las recomendaciones sobre cómo presentar y comunicar los hallazgos a los stakeholders y cómo gestionar la relación con los equipos de operación y mantenimiento durante y después de una evaluación de seguridad ofensiva.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Warum sich für OT-Sicherheit vor allem die IT-Abteilung ändern muss
Pub date: 2024-10-17

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In dieser Folge des Rhebo-Podcast „OT Security Made Simple“ sprechen Gastgeber Klaus und der OT-Cybersecurity-Experte Max Weidele von Sichere Industrie über die Notwendigkeit eines organisatorischen Wandels, um OT-Sicherheit zu erreichen. Was mit dem Asset Management als Grundlage beginnt, führt schnell zu der klaren Vision, dass die IT das Herzstück der OT-Sicherheitsorganisation sein wird.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Women in STEM: Bridging the Talent Gap in Industrial Cybersecurity
Pub date: 2024-10-15

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Craig sits down with Jessica Cook, a computer science engineering senior at Mississippi State University, to explore her journey into industrial cybersecurity.

From discovering her passion for tech in high school to gaining hands-on experience in OT cybersecurity, Jessica discusses how internships and real-world exposure have shaped her understanding of the industry.

She talks about the exciting evolution of industrial careers, highlighting how traditional manufacturing roles are becoming more technical and data-driven.

Jessica shares valuable advice on building relationships, leveraging networking opportunities, and overcoming the challenges of being a woman in a traditionally male-dominated field.

As she prepares to graduate, she reflects on her career path and the opportunities ahead in cybersecurity and OT.

Chapters:

00:00:00 - Introduction and Jessica’s Background in Cybersecurity
00:01:19 - Discovering a Passion for Tech and Breaking Into STEM
00:03:11 - Industrial Cybersecurity: Navigating a Changing Landscape
00:05:29 - Mississippi State’s Cybersecurity Program and Its Growth
00:06:58 - Real-World Experience: Internships and Co-Ops in OT Cybersecurity
00:10:06 - Key Courses and Mentors Shaping a Cybersecurity Career
00:14:30 - Leadership, Networking, and Extracurriculars in Engineering
00:19:06 - Practical Advice for Students and Early-Career Professionals
00:21:15 - Looking Ahead: Graduation and Career Prospects in OT Cybersecurity

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: How Cybersecurity is Reshaping Food Safety with Rick Biros
Pub date: 2024-10-14

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode of the Bites and Bytes Podcast, host Kristin Demoranville welcomes Rick Biros, the founder of Food Safety Tech and the Food Safety Consortium. Rick, an industry veteran with decades of experience, shares fascinating insights into the critical role of food safety and its intersection with Cybersecurity. From the early days of food safety regulations sparked by major outbreaks to today’s technological advancements, Rick discusses how the industry has evolved and why Cybersecurity is becoming an integral part of protecting our food supply.

Rick also reflects on his journey from launching Food Quality magazine to creating the Food Safety Consortium, a must-attend event for senior-level food safety professionals. The episode covers how the Consortium fosters a collaborative environment for problem-solving and innovation, bringing together leaders from across the industry.

Listeners will also hear Rick’s thoughts on the latest challenges facing the food industry, including the impact of recent cyber threats and how technology is reshaping food safety protocols. Whether you’re in the food industry, Cybersecurity, or just curious about the future of food protection, this episode offers a wealth of knowledge and practical insights.

🎉🎂 Happy 1st Birthday to the Bites and Bytes Podcast! 🎧🎉Here’s to a year of incredible conversations, industry insights, and amazing listeners like YOU! 🎙️🌟 Thank you for all your support—here’s to many more! 🥳

________________________________________________________________________________________

Rick’s Information

LinkedIn: https://www.linkedin.com/in/rick-biros-860bb47/

Food Safety Tech Bio: https://foodsafetytech.com/about-us/

________________________________________________________________________________________

Show Notes:

Brussels memory – La Truffe Noire Restaurant

https://www.truffenoire.com/en/

What is Candling wine?

https://www.instagram.com/cristienorman_somm/reel/C9A2l-hyOjV/

Jack-in-the-box crisis

https://outbreakdatabase.com/outbreaks/jack-in-the-box-restaurant-chain-ground-beef-hamburgers-1992

Mark Carter – president of IAFP (International Association for Food Protection)

https://www.foodprotection.org/about/news-releases/mark-carter-assumes-presidency-of-the-international-association-for-food-protection/

Food Safety Modernization Act (FSMA)

https://www.fda.gov/food/guidance-regulation-food-and-dietary-supplements/food-safety-modernization-act-fsma

Boars Head Crisis

https://www.fsis.usda.gov/recalls-alerts/boars-head-provisions-co--expands-recall-ready-eat-meat-and-poultry-products-due

https://www.marlerblog.com/case-news/bill-marler-free-advice-for-boars-head-ceo-and-other-after-a-foodborne-illness-outbreak/

Peanut Corp of America Crisis

https://www.npr.org/sections/thesalt/2015/09/21/442335132/peanut-exec-gets-28-years-in-prison-for-deadly-salmonella-outbreak

Bill Marler

https://billmarler.com/

Sabra – Salmonella incident 2021

https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/sabra-dipping-company-llc-615938-12012021

Rob Mommsen

https://www.linkedin.com/in/rob-mommsen-b6848211/

Frank Yiannas

https://foodsafetytech.com/news_article/boars-head-appoints-frank-yiannas-as-chief-food-safety-advisor-and-finalizes-food-safety-advisory-council/#:~:text=Boar's%20Head%20Brand%20announced%20on,and%20quality%20across%20the%20organization.

https://www.smarterfysolutions.com/

David Theo – Jack-in-Box

https://www.latimes.com/local/obituaries/la-me-david-theno-20170710-story.html

________________________________________________________________________________________

Food Safety Tech

https://foodsafetytech.com/

➡️ Subscription to the free newsletter:

https://innovativepublishing2.actonsoftware.com/acton/media/3357/food-safety-tech-newsletter-opt-in-page

________________________________________________________________________________________

Innovative Publishing Company

https://www.linkedin.com/company/innovative-publishing-company-llc/

http://innovativepublishing.net/

________________________________________________________________________________________

Food Safety Consortium Conference

https://foodsafetyconsortium.org/

➡️ Register here:

https://www.eventleaf.com/Attendee/Attendee/EventPage?eId=RCMrOPTC6EZVv99yKxyQJw%3D%3D

💰⭐ Discount code for $200.00: RickyB

________________________________________________________________________________________

Kristin Demoranville Speaking at:

Food Safety Consortium Conference, Arlington, VA

https://foodsafetyconsortium.org/

BREAKOUT 3: Food Defense in the Digital Era

2:15 PM - 3:00 PM EST on Monday, October 21st

ICS Cyber Security Conference, Atlanta, GA

https://www.icscybersecurityconference.com/

Agriculture at Risk: Recognizing and Securing Our Forgotten Critical Infrastructure

11 AM EST on Thursday, October 24th

InCyber Forum Canada, Montreal, QC

https://northamerica.forum-incyber.com/en/home-en/

Guardians of the food supply chain: cybersecurity resilience in agriculture and food safety

1:55 PM to 2:40 PM EST on Tuesday, October 29th

💰⭐ 50% discount code: ININ59XU2CF3
➡️ Registration link: https://2024.northamerica.forum-incyber.com/en/pe1/pe1-home.htm

________________________________________________________________________________________

Bites and Bytes Podcast Info:

TikTok

Website: Explore all our episodes, articles, and more on our official website. Visit Now

Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now

Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog

Audience Survey: We value your feedback! Help us make the podcast even better. Take the Survey

Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 3/4 Acciones de Seguridad Ofensiva en ICS
Pub date: 2024-10-14

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se presentan las opciones y técnicas y cómo se deben diseñar y ejecutar las campañas para maximizar la efectividad en entornos OT.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: mnemonic security podcast
Episode: Prioritisation & Decision Making in Critical Infrastructure Defence
Pub date: 2024-10-14

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Joe Slowik, ATT&CK CTI Lead at MITRE, joins the latest episode of the mnemonic security podcast to share his insights on the complexities of securing critical infrastructure. With a background in cyber threat intelligence, incident response, and detection engineering, Joe discusses with Robby the challenge of defining and prioritising what's truly "critical" in a landscape where every sector claims importance.

They explore the difficulty in distributing security investments across industries and the growing need for organisations of all sizes to adopt a mindset of self-defence. Joe also addresses the potential consequences of large-scale cyberattacks, such as those by Volt Typhoon, emphasising the need for coordinated incident response and leadership during crisis scenarios. He concludes with a strong call for resilience and highlights the vital role CEOs play in ensuring organisational preparedness.

The podcast and artwork embedded on this page are from mnemonic, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: EPRI Current
Episode: 39. AI and Generative AI: Potential Cybersecurity Impacts to the Energy Industry?
Pub date: 2024-10-10

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

AI and generative AI are transforming the energy industry but also bringing new cybersecurity challenges. In the newest EPRI Current podcast episode, experts from EPRI and NVIDIA discuss AI's benefits and ways to combat potential cybersecurity threats to critical energy infrastructure.

Guests: Jason Hollern, EPRI cybersecurity technical executive, and Marc Spieler, Senior Managing Director for Energy with NVIDIA.

Links and Resources:

Artificial Intelligence and Generative AI in the Energy Sector: Cyber Security Use-Cases, Considerations, and Implications https://www.epri.com/research/products/000000003002029821

If you enjoy this podcast, please subscribe and share! And please consider leaving a review and rating on Apple Podcasts/iTunes.

Follow EPRI:

LinkedIn https://www.linkedin.com/company/epri/

Twitter https://twitter.com/EPRINews

EPRI Current examines key issues and new R&D impacting the energy transition. Each episode features insights from EPRI, the world's preeminent independent, non-profit energy research and development organization, and from other energy industry leaders. We also discuss how innovative technologies are shaping the global energy future. Learn more at www.epri.com

The podcast and artwork embedded on this page are from EPRI, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: How CISOs Are Bridging the Gap between OT and IT Cybersecurity
Pub date: 2024-10-08

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this rewind episode, we explore the critical role CISOs play in bridging the gap between operational technology (OT) and enterprise cybersecurity.

With manufacturing and critical infrastructure facing increasing cyber threats, CISOs must navigate both the boardroom and the plant floor to secure complex environments without disrupting production.

This discussion focuses on the importance of risk assessment, real-time monitoring, and the adoption of specialized cybersecurity tools.

The episode highlights the need for cross-functional collaboration, leveraging external expertise, and shifting toward proactive, secure-by-design approaches.

It also addresses the vulnerabilities in supply chains, the limitations of relying on cybersecurity insurance, and the necessity of actionable, strategic measures to protect industrial environments.

Chapters:

00:00:00 - Kicking Off: How CISOs Are Redefining Industrial Cybersecurity from the Ground Up
00:00:54 - Cybersecurity Missteps Putting the C-Suite at Risk
00:12:31 - CISO Resignations: Is the Industrial Sector Prepared for the Fallout?
00:23:43 - Securing Critical Assets: What Every CISO Should Know

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Aaron C. Crow: OT and Product Security (Special Episode)
Pub date: 2024-10-07

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this special episode, David and Shlomi, hosts of the Left to Our Own Devices podcast, sit down with Aaron C. Crow, a seasoned Cyber and Strategic Risk leader with 25 years of experience. Together, they share valuable insights on OT and product security, while also exploring the future direction of the industry.

This episode is a republish from Aaron’s own PrOTect It All podcast, where it was originally released.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 26 · TOP 10% what is this?)
Episode: EP 47: Hacking Smart Buildings
Pub date: 2024-10-08

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

If you are in IT, you are probably not thinking about the risks associated with the Otis Elevator or the Coke machine. Maybe you should. Chester Wisnieski, the director and global field CTO at Sophos, points out that IoT devices, big and small, create an outsized threat to any organization. And that’s why IoT vendors need to secure these devices, even if they only “phone home” for more Coke. If they’re on your network, they need to be secured.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All (LS 24 · TOP 10% what is this?)
Episode: Building Resilient Tech Environments: Lessons from Dennis Maldonado
Pub date: 2024-10-07

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode, Aaron Crow engages in an insightful conversation with Dennis Maldonado, Director of Technology for Harris, Fort Bend ESD 100. The discussion emphasizes the importance of resiliency in technology environments and how strategic planning can safeguard against unforeseen disasters without necessitating a complete technological overhaul.

From his extensive experience, Dennis shares how effective communication and collaboration were critical during events like Hurricane Harvey. He also provides his perspective on future trends and concerns in cybersecurity, including the rise of ransomware and nation-state attacks targeting critical infrastructure.

The episode illuminates the significance of networking, with Aaron and Dennis underscoring its value in career advancement and sharing personal stories to illustrate how being well-known and trusted can open doors to unexpected opportunities.

Additionally, Dennis discusses the zero trust model and the intricate balance between maintaining cybersecurity and ensuring system availability in critical infrastructure.Listeners will gain practical insights into building resilient tech environments through real-world examples and expert advice.

The episode is a treasure trove of learnings on keeping organizations secure, responsive, and prepared for any eventuality. Join as "Protect It All" dives deep into building resilient tech environments with Dennis Maldonado's invaluable lessons.

Key Moments:

09:15 Networking is crucial for success in cybersecurity.

13:46 Volunteer firefighter boosted dispatch center through IT.

18:52 Transfers emergency calls to fire and EMS.

22:06 Quick response with information saves lives effectively.

26:22 Implemented lessons for resilient project development.

42:14 Sharing lessons learned from threat modeling experiences.

48:04 Zero trust model effectively mitigates cybersecurity incidents.

57:32 Public safety adapts by reverting to manual methods.

01:02:51 Cybersecurity's mainstream rise sparks widespread interest.

About the guest :

Dennis serves as Director of Technology for Harris Fort Bend ESD 100 (WESTCOM) managing and maintaining the technology needs of 911 call taking and emergency dispatch services for multiple public safety agencies.

With over 15 years of experience in information technology and over 12 years in cybersecurity enterprise environments and consulting, Dennis’s experience includes cyber resilience, network penetration testing, full-scope red team engagements, adversarial simulation, and physical security assessments.

Dennis presented at multiple security industry conferences including DEF CON, InfoSec SouthWest, BSides conferences, Houston Security Conference, Houston OWASP, SANS HackFest, and several local meetups and organizations around the United States.

As an active leader in the Houston cyber security community, Dennis is responsible for founding two cyber security meetups in the Houston area: Houston Locksport, founded in 2014 and Houston Area Hackers Anonymous (HAHA), founded in 2016.

How to connect Dennis:

LinkedIn: https://www.linkedin.com/in/dennismald/

Twitter/X: https://twitter.com/dennismald

Houston Area Hackers Anonymous (HAHA): https://www.meetup.com/houston-area-hackers-association/=

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4 Análisis de Seguridad Ofensiva en ICS
Pub date: 2024-10-07

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se analizan cuáles son los principales ejercicios y las técnicas de seguridad ofensiva, así como los roles para llevarla a cabo y las etapas.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Wie OT-Monitoring TSN weitreichend ermöglicht und absichert
Pub date: 2024-10-01

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In dieser Folge von OT Security Made Simple erläutert unser Gast Moritz Flüchter von der Universität Tübingen, wie ein OT-Monitoring auch dafür genutzt werden kann, um Time Sensitive Networking (TSN) in Netzwerken zu ermöglichen, in denen ein Teil der Systeme und Endgeräte nicht TSN-fähig sind. Nicht zuletzt zeigt er auf, wie eine integrierte Anomalieerkennung die bestehenden Unsicherheiten von TSN überwacht und Denial-of-Service-Attacken erkennt.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: OT Cybersecurity Lessons from the Trenches Revisited
Pub date: 2024-10-01

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this reflective episode, we revisit the real-world challenges of securing industrial environments, where the intersection of IT and OT often creates unforeseen cybersecurity vulnerabilities.

From mismanaged remote access to the critical need for continuous asset monitoring, our experts dive deep into the lessons learned from boots on the ground work in the field.

They share insights on managing OT cybersecurity risks while maintaining production uptime and operational integrity.

This episode provides invaluable takeaways for those navigating the complexities of protecting industrial networks, offering practical solutions for balancing security with operational demands.

Chapters:

00:00:00 - A rewind to the biggest OT cybersecurity lessons and surprising moments!
00:01:05 - Missteps and Common Blunders with Manufacturing, ICS and Cybersecurity
00:10:26 - Industrial Cybersecurity Lessons From the Field
00:20:19 - The State of OT Cybersecurity From the Field

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4 Contexto de Seguridad Ofensiva en ICS
Pub date: 2024-09-30

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se presenta el contexto del caso: datos del entrevistado,, los principales ejercicios y técnicas de seguridad ofensiva que aplican a los entornos de tecnologías de operación, y que obstáculos existen al aplicarlas en un entorno ICS y cómo se podrían minimizar.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: The Security Sandbox | Ensuring Operational Availability & Safety with Unified Cyber Threat Intelligence
Pub date: 2024-09-26

Most cybersecurity threats begin in IT systems. But as the lines between IT and OT continue to blur, these same threats have more and more opportunities to move closer to critical control systems. Having both visibility and context into what assets are most at risk across your operational environments is crucial for maintaining the safety and availability of these systems.

In this episode of the Security Sandbox, we'll cover the strategic use of cyber threat intelligence (CTI) to safeguard critical infrastructure and industrial environments.

You'll learn about:

Integrating OT/IoT threat intelligence with traditional IT threat intelligence for a complete picture of the attack surface
Using asset context when acting on threat intelligence in OT systems
Real-world examples of successful proactive threat response

Visit Our Website

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: mnemonic security podcast
Episode: KraftCERT Threat Assessment 2024
Pub date: 2024-09-30

KraftCERT trusselvurdering 2024 | In Norwegian only

In this episode, Robby is joined by Espen Endal and Bjørn Tore Hellesøy from KraftCERT/InfraCERT - the Norwegian CERT for the energy and petroleum sectors.

The trio discuss the Threat Assessment report recently published by KraftCERT/InfraCERT, and the unique challenges the Norwegian energy sectors are facing. They touch into topics such as threat evaluation, insider threats, countermeasures, and the importance of maintaining robust security practices despite evolving digital landscapes.

The conversation emphasises the contextualization of national threat assessments to be practical for energy production companies, stressing the balance between emerging technologies like AI and Digital Twins and their associated risks.

The Threat Assessment 2024 report is available at: https://www.kraftcert.no/filer/KraftCERT-ThreatAssessment2024.pdf

The podcast and artwork embedded on this page are from mnemonic, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Zvika Ronen Co-Founder & CTO @FOSSAware about Open-Source cyber and Risk Management
Pub date: 2024-09-26

השימוש בספריות קוד פתוח הפך לפרקטיקה מקובלת בכול פיתוח תוכנה, קיצור משך הפיתוח הוא משמעותי אבל טומן בחובו סיכונים עיסקיים וסיכוני סייבר משמעותים ללקוחות.

המעבר של העולם התפעולי לבקרים מבוססי מערכת הפעלה סטנדרטית ותאומים דיגיטלים מוזיל עלויות ובאותה נשימה חושף את הסביבה התפעולית לסיכוני סייבר מוכרים מסביבות המחשוב הסטנדרטיות.

נחשון פינקו מארח את צביקה רונן מייסד שותף והמנהל הטכנולוגי בחברת פוסאוור, מומחה בתחום ניהול סיכונים בקוד פתוח בשיחה על השימוש בקוד פתוח ע"י חברות תוכנה.

מה המשמעות של הרישוי השונה בקוד פתוח

איך מוודאים שהקוד הפתוח שהוכנס ע"י המפתחים "נקי" ולא מסתיר נוזקות שיפתחו באתר הלקוח

איפה פוגש הקוד הפתוח את העולם התפעולי ועוד

Open-source libraries have become an accepted practice in all software development. Shortening the duration of development is significant but carries significant business and cyber risks for customers.

The transition of the operational world to controllers based on a standard operating system and digital twins lowers costs. Still, it exposes the operational environment to known cyber risks from standard computing environments.

Nachshon Pincu hosts Zvika Ronan, Co-founder and chief technology officer at FOSSAware and an expert in open-source risk management, in a conversation about software companies' use of open source.

What does the different open-source licensing mean?

How do you ensure that the open code entered by the developers is "clean" and does not hide vulnerabilities that will be opened on the client's site?

Where does the open source meet the operational world?

and more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 3% what is this?)
Episode: Securing Embedded Systems
Pub date: 2024-09-25

In this episode, Bryson sits down with MITRE EMB3D co-founder Niyo Little Thunder Pearson. For nearly 20 years, Niyo has been at the forefront of protecting critical infrastructure systems. He previously led incident response for American Express, directing the company’s Security Operations Center during the LulzSec and Anonymous attacks, and worked to develop an adversarial cyber defense program for the nation’s third largest gas utility at ONE Gas Oklahoma. Now, Niyo has co-founded MITRE EMB3D, a groundbreaking global threat network aimed at enhancing the security of embedded devices.

What is MITRE EMB3D? Who is the intended audience? What problems is it trying to solve?

“There is such a gap that exists today on what we understand and how risk averse these [embedded] devices are. They do well and they operate well. They're built for what they're doing in a safety context, but the security was never brought forward with it,” Niyo said.

Join us for this and more on this episode of Hack the Plan[e]t.

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 26 · TOP 10% what is this?)
Episode: EP 46: Hacking Israeli-made Water Treatment Devices In Pennsylvania
Pub date: 2024-09-24

Political hacktivism once mainly focused on website defacement. Now it has shifted to targeting physical devices, affecting critical infrastructure such as water treatment plants. At Black Hat USA 2024, Noam Moshe from Claroty highlighted how the HMIs in PLC devices from Israeli manufacturers may be susceptible to political attacks by nation-state actors using unknown vulnerabilities in the PComm protocol.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Securing Critical Assets: What Every CISO Should Know
Pub date: 2024-09-24

In this episode, Craig and Dino explore the evolving responsibilities of the CISO in managing cybersecurity within operational technology (OT) environments.

They address the persistent disconnect between IT and OT teams and the unique challenges CISOs face in bridging this gap.

With a focus on collaboration, they discuss the critical role of external partnerships and the importance of understanding the industrial landscape to implement effective security measures.

The conversation highlights how CISOs can balance rigorous cybersecurity protocols with operational demands, ensuring both safety and continuous uptime in complex industrial systems.

Chapters:

00:00:00 - Prioritizing Safety and Minimizing Downtime
00:00:48 - The Evolving Role of CISOs in Operational Technology (OT)
00:02:11 - Overcoming IT and OT Collaboration Challenges
00:03:09 - The Persistent Disconnect Between IT and OT
00:04:06 - CISOs' Responsibility for OT Security
00:05:08 - Balancing Security and Operational Uptime
00:06:57 - The Role of External Resources in Cybersecurity
00:11:38 - Limited CISO Interaction with the Board
00:20:38 - The Realities of Relying on Cybersecurity Insurance
00:24:18 - Conclusion: Moving Forward with IT-OT Collaboration

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 414 - Winning the OT Security Battle
Pub date: 2024-09-24

We sat down with Tim Conway and Robert Lee, two leading cybersecurity experts, to discuss pressing issues in OT cybersecurity.

CrowdStrike Lessons Learned

Tim and Robert began by examining the CrowdStrike incident from July 2024. They highlighted the dangers of over-relying on trusted technology without sufficient testing and verification, and the importance of integrating resilience into systems and avoiding a one-size-fits-all security approach.

Cyber Threat Landscape

Robert discussed the rise of sophisticated malware like Fuxnet, Frostygoop and Pipe Dream, designed to target OT systems. Fuxnet was a highly targeted attack aimed at disrupting critical infrastructure in Russia, while Frostygop used similar techniques against Ukraine. In contrast, Pipe Dream serves as a more versatile attack framework applicable to various OT systems.

He underscored an important lesson: even if specific malware isn't reused, studying its tactics can improve our prevention, detection, and response strategies. The key takeaway: threats to OT environments are growing, with increasingly targeted efforts from a range of actors.

Critical Control – ICS Network Visibility

Tim and Robert addressed the challenges of gaining visibility into OT devices. Tim noted that OT environments are diverse and require more than a one-size-fits-all approach. Each environment has unique characteristics that must be considered. While attackers exploit both commonalities and specific features, defenders must balance the need for visibility with the risk of disrupting operations. Legacy systems without modern security features further complicate these efforts. Despite historical challenges in visibility due to limited capabilities and resistance to change, recent technological advances have improved the situation. However, new technologies, such as encryption, introduce additional complexities. A balanced approach, using critical controls as a framework, is essential for prioritizing security efforts and adapting to evolving needs.

Critical Control – Incident Response Plan

Tim and Robert highlighted that many organizations lack specific incident response plans for OT, relying instead on general IT plans. Backup plans for power outages often do not address cyber attack scenarios. Effective OT incident response requires a tailored plan that includes data collection, safety procedures, and appropriate tools. In addition, maturity in incident response involves having a detailed, operationally integrated plan that addresses various scenarios, including handling outages and restoring systems without SCADA support.

OT and IT Convergence

Tim and Robert discussed several crucial aspects of OT security. They noted that the increasing interconnection between IT and OT systems has elevated the risk of attacks transitioning from IT to OT environments. Additionally, remote access, often used for vendor support, presents a significant security threat.

They emphasized the distinct characteristics of OT systems, which necessitate specialized security approaches. Treating OT and IT as identical can lead to dangerous oversimplifications and vulnerabilities. Therefore, security measures must be tailored to the specific needs of OT environments, considering their safety, physical constraints, and unique risks.

Tim and Robert also touched on cyber-informed engineering. Key takeaways include recognizing common attack vectors from IT systems, implementing distinct security strategies for OT, and avoiding the assumption that OT and IT are the same. Tailoring security measures to the specific needs and constraints of OT environments is essential for effective protection.

Celebrating Wins

Finally, Tim and Robert highlighted the importance of celebrating cybersecurity successes, such as defending against VOLTZITE. Recognizing and celebrating these victories can boost morale and encourage teams to continue their efforts.

Tim Conway, Senior Instructor, https://www.sans.org/profiles/tim-conway/

Tim serves as the Technical Director of ICS and SCADA programs at SANS, and he is responsible for developing, reviewing, and implementing technical components of the SANS ICS and SCADA product offerings. A recognized leader in CIP operations, he formerly served as the Director of CIP Compliance and Operations Technology at Northern Indiana Public Service Company (NIPSCO), where he was responsible for Operations Technology, NERC CIP Compliance, and the NERC training environments for the operations departments within NIPSCO Electric.

Robert M. Lee, Fellow, https://www.sans.org/profiles/robert-m-lee/

SANS fellow Robert M. Lee brings to the classroom one of the most valuable and respected of credentials: real-world experience. Robert is the CEO and founder of his own company, Dragos, Inc., that provides cyber security solutions for industrial control system networks.

Further viewing; https://youtu.be/BiUpuRk6pvA?si=xQcx9oiJOxQu0n7H

mysecuritytv #otcybersecurity

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Manufacturing Happy Hour (LS 43 · TOP 1.5% what is this?)
Episode: 204: OT Security Best Practices for Manufacturers with Fortinet's Rich Springer
Pub date: 2024-09-24

Is your shop floor as secure as you think it is? Innovation in the manufacturing world has made IT-OT convergence much more commonplace today, but is the industry taking the potential risks seriously enough?

In this episode, we hear from Fortinet’s Director of Marketing for OT Solutions, Rich Springer, about the real threats facing manufacturers within OT networks, and why effective OT security is a non-negotiable today...

Rich brings bags of experience to the table, from his early days in furniture and glass factories to his time as a Navy submarine officer and later as the global head of SCADA operations for a major wind turbine company. He shares how these experiences shaped his understanding of the unique cybersecurity challenges facing the manufacturing sector.

Painting a picture of how an OT threat can bring production to a standstill, Rich recommends that manufacturers use tabletop exercises to assess risk points and their impact on the whole production line. Rich also explains that part of protecting your OT network is about getting IT and OT teams to work together, and he gives practical advice on how to bridge the gap.

In this episode, find out:

Rich explains Fortinet’s position on OT network security
We hear about Rich’s diverse career background and how his previous roles prepared him for his role at Fortinet
The current state of OT convergence and why companies are yet to take action
Rich breaks the misconception that air gaps will protect manufacturers from digital threats
Advice for better collaboration between IT and OT teams
Rich explains why he’s optimistic that manufacturers are paying attention to the right things in security
What the report says about manufacturers and their approach to OT systems today
What it takes for cybersecurity experts to get executives to pay attention to the threats facing OT
How to run a tabletop exercise to assess threat and impact on production
What surprises Rich most about cybersecurity in manufacturing today

Enjoying the show? Please leave us a review here. Even one sentence helps. It’s feedback from Manufacturing All-Stars like you that keeps us going!

Tweetable Quotes:

“The separation of duties should be decided on the tabletop exercise, not when the fire is burning.”
“The technology has evolved. So therefore, it has made this air gap strategy a little less realistic over the years. And this is a common challenge.”
“When the systems go down, they go to paper. So if the line hasn't stopped, what happens with our suppliers if we have to go paper? Take your tabletop exercise to that level.”

Links & mentions:

Advancing Digital Transformation in a Time of Unprecedented Cybersecurity Risk, a report on how digital transformation in manufacturing has driven a widespread need for cybersecurity awareness
2024 State of Operational Technology and Cybersecurity Report, Fortinet’s report on OT cybersecurity

Make sure to visit http://manufacturinghappyhour.com for detailed show notes and a full list of resources mentioned in this episode. Stay Innovative, Stay Thirsty.

The podcast and artwork embedded on this page are from Chris Luecke, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Hitting Tens of Thousands of Vehicles At Once [The Industrial Security Podcast]
Pub date: 2024-09-23

Compromise a cloud service and tens thousands of vehicles can be affected at once. Matt MacKinnon of Upstream Security walks us through the world of cloud security for connected vehicles, transport trucks, tractors, and other "stuff that moves."

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All (LS 24 · TOP 10% what is this?)
Episode: Funding OT Cybersecurity: Priority Setting and Practical Approaches
Pub date: 2024-09-23

Welcome to Episode 25 of the Protect It All podcast, titled "Funding OT Cybersecurity: Priority Setting and Practical Approaches." In this episode, host Aaron Crow tackles the pressing issue of securing Operational Technology (OT) systems in critical sectors like energy, manufacturing, and transportation. Although often overshadowed by IT security, the increasing number of OT system attacks makes it clear that underfunding is no longer an option.

Aaron explores the unique challenges of OT cybersecurity, such as legacy thinking and budget constraints. He offers strategies to align cybersecurity with business goals, prioritize investments effectively, and implement risk-based funding approaches. The episode emphasizes the importance of understanding asset inventories and making incremental improvements to strengthen security.

Listeners will also learn how to bridge the communication gap between OT teams and business executives and translate technical risks into business impacts. With real-world examples and actionable insights, this episode is essential for anyone tasked with protecting OT environments.

Tune in to gain valuable knowledge and start effectively prioritizing and funding your OT cybersecurity initiatives.

Key Moments :

00:10 Cybersecurity requires comprehensive, risk-aware approach beyond basic safety.

05:18 Understanding OT risks is crucial for prioritization.

09:11 We do business at the speed of trust.

12:13 Communicate cybersecurity's financial impact to business leaders.

13:58 Cost-benefit analysis of asset inventory in OT.

18:15 Establish security basics before advanced AI implementation.

23:21 Easier board conversations amid constant news events.

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 413 - Operational Technology (OT) Cybersecurity - Episode 4
Pub date: 2024-09-22

This episode dives into OT Cybersecurity and discusses:

SCADA, ICS & IIoT Cybersecurity

How do we define an OT-related cyber incident?

What are the leading standards and guidelines for managing OT Cybersecurity and resilience?

Threat intelligence and suitable ISAC models

Vendor platform insights and cyber maturity landscape

Speakers include:

Daniel Ehrenreich, Secure Communications and Control Experts

Lesley Carhart, Director of Incident Response - Dragos

Ilan Barda, Founder - Radiflow

Rahul Thakkar, Team Lead, System Engineering, ANZ, Forescout

Dean Frye, Solutions Architect ANZ, Nozomi Networks

To visit and subscribe to the full series visit https://mysecuritymarketplace.com/security-risk-professional-insight-series/

mysecuritytv #otcybersecurity

iot #security #cra #wetalkiot

Summary of this week's episode:

01:42 Understanding the Cyber Resilience Act

02:04 Keyfactor's Role in IoT Security

03:37 Avnet Silica's Approach to Security

05:19 Exploring the Cyber Resilience Act

10:42 Challenges and Risk Assessments

19:05 Practical Implementations and Examples

23:15 Collaboration and Future Prospects

24:44 Balancing Innovation and Security

Show notes:

Guillaume Crinon: https://www.linkedin.com/in/guillaumecrinon/

Romain Tesniere: https://www.linkedin.com/in/romain-tesniere-26698b80/

About Keyfactor: https://www.keyfactor.com

Deep dive into the Cyber Resilience Act:

https://my.avnet.com/silica/solutions/iot/secure-device-management-provisioning/

https://www.keyfactor.com/resources/content/eight-steps-to-iot-security?lx=6IfNm7

https://www.brighttalk.com/webcast/17778/604186

About Avnet Silica:

This podcast is brought to you by Avnet Silica—the Engineers of Evolution.

You can connect with us on LinkedIn: https://www.linkedin.com/company/silica-an-avnet-company/. Or find us at www.avnet-silica.com.

The podcast and artwork embedded on this page are from Avnet Silica, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Advanced Manufacturing Now (LS 34 · TOP 3% what is this?)
Episode: Cyber Threats in Manufacturing: Identifying and Mitigating Risks
Pub date: 2024-09-03

In this episode, Steve Plumb, Editor-in-Chief, sits down with Jeremy Dodson, Chief Information Security Officer, and Jay Korpi, Principal Cybersecurity Specialist, from NextLink Labs to discuss cybersecurity in the manufacturing industry. They highlight the convergence of IT and OT and the need for understanding the differences between the two. They also talk about common breaches, such as social engineering attacks and misconfigurations, and the need for comprehensive risk assessments and training programs.

The podcast and artwork embedded on this page are from SME Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: From Legacy Systems to Ransomware: The Evolution of OT Cybersecurity
Pub date: 2024-09-03

In this episode, Craig Duckworth is joined by Roger Hill, founder of Hillstrong Group Security.

Roger is a seasoned 30-year industry veteran in the field of industrial automation and cybersecurity. He joins Craig to discuss the critical challenges and emerging trends in industrial cybersecurity.

From the evolution of security practices in industrial environments to the complexities of integrating modern solutions with legacy systems, Roger offers invaluable insights.

He delves into the importance of breaking down silos between IT and OT teams, the rise of ransomware as a major threat, and the need for collaborative approaches to secure critical infrastructure.

Whether you're grappling with aging systems or looking to future-proof your OT security, this conversation is packed with practical advice and forward-thinking strategies.

Chapters:

00:00:00 - Introduction to OT Cybersecurity
00:00:46 - Meet Roger Hill: A Veteran in Industrial Automation and Cybersecurity
00:00:57 - How OT Security Has Evolved Over 30 Years
00:01:52 - The Impact of Stuxnet: A Turning Point in OT Cybersecurity
00:03:41 - Navigating Emerging Technologies and the Rising Ransomware Threat
00:05:32 - Overcoming Challenges in Adopting New Technologies
00:07:13 - Why Context and Visibility Are Key to Effective OT Security
00:09:10 - Budgeting and Governance: The Backbone of OT Security
00:11:13 - Breaking Down Silos: The Critical Role of IT and OT Collaboration
00:13:00 - Challenges in Global OT Security: Governance and Compliance
00:14:50 - The Aging Workforce Problem: Building and Retaining Talent
00:17:00 - Importance of Cross-Functional Teams in OT Security
00:23:24 - What’s Next? The Future of OT Cybersecurity
00:28:29 - Final Thoughts: Practical Advice and Forward-Looking Strategies

Links And Resources:

Roger Hill on LinkedIn
Dino Busalachi on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4 Contexto del caso Matriz de Roles y Responsabilidades en Seguridad OT
Pub date: 2024-09-02

En este episodio se presenta el contexto del caso: datos del entrevistado, los factores clave del entorno OT actual que hacen imprescindible la implementación de una matriz de roles y responsabilidades, y los obstáculos y los beneficios que puede aportar una matriz bien definida en términos de eficiencia operativa y mitigación de riesgos.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: How to Protect Removable Media from Ongoing Attacks
Pub date: 2024-08-28

Use of removable media in the industrial sector today is continuing to grow and it is just as vulnerable now as it has been over the past five to ten years. A new report is out that analyzes USB-borne malware and some of the results are very interesting.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Energy Talks
Episode: #85: Why Should You Talk About Incident Response? | Part 1
Pub date: 2024-08-29

Learn about past and future OT cyber incident response and disaster recovery in the power grid.Welcome to the first episode of our new Energy Talks miniseries, Why Should We Talk About Incident Response? Join OMICRON cybersecurity experts Andreas Klien and Simon Romer as they explore the critical roles of IT and OT in cyber incident response and disaster recovery alongside other experts from the power industry.

In this episode, Andreas and Simon discuss disaster recovery from an OT perspective, using a recent CrowdStrike incident as a case study. Simon also highlights key considerations for utilities when developing OT incident response and recovery processes and offers practical tips for those without established plans.

We want to hear from you! If you work at a utility, please share your experiences implementing OT response and recovery processes – what prompted you to start, and what challenges have you faced? If you would like to contribute, email us at omicroncybersecurity.com and we may feature your story in an upcoming episode.

Stay tuned for upcoming episodes in our miniseries Why Should We Talk About Incident Response?

Learn more about OMICRON’s approach to advanced cybersecurity for OT environments.

We would really like to know what you think about Energy Talks and which topics you would like to hear more about. To do this, simply send us an email to podcast@omicronenergy.com and be sure to give us a star review on Spotify or Apple Podcast. Thanks for your feedback!

The podcast and artwork embedded on this page are from OMICRON electronics GmbH, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: The Security Sandbox | Modernizing Cyber Risk Management in OT
Pub date: 2024-08-28

Over the past decade, operational technology (OT) systems have become increasingly digitized and more vulnerable to cyber threats, making effective cyber risk management more crucial than ever. This session will explore the concept of cyber risk, defined as the potential for loss or harm to digital infrastructure, and how you can proactively apply the latest tools, trends and techniques to reduce cyber risk and enhance the resilience of your OT systems.

We’ll cover:

Different risk scoring approaches, like quantitative, qualitative, and hybrid models, which help organizations prioritize and address vulnerabilities.
Emerging trends in cyber risk management, including the growing adoption of AI-driven analytics, automation, and integrated security frameworks.
How technologies like artificial intelligence and advanced threat detection systems are reshaping how organizations mitigate risk in OT environments.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 44: Performing Security Assessments on ICS systems
Pub date: 2024-08-27

Too few vulnerabilities in industrial control systems (ICS) are assigned CVEs because of client non-disclosure agreements. This results in repeatedly discovering the same vulnerabilities for different clients, especially in critical infrastructure. Don C. Weber from IOActive shares his experiences as an ICS security professional and suggests improvements, including following the SANS best practices for ICS security..

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Advanced Manufacturing Now (LS 34 · TOP 3% what is this?)
Episode: Assess, Accelerate, Operationalize: Aligning Digital Transformation with Cybersecurity
Pub date: 2024-08-27

In this episode, Amy Bryson, Contributing Lead Editor, and Tod Virden, GM of Advanced Analytics at GrayMatter, discuss aligning digital transformation with cybersecurity. They highlight the importance of making cybersecurity part of the strategy from the beginning and they examine examples of client solutions GrayMatter has worked on.

The podcast and artwork embedded on this page are from SME Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Why Cybersecurity Matters: Protecting Our Food Supply from Digital Threats with Kristin Demoranville
Pub date: 2024-08-26

In this insightful episode of Protect It All, titled "Why Cybersecurity Matters: Protecting Our Food Supply from Digital Threats with Kristin Demoranville," host Aaron Crow and guest Kristin Demoranville tackle the critical yet often overlooked role of cybersecurity in the food and agriculture industry.

Kristin stresses the need to shift from reactive to proactive cybersecurity measures to protect our complex food supply chains and ensure resilience. The discussion covers real-world cyber incidents like the ransomware attack on JBS meat company, emphasizing the human factors, financial misconceptions, and the necessity for robust incident response and business continuity plans.

Listeners will also learn about the dangers of excessive reliance on technology and automation, the significance of water conservation, and the importance of integrating OT security in data centers. Through professional insights and personal anecdotes, Kristin highlights the crucial need for community support within the OT landscape.

This episode offers a comprehensive look at the cultural and societal implications of cyber threats to our food supply, making it essential listening for anyone interested in the safety and security of the food industry.

Key Moments:

00:10 Training and spreading awareness about operational technology.

10:21 Agriculture lacks attention; needs OT cybersecurity focus.

15:26 Security professionals foresee major food safety risk.

18:04 Supply chain issues during COVID highlight concerns. Regenerative farming and feeding the population.

24:04 ICS OT industry united in game proposal.

27:35 Designing systems must consider cyber risk implications.

34:11 Cybersecurity often an afterthought in many companies.

41:47 Respectful, supportive, and geeky cyber community advocate.

42:58 Texan upbringing shaped love for celebratory food.

51:10 Concern over CrowdStrike blaming and finger pointing.

57:16 Operator scans RFID tags from break room.

59:24 Resisting a wasteful task, leading to change.

About the guest :

Kristin Demoranville is the visionary founder and CEO of AnzenSage, a cybersecurity firm specializing in the food and agricultural industry. She also leads as the CEO and co-founder of AnzenOT, a groundbreaking SaaS OT Cybersecurity Risk Intelligence solution. With 26 years in the tech industry, Kristin seamlessly blends cybersecurity with food protection culture, always emphasizing the vital role of people and processes. Her extensive background—ranging from collaborating with Fortune 500 companies and various manufacturing sectors to studying gorilla behavior as part of her Environmental Management degree—gives her a unique and well-rounded perspective on cybersecurity and critical infrastructure. A published expert and in-demand speaker, Kristin is known for bridging the worlds of food protection and cybersecurity. She’s also the host of the Bites & Bytes Podcast, where she drives meaningful conversations between professionals across food, cybersecurity, and technology.

Anzensage Website : https://www.anzensage.com/

AnzenOT Website : https://www.anzenot.com/

Bites and Bytes Podcast: https://www.bitesandbytespodcast.com/

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Heather Vermillion: PACCAR, Security & Personal Growth
Pub date: 2024-08-27

In this episode of "Left to Our Own Devices," we dive into the world of automotive cybersecurity with Heather Vermillion, a security engineer at PACCAR, who shares her journey from the Department of Defense to safeguarding advanced automotive technologies, while also championing the next generation of cybersecurity professionals.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: How CISA Supports Cybersecurity from Critical Infrastructure to Elections
Pub date: 2024-08-27

Chris Cockburn, Cybersecurity Advisor at CISA, shares his insights on how CISA supports industrial cybersecurity from critical infrastructure to elections.

We explore the impact of state-sponsored cyber threats, the importance of securing emerging technologies like AI through the "Secure by Design" initiative, and the role of government-private sector partnerships in building a resilient cybersecurity posture.

He shares the free resources available to support industrial cybersecurity including Fusion Centers. Whether it's defending against sophisticated cyber attacks or ensuring the integrity of our election systems, this episode provides essential guidance for securing the future of critical infrastructure.

Chapters:

00:00:00 - Introduction to AI security concerns in critical infrastructure
00:00:59 - Meet Chris Cockburn, cybersecurity expert from CISA
00:01:10 - Chris Cockburn’s journey from DoD to CISA
00:02:21 - Overview of global industrial cybersecurity challenges
00:03:35 - How CISA collaborates to strengthen cybersecurity
00:04:52 - Regional cybersecurity support for critical sectors
00:05:49 - Tackling resource challenges in cybersecurity
00:08:03 - Continuous efforts to secure election systems
00:09:26 - Navigating the complexities of IT/OT convergence
00:12:36 - Making the most of cybersecurity insurance
00:15:08 - Ensuring AI is secure by design
00:19:06 - CISA’s partnership with Idaho National Lab for cybersecurity training
00:20:48 - Key strategies for building cyber resilience
00:22:09 - Fusion Centers: Enhancing collaboration in cybersecurity
00:23:53 - Final thoughts on the future of cybersecurity

Links And Resources:

Chris Cockburn on LinkedIn
CISA Cybersecurity Resources and Tools
Dino Busalachi on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Safeguarding the Grid and the Plate: OT Insights with Aaron Crow, Host of PrOTect IT All Podcast
Pub date: 2024-08-26

In this special joint episode of the Bites and Bytes Podcast, host Kristin Demoranville teams up with Aaron Crow, the esteemed ProOTect IT All Podcast host and Senior Director at MorganFranklin Cyber. Aaron brings over two decades of experience in the cybersecurity domain, with a particular focus on operational technology (OT) and critical infrastructure. Together, they explore the evolving landscape of OT cybersecurity, discussing the challenges and strategies involved in protecting both the power grid and food supply chains. Aaron shares his insights from his extensive career, including overseeing cybersecurity protocols at over 40 power generation sites, highlighting the importance of cross-industry collaboration. Whether you’re in the food industry or power utilities, simply passionate about cybersecurity, or even curious, this episode offers valuable insights into safeguarding our most vital systems.

_______________________________________________

🏆 Vote for Bites and Bytes Podcast for Women in Podcasting Award
🏆Voting Opens on August 1, 2024, and closes on October 1, 2024

https://womeninpodcasting.net/bites-and-bytes-podcast/

THANK YOU! 🤩 🎉

_______________________________________________

Aaron’s Info:

Website

Aaron Crow has carved a niche for himself as a prominent figure in the cybersecurity domain, particularly within the power utility and operational technology (OT) sectors. Currently serving as the Senior Director at MorganFranklin Cyber, Aaron focuses on OT cybersecurity across critical infrastructure, where he applies his extensive experience to safeguard vital systems.

His career, spanning over two decades, showcases a dedication to enhancing cybersecurity measures in critical infrastructure environments. Aaron's extensive experience includes a notable tenure as Manager of OT for power generation at Luminant (Vistra), where he was responsible for overseeing cybersecurity protocols across more than 40 power generation sites, including a vital nuclear power plant.

Aaron's expertise in the field is further evidenced by his impactful roles at EY, a leading Big 4 Consulting Firm, and Industrial Defender. At EY, he held the position of Senior Manager, leading transformational OT cybersecurity programs for a wide array of significant critical infrastructure clients. His leadership and strategic insight were instrumental in addressing and mitigating multifaceted cybersecurity challenges. As the CTO of Industrial Defender, Aaron significantly influenced the company's product development and strategic direction, demonstrating his ability to innovate and drive growth within the OT cybersecurity space.

Beyond his professional achievements, Aaron is deeply committed to contributing to the broader cybersecurity community. He is the host of the "PrOTect IT All" podcast, where he has recorded over 50 episodes featuring discussions with some of the most recognized thought leaders in the OT cybersecurity field. This platform has become an essential resource for sharing knowledge, trends, and insights, further solidifying Aaron's role as a thought leader in the industry.

In addition to his professional and community contributions, Aaron holds an advisory position with Building Cyber Security. This role leverages his comprehensive experience and dedication to advancing security practices within building management systems, emphasizing his commitment to improving industry-wide cybersecurity resilience.

Aaron's distinguished career in cybersecurity, particularly within the power utility sector and his extensive work as an asset owner, underscores his profound understanding of the challenges and complexities inherent in securing critical infrastructure. His expertise, leadership, and commitment to the field position him as a key figure in shaping the future of OT cybersecurity, making him a valuable asset to any organization or initiative aiming to enhance cybersecurity measures in critical infrastructure environments.

_______________________________________________

PrOTect IT All Podcast

About the Show: Welcome to "PrOTect It All," the podcast where we peel back the layers of cybersecurity to reveal the core strategies, challenges, and triumphs of protecting our digital and operational landscapes. We're thrilled to have you on board for an upcoming episode! Your insights and experiences are invaluable to our listeners who are eager to learn and engage with the leading minds in IT and OT security.

As we gear up to dive into conversation, please feel free to share any specific topics or stories you'd like to discuss. Our audience appreciates both the technical deep-dives and the high-level overviews, so bring your unique perspective, and let's make cybersecurity accessible and engaging together.

Thank you for joining us on this journey to foster a more secure future. We can't wait to hear your voice on the "PrOTect It All" podcast!

_______________________________________________

Episode Key Highlights:

(01:39 - 02:49) Food and Ag Cybersecurity Innovations(05:51 - 06:41) Difference Between OT and IT(10:17 - 11:19) Importance of Agriculture in Critical Infrastructure(16:47 - 18:33) Building Resilience in the Food Industry(22:41 - 23:34) Legacy Tech Challenges With IoT Integration(28:35 - 29:44) Understanding Cyber Physical Systems(36:05 - 37:06) Potential Chaos in American Disaster Response(43:22 - 44:23) Cyber Attack Threatening Lives Through Food(47:31 - 48:04) Resilience in Food Industry Cybersecurity(51:36 - 52:51) RFID Tag Duplication Risk_______________________________________________

Bites and Bytes Podcast Info:

TikTok

Website: Explore all our episodes, articles, and more on our official website. Visit Now

Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now

Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog

Audience Survey: We value your feedback! Help us make the podcast even better. Take the Survey

Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Alethe Denis on Social Engineering, Red-Teaming
Pub date: 2024-08-26

Bishop Fox senior security consultant Alethe Denis joins the Claroty Nexus podcast to discuss social engineering in cybersecurity and how it has become part of red-team engagements, especially inside critical infrastructure organizations. She explains the value of open source intelligence and data stolen in breaches to scammers and extortionists in creating pretexts for their schemes. She also explains how to best defend against these tactics that aid threat actors in weaponizing personal information against victims and organizations.
For more, visit nexusconnect.io/podcasts.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Vendor and Version Lock Threats to Industrial Cybersecurity
Pub date: 2024-08-20

In this episode, Dino and Craig dive into the complexities of cybersecurity in the operational technology (OT) space, focusing on the challenges posed by vendor lock, version lock, and outdated systems.

They explore the disconnect between IT and OT teams, emphasizing the need for collaboration to secure industrial environments effectively.

The discussion highlights practical strategies like virtual patching and microsegmentation to mitigate risks, stressing the importance of working with the right partners to protect legacy systems while maintaining production efficiency.

Chapters:

00:00:00 - Introduction to Equipment Life Cycle
00:00:56 - Key Challenges in Operational Technology (OT)
00:01:24 - The OEM Blockade: A Barrier to Progress
00:02:09 - Unpatched Vulnerabilities in Newly Installed Equipment
00:04:22 - Bridging the Gap: IT and OT Collaboration Issues
00:05:40 - Practical Solutions: Compensating Controls
00:06:48 - The Realities of IT and OT Convergence
00:09:00 - Shared Infrastructure Risks
00:12:00 - The Gap in Due Diligence on the Plant Floor
00:14:00 - The Need for Better OT Cybersecurity Practices
00:16:00 - Finger-Pointing in OT Environments
00:19:21 - Why Process Integrity Matters in OT
00:24:02 - Final Thoughts: Moving Forward in OT Security

Links And Resources:

Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Alon Dankner on Extracting Crypto Keys from PLCs
Pub date: 2024-08-19

Alon Dankner of the Technion Institute for Technology in TelAviv Israel joins the Claroty Nexus Podcast to discuss a presentation he gave at the recent Black Hat cybersecurity conference in Las Vegas. Dankner and colleague Nadav Adir's presentation looked at the attack surface of programmable logic controllers (PLCs), in particular Siemens’ S7 protocol. Dankner and Adir developed six attacks against the encryption implementation in the protocol that expose private crypto keys and allow an attacker full control over the industrial control system.
For more, visit nexusconnect.io/podcasts

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Tackling Tech Troubles: Inside the DFW Airport Cyber Incident and Wider Industry Challenges with Evan Morgan
Pub date: 2024-08-19

In this episode of Protect It All, titled "Tackling Tech Troubles: Inside the DFW Airport Cyber Incident and Wider Industry Challenges with Evan Morgan," host Aaron Crow explore the complexities of widespread tech issues, focusing on a recent cybersecurity incident at DFW Airport that affected over 1,000 machines. Guest Evan Morgan, founder of Cyber Defense Army, discusses the challenges of resolving such large-scale incidents and the importance of standardization and AI in cybersecurity.

Evan shares his journey from an Air Force aircraft mechanic to a cybersecurity expert, highlighting the benefits and challenges of running a small consultancy versus a large firm. The episode also covers recent cybersecurity incidents involving CrowdStrike and Microsoft 365, emphasizing the need for preventive measures and trust in business and technology.

Practical tips for everyday cybersecurity and insights into industry-wide challenges make this episode a valuable resource for listeners across all sectors.

Key Moments:

00:10 Entrepreneurship brings freedom and awesome transformations.

03:54 Recent tech outages are gaining mainstream media attention.

07:52 Adapting existing tech for enhanced security measures.

10:48 Over-the-air car updates are complex and uncertain.

14:01 DFW airport machines, recovery time, and problem.

18:39 How do we improve efficiency and learning?

21:26 Customers validate goods, test, streamline, feedback.

25:10 Cyber enables business growth and protection.

28:52 Cyberattack halted gas sales, risking pipeline operations.

32:55 Challenges in the multi-faceted role, regulatory changes.

35:35 Commonalities in cybersecurity, despite differences in industry.

39:33 Robotics and AI revolutionize future human roles.

40:42 AI would bring trust, speed, and efficiency.

44:38 Defense technology, both funny and scary.

47:59 Distance tech carries risk, needs personal vigilance.

About the guest :

Evan Morgan is the Founder of Cyber Defense Army, a cybersecurity consultancy and services firm that incorporates geopolitical risk in their cybersecurity practices. He is a service-disabled Veteran of the United States Air Force and served in the post-9/11 campaigns, as well as remote tours to the Republic of Korea. He holds a Master's degree in Information Systems (Computer Security Management specialization) and a Master of Business Administration (Information Systems Management specialization), both with honors from Strayer University. Post his military service, he has led cybersecurity functions for Fortune 100 organizations, was a global leader for a worldwide consultancy, and has been honored with multiple cybersecurity awards for his efforts in protecting the organization he was a part of previously.

Connect with Evan via LinkedIn: https://www.linkedin.com/in/evanmorgan/

Cyber Defense Army's website: https://www.cyberdefensearmy.com/

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | How programming language Rust makes for a more secure product code
Pub date: 2024-08-15

This episode sees Rhebo Head of Development, Martin Förster, taking the driver’s seat. He talks to fellow developers Ingmar Pörner & Raphael Peters about how programming language Rust makes for robust and secure software and what a high-quality development process in an OT security company looks like.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Reduce Risk to People and Industrial Assets with ISA/IEC 62443
Pub date: 2024-08-13

People, process and technology are three critical components to any security program. When they all are working and in sync, everything comes together in a perfect harmony – and systems stay safe and secure and up and running.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 43: Hacking Large-Scale Off-Grid Solar Systems and Other Consumer IoT Devices
Pub date: 2024-08-13

This is a story about how we've essentially learned nothing about IOT over the last decade, and why we really need to do more today to help secure our tomorrow. Dan Berte, Director of IoT security for BitDefender, discusses his more than a decade in IoT, how the vendor maturity often isn’t there for our smart TVs or for our solar panels, so reporting vulnerabilities sometimes goes nowhere. That doesn’t stop defenders like Dan, who, along with his team, work hard to change and to educate the industry.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Ariel Lasry Israel Country Director @Rockwell Automation on Automation, Process and cyber security
Pub date: 2024-08-14

מפעלים משתנים ומכניסים דיגיטציה למערכות הייצור על מנת להישאר רלוונטיים מול עלויות העבודה הזולה במזרח ולהגדיל את שורת הרווח באותם אמצעי ייצור. מה המשמעויות ואיך זה משפיע רוחבית כולל ובמיוחד בתחום הסייבר.

נחשון פינקו מארח את אריאל לסרי מנכ"ל רוקוול ישראל בשיחה על עבר, הווה ועתיד התעשייה ואיך רוקוול נכנסה לעולם הסייבר.

לאן הולכת התעשייה

המשמעויות של כניסת הדיגיטציה למערכות הייצור

איך משתלב הסייבר בתמונה הכוללת

Factories are changing and digitizing their production systems to remain relevant in the face of cheap labor costs in the East and increase the profit margin with the same means of production. What are the meanings, and how does it affect horizontally, especially in the cyber field?

Nachshon Pincu hosts Ariel Lasry, Israel's country Director of Rockwell Israel, in a conversation about the industry's past, present, and future and how Rockwell entered the cyber world.

Where is the industry going?

The implications of digitization entering production systems

How does cyber fit into the overall picture?

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Robert Putman: From PlayStation to ABB
Pub date: 2024-08-13

In this episode of Left to Our Own Devices, Rob Putman, Global Manager of Cybersecurity Services at ABB, shares his journey from Sony PlayStation to leading cybersecurity in industrial automation. Tune in for insights on product security and industrial control challenges.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Automation Chat (LS 26 · TOP 10% what is this?)
Episode: Practical Steps for Protecting IT & OT Systems from Ransomware Attacks
Pub date: 2024-08-13

In this episode of our “Automation Chat” podcast from The Journal From Rockwell Automation and Our PartnerNetwork magazine, Executive Editor Theresa Houck chats with Dave Kang, Advisory Solutions Architect at Dragos and Kamil Karmali, Senior Global Commercial Manager, Cybersecurity Services at Rockwell Automation. Get nuts-and-bolts, practical information about strengthening cybersecurity for industrial networks and systems, including:

How ransomware attacks have evolved over the past year.
Steps you can take to prepare for — and recover from — an attack.
Common governance models and decision-making structures.
3 key considerations for developing a unified IT and OT strategy.
Workforce needs for an effective cybersecurity strategy.
How effective cyber hygiene and risk posture helps reduce risk of cyber incidents.
Cybersecurity-related compliance requirements in North America and around the world.
Why it's vital for manufacturers to have a business continuity plan.

And as always, get your family-friendly, silly Joke of the Day.

Resources from this episode:

Blog: 6 Steps to Reduce Industrial Cybersecurity Risks.
Q&A with Executive Editor Theresa Houck: Understanding the OT Threat Landscape Helps Manufacturers Improve Cybersecurity
Rockwell Automation Manufacturing Industry Cybersecurity web page.
Subscribe to The Journal’s 4 print magazines (Feb., May, July and Oct.) by e-mailing Anna Hicks at ahicks@endeavorbusinessmedia.com.
Subscribe to our 4 digital magazines at http://rok.auto/thejournal-subscribe.

You can also watch their discussion on YouTube at https://youtu.be/8Pm670QAO9E.

Automation Chat is brought to you by The Journal From Rockwell Automation and Our PartnerNetwork magazine.

Find us on LinkedIn.

Find us on Facebook.

Find us on X (Twitter).

Please subscribe to "Automation Chat" and give us a 5-star rating and a review.

** Named “Best Podcast” 3 Consecutive Years! 2022-2024 Apex Award of Publication Excellence.

View Details

Podcast: PrOTect It All
Episode: Cybersecurity in Critical Industries: Lessons from Medical Devices to Automotive
Pub date: 2024-08-12

In Episode 21 of "Protect It All," titled "Cybersecurity in Critical Industries: Lessons from Medical Devices to Automotive," host Aaron Crow is joined by experts David Leichner and Shlomi Ashkenazy to explore the multifaceted world of cybersecurity across various critical industries.

The conversation starts with Shlomi sharing a transformative personal experience in London, emphasizing the importance of pursuing one's passions. David follows with a moment of realization about the critical nature of cybersecurity during an eye surgery, underscoring the necessity of protecting people through robust cyber measures.

The episode delves deep into how cybersecurity practices are implemented in medical devices, automotive, and industrial manufacturing sectors. David, Shlomi, and Aaron discuss generative AI and its dual potential to enable and defend against cyber threats, drawing parallels to cyber weapons like Stuxnet. The importance of secure design, continuous monitoring, and compliance with ever-evolving regulations are highlighted, particularly in upgrading legacy systems in critical infrastructure.

With comprehensive insights into integrating IT and OT cybersecurity measures, the episode provides a compelling call to action for increased awareness and collaborative efforts to bolster defenses. Aaron also extends an invitation for engagement through conferences like Black Hat and Defcon, where practical solutions and innovative strategies are showcased.

Tune in to gain a deeper understanding of the critical intersection of cybersecurity in various industries and learn valuable lessons from the experts on safeguarding our digital and physical world.

Key Moments:

00:10 Security threats have expanded to 15-year-olds.

08:35 Privacy breaches occur through overlooked device vulnerabilities.

12:14 Power utility leading in cybersecurity due to regulation.

17:06 Smaller companies need to prioritize cybersecurity measures.

26:42 Security strategy requires adapting to different environments.

28:30 FDA emphasizes cybersecurity importance at the H-ISAC conference.

37:43 MIT study simulates cyber attack, uses AI.

40:24 AI can eliminate manual product development processes.

46:16 Cybersecurity brings unknown threats: deterrence or powerful AI.

50:26 Black start plants generate and transmit power.

59:00 Soft skills are crucial for effective communication and trust.

01:00:09 Sent demos to heroes, got a minimal response.

01:06:47 Promoting face-to-face meetings and events globally.

01:10:19 Agreement on conclusion of project.

About the Guests :

David Leichner

David has over 25 years of marketing and sales executive management experience garnered from leading tech companies including Cynet, Information Builders, Magic Software, Gilat Satellite Networks, BluePhoenix Solutions, and SQream. At Cybellum, a provider of integrated cybersecurity solutions for leading device manufacturers, David is responsible for creating and executing the marketing strategy and managing the global marketing team that forms the foundation for Cybellum’s market penetration.

Shlomi Ashkenazy

Shlomi is the Head of Brand and Strategy at Cybellum, overseeing product security thought leadership, positioning, and brand activities. A physicist-turned-cybersecurity brand builder, Shlomi spent the years before joining Cybellum as a consultant, working with dozens of founders in the cybersecurity, AI, DevOps, Quantum, and Health Tech industries on building their brand, product marketing, positioning, and messaging. Shlomi also produces and co-hosts "Left to Our Own Devices: The Product Security Podcast" and spearheads multiple business strategy and GTM initiatives at Cybellum.

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Doron (D) Hadar Co-Founder @𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 𝗜𝗠𝗣𝗔𝗖𝗧 on Crisis Management strategy & Ransomware Negotiation
Pub date: 2024-08-08

הוא מכונה "ד" משנותיו בצה"ל. בשני העשורים האחרונים הוא ייעץ וריכז תגובות לאירועי משבר בצה"ל ובארגוני ביטחון לאומי אחרים. כעת, הוא ייסד את חברת קריטיקל אמפאקט לניהול משברים

עו"ד הדס תמם בן אברהם ונחשון פינקו מארחים את דורון הדר ("ד") בשיחה על ניהול משברים ברמת המדינה ואירועי משבר סייבר מסחריים. שילוב הגנת סייבר-טכנית עם הבנה מעמיקה של המניעים האנושיים, היתרונות והפגיעויות של היריב

He is known as "D" from his years in the IDF. For the past two decades, he has advised on and coordinated responses to crisis events within the IDF and other national security organizations.
Now, he co-founded 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 𝗜𝗠𝗣𝗔𝗖𝗧 crisis management firm.

Adv. Hadas Tamam Ben-Avraham and Nachshon Pincu host Doron Hadar ("D") in a conversation on crisis management at the country level and commercial cyber crisis events.

Combine cyber-technical defense with a thorough understanding of the adversary's human motivations, advantages, and vulnerabilities.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Bonus Episode: Dr. Allan Friedman Returns: CISA SBOM-a-Rama 2024
Pub date: 2024-08-07

In this episode, Dr. Allan Friedman from CISA returns to discuss the upcoming SBOM-a-Rama, a pivotal event in supply chain cybersecurity. He shares insights on the evolution of SBOMs, the significance of community collaboration, and what to expect from this year's hybrid event, including a showcase of innovative SBOM solutions.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Noam Moshe on Extracting Forensic Data from Unitronics PLCs
Pub date: 2024-08-08

Claroty Team82 researcher Noam Moshe joins the Nexus Podcast to talk about Team82’s research into Unitronics Vision series integrated HMI/PLC devices. The OT devices were exploited last year in attacks against water treatment facilities in the U.S. and Israel. Team82 researched the security of these devices and developed a pair of tools that allowed them to extract forensic information from the PLCs. Both tools were released to open source on Team82’s Github page.
Moshe also presented this research today at the Black Hat Briefings in Las Vegas.

Read Team82’s research blog here.
Download the forensics tools here.
For more, visit nexusconnect.io/podcasts

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: The Human Factor : Securing Your Industrial Assets
Pub date: 2024-08-06

In this episode, Dino Busalachi and Craig Duckworth dive into the complexities of human factors and industrial cybersecurity. They discuss the need for robust cybersecurity awareness at all levels, and the challenges of integrating IT and OT environments.

The conversation highlights real-world scenarios, from phishing attacks to internal threats, and emphasizes the importance of building a strong cybersecurity culture.

Dino and Craig also explore strategies for improving visibility, managing remote access, and ensuring compliance with industry regulations, offering actionable insights for industrial professionals.

Chapters:

00:00:00 - Kicking Off: Why Industrial Cybersecurity Matters
00:01:17 - The Human Element: Cybersecurity's Biggest Challenge
00:02:14 - Plant Floor Realities: Tackling Cyber Threats on the Ground
00:03:20 - Boosting Awareness: Training for a Secure Future
00:05:41 - Breaking Barriers: Overcoming OEM and IT Hurdles
00:08:10 - Culture Shift: Building a Cybersecurity-First Organization
00:09:32 - Top-Level Insight: Managing Executive Challenges and Costs
00:16:10 - Outsourcing Excellence: Best Practices for OT Cybersecurity
00:25:26 - Zero Trust Unpacked: Enhancing Cyber Hygiene
00:26:49 - Wrapping Up: Key Takeaways and Final Thoughts

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: AI takes on polymorphic malware [The Industrial Security Podcast]
Pub date: 2024-08-05

The bad guys keep getting better at what they do, and so must we defenders. Gary Southwell of Aria Cyber joins us to look at using AI to get ahead of constantly-changing malware.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Talk Podcast with Scott MacKenzie (LS 45 · TOP 1% what is this?)
Episode: Bill Johnson with TDI Technologies
Pub date: 2024-08-05

Industrial Talk is onsite at DistribuTech and talking to Bill Johnson, President and CEO of TDi Technologies about "Protecting your connected assets with Console Works".Scott MacKenzie and Bill Johnson discussed the challenges of remote access in industrial environments, particularly in terms of cybersecurity. Bill explained how his company's product, Console Works, provides secure remote access to assets while controlling who can access them. Scott emphasized the importance of separating insiders and vendors, and Bill highlighted the need to validate users and keep the platform free of viruses and malware. The speakers also discussed the importance of directly connecting to industrial control systems for security and accuracy, and the need for zero trust foundations in critical infrastructure security. They stressed the value of validating information from multiple sources to ensure accuracy and security.Action Items* [ ] Contact Bill Johnson or visit consoleworks.com to learn more about ConsoleWorks and how it can provide secure remote access for industrial control systems. * [ ] Share the Industrial Talk Podcast on other platforms to continue educating others, collaborating on innovations, and changing the world securely. * [ ] Consider attending Distributech next year for more conversations on connecting industrial systems securely.

OutlineRemote access security in industrial environments.* Bill Johnson, industry expert on remote access and cybersecurity, joins the show. * Speaker discusses TDI Technologies' unique remote access solution for industrial environments.

Remote access security and asset management.* Scott MacKenzie explains how their product validates users and controls access to assets. * Product acts as a "man in the middle" to ensure secure connections and logging of unencrypted traffic. * Bill explains how to set up the product to monitor and analyze endpoints, with onboarding assets from integrations with tools like Dragos or Nozomi. * Bill discusses how to provide credentials for endpoints, with options for either product ownership or business choice, and setting up taking a day's time.

Securing remote access to critical infrastructure.* Speaker explains how product simplifies network access for end users. * Bill emphasizes data security and automation in connected infrastructure.

Cybersecurity for critical infrastructure using data and AI.* Bill explains how their product collects device configuration settings directly from the endpoint. * Bill highlights the benefits of validating information from multiple sources, including devices, tools, and vendors. * Ralph wants Scott to use data from multiple sources to build a trusted picture of a device. * Bill Johnson from TDI Technologies discusses cybersecurity and remote access solutions.

If interested in being on the Industrial Talk show, simply contact us and let's have a quick conversation.Finally, get your exclusive free access to the Industrial Academy and a series on “Marketing Process Course” for Greater Success in 2024. All links designed for keeping you current in this rapidly changing Industrial Market. Learn! Grow! Enjoy!BILL JOHNSON'S CONTACT INFORMATION:Personal LinkedIn: https://www.linkedin.com/in/baronpilot/Company LinkedIn: https://www.linkedin.com/company/tditechnologies/Company Website: https://www.tditechnologies.com/PODCAST VIDEO:https://youtu.be/iV8CznZ5n6wOTHER GREAT INDUSTRIAL RESOURCES:NEOM: https://www.neom.com/en-usHexagon: https://hexagon.com/Palo Alto Networks: https://www.paloaltonetworks.com/ot-security-tcoPalo Alto Networks Report HERE.Fictiv: https://www.fictiv.com/Hitachi Vantara: https://www.hitachivantara.com/en-us/home.htmlIndustrial Marketing Solutions: https://industrialtalk.com/industrial-marketing/Industrial Academy: https://industrialtalk.com/industrial-academy/Industrial Dojo: https://industrialtalk.com/industrial_dojo/We the 15: https://www.wethe15.org/YOUR INDUSTRIAL DIGITAL TOOLBOX:LifterLMS: Get One Month Free for $1 – https://lifterlms.com/Active Campaign: Active Campaign LinkSocial Jukebox: https://www.socialjukebox.com/Industrial Academy (One Month Free Access And One Free License For Future Industrial Leader):Business Beatitude the BookDo you desire a more joy-filled, deeply-enduring sense of accomplishment and success? Live your business the way you want to live with the BUSINESS BEATITUDES...The Bridge connecting sacrifice to success. YOU NEED THE BUSINESS BEATITUDES!

TAP INTO YOUR INDUSTRIAL SOUL, RESERVE YOUR COPY NOW! BE BOLD. BE BRAVE. DARE GREATLY AND CHANGE THE WORLD. GET THE BUSINESS BEATITUDES!

Reserve My Copy and My 25% Discount

The podcast and artwork embedded on this page are from The Industrial Talk Podcast with Scott MacKenzie, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: The Intersection of Cybersecurity and Personal Development: A Deep Dive with Aaron Crow and Neal Conlon at the Lone Star Cyber Shootout
Pub date: 2024-08-05

In this episode of "Protect It All," hosts Aaron Crow and Neal Conlon discuss the upcoming Lone Star Cyber Shootout. Set to take place on September 6, 2024, at the prestigious Staccato Ranch in Florence, TX, this episode highlights the unique blend of cybersecurity expertise and personal development that participants can anticipate.

Neal and Aaron share their captivating professional journeys and discuss how their diverse backgrounds converge at the crossroads of trust, cybersecurity, and personal growth. They recount their own experiences, noting the importance of trust in both personal and professional spheres. Moreover, the hosts vividly describe what attendees can anticipate from the Lone Star Cyber Shootout, detailing the state-of-the-art facilities, value-driven activities, and the exciting networking opportunities that await.

Listeners will discover the exceptional nature of Staccato Ranch, its veteran-focused initiatives, and how the event is structured to provide unparalleled insights and hands-on experiences in both cyber and physical security. Neal and Aaron underscore the importance of such events in fostering community connections and highlight the three pillars of an amazing event—epic location, outstanding content, and a strong community.

Join Aaron and Neal as they gear up for a day full of learning, camaraderie, and growth at the Lone Star Cyber Shootout, one of the cybersecurity world's most innovative and dynamic events. Secure your spot and prepare for an experience that promises to be as enlightening as it is adventurous!

Key Moments:

03:49 Diverse career in real estate and sales.

09:47 Public impact from events necessitates political unity.

12:07 New cybersecurity event bridges cyber and physical.

16:14 Transformational event in cybersecurity and technology consolidation.

17:32 Event fosters trusted partnerships in evolving cybersecurity.

22:46 Improving daily, manufacturing and professional development topics.

25:18 "Amazing content, valuable relationships, and community."

27:02 Cyber events filling up quickly, next in 2025.

To register, click https://corvosec.com/lonestar-cyber-shootout/

To sponsor the event, check out https://corvosec.com/lone-star-cyber-shootout-sponsorships/ or email sponsors@corvosec.com.

For further details, contact Aaron at aaron@corvosec.com or Neal at neal@corvosec.com.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: Stop Blaming CrowdStrike for OT!
Pub date: 2024-08-01

While we recover from our own operation interruptions, we're putting out bonus episodes where we can, and this is one of them. Our anonymous guest has this to say about the recent IT issues that interrupted the world's critical infrastructures... or did they? Listen to this and I think you'll agree that we should stop blaming CrowdStrike for outages in OT.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: The Security Sandbox | Evolving Endpoint Security in OT
Pub date: 2024-07-31

Traditionally, operational technology (OT) operators have shied away from active monitoring methods, driven largely by concerns over system disruption and OEM vendor validation expectations. However, the tide appears to be turning. Over the past few years, we’ve seen mindsets evolving from relying on a 100% passive approach to embracing more active monitoring methods to get deeper asset context, including configuration information, log files, user activity correlation, USB insertions, and even operational data from level 0 in a PLC.

During this session, we'll delve into the advancements in OT-safe proactive monitoring and how you could apply some of these latest developments towards securing your critical infrastructure while ensuring operational continuity and compliance.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Hillel Kobrovski, cyber Lecturer @Ono Academic College about AI's Influence on the cyber profession
Pub date: 2024-08-01

הי.איי אינו דבר חדש וקיים שנים רבות תחת שמות שונים כגון רשתות נוירונים וכדומה. עולם המידע עבר טלטלה כאשר כלי האינטליגנציה המלאכותית הפכו לנחלת הכלל והונגשו לציבור בתחילה עם צ'אט ג'י.פי.טי ולאחריו מערכות רבות נוספות.

נחשון פינקו מארח את הילל קובורובסקי עתידן, חוקר טרנדים טכנולוגים ומרצה סייבר באקדמית אונו בשיחה על ההשפעות של הי.אי. בעולם הסייבר.

איך יראה עולם הגנת הסייבר בעתיד הלא רחוק

ההשפעות של ההי.איי. על מקצועות הסייבר והכשרת מומחי סייבר

ועוד

AI is not new and has existed for many years under different names, such as neural networks. The world of information went through a shake-up when artificial intelligence tools became the common domain and were initially made available to the public with Chat GPT, followed by many other systems.

Nachshon Pincu hosts Hillel Koborovsky, a futurist, researcher of technological trends, and cyber lecturer at Ono Academy, in a conversation about the effects of AI in the cyber world.

What will the world of cyber defense look like soon

The effects of AI on the cyber professions and the training of cyber experts

and more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Alexander Antukh on Cyber Risk Quantification
Pub date: 2024-08-01

Alexander Antukh, CISO of AboitizPower in the Philippines, the country's largest power and renewable energy provider, joins the Nexus Podcast to discuss cyber risk quantification (CRQ). CRQ is a framework used to assess the financial impact of a cybersecurity threat on an organization. Antukh is an advocate of CRQ, and discusses his approach to using it to predict risk in his organization, what level of organizational maturity is required for this approach to succeed, and how it's being applied in operational technology (OT) environments.
For more, visit nexusconnect.io/podcasts

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Brand & Butter of Agriculture with Maureen Ballatori
Pub date: 2024-07-31

Join host Kristin Demoranville on the Bites and Bytes Podcast as she welcomes Maureen Ballatori, the dynamic founder and CEO of Agency29. In this insightful episode, Maureen highlights the crucial role of branding in the food, beverage, and agriculture industries. Discover how to build strong, trustworthy brands and navigate the unique challenges faced by agribusinesses in today's evolving market.

This episode provides valuable insider perspectives on why understanding branding is essential for risk management strategies in cybersecurity, operational technology (OT), food safety, and beyond. Whether you're a tech-savvy professional, a cybersecurity expert, or an OT specialist, Maureen's expertise offers a fresh outlook on the intersection of branding and technology in the food industry.

_______________________________________________

🏆 Vote for Bites and Bytes Podcast for Women in Podcasting Award 🏆

Voting Opens on August 1, 2024, and closes on October 1, 2024

https://womeninpodcasting.net/bites-and-bytes-podcast/

THANK YOU! 🤩 🎉

_______________________________________________

Episode Key Highlights:

(01:59 - 02:44) Connection to Dairy Farm Upbringing

(05:34 - 07:29) Brand Building for Food & Beverage

(09:14 - 10:20) Branding in Food and Ag

(16:36 - 18:04) Building Trust Through Transparency

(22:49 - 23:19) Handling Mistakes With Transparency

(27:24 - 28:05) Global Impact of Declining Dairy Consumption

(34:03 - 34:48) From Dairy Farm to Branding Success

(38:31 - 39:53) Importance of Niche Specialization in Industry

(41:46 - 43:08) Cybersecurity's Impact on Agriculture

(50:27 - 52:07) Building Trust in Food and Ag

_______________________________________________

Show Notes:

Cornell University https://dairy.cornell.edu/

Apples varieties: https://waapple.org/varieties/all/

Bio-ISAC (Milk contimination) https://www.isac.bio/post/update-hpai-h5n1-avian-influenza-2024

BIO-ISAC (cybersecurity efforts): https://www.isac.bio/bioag

Dairy Conference speaking: https://www.maureenballatori.com/events/2024-northeast-dairy-convention

CPG = Consumer Packaged Goods

Ag Chat and Chew: https://us06web.zoom.us/meeting/register/tZIocOGprj8qE9QpQq1QDw75aMj8liv75Jzt#/registration

Andrew Rose: https://www.linkedin.com/in/chesapeakesun/

Andrew Rose’s Bites and Bytes Podcast Episode: https://podcasts.apple.com/us/podcast/the-double-andrew-rose-special-insights-on/id1704061572?i=1000659643673

Grow New York: https://www.grow-ny.com/

Grapevine Powdery Mildew: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8307186/

AgriTech for Powdery Mildew: Robots fitted with ultraviolet light lamps that roam vineyards at night are proving effective at killing powdery mildew: https://cals.cornell.edu/news/robots-armed-uv-light-fight-grape-mildew#:~:text=Robots%20fitted%20with%20ultraviolet%20light,for%20many%20crops%2C%20including%20grapes.

World Agri-Tech – https://worldagritechusa.com/

_______________________________________________

Maureen Ballatori’s Contact Information:

Website

Agency29

Spilled Salt

_______________________________________________

Bites and Bytes Podcast Info:

TikTok

Website: Explore all our episodes, articles, and more on our official website. Visit Now

Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now

Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog

Audience Survey: We value your feedback! Help us make the podcast even better. Take the Survey

Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 42: OT-CERT
Pub date: 2024-07-30

The resources available at small utilities are scarce, and that’s a big problem because small water, gas, and electric facilities are increasingly under attack. Dawn Capelli of Dragos is the Director of OT-CERT, an independent organization that provides free resources to educate and even protect small and medium sized utilities from attack.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Crowdstrike, Virtual Patching and Industrial OT Environments with Debbie Lay, TXOne Networks
Pub date: 2024-07-30

Dino Busalachi sits down with Debbie Lay, Senior Solutions Architect from TXOne Networks, in this week's episode, to discuss challenges and innovative solutions in OT cybersecurity.

They cover the ongoing issues of outdated systems, the complexities of IT and OT convergence, and the benefits of virtual patching as a method for securing OT environments and legacy equipment. They also address the impact of the Crowdstrike event on Industrial OT environments.

Debbie shares her extensive experience and insights into how industries can safeguard their operations from ransomware and other threats without disrupting production.

This episode provides perspectives on managing cybersecurity in industrial environments, and the importance of collaboration between IT and OT teams.

Tune in to understand how virtual patching can be an effective approach to protect critical assets on the plant floor!

Chapters:

00:00:00 - Introduction to OT Cybersecurity
00:01:02 - Debbie Lay's Journey into OT Cybersecurity
00:02:13 - Challenges of Implementing IT Solutions in OT
00:04:17 - Virtual Patching in OT Environments: Securing Legacy Equipment
00:07:17 - IT and OT Convergence: Complexities and Solutions
00:08:21 - Bridging the IT-OT Gap: Importance of Collaboration
00:12:57 - TXOne Technologies for Enhancing OT Security
00:14:40 - The Impact of Cloud-Based Solutions on OT Operations
00:18:46 - Collaboration: A Critical Component in OT Security
00:20:12 - Industry Trends and Key Challenges in OT Cybersecurity
00:23:49 - Conclusion and Insights on Future Discussions

Links And Resources:

Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Lessons from CrowdStrike: Managing Risks in IT and OT Environments
Pub date: 2024-07-29

In Episode 19 of "Protect It All," titled "Lessons from CrowdStrike: Managing Risks in IT and OT Environments," Host Aaron Crow gets into the recent CrowdStrike Falcon platform incident that caused widespread system crashes and blue screens of death on Windows machines. Drawing from his extensive IT and OT experience, Aaron explains that the issue stemmed from a routine update error, not a cybersecurity attack. He explores why it had such a significant impact on major entities like airlines and airports.

Aaron highlights the critical differences between IT and OT risk management, emphasizing the importance of automated updates, real-time threat detection, and thorough update testing. He discusses the need for comprehensive risk assessment and the implementation of cyberinformed engineering practices to prevent similar issues in the future.

Listeners will gain key insights into balancing cybersecurity measures with system reliability and availability and actionable recommendations for strengthening their IT and OT environments.

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: KBKAST (LS 31 · TOP 5% what is this?)
Episode: Episode 269 Deep Dive: Sam Mackenzie | Critical Infrastructure Defence is Doable
Pub date: 2024-07-26

Sam speaks straightforward cybersecurity and technology with business leaders in critical infrastructure. With 25 years’ experience at international corporations and household names in Australia, he’s created and led high performance teams in health, telecoms, energy and more recently in local government, focusing on using structured thinking and making the complex simple.Sam’s recent research project involves interviewing leaders of critical infrastructure in Australia to gain valuable industry insights. Sam also serves on the Cybersecurity Committee for the Australian Computer Society (ACS) and is building a new community of driven professionals, passionate about protecting critical infrastructure and keeping society safe.

The podcast and artwork embedded on this page are from KBI.Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Emerson Automation Experts (LS 24 · TOP 10% what is this?)
Episode: Building Cybersecurity Robustness in Pipeline Operations Podcast
Pub date: 2024-07-25

Manufacturers and producers across all industries know the challenges in keeping their operations cyber-secure. Industries such as pipeline transportation and electrical & gas distribution networks face additional challenges in the wide geographic spread of their operations and the need for reliance on public communications networks.

In this podcast, I’m joined by Emerson cybersecurity expert Steve Hill to discuss these additional challenges and ways the companies in these industries, suppliers, and federal regulators are collaborating to develop and implement best practices for strong cyber resiliency.

Give the podcast a listen and visit the SCADA Solutions & Software for Energy Logistics on Emerson.com and the AspenTech Digital Grid Management page for methods and solutions to improve your cybersecurity defenses and ongoing programs.

TranscriptJim: Hi, everyone. This is Jim Cahill with another “Emerson Automation Experts” podcast. Pipelines cover a wide geographic area and require continuous monitoring for safe, efficient, and reliable operations. Today, I’m joined by Steve Hill to discuss the challenges pipeline operators face in keeping their pipeline networks cybersecure. Welcome to the podcast, Steve.

Steve: Thanks, Jim. Pleasure to be here.

Jim: Well, it’s great to have you. I guess, let’s get started by asking you to share your background and path to your current role here with us at Emerson.

Steve: Thanks, yeah. I’ve been in the automation and SCADA industry for about 40 years, started on the hardware design and communications that then moved over to software. And it’s nearly 20 years I’ve been with Emerson. I joined as part of the Bristol Babcock acquisition. My main focus now is working in wide-area SCADA as the director of SCADA Solutions for Emerson, and most of that’s working in the oil and gas industry, working with Emerson sales and the engineering teams and our customers as they design systems and products for the industry.

And also, alongside that, for the last few years, I’ve been collaborating with CISA. That’s the U.S. government Cybersecurity and Infrastructure Security Agency as part of the Joint Cyber Defense Collaborative.

Jim: Okay. That’s a nice, varied background. That’s really good for our discussion. So, what exactly do you mean by wide-area SCADA?

Steve: That’s a great question. There’s a SCADA system where the software is monitoring equipment across a very wide area. It might be a very large geographic area, like a pipeline or gas, or water distribution network, or perhaps a well field. I mean, some of the systems, for example, I was speaking to a customer last week who is monitoring an entire pipeline across Peru, and yet, their control centers are actually in Mexico. So, to do that kind of thing, the equipment is usually connected via public networks. You know, private networks don’t extend that far, and even the control centers may be widely distributed.

And as part of that, compared to in-plant control, there’s an assumption that your communications are clearly not gonna be 100% perfect. You’re gonna lose communications either momentarily, like with cellular networks, and when, for example, like we’ve got in Texas this week, with natural events like hurricanes can cut communications for hours. But because these systems are all critical infrastructure, such as pipelines or electrical distribution, the actual operations, the process, must never be interrupted. Today, we’re talking about cybersecurity, and that same sensitivity is why these systems are now the target to some of the most sophisticated cyberattacks.

Jim: Okay, that gives a picture of the breadth of these types of SCADA systems, and you had mentioned you’d work with CISA, the cybersecurity infrastructure defense agency, and the Joint Cyber Defense Collaborative, which I’ll just call JCDC for short. Can you give some more examples on that work?

Steve: Yeah. Really, I could give you a bit of background. Probably many of our listeners know that there’s been several successful cyberattacks against critical infrastructure over the last few years. Probably the most famous in the pipeline industry was an attack that’s referred to as the Colonial Pipeline attack. That was actually a criminal ransomware attack that resulted in gasoline and jet fuel shortage across the Eastern U.S. for several days, and that was criminals basically trying to get money. And it was almost a random attack, it wasn’t targeted.

However, there have been actual state-sponsored attacks, and probably the one that was most successful was prior to the Russian military attack against Ukraine. They actually instituted several successful cyberattacks against the Ukrainian power grid. And very concerning is, in recent months, the U.S. infrastructure, including pipelines, have been successfully infiltrated by a group that are called Volt Typhoon, who are thought to be from the People’s Republic of China. So JCDC and CISA are working hard to really counter and protect against these threats.

Jim: Wow. Well, that’s clearly a huge concern. What is the JCDC doing to address these challenges?

Steve: Well, in 2023, so last year, JCDC facilitated the development of something called the Pipeline Reference Architecture. Basically, Emerson, alongside other industry vendors and also pipeline operators, participated in the development of this Pipeline Reference Architecture, which I’ll refer to as the PRA. It’s a fairly short document that outlines the design and operating principles for SCADA systems in the pipeline industry. And one thing the government is keen to point out, it’s not a regulatory document, but it does set out the best principles and is intended as guidance for the industry. Really, they want to work with the industry to come up with best practices.

Jim: Well, it sounds like this PRA is another set of standards to address cybersecurity. Why is another document needed in the industry where a bunch of standards exist now?

Steve: Yeah, that’s a question I and other members get asked quite a lot. The main reason is that wide-area SCADA represents a very different set of challenges to traditional SCADA, which we refer to as inside the wire. So for example, a refinery or a manufacturing plant, everything is in one location. But as I mentioned before, wide-area SCADA has got a very wide displacement, physically. It also actually has a lot of remote field workers. There may be folks working on that system hundreds of miles from base, and you’re also using communications networks that are not even owned or operated by the owners of the pipeline. Though this PRA is really intended for the pipeline industry, clearly, it’s applicable to almost any wide-area SCADA, that’s water or electrical industry as well.

Jim: Okay, that makes sense. So those are definitely challenges that don’t exist for more automation systems, as you say, inside the wire. Tell us more about how the PRA addresses these.

Steve: Well, the big thing is segmentation, basically, taking the network and splitting it into different levels that represent different areas of the operation. For example, the internet would be what’s referred to as level zero, and moving all the way down to the bottom of the network, that’s level nine. And the levels in between that represent different levels of trust. Now, those who are familiar with cybersecurity and SCADA are probably familiar with something that is called the Purdue model, which I think first came out in the late 1980s, and that also splits up SCADA and control networks and actually business networks into different levels. However, when that came out, the internet was in its infancy. No one would ever have used the internet or even really public IP networks for their connectivity. So it doesn’t really take into account many of the things we take for granted today in these systems.

So the PRA is intended to expand and take into account the reality that, for example, some of this critical data will actually be transiting across a public network, right? And in order to achieve that with this segmentation, we’re using a concept called Defense in Depth, right? And as you go down the different levels of the network, the assumption is you can trust each item on that network better. So, for example, on the internet, you don’t trust anything, but when you get down, let’s say, to the communications between an RTU [remote terminal unit] and a gas chromatograph on a local serial link, you might completely trust that. Now, it’s interesting, although that’s part of the PRA model, that does actually conflict with a security concept called Zero Trust, which is something that Emerson has really based our products on. But both zero trust and defense in depth are valid.

Jim: Now, you had mentioned a couple of concepts I’d like to explore a little bit more in there, and let’s start with zero trust. Can you explain that concept to us?

Steve: Oh, yeah. Yeah. Zero trust is a concept where any piece of equipment or software should trust nothing. Don’t trust anything else on the network, don’t trust the network to be safe, and it should not rely on anything else for protection. And historically, SCADA was protected, for example, by firewalls. You would use insecure products that were known to not be secure because they were developed perhaps 20 or 30 years ago and hide them behind firewalls, and that’s really how we’ve handled security today. But there’s a realization you can’t do that. So we now need to design products so that they don’t trust anything.

But the reality is many of our customers, Emerson’s customers and pipeline operators, have devices that were installed perhaps 30 years ago. That’s the typical lifespan of some RTUs and controllers in this industry. So as a result, when you get down to the lower levels of the network, zero trust doesn’t work. So you do have to have levels of additional protection. So for example, if you had a Modbus link, which is basically insecure almost by design, that should be protected by additional levels of firewalls and so on. But if you’re designing a modern product, it should be designed so it doesn’t rely on anything else. And that’s the concept of zero trust.

Jim: Okay, got it. So don’t trust anything. Everything must be proven out. And the other concept you talked about was defense in depth. So, what does that mean?

Steve: Well, the phrase is most commonly used where we’re talking about a network with multiple levels in. So when you come from, for example, the internet into your business network, you would have a set of firewalls and what’s called the demilitarized zone. And then when you go from your business network down to your controls network, you’d have another set of firewalls. So it’s multiple levels of protection. However, that same concept should be used actually within products as well. And, in fact, Emerson takes that very seriously with our secure development lifecycle certifications, IEC 62443, and how we design those products.

Jim: Well, that’s good. As you get those two and as you put in more modern technology, that it complies and has that cybersecurity built into mind there. So, can you give us an example of how it’s built in?

Steve: Yeah. That great one. If I take, for example, the Emerson FB3000 RTU, that’s a flow computer and a controller device that’s designed specifically for the oil and gas industry, especially for pipelines, an obvious concern is that that may be attacked externally to modify the firmware. Now, at the first level, the RTU itself has secure protocols. It uses something called DNP3, which would, in theory, provide access to the device. But then the firmware, when we issue new firmware, we put it on a website so we have protection of the website, we also publish a hash, which is basically a unique key that the customer downloading the firmware can check. It hasn’t been modified by anyone attacking the website. But then, when they actually put it into the RTU, so they’re updating firmware, the RTU will check that that firmware was developed by Emerson and was intended for that device. It does that by certifying certificates on the load.

Now, once it’s in the device and it’s running in the field, you might say, “Well, the task is done,” but there’s an additional level of protection. It will continually and on boot, check that firmware, make sure the certificate still matches, it’s not being changed. And if it has been changed, it will actually revert to a known good factory firmware that’s basically embedded in the device. So you can see that there’s really five or six different things all checking and ensuring that firmware in that device was not compromised. So basically, multiple levels within the device, and in addition, there’s multiple levels on the network. So the bad guys have to get through a lot of different levels to damage or compromise the device. And we’re trying to do that with everything we design today.

Jim: Yeah. And with modern cryptography and making any change completely will change that hash and everything and make it impossible to slip something in without it being noticed. So that’s really a nice thing.

Steve: Yeah. And the fact that even if it detects it, it then goes back to factory firmware, which may be a slightly older version, but your operation will keep running. It will keep controlling, which is a very nice feature.

Jim: Yeah, that’s a great example there. I guess, going back to the PRA, what else does it include other than the segmentation that you discussed?

Steve: There’s about 10 high-level principles that cover aspects of the design and operation of the SCADA system. And for each of these, there’s various examples and guidance on how to actually follow the principle in a real-world system. So, for example, there was a whole section on how to manage third-party devices in the contractors, because on a pipeline system, you’re almost certainly gonna have, for example, engineers from Emerson coming in from third parties. So it gives examples on the real-world aspects of operating the system.

Jim: Are there other examples from it you can share?

Steve: Yeah. One important one is when you’re designing the system, you should identify and document all of the different data flows that occur. And that’s, when I say data flow, communications or conversation between different pieces of equipment. So, for example, this RTU may communicate with that SCADA platform on this particular machine and may communicate with a measurement system on another machine, document all of those data flows, and then deny all other data flows by default. Then, after the system is running, continually monitor it passively. And if you see an additional communication, say, between two pieces of equipment that normally never communicated or didn’t communicate on a particular IP socket, flag that immediately, because it may be something that’s going on that was unexpected. It certainly was outside the original design of the system.

Jim: This has been very educational. Thank you so much, Steve. Where can our listeners go to learn more?

Steve: Well, really a couple of places. If you go to the CISA blog, which is at www.cisa.gov/news-events, there’s details there. The actual PRA was published on March the 26th of this year. And also, if you want to discover more about Emerson’s involvement in wide-area SCADA and the cybersecurity associated with it, if you go to Emerson.com/SCADAforEnergy, you’ll find some information there.

Jim: Okay, great. And I’ll add some links to that and to some of the other things we discussed in the transcript. Well, thank you so much for joining us today, Steve.

Steve: Not a problem. It’s a pleasure.

-End of transcript-

The podcast and artwork embedded on this page are from Emerson Team, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Tony Reshef CaaS @Electra group and others on the roll of contract Ciso & being an ethical hacker
Pub date: 2024-07-25

גופים רבים שאינם יכולים להרשות לעצמם סיסו במשרה מלאה פונים לאופציה של סיסו אס הסרבייס.

נחשון פינקו מארח את טוני רשף הסיסו של אלקטרה, מדיקל ארליסיין ויווויזן בין שאר הדברים שהיא עושה בשיחה על המשמעות של סיסו אס הסרביס, ההבדל בין סיסו אס הסרביס ויעוץ סייבר. איך בונים את התפקיד על מנת שיהיה אפקטיבי? החשיבות של סקרי סייבר, תוכנית עבודה ובדיקות חדירות לארגון. מהם גבולות הגזרה של הסיסו כאשר הוא אינו חלק אינטגרלי משדרת הניהול

Many organizations that cannot afford a full-time CISO use the Ciso as a Service (CaaS) option.

Nachshon Pincu hosts Toni Reshef, serving as a contract Ciso for @Electra group, Medical EarlySign, and Uvision, among other things she does in a conversation about the meaning of CaaS, the difference between CaaS and cyber consulting.

How do you build the CaaS position to be effective?

What is the importance of cyber surveys, Cyber plans, and penetration tests (PT) for organizations?

What are the limits of the CaaS when it is not an integral part of the management avenue?

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: From Concept to Reality: ResetCon and the Future of ICS Security Conferences
Pub date: 2024-07-24

In this episode, host Aaron Crow dives into critical infrastructure and industrial control systems with special guests Matthew Miller and James Warne. Together, they introduce ResetCon—an upcoming conference to close the gap between technical research and practical applications in cybersecurity.

Our listeners get an exclusive discount for attending ResetCon this year! Visit https://rstcon.org/2024/ and use the code PrOTect to receive a 10% discount on your tickets.

The discussion highlights the importance of including cybersecurity in infrastructure design, tackling supply chain attacks, and fostering collaboration among industry experts. With the call for papers closing soon, listeners are encouraged to submit abstracts and join this revolutionary initiative.

Episode 18 promises valuable insights into the intersection of IT, OT, and critical infrastructure cybersecurity. It emphasizes the need for more skilled professionals and community-driven solutions.

Don’t miss this chance to learn, get inspired, and prepare for ResetCon!

Key Moments:

03:32 ResetCon aims to deliver cutting-edge tech talks.

08:47 Debating cause, but the outcome is unchanged.

11:49 Conference seeks to address critical infrastructure issues.

16:06 ICS Village presence at key cybersecurity events vital.

18:34 Sharing industry knowledge and protecting brand integrity.

20:51 Colin O'Flynn presents cutting-edge hardware innovations.

26:05 Diverse audiences at the ponderous conference.

28:34 Understanding same team, goals, critical infrastructure, not experts.

30:37 Submitted on 3rd, some issues, resubmitted 6th.

35:52 High-tech talks, networking, and exploring Savannah.

38:39 Discussing boat transportation as part of long-term goal.

40:38 Collaboration can lead to innovative infrastructure solutions.

44:10 Discussing relevance of Wi-Fi and security measures.

About the guests :

James Warne

Jay's work in research has affirmed his commitment to technology, security, and computation. His time on and leading high-performing teams codified his desire to enable and support his scientists and engineers. Jay constantly seeks ways to contribute to his field; one may find him testing his theories, reading and sharing papers, problem-solving with industry, arming investors with technical knowledge, coordinating RSTCON, developing instructive/ research presentations, mentoring new industry hopefuls, advising the Cornell Cyber Club, or outdoors.

Matthew Miller

Matthew spent eight years in the United States Navy and Special Operations as a CNO Operator. After the military, he shifted his career toward security research and software engineering. Recently, Matthew co-founded ResetCon to address growing cybersecurity concerns in critical infrastructure. He's passionate about his family, work, and about giving back to the community

Know more about Reset Conference - https://rstcon.org/

Attend ResetCon this year!

Visit https://rstcon.org/2024/ and use the code PrOTect to receive a 10% discount on your tickets.

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 3% what is this?)
Episode: The Case For A Cyber Force
Pub date: 2024-07-23

In this episode, Bryson sits down with Mark Montgomery, Senior Director at the Foundation for Defense of Democracies. For three years, Mark served as Executive Director of the Cyberspace Solarium Commission, created by congressional mandate to develop strategic approaches to defending against cyber attacks. Now, he directs CSC 2.0, an initiative that works to implement the recommendations of the Commission.

What were the key recommendations of the Cyberspace Solarium Commission? What are the politics of cybersecurity? How do we ensure that our international partners have the same level of resiliency and recovery that we have domestically?

“We'd like to fight our adversaries overseas. That means we have to fight with and through our allies and partners. So they have to have strong critical infrastructure as our forces arrive and execute their missions,” Mark said.

Join us for this and more on this episode of Hack the Plan[e]t.

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Patch Management and Software Updates: IT versus OT
Pub date: 2024-07-23

Craig and Dino dig into the differences and nuances of patch management and software updates comparing IT versus Operational Technology (OT) environments.

They explore the distinct challenges that OT systems face with software updates, and risks associated with patch management, including potential operational disruptions and risks of downtime.

They discuss the importance of IT understanding the OT risks and challenges of updating software and implementing patches to ICS and OT equipment.

The conversation highlights innovative solutions like virtual patching, the role of OEMs, and the critical need for a strategic, collaborative approach to cybersecurity in industrial settings.

Chapters:

00:00:00 - Introduction to Patching Challenges
00:01:08 - IT vs OT Patching: Key Differences
00:02:55 - Understanding the Cost of Downtime in OT
00:03:32 - Overcoming Challenges with Legacy Systems
00:05:21 - Navigating OEMs and Safety Concerns
00:06:45 - The Role of Safety in OT Patching
00:08:52 - Exploring Virtual Patching Solutions
00:13:11 - Enhancing Vendor Collaboration and Risk Management
00:16:48 - Impact of Mergers and Acquisitions on Cybersecurity
00:18:33 - Addressing Insurance and Compliance Issues
00:20:12 - Significant Consequences of Not Patching
00:23:14 - Building an Effective Collaborative Cybersecurity Strategy
00:24:03 - Conclusion and Actionable Insights

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Automation Chat (LS 26 · TOP 10% what is this?)
Episode: How to Maintain Business Continuity with IT/OT Synergies in Your Cybersecurity Strategy
Pub date: 2024-07-23

In this episode of our “Automation Chat” podcast from The Journal From Rockwell Automation and Our PartnerNetwork magazine, Executive Editor Theresa Houck chats with Brian Deken, North America Commercial Manager of Networks & Cybersecurity Services at Rockwell Automation. They talk about cybersecurity challenges and outcomes manufacturers are trying to achieve and how to attain them.

Also learn why it’s vital to do cybersecurity assessments in real time and why you can’t integrate and optimize an IT tool for an OT environment. And see how Rockwell Automation provides IT/OT synergies through its partner ecosystem and uses the NIST-based approach to help manufacturers to focus resources for cybersecurity.

And as always, get your family-friendly, silly Joke of the Day.

Resources from this episode:

Cybersecurity Preparedness Assessment.
Rockwell Automation Industrial Cybersecurity Solutions.
Blog: Improving Critical Infrastructure Cybersecurity (includes NIST explanation).
Subscribe to The Journal’s 4 print magazines (Feb., May, July and Oct.) by e-mailing Anna Hicks at ahicks@endeavorbusinessmedia.com.
Subscribe to our 4 digital magazines at http://rok.auto/thejournal-subscribe.

You can also watch their discussion on YouTube at https://youtu.be/8NtR7oHzhhY.

Automation Chat is brought to you by The Journal From Rockwell Automation and Our PartnerNetwork magazine.

Find us on LinkedIn.

Find us on Facebook.

Find us on X (Twitter).

Please subscribe and give us a 5-star rating and a review.

** Named Best Podcast 2 Consecutive Years! 2022 & 2023 Apex Awards of Publication Excellence.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: פרק מס' 1 בסדרת "מחפשים עבודה" – אסטרטגית חיפוש עבודה וכתיבת קור"ח בראיית המגייסת והמסננת האוטומטיות
Pub date: 2024-07-23

חזרת ממילואים ומצאת את עצמך בלי עבודה ופרנסה קבועה

רוצה להיכנס להייטק או כול תחום אחר כג'וניור

רוצה להחליף מקום עבודה כסיניור

רוצה לעשות שינוי כיוון בקריירה שלך סדרת הפודקאסטים הזו נועדה עבורך

נחשון פינקו מארח את דפנה הר-לבן מנהלת קשרי הייטק בקריה האקדמית אונו ומנהלת מחלקת גיוסים בעברה. בתפקידה הנוכחי דפנה מסייעת לסטודנטים במכללה במציאת עבודה. הפודאסט כולו סביב חיפוש עבודה, בניית אסטרטגיה לחיפוש עבודה ואיך בונים נכון קורות חיים.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: New Resource: Adapting IT Advice for OT [The Industrial Security Podcast]
Pub date: 2024-07-22

The CIS Top 18 is widely used in IT, and Jack Bliss of 1898 & Co. has adapted that list for OT/industrial, adding a lot of industrial context and lists of related OT-centric tools and technology.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Bridging the Security Gap: How HERA Transforms Remote Access in Industrial Environments with Andrew Ginter
Pub date: 2024-07-22

Welcome back to Protect It All! In Episode 17, host Aaron Crow is joined by Andrew Ginter, VP of Industrial Security at Waterfall Security Solutions, to dive deep into secure remote access for Operational Technology (OT) systems. They explore the cutting-edge HERA (Hardware Enforced Remote Access) technology, which offers a revolutionary approach to remote control via TPM hardware, unidirectional gateways, and stringent encryption protocols.

This episode covers everything from the critical need for robust security in high-stakes environments like wind farms and manufacturing to the dangers of supply chain vulnerabilities to the broader implications for industries dependent on remote operations.

Ginter sheds light on the limitations of software-based solutions and the strategic advantages of hardware-enforced security, while also discussing his book "Engineering Great OT Security" and the latest initiatives in cyber-informed engineering.

Tune in to learn how organizations can remain competitive, reduce costs, and stay secure in an increasingly interconnected industrial world. This enlightening discussion could change the way you think about remote access!

Key Moments:

05:53 Spectrum of consequence in remote access explained.

07:55 Security flaws in remote access systems.

10:23 Remote access is often overlooked by many.

15:11 Supply chain vulnerability due to cloud connectivity.

17:33 Hardware-enforced remote access, HERA, fills the security spectrum.

20:52 Custom ASIC with 1M transistors for encryption.

25:55 Ways to exploit network security vulnerabilities discussed.

26:35 Exploiting technology to send unauthorized messages.

32:50 Benefits of centralizing engineering teams in businesses.

34:18 Competing in the international market with unique services.

39:31 Understanding the implications before implementing technology is crucial.

40:30 Uncertainty about large number, risk opportunity tap.

43:50 Firewall controls data flow and is potentially misconfigurable.

About the guest :

At Waterfall Security, Andrew leads a team of experts working with the world's most secure industrial sites. He is the author of three books on industrial security, co-author of the IIoT SF and the UITP Guide to CyberSecurity in Tendering, and co-host of the Industrial Security Podcast.

Links:

https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/hardware-enforced-remote-access-hera-under-the-hood/

LinkedIn: https://www.linkedin.com/in/andrewginter/

Email Andrew: andrew.ginter@waterfall-security.com

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Vincente Diaz on Using AI for Malware Analysis
Pub date: 2024-07-21

Vincente Diaz, Threat Intelligence Strategist on Google’s VirusTotal team and formerly the EU director of Kaspersky Lab’s Global Research & Analysis Team, joins the Nexus Podcast to discuss how artificial intelligence and machine learning is an integral part of what VirusTotal is doing around malware analysis. Vincente describes the advantages these advanced technologies bring to malware analysis, in particular how it cuts down analysis time, and improves exploit detection.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Osher Assor Partner and CEO of Cyber Security & Tech Division @Auren Israel about penetration testing (PT)
Pub date: 2024-07-17

האם העובדה שביצעתם מבדקי חדירות ותיקנתם ליקויים אומרת שאתם מוגנים? אין ספק שאתם יותר מוגנים ממה שהיתם לפני, אבל נדרש לערוך את מבדקי החדירות בלופ כדי לוודא שלא נפתחו פרצות חדשות מאז המבדק האחרון

נחשון פינקו מארח את אושר עשור שותף ומנכ"ל חטיבת הסייבר והטכנולוגיה באוריין ישראל, אחת משתיים עשרה חברות ראיית החשבון הגדולות בעולם. בשיחה על מבדקי חדירות, ההבדל בין כלים אוטומטים למבדק אנושי ועוד

Does the fact that you performed penetration tests and corrected defects mean that you are protected? You are undoubtedly more protected than before, but conducting the penetration tests in a loop is necessary to ensure that no new loopholes have opened since the last test.

Nachshon Pincu hosts Osher Asor, partner and CEO of Cyber Security & Tech Division @Auren Israel, one of the twelve largest accounting firms in the world. In a conversation about penetration tests, the difference between automated tools and human testing, and more.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 41: Firmware SBOMs, Zero Trust, And IoT Truth Bombs
Pub date: 2024-07-16

For the last twenty years we’ve invested in software security without parallel development in firmware security. Why is that? Tom Pace, co-founder and CEO of NetRise, returns to Error Code to discuss the need for firmware software bills of materials, and why Zero Trust is a great idea yet so poorly implemented. As in Episode 30, Tom is a straight shooter, imparting necessary truth bombs about our industry. Fortunately he’s optimistic about our future.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Richtige Cybersicherheits-Invest-Entscheidungen brauchen zuerst eine OT-Security-Strategie
Pub date: 2024-07-15

In dieser Folge von Rhebos OT Security Made Simple erklärt Matthias Maier vom SIEM-System-Hersteller Splunk, warum eine OT-Sicherheitsstrategie auf Managementlevel unumgänglich ist, um bei der Tool-Auswahl die richtigen Investment-Entscheidungen zu treffen. Er erläutert die einzelnen Schritte und verdeutlicht noch einmal die Verantwortung des Managements bei der Cybersicherheit der OT, insbesondere mit Blick auf NIS2 und Co.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Risk Management Podcast (LS 34 · TOP 3% what is this?)
Episode: EP 162: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), part 2
Pub date: 2024-07-16

Let's continue unpacking the "Cyber Incident Reporting for Critical Infrastructure Act". What else do you need to know? Let's find out with your hosts Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

The podcast and artwork embedded on this page are from Kip Boyle, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Future Trends in Industrial Cybersecurity with Sandeep Lota of Nozomi Networks
Pub date: 2024-07-16

In this episode, cybersecurity expert Sandeep Lota, Nozomi Networks Field CTO, joins Dino Busalachi to discuss the challenges and innovations in OT cybersecurity.

Key topics they explore include dealing with the evolution of OT security tools, the challenges with IT-OT convergence, and the increasing importance of continuous monitoring.

Sandeep also talks about the role of OEM partnerships and the rising trend of managed services. Tune in to stay ahead of the curve!

Chapters

00:01:00 - Meet Sandeep Lota of Nozomi Networks
00:02:00 - Cybersecurity Journey and Milestones
00:03:00 - IT vs OT: The Convergence Challenge
00:05:00 - OEM Partnerships in Security
00:07:00 - Future Trends in OT Security
00:10:00 - Why Continuous Monitoring Matters
00:11:00 - The Boom in Managed Services
00:18:00 - Nozomi Networks' Global Impact
00:19:00 - Key Takeaways and Final Thoughts

Links And Resources:

Sandeep Lota on LinkedIn
Nozomi Networks
Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Understanding IT OT Convergence: Dealing with Challenges and Building Trust
Pub date: 2024-07-15

In this episode, host Aaron Crow delves into IT OT convergence, a crucial yet often misunderstood topic. Listeners will gain insights into the distinct differences between IT and OT, the challenges of integrating these fields, and the reasons behind the historical mistrust between IT and OT teams.

Aaron discusses how technology might be similar, but the roles and impacts are starkly different—with IT focusing on corporate environments and OT handling mission-critical operations like power plants and manufacturing lines. He also shares real-world stories and strategies for building trust and fostering collaboration between these often siloed teams.

Tune in to learn how to overcome these hurdles to create a more secure and efficient organization. Whether you're an IT professional or an OT specialist, this episode offers valuable perspectives on navigating the complexities of IT OT convergence.

Key Moments:

00:10 Technology similarities, lack of understanding, a trust issue.

03:49 Corporate distrust causes technology outages and inefficiency.

07:21 Building trust and collaboration for buy-in.

11:20 Different games, but similar athletic requirements.

15:38 Team successful in providing technical support in Texas.

17:09 Connect with us at Black Hat, DEF CON.

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Applying ISAIEC 62443 Can Boost Defense in Depth
Pub date: 2024-07-15

To create a secure manufacturing enterprise, you need to apply defense in depth. That means at a very basic level, if a threat actor is able to get through one level of defense, there are plenty more for them to wade through. A solid defense in depth program can truly halt an attack or really slow it down.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Miri Ofir Director of R&D @Check Point on the cyber-physical systems & embedded cyber protection
Pub date: 2024-07-12

תחום הגנת הסייבר על מערכות אימבדד (מערכות סייבר פיזיות) עוסק בהגנה על מערכות שבדרך כלל מבוססות על מערכות הפעלה ותוכנה משולבות בפירמוור מצומצם מחד, מאידך כמות המכשירים המפוזרים בעולם מגיע לעשרות ואף מאות מיליוני יחידות. עובדה זו משמשת תוקפים ליצירת מתקפות מסיביות על חברות ע"י שימוש בו זמני במיליוני מערכות אימבדד. בצורה כזו הופלו בעבר חברות התקשורת הגדולות בארה"ב מה שהביא לאי יכולת מתן שירותיים ללקוחות וניתוק אזורים שלמים מתקשורת

עם התרחבות הרגולציה בתחום והדרישה מיצרנים להטמיע מערכות הגנה בתוך המוצרים נושא הגנת מערכות סייבר פיזיות תופס תאוצה. חברת צ'ק פוינט הייתה מהראשונות לזהות את הצורך ומתן מענה למוצרי אי.או.טי כבר בעשור הקודם

נחשון פינקו מארח את מירי אופיר דירקטורית פיתוח בצ'ק פוינט שהצוותים שלה מסייעים לחברות המייצרות מערכות פיזיות להגביה את חומות הסייבר במוצריהן, בשיחה על הצורך, הדרישה הגוברת של הרגולטורים להגנות משמעותיות ועד כמה שונה ההגנה הסייבר פיזית מהעולם המוכר של האי.טי

Cyber protection for embedded and cyber-physical systems (CPS) revolves around securing systems that typically rely on operating systems and software integrated into limited firmware. On the other hand, the number of devices scattered worldwide reaches tens of millions and, in some cases, even hundreds of millions of units. Unfortunately, attackers exploit this vast network to orchestrate massive attacks on companies, simultaneously leveraging millions of compromised systems. In the past, such coordinated attacks have disrupted major communication companies in the US, leading to service outages for customers and disconnections in entire regions.

As regulations expand within this domain, manufacturers face increasing pressure to implement robust protection mechanisms in their products. The issue of safeguarding CPS has gained momentum, and companies like Check Point have been at the forefront. Check Point recognized the need for solutions tailored to IoT products as early as the previous decade.

Nachshon Pincu hosts Miri Ofir, Director of R&D at Check Point, who illuminates the urgency of robust protections. Her teams work closely with companies that produce physical systems, fortifying their products against cyber threats. This discussion delves into regulators' evolving demands, emphasizing the unique challenges of CPS protection compared to the familiar landscape of traditional IT security.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: An OGOFOT Public Service Announcement
Pub date: 2024-07-10

A quick update from MIranda, to explain the recent delays in new episodes. She also has a few teasers of new episodes that will be coming soon! Well, maybe "eventually" is a better word, because our production process has become more difficult. But there is some great new content on its way, we promise!

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Smarter Homes & Buildings
Episode: Utilize Native Functionality in Building Automation PLCs to Improve Security
Pub date: 2024-06-24

In this episode of the ASHB Smarter Homes and Buildings Podcast, ASHB is joined by Vivek Ponnada from Nozomi Networks. Vivek, a Technology Solutions Director shares his expertise on programmable logic controllers (PLCs). ASHB and Vivek dive into the world of PLCs, discussing their role in building automation, from HVAC systems to lighting control. Vivek highlights the security concerns associated with PLCs and introduces the groundbreaking "Top 20 Secure PLC Coding Practices" project. This initiative aims to enhance the security of these crucial systems using native functionality and proposing best practices for engineers. Vivek also explores the project's future direction, including the expansion to the "Top 20 Secure PLC Environmental Practices" project. Learn about the importance of securing PLCs in building automation, the collaborative efforts driving this initiative, and how you can get involved. Visit plc-security.com for more information and to join the community.

The podcast and artwork embedded on this page are from ASHB (Association for Smarter Homes & Buildings), which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: The Security Sandbox | AI to the Rescue: Protecting Critical Assets Using the Cloud
Pub date: 2024-07-09

Artificial intelligence (AI) is having a moment… a really long moment. It’s been evolving for decades, but now it’s everywhere all at once. AI-powered digital assistants like Siri and Alexa, as well as generative AI tools like ChatGPT, Gemini and Copilot, have put AI at everyone’s fingertips, including cybercriminals.In cybersecurity, the race is on to outsmart bad actors who are already using new forms of AI to find vulnerabilities faster and launch more effective attacks. During this session, we'll delve into what AI really is, its applications for cybersecurity, and how critical infrastructure and industrial organizations are using it to stay ahead of cyber threats.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: S4x24 Main Stage Interview With Stewart Baker
Pub date: 2024-07-10

Stewart Baker is one of the preeminent lawyers on topics of cyber law with an impressive career in and out of government. Stewart also hosts the Cyberlaw podcast.

The Biden administration is contending that vendors should be held liable for security deficiencies in their products.

Assuming this is turned into law and/or executive orders, what does it mean? What can we learn from other liability law to inform us what would be required for a vendor to be held liable for a security issue? How would the judgment / damages be determined.

Dale's note: We talk about the SEC charges against SolarWinds in this interview.

View Details

Podcast: PrOTect It All
Episode: Navigating Cybersecurity in OT: Challenges, Tools, and AI Integration with Joseph Perry
Pub date: 2024-07-08

In this episode, Aaron Crow and special guest Joseph Perry dive deeply into the evolving landscape of cybersecurity. The episode explores the integration of commercial off-the-shelf systems into OT environments, highlighting how this transition brings similar security challenges from the IT sector into play. Throughout their discussion, Aaron and Joseph tackle the complex vulnerabilities, the resistance to adopting new technologies, and the critical necessity of tailored security measures. They also examine the pervasive buzzwords like "AI" in modern cybersecurity products.

Listeners will gain insights into the growing regulatory scrutiny from the SEC, the heightened responsibility of Chief Security Officers, and the anticipated evolution of cybersecurity professions into more rigorous, skilled trades. The conversation further touches on the chaotic state of threat intelligence, the impact of technological advancements such as AI on cyber-attacks, and the increasing industrialization of fraud. From understanding the hype cycles of AI to the practical challenges of explaining complex security solutions to non-technical stakeholders, this episode is packed with valuable information.

Aaron and Joseph also discuss the importance of learning from past IT mistakes when adopting new technologies and the unique challenges of protecting both cutting-edge and legacy systems within OT environments. As they address topics like social engineering attacks, ransomware, and the use of AI tools in cybersecurity, listeners will come away better equipped to navigate the intricate cybersecurity landscape. Tune in for a comprehensive exploration of these critical issues.

Key Moments:

05:36 Library catalog conversion led to career in cybersecurity.

15:02 AI useful in cybersecurity for structured data.

18:07 Questions remain about AI, and human intervention need.

25:39 Advanced fraud detection surpasses current AI capabilities.

28:37 AI contributes significantly to medicine, finance, and cybersecurity.

34:57 Powerful means test and audience testing revolutionized fraud.

37:58 Attacks getting shorter, focused on initial access.

47:52 Focus shifts to CPE, vulnerability, and attack.

48:53 Russian threat actors reassert, causing chaos. No rules.

54:43 IT challenges in dealing with construction clients.

59:56 Evolution of cyber security concerns and measures.

About the guest :

Joseph Perry is a seasoned cybersecurity expert currently leading incident response, threat intelligence, and purple teaming at MorganFranklin Cyber. With a background spanning the US Navy and the National Security Agency, Perry has built a robust expertise in emerging technology and cybersecurity. He specializes in critical infrastructure protection, threat intelligence, and the adoption of new technologies.

Perry is a prominent figure in the cybersecurity community, contributing his insights at major conferences like Black Hat and Defcon. He focuses on the practical applications of AI in cybersecurity, fraud detection, and the evolving threat landscape. Committed to advancing the field, Perry emphasizes continuous learning and domain expertise to help organizations combat cyber threats effectively

How to connect Joseph : https://www.linkedin.com/in/lousyhacker/

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: Top Takeaways: Why IT and OT Must Unite Now
Pub date: 2024-07-02

This episode focuses on the critical intersection of IT and OT in industrial cybersecurity.

Featuring discussions on strategic partnerships and validated designs, the episode addresses the challenges of data protection, digital safety, and asset inventory.

The conversation goes into how companies can better secure their operations by integrating IT and OT, leveraging new technologies, and improving operational efficiency.

The speakers also share insights on the evolving landscape of cybersecurity and the importance of collaboration between different departments within organizations to mitigate risks and ensure safety.

Chapters:

00:00:00 - Welcome to Industrial Cybersecurity Insiders!
00:01:20 - Cybersecurity and Data Protection in Modern Manufacturing with Jim Fledderjohn, Dell Technologies
00:07:12 - The Future of Cybersecurity Insurance with Observatory Holding’s CEO, Gerry Kennedy
00:13:59 - Unmasking Industrial Cybersecurity Threats and Solutions with Dave Purdy of TXOne Networks
00:23:21 - Cybersecurity A-Z in Manufacturing and Industrial Sectors with Armis CTO, Mick Coady

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Ahmik Hindman on Patching OT and ICS
Pub date: 2024-07-08

Ahmik Hindman, Senior Network and Security Solution Consultant at Rockwell Automation, joins the Claroty Nexus podcast to discuss the challenges and success stories he's experienced in patching operational technology equipment and industrial control systems. Hindman has been at Rockwell Automation for 28 years and has expansive experience with customers solving these complex cybersecurity issues. Hindman shares some of the frameworks, tools, and approaches he's worked with, and how convergence and other recent trends have changed how organizations handle vulnerabilities.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: SEC Cybersecurity Rulings: Are Public Companies Really Ready?
Pub date: 2024-06-25

Craig Duckworth and Dino Busalachi discuss the pressing issue of cybersecurity compliance for publicly traded companies under new SEC regulations.

They discuss the reasons behind the low number of reported breaches, including national security exemptions and potential corporate negligence.

Craig and Dino address the challenges companies face in safeguarding their operations, from inadequate incident response plans to the ins and outs of securing industrial control systems.

Tune in to understand why transparency and proactive measures are essential for protecting both companies and their investors.

Chapters:

00:00:00 - Introduction: The True Cost of Cybersecurity Neglect
00:01:00 - Craig and Dino Unpack the SEC Rulings for Public Companies
00:02:29 - National Security Exemptions: A Double-Edged Sword
00:03:42 - The Complexities of Supply Chain Cybersecurity
00:05:32 - The CISO's Dilemma: Balancing Security and Operations
00:08:32 - Financial Fallout from Cybersecurity Failures
00:10:03 - Incompetence or Intentional? Unveiling Cybersecurity Failures
00:17:10 - The Role of Insurance in Cybersecurity Breach Mitigation
00:18:00 - Call to Action: Practical Steps to Improve Cybersecurity
00:21:47 - Conclusion and Final Thoughts: Taking Responsibility

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Food Security and Crisis Management with Kyle King
Pub date: 2024-07-08

In this special episode of the Bites and Bytes Podcast, host Kristin Demoranville is joined by Kyle King, Managing Director of Capacity Building International and founder of Crisis Lab. Unlike our typical episodes focused on food industry experts, this conversation explores broader themes such as food insecurity, crisis management, and food security during global crises.

Kyle shares his extensive experience in emergency services and international security, discussing the impact of global conflicts, such as the Russian invasion of Ukraine, on our food supply chains. Learn how food insecurity leads to mass migration and the innovative ways communities build resilience. Kyle also sheds light on the crucial role technology plays in both the challenges and opportunities of modern farming.

This episode is part one of a special two-part series. Stay tuned for part two on the Crisis Lab Podcast, where Kyle and Kristin will discuss practical steps communities can take to be more resilient in the face of food supply challenges and technological disruptions. That episode will air on July 14, 2024, on the Crisis Lab Podcast.

___________________________________________________

Show Notes:

Food waste statistic:

https://www.theworldcounts.com/challenges/people-and-poverty/hunger-and-obesity/food-waste-statistics
https://www.usda.gov/foodwaste/faqs

Fires with electric vehicles:

https://www.diva-portal.org/smash/get/diva2:1168490/FULLTEXT01.pdf

German EV Sales after tax cut removed:

https://www.msn.com/en-ca/money/markets/ev-sales-run-out-of-juice-in-europe-as-germans-tighten-belts/ar-AA1nbdJG

Baltic Sea Infrastructure Incident:

https://carnegieendowment.org/research/2024/05/nato-baltic-sea-security-nord-stream-balticconnector?lang=en¢er=india

Russian ships off the coast of Florida, USA:

https://www.newsweek.com/us-navy-shadowing-russian-flotilla-off-florida-coastsatellite-data-1911106
https://economictimes.indiatimes.com/news/international/us/why-is-there-a-russian-nuclear-submarine-just-200-miles-off-the-coast-of-florida/articleshow/110977652.cms?from=mdr

Deep Sea Mining for Minerals for EV batteries:

https://www.npr.org/2021/09/03/1031434711/your-next-car-may-be-built-with-ocean-rocks-scientists-cant-agree-if-thats-good
https://www.instituteforenergyresearch.org/renewable/deep-sea-mining-of-critical-minerals-for-ev-battery-production/

___________________________________________________

Crisis Lab Podcast: https://www.crisislab.io/podcasts/crisis-lab

Crisis Lab: https://www.crisislab.io/

Crisis Lab Newsletter: https://www.linkedin.com/newsletters/7197166347129139200/

Capacity Building International: https://www.capacitybuildingint.com/

Kyle King LinkedIn: https://www.linkedin.com/in/kylek-us/

___________________________________________________

Bites and Bytes Podcast Info:

TikTok: @bitesandbytespodcast

Website: Explore all our episodes, articles, and more on our official website. Visit Now

Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now

Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog

Audience Survey: We value your feedback! Please help us make the podcast even better. Take the Survey

Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cybersecurity Insider
Episode: CISO Resignations: Is the Industrial Sector Prepared for the Fallout?
Pub date: 2024-06-18

Dino Busalachi and Craig Duckworth, CTO and CEO of Velta Technology, respectively, tackle the inherent risks of CISO resignations.

They discuss the immense stress and challenges that put these crucial roles at risk.

They talk about the unique struggles CISOs face in managing industrial cybersecurity, where outdated systems and a lack of authority compound their difficulties.

Dino and Craig also address the critical disconnect between IT and OT environments, the importance of on-the-ground involvement, and the need for a collaborative approach to secure industrial operations.

Tune in to understand why the role of a CISO has become untenable for many and what can be done to address this growing issue.

Chapters:

00:00:00 - Introduction to the Unpatchable Environment: Why It's a Problem
00:01:39 - The Great Resignation of CISOs: Unveiling the Reasons
00:02:05 - Manufacturing's Unique Cybersecurity Struggles
00:03:08 - Stress and Responsibility: The CISO's Daily Battle
00:04:13 - Modern Cybersecurity: Why It's So Complex
00:05:00 - IT vs. Plant Management: Bridging the Gap
00:07:06 - Senior Leadership's Role in Cybersecurity: Are They Doing Enough?
00:08:39 - IT and OT Collaboration: The Key to Security
00:10:12 - Third-Party OT Suppliers: A Hidden Risk
00:12:00 - The Wild West of Cyber-Physical Connections
00:14:23 - Regulations and Realities: Why Compliance Falls Short
00:16:40 - The Reality of Cybersecurity Threats: What You Need to Know
00:20:00 - Flat Networks: The Hidden Danger
00:23:38 - Conclusion: A Call to Action for CISOs

Links And Resources:

Velta Technology
Dino Busalachi on LinkedIn
Jim Cook on LinkedIn
Craig Duckworth on LinkedIn

The podcast and artwork embedded on this page are from Velta Technology, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Their own rail system, water treatment and more [The Industrial Security Podcast]
Pub date: 2024-07-02

Airports really are small cities. Eric Vautier, CISO of all 3 Paris airports looks at what is an airport and how are thousands of airports changing because of NIS2 and the regulatory environment more generally.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Adv. Rami Tamam & Jack Altal, leaders of the Cyber Forensics MBA @Ono AC, about managers and cyber
Pub date: 2024-07-03

עולם הסייבר הולך ומתרחב, יותר ויותר רגולציות ונושאים בהם נדרשים מנהלים לקחת החלטות שיהיו להן השפעות לטווח ארוך, איך מתמודדים ומה צריך לעשות על מנת לוודא שננקטו הצעדים הנכונים?

נחשון פינקו מארח את עו"ד רמי תמם וג'קי אלטל מובילי תוכנית לתואר שני בסייבר פורנזיקה בקריה האקדמית אונו, בשיחה על הצורך והחשיבות של מנהלים להבין סייבר גם אם זה לא מרכז עיסוקם.

The cyber-world is expanding, more and more regulations and issues require managers to make decisions that will have long-term effects. How do you cope, and what should be done to ensure that the proper steps have been taken?

Nachshon Pincu hosts attorney Rami Tamm and Jackie Altal, leaders of a master's degree program in cyber forensics at the Ono Academic College, in a conversation about the need and importance of managers to understand cyber even if it is not their focus.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 50: Gary and Tyler celebrate the first 50 episodes
Pub date: 2024-07-02

When you hit a milestone like 50, you need to take a few minutes to reflect. On this very special episode, Gary Cohen and Tyler Wall look back at what they’ve learned, discuss what has surprised them and rate some cybersecurity movies.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Insights with NDK Cyber
Episode: NDK’s Top 3 of Season 3: 'The future of OT Security is so exciting' with Danielle Jablanski
Pub date: 2024-07-03

Our top podcast episode of Season 3 is back in the spotlight, and it's a must-listen!

Join us as we revsit our time meeting with Danielle Jablanski, exploring the exciting future of cybersecurity!.

We explore the fascinating realm of smart cities and their development, while also delving deep into Danielle's expertise in OT security challenges and navigating legacy technology hurdles.

The podcast and artwork embedded on this page are from NDK Cyber, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Episode 14 - Practical Approaches to OT Cybersecurity in Critical Infrastructure
Pub date: 2024-07-01

In this episode, our host, Aaron Crow, explores the intriguing world of OT cybersecurity products.

This episode explores the key differences between IT and OT, the challenges faced in OT environments, and how some IT products can actually be adapted for OT use.

Aaron explains why availability and safety take precedence in OT settings, from power plants to manufacturing lines, and how traditional IT cybersecurity measures need to be tailored for these unique environments. He also discusses the importance of understanding protocols, implementing multi-layered defenses, and leveraging advancements in cybersecurity tools.

Tune in as we unravel the distinct intricacies of protecting our critical infrastructures and discover how IT and OT worlds continue to converge.

Key Moments:

00:10 Adapting IT products for OT cybersecurity challenges.

06:33 IT products integrating OT capabilities, impacting uptime.

10:33 Windows XP boxes in production pose risk.

14:00 Access device remotely to avoid travel time.

17:45 Complex network setup required for risk reduction.

20:06 Multiple vendors complicate technology and support solutions.

24:14 Plan for OT challenges by engaging IT.

26:21 OT and IT overlap, and industry devices evolve.

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Risk Management Podcast (LS 34 · TOP 3% what is this?)
Episode: EP 161: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)
Pub date: 2024-07-02

CIRCIA stands for the "Cyber Incident Reporting for Critical Infrastructure Act". But what does it really mean? Let's find out with your hosts Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

The podcast and artwork embedded on this page are from Kip Boyle, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 4/4 Desenlace del caso Aplicando Virtual Patching en un entorno OT
Pub date: 2024-07-01

En este episodio se muestran las recomendaciones para las organizaciones que están considerando adoptar el parcheo virtual como parte de su estrategia de ciberseguridad en OT

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Scott Sheahan: From Aerospace to Automotive Cybersecurity
Pub date: 2024-07-02

We sat down with Scott Sheahan, the owner of Rustic Security, to learn from his rich background in the automotive cybersecurity world and embedded software development.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 3/4 Acciones del caso Aplicando Virtual Patching en un entorno OT
Pub date: 2024-07-01

En este episodio se presentan las opciones y tecnologías disponibles para implementar el parcheo virtual en entornos OT y cuáles son las ventajas y desventajas de cada una de ellas.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Dr. Bilyana Lilly on Information Warfare
Pub date: 2024-07-01

Dr. Bilyana Lilly, an expert on geopolitics and Russia’s codification of information warfare as a strategy, says that the war in Ukraine has only temporarily delayed Russia’s activity against the West in cyberspace. On this episode of the Nexus podcast, she reinforces the idea that despite the fact that Russia is operating under severe resource constraints, CISOs should be preparing for the inevitable.

“I think it’s important to identify the conditions and the constraints that currently the Russian government is currently experiencing. Because once these constraints are lifted then I think we’ll see an increase in cyber activity, which gives us some time to prepare,” Lilly said. “That’s what I think we should be doing right now. I think we shouldn’t be letting our guard down because I think those attacks are coming.”

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Warum spielen Unternehmen bei der OT-Sicherheit noch immer mit dem Feuer?
Pub date: 2024-06-27

In dieser Folge von OT Security Made Simple teilt Götz Schartner, Geschäftsführer des SOC-Dienstleisters 8com und Sachverständiger für Cyberversicherungen, seine Erfahrungen zu den häufigsten Angriffen. Er erklärt, warum OT-Sicherheit noch immer zu wenig Beachtung findet und weshalb das der größte Fehler eines Unternehmens sein könnte.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: S4x24 Main Stage Interview With Rob Lee
Pub date: 2024-06-26

Dale Peterson interviews Rob Lee on the S4 Main Stage. They cover a lot of ground and Rob is never shy about sharing his opinions and analysis. They discuss:

Rob’s first S4
PIPEDREAM deployed v. employed distinction … and why 2 years later is it still the most dangerous ICS malware?
Are we really more homogenous?
What makes a group something that Rob/Dragos tracks as an ICS focused attacker?
If the answer to intel is do the basics, do I need intel?
What ICS specific data was VOLTZITE exfiltrating?
What countries are targeting critical infrastructure? Is it realistic to expect any country to not target its adversaries CI?
Threat actors focused on manufacturing
How should an asset owner measure the effectiveness of their detection solution?

View Details

Podcast: PrOTect It All
Episode: Unlocking the Future: Hands-On Learning and AI's Role in Cybersecurity Education with Philip Huff
Pub date: 2024-06-24

Welcome to Episode 13 of Protect It All! This episode features Philip Huff, a professor at UA Little Rock and a cybersecurity expert. He explores the promise of AI in education, especially for robotics and automation, while cautioning against the erosion of educational rigor.

Philip and host Aaron Crow discuss the importance of hands-on learning and real-world experience in aligning educational standards with industry needs. They delve into the role of industry partnerships, the necessity of embedding cybersecurity education at the community college level, and the growing skills gap in technology due to retiring experts.

The conversation also covers the advantages of competency-based education and flexible training programs in enhancing social mobility. Throughout, they stress the critical role of human involvement in AI and cybersecurity and the need for innovative, resilient systems.

Tune in for an engaging discussion on the future of education and workforce development in the tech and cybersecurity sectors.

Key Moments:

00:10 Early career challenges prepare for real-world demands.

04:35 Degree's purpose is knowledge and skill acquisition.

08:17 Promoting cyber-informed engineering principles in community colleges.

11:32 Small private school in Texas prioritizes practical engineering.

14:48 Trade skills in high demand, apprenticeships offered.

17:33 Community colleges offer efficient curriculum changes for workforce.

23:12 Team's success attributed to aligning schedules with peers.

26:57 Company and employee benefit from long-term commitment.

28:46 Aligning learning outcomes with career competencies is crucial.

31:44 Retooling professionals for new careers and skills.

36:13 Value education based on future job prospects.

37:35 Integration of AI in education needs balancing.

42:52 Transforming education to align with real learning.

46:28 Transforming classroom for positive shared learning experiences.

49:57 Unused industrial equipment turned into educational tools.

52:10 Learn troubleshooting, not just following instructions.

56:07 Excitement and fear about accessible AI advancements.

59:12 Developing cyber engineering education standards at Idaho National Labs.

About the guest :

Philip Huff is an Associate Professor of Cybersecurity at the University of Arkansas in Little Rock and serves as the Director of Cybersecurity Research in the Emerging Analytics Center. Dr. Huff is also chief scientist and co-founder of Bastazo, a company specializing in cybersecurity solutions for industrial technology. He leads the National Cyber Teaching Academy, the Department of Energy’s Emerging Threat Information Sharing and Analysis Center, and the Cybersecurity Consortium for Innovation which all focus on driving work-force development and innovation for cybersecurity in the region. He is also a CISSP.

How to connect with Philip: https://www.linkedin.com/in/philip-huff-65012621/

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Automation Chat (LS 26 · TOP 10% what is this?)
Episode: How Edge Computing Simplifies & Enhances AI-Based Cybersecurity in IT & OT
Pub date: 2024-06-25

As advancements in cybersecurity have improved detection and response capabilities, managing the immense amounts of data required by AI-based cyber solutions remains a challenge. So, in this episode, we chat about how edge computing can enhance cybersecurity. Executive Editor Theresa Houck is joined by Valerie Schneider, Business Development Manager and Mike Wurster, Director of Strategic Alliances with Stratus Technologies to discuss:

The biggest cyberthreats facing manufacturers and producers.
How industrial firms can deal with these cyberthreats.
How artificial intelligence can be integrated with existing OT security technologies & processes to provide a comprehensive Defense-in-Depth strategy.
How AI can enhance threat detection & response in OT environments.
Best practices for improving cybersecurity.
How edge computing & virtualization let users consolidate multiple applications on a single platform, allowing cybersecurity protocols to integrate with applications like HMI, SCADA, MES and batching.
How to balance security measures with usability & productivity.
Steps for improving OT cybersecurity without significant investment or disruption to operations.

You can also watch their discussion on YouTube at https://youtu.be/0kQ1c3z36MM.

Resources from this episode:

Stratus & Rockwell Automation Partnership: “Together, Simplifying Edge Computing for the Connected Enterprise.”
Analyst Brief: “Virtualization with Stratus Zero-Touch Computing Platforms.”
White Paper: “Edge Computing Bridges IT and OT People, Process, and Technology.”
Email Valerie Schneider valerie.schneider@stratus.com.
Email Mike Wurster at mike.wurster@stratus.com.

Automation Chat is brought to you by The Journal From Rockwell Automation and Our PartnerNetwork magazine.

Find us on LinkedIn.

Find us on Facebook.

Find us on X (Twitter).

** Named Best Podcast 2 Consecutive Years! 2022 & 2023 Apex Awards of Publication Excellence.

View Details

Podcast: Hack the Plant (LS 34 · TOP 3% what is this?)
Episode: Supporting Ukrainian Electrical Grid Resilience in Wartime
Pub date: 2024-06-21

Joe Marshall is a Senior IoT Security Strategist at Cisco Talos Intelligence Group. When Russia invaded Ukraine in 2022, Joe helped coordinate a multinational, multi-company coalition of volunteers and experts to find a technological solution.

Bryson and Joe sat down to discuss his efforts in Ukraine, how he got the go-ahead from Cisco leadership, and more.

“They were like, yeah, we can't even get accurate timing to work on our transmission grid because of jamming that is interrupting GPS communications,” Joe explains. “A week later I was sitting in my office and I went, ‘I wonder if we have something inside of Cisco that can actually help with this.’”

Join us for this and more on this episode of Hack the Plan[e]t.

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Hadas Tamam BA. Head of CRRI & Hillel Kobrovski @Ono AC on report of cyber economic damage in Israel
Pub date: 2024-06-20

עו"ד הדס תמם בן-אברהם ראש המכון למחקר סיכוני סייבר והילל קובורובסקי מרצה סייבר שניהם מהאקדמית אונו, בשיחה על הדו"ח החדש שפורסם באפריל 2024: הערכת העלות הכלכלית בגין תקיפות סייבר בישראל

Adv. Hadas Tamam Ben-Avraham, the Head of Cyber Risks Research Institute & Vice Dean at Ono Academic College, and Hillel Kobrovski, a Senior Lecturer for Cyber security at the College, in a conversation about The new report from April 2024 on the economic damage estimate from cyber attacks in Israel.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: The Double Andrew Rose Special: Insights on Cybersecurity in AgroFoods
Pub date: 2024-06-20

In this special episode of the Bites and Bytes Podcast, host Kristin Demoranville is joined by two cybersecurity experts, both named Andrew Rose, for an insightful discussion on the intersection of cybersecurity and AgroFoods. Andrew Rose, from the UK, is currently the Chief Security Officer (CSO) at SoSafe and formerly the CISO at Proofpoint, CSO at Mastercard UK, and CISO at the National Air Traffic Services (NATS). The other, Andrew Rose, is from the US; he’s an Ag Futurist and a cybersecurity advisor specializing in agricultural production, including advising for BIO-ISAC.

Learn about the critical role of resiliency in the agri-supply chain, the impact of human error on cybersecurity, and the need for education and awareness to prevent breaches. Explore how cybersecurity integrates into food safety culture and the importance of building security into agri-tech products. The discussion also covers emerging cybersecurity trends, the role of government agencies like the FBI, and the global implications of food security.

Tune in for expert insights, practical advice, and a deeper understanding of the unique challenges and opportunities in agri-food cybersecurity and this critical infrastructure.

Also, Happy Pride! 🏳️‍🌈

Episode Key Highlights:

(16:03 - 16:55) National Seminars on Agricultural Security Threats

(19:19 - 20:24) Lessons for Food Industry Cybersecurity

(22:50 - 23:54) Importance of Data Integrity and Availability

(27:51 - 29:22) Social Engineering

(34:03 - 35:46) Food Security and Existential Risks

(39:13 - 40:17) Impact of Global Food Economy

(41:29 - 42:09) Impact of Ukraine on Grain Prices

(49:34 - 51:11) Rising Nation-State Threats in Cybersecurity

(53:13 - 54:22) Importance of Product Security in Agro-Tech

(59:46 - 01:00:55) Financial Impact of Ransomware Attack

Notes from the Show:

Scott’s Pizza Tour – NYC

Secret Pizza – Las Vegas

Reporting Agricultural Incidents (Ic3.gov)

🏳️‍🌈👊⚡️ Pride Merch 🏳️‍🌈👊⚡️

Bare Knuckles & Brass Tacks Podcast

BKBT Pride Merch Shop

Learn more about Out in Tech

Learn more about the Scholarship for LGBTQ+ students

This BKBT podcast episode discusses these causes and the Pride Merch Shop.

Bites and Bytes Podcast Info:

Website: Explore all our episodes, articles, and more on our official website. Visit Now

Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now

Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog

Audience Survey: We value your feedback! Help us make the podcast even better. Take the Survey

Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 39: Hacking Water Systems and the OT Skills Gap
Pub date: 2024-06-18

A critical skills gap in Operational Technology security could have a real effect on your water supply and other areas of the critical infrastructures. Christopher Walcutt from DirectDefense explains how the IT OT convergence, and the lack of understanding of what OT systems are, might be contributing to the spate of water systems attacks in 2024.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 49: Jacob Marzloff on building a resilient OT network
Pub date: 2024-06-18

When it comes to critical infrastructure, like the energy sector, weak cybersecurity can cause incalculable damage. In this episode, we talk with Jacob Marzloff of Armexa about how to build a more resilient OT network and some of the technological advancements that are shaping the industry.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Launching an ISA/IEC 62443-driven Cybersecurity Program
Pub date: 2024-06-17

Most industrial firms lack a firm foundation of cybersecurity protection. Bad actors are on the rise and are constantly revising their attack tactics. Learn the best way to start a new journey along the ISA/IEC 62443 protection pathway.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4 Análisis del caso Aplicando Virtual Patching en un entorno OT
Pub date: 2024-06-17

En este episodio se analizan las diferencias entre el parcheo virtual y el parcheo físico y cuales son los factores apropiados para aplicar virtual patching

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Exploring the Impact of AI and 5G on Future Technologies with Dr. Anmol Agarwal
Pub date: 2024-06-17

In this episode, our host Aaron Crow, sits down with Dr. Anmol Agarwal, a distinguished security professional at Nokia and adjunct professor specializing in machine learning. Together, they dive deep into machine learning, AI, and cutting-edge telecommunications technologies.

They uncover how vast amounts of data are crucial for training machine learning models to detect anomalies and prevent cyber threats, particularly in the telecommunications industry. Dr. Agarwal also sheds light on the transformative impacts of 5G and future 6G networks, from enhancing communication speed to revolutionizing smart manufacturing and industrial networks.

Explore the fascinating world of digital twins, AI-powered anomaly detection, and the complexities of transitioning from 4G to 5G. Aaron and Dr. Agarwal also discuss the global efforts required to standardize these technologies and emphasize the importance of diversity and passion in the tech industry.

Tune in as they tackle the current challenges and future possibilities in AI and telecommunications, and discover how these innovations are shaping the security landscape. Plus, take advantage of Dr. Agarwal's valuable insights and upcoming research on AI-based solutions to prevent DDoS attacks. Let's dive in!

Key Moments:

00:10 Old technology, like dial-up, latency is important.

04:08 Latency in IT and OT processes. Excitement for 5G.

08:40 Machine learning for anomaly detection, digital twins, network sensing for 6G.

12:54 5G as secure media pipe for communication.

15:43 Training machine learning models requires ample data.

18:14 AI benefits outweigh fear of job loss.

22:06 AI creates and replaces jobs, imperfect but beneficial.

25:34 AI adapts dynamically, opens limitless possibilities.

27:31 Live stream with CEO playing themed tabletop.

32:06 5G signal has shorter coverage than 4G.

36:42 Diversity in cyber is crucial for innovation.

40:37 Diverse backgrounds bring fresh perspectives to cybersecurity.

43:04 AI creating deepfakes raises concerns about misinformation.

45:01 Concerned about deep fake potential and solutions.

About the guest :

Dr. Anmol Agarwal is a security expert at Nokia, dedicated to securing advanced communication technologies such as 5G and upcoming 6G networks. Her critical work ensures that the data transmitted through your cell phone calls and text messages remains confidential and protected from hacking. Additionally, Dr. Agarwal imparts her extensive artificial intelligence knowledge as a part-time adjunct professor teaching machine learning. Her expertise not only safeguards our digital communications but also enhances their speed and efficiency through the innovative application of AI.

How to connect with Dr. Anmol :

LinkedIn: https://www.linkedin.com/in/anmolsagarwal/

X: https://twitter.com/anmolspeaker

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Energy Talks
Episode: #81: Cybersecurity in the Power Grid – A 360° View | Part 8
Pub date: 2024-06-13

Minimizing cybersecurity vulnerabilities at the hardware level.Welcome to the 8th episode of our Energy Talks miniseries, Cybersecurity in the Power Grid, in which we provide a 360-degree view of how power grids can best safeguard their infrastructures from cyber attacks.

This episode investigates why, in addition to software, hardware devices must be secured against cyber threats.

OMICRON hardware developer Marcel Ströhle describes how hardware cybersecurity is crucial to overall system security because hardware devices are another potential attack vector that can be easily neglected. Through examples of actual hardware attacks, he highlights how important proper cybersecurity is for your hardware applications and offers tips to ensure it.

Marcel shares his experiences securing hardware devices and describes how he and his team have developed reliable and robust hardware technology, such as the MBX2 mobile test set, used in OMICRON’s cybersecurity solutions.

Stay tuned for upcoming episodes in our Cybersecurity in the Power Grid miniseries. Learn more about OMICRON’s approach to cybersecurity in power grids.

The podcast and artwork embedded on this page are from OMICRON electronics GmbH, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4 Contexto del caso Aplicando Virtual Patching en un entorno OT
Pub date: 2024-06-10

En este episodio se presenta el contexto del caso, las principales amenazas y desafíos de seguridad que enfrentan los entornos de tecnologías de operación en la actualidad, y cómo el virtual patching puede ayudar a mitigar estos riesgos.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Cybersecurity and Safety Risks of Modern Vehicles: Understanding Vulnerabilities and Solutions with Kevin Walter
Pub date: 2024-06-10

In this episode, host Aaron Crow interviews Kevin Walter, an expert in vehicle security, about the growing cybersecurity and safety risks in modern vehicles. Kevin, with a master’s degree in cybersecurity and extensive experience in vehicle systems like the CAN bus, shares his insights into the hidden vulnerabilities within today's cars.

The discussion covers key topics such as the challenges automakers face in updating vehicle software, the real-world implications of vehicle hacking—including the notorious 2014 Jeep hack—and the emerging threats from autonomous vehicles and AI systems. Kevin and Aaron explore how hackers can exploit architectural weaknesses and what measures can be taken to protect against these threats, from simple solutions like Faraday bags to advanced strategies like kill switches.

Whether you’re a cybersecurity enthusiast, a vehicle owner, or just intrigued by the intersection of technology and safety, this episode offers valuable insights into keeping modern vehicles secure. Join Aaron and Kevin for an engaging dive into automotive cybersecurity. Let’s get started!

Key Moments:

00:10 Vehicle network, OBD 2 standard, vehicle diagnostics.

07:22 Incident leads to upgrading car engine.

08:06 Programmed car transmission to work with engine.

13:34 Cars now require computer skills for repair.

14:25 Shop had to enable new battery in car.

18:50 Tire sensor vulnerabilities lead to serious risks.

20:55 Relying on sensors, lacking basic driving skills.

26:05 Greenberg upset about engine shutdown on highway. The jeep's brakes disabled in parking lot. Demonstrated vehicle vulnerability in 2014.

27:40 Potential security risk shutting down connected vehicles.

32:16 Harley dealership charged $100 to enable Spotify.

36:12 OBD2 standard needed for vehicle safety.

39:32 Tesla's automated driver assist misinterprets speed limit.

41:43 Keyless cars vulnerable to theft via tech.

46:13 Interconnected systems may lead to car hacking.

49:19 Balancing innovation with cybersecurity is crucial.

About the guest :

Kevin Walter is an experienced professional in the field of vehicle network and computer systems. He possesses a deep understanding of the more than 50 electronic control units typically found in these networks. Kevin is well-versed in the use of onboard diagnostics tools, specifically the OBD 2 standard, which has been a universal feature in vehicles since 1996. This standard is crucial for mechanics to diagnose and troubleshoot vehicle issues effectively. Kevin’s extensive background includes work as an independent transportation contractor, further solidifying his expertise in the automotive industry.

How to connect Kevin :

https://www.linkedin.com/in/kevin-w-942416211/

Watch a key fob replay attack video Kevin made with his vehicle.:

https://drive.proton.me/urls/3FJXK72NVG#lr_dL45TIogs

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 4/4 Desenlace del Caso Gestión de Ciberseguridad en la Cadena de Suministro Industrial
Pub date: 2024-06-03

En este episodio se muestran las mejores prácticas para gestionar el riesgo de la cadena de suministro, como aprovechar las soluciones emergentes y las lecciones clave.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Vinnie Liu on Offensive Security Testing During Incidents
Pub date: 2024-06-10

Bishop Fox CEO and Cofounder Vinnie Liu joins the Nexus Podcast to discuss his team's role during security incidents in conducting offensive security testing alongside incident response activities. In healthcare environments where ransomware is the leading threat, red-teams and other offensive security specialists are called in, Liu said, to ensure that secondary attack vectors cannot be leveraged by attackers to maintain persistence inside an organization.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 48: Ron Brash on SBOMS and the importance of visibility
Pub date: 2024-06-05

In cybersecurity, knowing what goes into every device and system is absolutely crucial. Enter: SBOMs. Today, we talk to Ron Brash of aDolus Technology once again about the importance of SBOMs and vulnerability management.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 112: Breaking Barriers in Cybersecurity: Roya Gordon’s Transformative Journey and Expert Advice for Veterans
Pub date: 2024-06-04

Today, we are thrilled to welcome Roya Gordon as our guest.

Roya is an executive industry consultant specializing in operational technology, cybersecurity, and Hexagon. She is a military veteran, an accomplished technologist, and a prolific speaker in our industry. Her creativity knows no bounds, encompassing her passion for the arts and her love of opera and symphonies. She is also an avid traveler and a super fun person to have around.

Roya brings a unique and engaging perspective to our discussion today. She shares her journey from a pre-law magnet program to becoming a skilled speaker in the Navy, highlighting the value of communication skills for conveying technical information to audiences and sharing the challenges and opportunities veterans face when breaking into the cybersecurity industry.

Stay tuned as Roya shares her invaluable insights and experiences, offering guidance for veterans aspiring to enter the cybersecurity field. You will not want to miss the wisdom and stories Roya shares with us today.

Show highlights:

Roya shares her background as an army brat.
Roya discusses her six-year experience in the Navy.
How Roya gradually realized she was involved in technology through her Navy intelligence work
Roya talks about her studies in international relations and national security after leaving the Navy and how she pivoted to studying cyber-warfare
Roya landed a job as a security researcher at Idaho National Laboratory (INL) despite lacking an IT background.
Roya talks about the foundational training she received in OT cybersecurity at INL.
How advanced tools often get underutilized due to a lack of trained personnel
Roya highlights the value of certifications.
How non-technical roles like journalism and event planning can offer entryways into the cybersecurity space.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Hexagon

Roya Gordon on LinkedIn

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 38: Regulating OT Data Breaches And Ransomware Reporting
Pub date: 2024-06-04

When critical infrastructure is shut down due to ransomware or some other malicious attack. Who gets notified when? And does that help or hinder trying to keep the systems back up and running? Chris Warner, from GuidePoint Security, discusses the upcoming Cyber Incident Reporting for Critical Infrastructure Act or CIRCIA, and what will it will mean for critical infrastructure organizations.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 34 · TOP 3% what is this?)
Episode: Digging into regulatory compliance issues.
Pub date: 2024-06-05

UK will propose law to ban ransom payments for critical infrastructure entities. EPA outlines enforcement measures to protect water utilities against cyberattacks. Rockwell advises customers to disconnect ICS devices from the internet. Senator Vance asks CISA for information on Volt Typhoon. Guest Kimberly Graham of Dragos joins Dave to discuss regulatory compliance issues.

Programming Note.Control Loop is going on a temporary hiatus. Thank you for being a loyal listener. N2K CyberWire will be back soon with more ICS/OT news and analysis that you rely on. Please stay tuned for more updates.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. It’s only 5 short questions. Thanks!

Control Loop News Brief.UK will propose law to ban ransom payments for critical infrastructure entities.Exclusive: UK to propose mandatory reporting for ransomware attacks and licensing regime for all payments (The Record)

EPA outlines enforcement measures to protect water utilities against cyberattacks.EPA Outlines Enforcement Measures to Help Prevent Cybersecurity Attacks and Protect the Nation’s Drinking Water (Environmental Protection Agency)

Rockwell advises customers to disconnect ICS devices from the internet.Rockwell Automation Reiterates Customer Guidance to Disconnect Devices from the Internet to Protect from Cyber Threats (Rockwell Automation)

Senator Vance asks CISA for information on Volt Typhoon.Senator Vance issues warning on China-backed Volt Typhoon threat to US critical infrastructure (Industrial Cyber)

Control Loop Interview.Guest Kimberly Graham, Vice President of Product Management at Dragos, discussing regulatory compliance issues.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the N2K CyberWire website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Manufacturing Happy Hour (LS 43 · TOP 1.5% what is this?)
Episode: 188: Adopting a Cybersecurity Strategy That Fits Your Manufacturing Business with Mollie Breen, CEO & Founder of Perygee
Pub date: 2024-06-04

How do you adopt a cybersecurity strategy that fits your manufacturing business?

In this episode of Manufacturing Happy Hour, host Chris Lueke is speaking to Mollie Breen, CEO & Founder of Perygee, an automation platform for IT and security teams, built to eliminate the visibility challenges of the digital-first world.

They kick off by exploring significant developments in cybersecurity over the past few years. Mollie highlights the dual role AI plays, assisting both hackers in identifying vulnerabilities and defenders in fortifying network security. She underscores the importance of reverting to cybersecurity fundamentals amid tech evolutions, noting that a shift back to basics is essential for adapting to new threats effectively.

Mollie provides background on her time at the NSA, revealing the surprising routine nature of tackling seemingly insurmountable tasks due to robust capabilities and top-tier expertise available. Her time at the NSA played a crucial role in her entrepreneurial journey with Perygee, where she navigated the intricate processes within governmental organizations to introduce innovative security measures.

Mollie and Chris also discuss practical advice for implementing cybersecurity strategies within organizations of varying sizes. Mollie touches on the unique cybersecurity challenges faced by medical device companies due to heavy regulations and the criticality of their operations. The conversation then moves to the timing and evolution of cybersecurity roles within growing businesses.

To wrap up, they discuss the potential for leadership in cybersecurity across all levels of an organization. This episode is packed with valuable insights for leaders across the manufacturing sector looking to enhance their cybersecurity strategies and foster a more secure operational environment.

In this episode, find out:

What’s new in cybersecurity, AI, and going back to basics
Mollie’s journey with the NSA and how that lead to her founding Perygee
Mollie offers practical cybersecurity advice for companies of all sizes
How training can go a long way in the context of cyber security
Mollie expounds on the right approach to cybersecurity in public vs. private companies
Unpacking cybersecurity strategies for small to medium-sized businesses
Understanding the unique cybersecurity challenges in medical devices
The benefits of learning from different cybersecurity approaches across industries
Mollie talks about the future of cybersecurity leadership in manufacturing

Enjoying the show? Please leave us a review here. Even one sentence helps. It’s feedback from Manufacturing All-Stars like you that keeps us going!

Tweetable Quotes:

“You have to remember cyber is an offensive and a defensive game.”
“Inevitably every time you have to secure a new thing, there's an ushering in of going back to the basics and asking yourself, ‘what do we do?’”
“I'm glad we're moving into a position where people are more informed. Doing something just out of fear of the headlines isn't necessarily the best decision for the organization.”

Links & mentions:

Perygee, an automation platform for IT and security teams purpose-built to eliminate the visibility challenges of the digital-first world
NIST Framework, excellent guidelines for getting started with cybersecurity
Cyber Readiness Institute, free resources for small businesses

Make sure to visit http://manufacturinghappyhour.com for detailed show notes and a full list of resources mentioned in this episode. Stay Innovative, Stay Thirsty.

The podcast and artwork embedded on this page are from Chris Luecke, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Unpacking Cybersecurity Ingredients: SBOMs in the Food Industry with Marc Frankel
Pub date: 2024-06-03

In this episode of the Bites and Bytes Podcast, host Kristin Demoranville chats with Marc Frankel, CEO and co-founder of Manifest Cyber, a software supply chain security company. They talk about the world of Software Bills of Materials (SBOMs) and their critical role in cybersecurity, especially within the food industry. Marc shares insights on the importance of SBOMs, their implementation, and the future of supply chain security. He also provides a unique perspective on the intersection of cybersecurity and the food industry, making this a must-listen for anyone interested in protecting our food systems. Tune in to learn how SBOMs can help your organization stay resilient in the face of cyber threats.

______________________________

Episode Key Highlights:

(02:29 - 03:11) Navigating Relationships as Entrepreneurs

(09:11 - 11:07) Importance of Software Ingredient Lists

(16:54 - 17:59) Understanding SBOM Regulatory Requirements

(25:49 - 26:35) Streamlining Software Supply Chain Security

(34:54 - 36:25) Mission-Driven Software Supply Chain Importance

(38:33 - 39:23) Duty to Monitor Software Security

Show Notes:

Hakarl, have you ever wondered what fermented Greenlandic shark tastes like? 🌊🦈 Discover the unique Icelandic delicacy that Marc Frankel bravely sampled! Learn More

Russ & Daughters (NYC, Lower East Side): Experience the legendary smoked salmon from one of NYC's most iconic spots. Perfect for your next bagel craving! 🥯🐟 Visit Russ & Daughters

US Executive Order on Improving the Nation's Cybersecurity (14028): Stay informed about the latest national cybersecurity measures. Read the Executive Order

FDA Medical Devices Cybersecurity Guidelines: Learn about how medical devices are secure with the FDA's latest guidelines. 🏥🔒 Explore the Guidelines

EU Cyber Resilience Act Learn about the upcoming changes in EU cybersecurity regulations. 🌍🛡️ Read the Act

Log4Shell: Get the details on one of the most significant cybersecurity vulnerabilities of recent times. 🔍💻 Learn More

______________________________

Marc and Manifest Information:

Find Marc Frankel on LinkedIn. Connect with Marc to jump into the world of SBOMs and cybersecurity. Connect with Marc

Information on Marc's company, Manifest. Discover how Manifest is revolutionizing software supply chain security. Visit their Website or LinkedIn for more details.

______________________________

Bites and Bytes Podcast Information:

Website: Explore all our episodes, articles, and more on our official website. Visit Now

Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now

Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog

Audience Survey: We value your feedback! Help us make the podcast even better. Take the Survey

Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Tools and Techniques for Better Network Visibility and Vulnerability Management with Kylie McClanahan
Pub date: 2024-06-03

In Episode 10 of Protect It All, titled "Tools and Techniques for Better Network Visibility and Vulnerability Management with Kylie McClanahan," host Aaron Crow and guest Kylie McClanahan dive into the critical elements of enhancing cybersecurity through advanced tools and strategies. Kylie, CTO of a company specializing in this field, shares her insights on overcoming the challenges of consistent naming conventions, accurate vendor data, and breaking down silos for effective communication across teams.

They explore the utility of tools like Spartan and Network Perception in visualizing network vulnerabilities, mapping asset inventories, and planning effective patch management. They emphasize the importance of correlating vulnerabilities with business priorities rather than just CVSS scores and the need for a layered security approach.

The episode also discusses cybersecurity risks to non-technical stakeholders, highlighting the business implications. The duo discusses the evolving landscape in the power utility sector, the dual nature of physical and cyber threats, and the ever-present need for continuous adaptation.

Kylie shares her excitement about machine learning and graph neural networks for grid state estimation while expressing caution about AI tools' accuracy. Aaron and Kylie stress the importance of reliable data, automated processes, and vendor security advisories in maintaining effective asset management.

Key Moments:

03:47 Discussion focused on improving cybersecurity classifications and communication.

08:48 Compliance sometimes leads to minimum effort for benefit.

11:17 Vendor security advisories prioritize patch tracking.

14:46 Testing for security vulnerabilities and potential exploits.

17:20 Understanding and communicating cybersecurity risk to non-professionals.

20:50 Disagreement on consistent product naming causes confusion.

25:46 NVD website publishes overwhelming recent vulnerabilities.

27:07 Understanding the importance of asset management.

32:13 Challenges of tracking change management in organizations.

33:33 People, process, and technology are crucial investments.

37:34 Spartan takes any scan, offers change management.

39:55 Vision of the future: a dynamic ecosystem.

43:19 Vendors acknowledge changes in control systems effectiveness.

48:09 Equations useful, AI for optimization, caution with models.

49:28 Questioning truthfulness of AI in HR replacement.

53:01 Toyota and Lexus prioritize reliable, tested technology.

About the guest :

Kylie McClanahan is the Chief Technology Officer of Bastazo, Inc and a doctoral candidate in Computer Science at the University of Arkansas. She has nearly a decade of experience with cybersecurity in the electric industry, including both professional experience and frequent collaborations with industry as a graduate researcher. Her research explores the automation of vulnerability analysis and remediation using natural language processing and machine learning. She holds a GCIP certification from GIAC and speaks frequently about cybersecurity in industrial control systems.

How to connect Kylie:

https://www.linkedin.com/in/kyliemcclanahan/

https://www.bastazo.com

https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc

Connect With Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: https://protectitall.co/
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest/episode, please email us at info@protectitall.co

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Diana Kelly on Protecting the AI Lifecycle
Pub date: 2024-06-03

Protect AI Chief Information Security Officer Diana Kelly joins the Claroty Nexus podcast to discuss the intricacies of securing machine learning and artificial intelligence use inside the enterprise. She also explains the concept of MLSecOps and how it compares and contrasts to DevOps used in application development.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Digitalization Tech Talks
Episode: Episode 41: Cybersecurity in the Process Industries - Protect Your Turf
Pub date: 2024-05-30

The OT (operational technology) space has never been more of a target to cyber threats than today. A recent McKinsey & Company article stated “As this sector embraces digitalization, its ‘attack surface’ is skyrocketing. In a space that boasted about being air-gapped, or unplugged from the internet environment in years past, these new capabilities have made it vulnerable to attack – and threat actors are chomping at the bit.”

In this episode we discuss cybersecurity in the process industries with cybersecurity expert, Marco Ayala, President of the Houston chapter of InfraGard, a partnership between the FBI and the private sector for the protection of U.S. critical infrastructure. Marco, who has a long history in industrial security, comes from the unique perspective of being a supplier to the process industries as well as an end user.

We discuss:

Current landscape of cybersecurity
Challenges facing owner operators today
Role of regulatory agencies and standards organizations
Strategies asset owners are undertaking and first steps to achieve them

Join our series hosts, Jonas Norinder and Don Mack, for an episode filled with helpful information that will guide you on your journey to stay cybersafe!

Show Notes:

Video: NOVA – A.I. Revolution (https://to.pbs.org/4aWsoe5) time 47:50 in video
Article: Board of directors: The final cybersecurity defense for industrials (https://mck.co/454z5cH)
Website: Cyber Informed Engineering (https://bit.ly/4e4ypbl)
Website: Consequence-Driven Cyber-Informed Engineering (https://bit.ly/4aC8O6p)
Website: InfraGard – Partnership for Protection (https://www.infragard.org/)
Additional resources: https://bit.ly/3yD2Q8j

Upcoming webinar (Wednesday, July 11, 2024):

Navigating the Digital Workforce: 4 Strategies for Success in the Age of Technology (https://bit.ly/3Va6H4m)

Contact us:

· Marco Ayala (marco.ayala@infragardhouston.org)

· Don Mack (mack.donald@siemens.com)

· Jonas Norinder (jonas.norinder@siemens.com)

The podcast and artwork embedded on this page are from Siemens, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 111: From Scrubbing Hard Drives to Securing the Future: Max's Journey in Cybersecurity
Pub date: 2024-05-28

We are thrilled to have Max Aulakh, the Founder and CEO of Ignyte Assurance Platform, joining us today.

Max is a military veteran and motorcycle enthusiast who enjoys doing voluntary work. He is a prolific contributor to the cybersecurity community, always willing to be of service to others. When Max was three, his father applied for American citizenship at the US Embassy in India. It was an extremely long process, and after losing all hope, he and his family finally migrated to Oklahoma a decade later.

Join us to learn how Max transitioned from the military to founding the successful Ignyte Assurance Platform. He also shares his views on regulations, discusses how AI has impacted the security field, and offers prudent and practical advice for anyone interested in pursuing a cybersecurity career.

Stay tuned for today’s candid and fascinating interview with Max Aulakh, the Founder and CEO of Ignyte.

Show highlights:

How Max’s military experience led to his career in security
Max’s Air Force mentor encouraged voluntary service.
How working with the Department of Treasury, scrubbing hard drives, led to Max’s interest in security.
Max explains how his military experience instilled a service mindset beneficial for security roles.
While in service, he attended the American Military University due to its flexible programs for deployed personnel.
The challenges he faced transitioning from a services company to a product-based company
Max shares how he launched Ignyte in 2019/2020
How Max assists companies with the Cybersecurity Maturity Model, particularly in thedefense sector.
Why standardization and testing are essential in operational technology
Max shares his views on the potential of AI

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Ignyte Assurance Platform

Max Aulakh on LinkedIn

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Rapid Recovery After an Attack [The Industrial Security Podcast]
Pub date: 2024-05-27

Ransomware is the most common cyber attack causing OT outages - all Windows machines encrypted. What if we could "press a button" and have everything working again in seconds or minutes? Alex Yevtushenko of Salvador Technologies joins us to look at new technology for rapid recovery.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Jennifer Minella on OT Cybersecurity Convergence
Pub date: 2024-05-28

Jennifer Minella, founder and principal advisor of Viszen Security, joins the Claroty Nexus podcast to discuss her experiences advising organizations on operational technology implementations, risk management, and succeeding at IT/OT convergence. This episode was recorded during RSA Conference where Jennifer and Bryson Bort gave a talk on convergence from the perspectives of a defender of industrial networks, and from the viewpoint of an offensive security specialist.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 3/4 Acciones del Caso Gestión de Ciberseguridad en la Cadena de Suministro Industrial
Pub date: 2024-05-27

En este episodio se presentan las estrategias o soluciones que se están considerando actualmente para reducir el riesgo en la cadena de suministro.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Why CISOs are becoming a the companies' supermen and superwomen
Pub date: 2024-05-16

This episode of OT Security Made Simple welcomes Jonathan Gordon of the OT cybersecurity researchers and analyst Takepoint. Jonathan argues that OT security needs to merge the bottom up and top down approach to succeed and that the CISOs will be at the frontline of driving and moderating this process.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: IoT Security Podcast
Episode: Navigating the Convergence: Securing OT in a Connected World
Pub date: 2024-05-14

In this episode, we're diving deep into the world of Operational Technology (OT) and IoT security, exploring the critical challenges and evolving threat landscape that are impacting sectors from manufacturing to critical infrastructure and healthcare. With insights from Patrick Gillespie, an OT expert at GuidePoint Security, we'll discuss the convergence of IT and OT systems, the risks introduced by COVID-19, and the advanced solutions from providers like Phosphorus that are combatting these threats. Patrick also sheds light on his personal journey from military service to a cybersecurity career, and the essential steps organizations should take to bolster their OT security, from embracing cyber hygiene to implementing robust security programs. Join us as we uncover the pressing issues facing IoT security today and how innovations are driving a safer, more secure operational environment.

Let’s connect about IoT Security!

Follow John Vecchi at https://www.linkedin.com/in/johnvecchi

The IoT Security Podcast is powered by Phosphorus Cybersecurity. Join the conversation for the IoT Security Podcast — where xIoT meets Security. Learn more at https://phosphorus.io/podcast

The podcast and artwork embedded on this page are from Phosphorus Cybersecurity, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Amplified: The process automation podcast (LS 24 · TOP 10% what is this?)
Episode: A conversation with 2024 Process Automation Hall of Fame inductee Joe Weiss
Pub date: 2024-05-22

Joe Weiss is managing partner of Applied Control Solutions Inc., and an ISA99 ICS cybersecurity pioneer and blogger.

The podcast and artwork embedded on this page are from ControlGlobal, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 47: Brad Hibbert on Third-Party Risk Management
Pub date: 2024-05-21

50% of respondents still rely on spreadsheets and multiple tools for third-party risk management. In this episode of the ICS Pulse Podcast, we talk to Brad Hibbert of Prevalent about the company’s 2024 Third-Party Risk Management Study and how to create more effective risk management practices.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 37: Solving Mysteries. Saving Lives. Just Another Day with OT Incident Response and Forensics
Pub date: 2024-05-21

When an enterprise network goes down, you call in the Incident Response team and they do forensics. When your SCADA goes down, who do you call? Meet Lesley Carthart, technical director of incident response at Dragos, who focuses on products and services for the non standard part of cybersecurity. That means things like performing digital forensics on SCADA, industrial control systems, and critical infrastructure. There’s still some normal enterprise computing involved, but very often the stories told by practitioners are … well, just plain weird.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: Preparing for the potential worst day
Pub date: 2024-05-21

In this episode, Bryson Bort is joined by Paul Shaver, Global OT Security Practice Lead at Mandiant / Google Cloud to discuss the cyber threat landscape. How did Paul’s military background play a role in his decision to start working with control systems? What is the difference between an advanced persistent threat and a regular threat? What does Paul think is the best way to protect against documented threats from nation-state actors?

“I think if we're not doing a better job of protecting critical infrastructure, protecting our assets, any one of the nation state actors could cause that level of mass scale outage or destruction of capability. It comes down to being better prepared to protect these environments,” Paul said.

Join us for this and more on this episode of Hack the Plant.

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 110: Global Cybersecurity Insights with Mike Holcomb
Pub date: 2024-05-21

We are delighted to have Mike Holcomb joining us on the show today.

Mike is both a fellow and a cybersecurity director, and he currently serves as the ICS OT Cybersecurity Global Lead at Fluor, a massive multinational engineering and construction firm with over 40,000 employees. He has participated in many major building projects, and we are excited to learn from his extensive experience today.

Stay tuned as Mike shares his insights and expertise.

Show Highlights:

Mike discusses the two years he spent in China building bowling alleys
Mike talks about his time teaching and consulting at a training company in San Diego
How Mike had the opportunity to double his salary and work with the Navy SEALs during 9/11
Mike discusses his experience working in IT security
Mike explains that Fluor has built some of the largest control system environments in the world
Mike discusses challenges in the energy sector
How regulations impact cybersecurity in various industries
Why cybersecurity regulations are essential within critical infrastructure
Mike discusses the challenge of aligning IT and OT cybersecurity teams

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Bridewell

Michael Holcomb on LinkedIn

Fluor

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Work (LS 42 · TOP 1.5% what is this?)
Episode: OT cybersecurity jobs are everywhere, so why is nobody taking them? | Guest Mark Toussaint
Pub date: 2024-05-20

Mark Toussaint of OPSWAT joins to talk about his work in securing operational technology, and specifically about his role as product manager. This is an under-discussed job role within security, and requires great technical expertise, intercommunication skills and the ability to carry out long term campaigns on a product from, as he put it, initial brainstorming scribblings on a cocktail napkin through the creation of the product, all the way to its eventual retirement. Learn what it takes to connect security engineering, solutions experts, project management, and more in the role of security product manager, and how OT security connects fast, flexible IT and cybersecurity with systems that, as Toussaint put it, might be put in place and unmodified for 15 or 20 years. It’s not that hard to connect the worlds, but it takes a specific skill set.

0:00 - Working in operational technology
1:49 - First getting into cybersecurity and tech
3:14 - Mark Toussaint’s career trajectory
5:15 - Average day as a senior product manager in OPSWAT
7:40 - Challenges in operational technology
9:11 - Effective strategist for securing OT systems
11:18 - Common attack vectors in OT security
13:41 - Skills needed to work in OT security
16:37 - Backgrounds people in OT have
17:28 - Favorite parts of OT work
19:47 - How to get OT experience as a new industry worker
21:58 - Best cybersecurity career advice
22:56 - What is OPSWAT
25:29 - Outro

– Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
– View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

The podcast and artwork embedded on this page are from Infosec, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Charles Blauner on the Changing Role of the CISO
Pub date: 2024-05-20

Charles Blauner, Team8 operating partner and CISO in residence, joins the Claroty Nexus podcast to discuss the rapid changes in responsibilities and liability risks facing today's chief information security officers. Blauner, former CISO at JP Morgan and Deutsche Bank, describes how, for example, the new SEC rules around disclosures and incidents, along with legal action against high-profile CISOs of public companies, have some security leaders re-thinking how they operate and negotiate within their roles. He also discusses whether enterprises should brace for an exodus of those in the CISO chair today.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4 Análisis del Caso Gestión de Ciberseguridad en la Cadena de Suministro Industrial
Pub date: 2024-05-19

En este episodio se analizan cuáles son las principales amenazas, las responsabilidades internas y externas, así como el impacto de un incidente en la cadena de suministro.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Click Here (LS 51 · TOP 0.5% what is this?)
Episode: 131. Mic Drop: Could spoofing satellites become Russia’s new jam?
Pub date: 2024-05-17

On the battlefields of Ukraine, Russia has become very adapt at electronic warfare — both jamming GPS satellites and spoofing satellite signals. We explain how it works and its ripple effects beyond the front lines.

The podcast and artwork embedded on this page are from Recorded Future News, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: Bridging Expertise: From IT Foundations to OT Triumphs in Rail Cybersecurity
Pub date: 2024-05-15

In this episode of Secure Tracks, Miki Shifman delves into bridging knowledge between IT and OT in transit cybersecurity with Mark Johnston, CISO of TriMet. Mark Johnston shares his enlightening journey from a seasoned IT security career to leading OT security initiatives at TriMet. Discover the challenges, innovations, and triumphs involved in integrating these critical technologies to enhance the safety and reliability of public transit systems.

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Podomation
Episode: 004 - Secure Seas: Navigating Maritime Cybersecurity
Pub date: 2024-05-16

The landscape of maritime cybersecurity has evolved significantly, driven by current events, increasing digitization and the adoption of emerging technologies. These changes enhance operational capabilities, but also introduce vulnerabilities. Regulation and standards introductions have been pivotal in guiding the integration of cyber risk management into safety management systems onboard ships. However, a primary concern in maritime cybersecurity is OT systems, which are vital for the control and operation of physical shipboard processes.

Panelists:
Sean Plankey, Global Head of Cybersecurity Software, Willis Towers Watson
Michael DeVolld, Senior Principal Consultant, American Bureau of Shipping
Kevin Duffy, CEO, Maritime Imperative
Marco Ayala, President, Infragard Houston

The podcast and artwork embedded on this page are from ISA - International Society of Automation, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: וובינר ניהול משבר סייבר במגזר התעשייתי
Pub date: 2024-05-15

וובינר בנושא ניהול משבר במגזר התעשייתי בהנחייתו של יוגב נחום מחברת קוד בלו משתתפים:

חגית איסר - מנכ"לית דגש פ.ק

יסמין טל בדש - מנהלת סיכוני סייבר עולמי של טכנולוגיה תפעולית וחדשנות באי.סי.אל לשעבר כימיקלים לישראל

יוסי שביט - ראש יחידת סייבר בתעשייה המשרד להגנת הסביבה

נחשון פינקו - סייבר אוונגליסט וסמנכ"ל בכיר ליעוץ ניאטק סייבר סקיורטי בע"מ

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Chris Hughes, Author of Effective Vulnerability Management
Pub date: 2024-05-15

Chris Hughes and Nikki Robinson recently wrote the book Effective Vulnerability Management. Dale and Chris discuss the topic and book including:

The definition and scope of vulnerabilities. It’s much more than coding errors that need patches.
Are ICS protocols lacking authentication “vulnerabilities”
The reality that most organizations have 100’s of thousands of unpatched vulnerabilities. Some statistics and will this change.
Ways to prioritize what vulnerabilities you address.
The SSVC decision tree approach that was introduced at S4 as Never, Next, Now
Tooling … vulnerability management, software configuration, ticketing, remediation.
And much more.

Links:

Effective Vulnerability Management, https://www.amazon.com/Effective-Vulnerability-Management-Vulnerable-Ecosystem/dp/1394221207/
Dale’s ICS-Patch Decision Tree, https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 34 · TOP 3% what is this?)
Episode: Hacktivism targeting OT devices.
Pub date: 2024-05-15

US Defense Department warns of Russian hacktivists targeting OT devices. The US government establishes safety and security board to advise the deployment of AI in critical infrastructure sectors. Vulnerabilities affect CyberPower UPS management software. US congressmen put forward water system cybersecurity bill. Encore guest Garrett Bladow, Distinguished Engineer at Dragos, joins us from the CyberCon 2023 event in Bismarck, North Dakota. Garrett discusses active visibility into OT systems. The Learning Lab is currently on a hiatus this episode.

Control Loop News Brief.US DOD warns of Russian hacktivists targeting OT devices.Urgent Warning from Multiple Cybersecurity Organizations on Current Threat to OT Systems (NSA)

US government establishes safety and security board to advise on deployment of AI in critical infrastructure sectors.DHS launches safety and security board focused on AI and critical infrastructure (FedScoop)

Over 20 Technology and Critical Infrastructure Executives, Civil Rights Leaders, Academics, and Policymakers Join New DHS Artificial Intelligence Safety and Security Board to Advance AI’s Responsible Development and Deployment (DHS)

Vulnerabilities affecting CyberPower UPS management software.Uninterrupted Power Supply (UPS): A Silent Threat to Critical Infrastructure Resilience (Cyble)

US congressmen introduce water system cybersecurity bill.Crawford puts forward bill on cybersecurity risks to water systems (Arkansas Democrat-Gazette)

Control Loop Interview.Guest is Garrett Bladow, Distinguished Engineer at Dragos, discussing active visibility into OT systems.

Control Loop Learning Lab.The Learning Lab is on a break. Stay tuned.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the N2K CyberWire website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Leadership in the Food Industry with Tia Glave and Jill Stuber
Pub date: 2024-05-14

Join host Kristin Demoranville for this insightful Bites and Bytes Podcast episode featuring special guests Tia Glave and Jill Stuber. The discussion will bridge the worlds of food safety, quality, and transformative leadership within the food industry.

Tia Glave, a trained chemical engineer and a seasoned food safety and quality professional, brings extensive experience working across diverse food sectors. In this episode, Tia discusses her approach to integrating leadership principles with technical strategies to enhance food safety programs, reflecting her passion for supporting talent in the food industry.

Jill Stuber, with her comprehensive background in Food Safety & Quality (FSQ) and her roles in various multi-million-dollar food organizations, shares her journey and the joy she finds in coaching and positively impacting the food safety sector. With a Master of Science in both Food Science and Quality Management, Jill’s professional coaching certification and leadership skills shine through as she discusses the importance of integrating leadership skills with technical expertise to foster better outcomes in food safety.

Together, they explore the evolving landscape of food industry leadership, the integration of technology, and the critical role of empathy and effective communication in cultivating a safe and innovative food environment. This episode explores their journeys and highlights their unique perspectives on the future of food safety and intentional leadership’s pivotal role in navigating modern food systems’ challenges.

In this episode, we also focus on the critical intersection of cybersecurity with food safety. As digital transformations sweep through the food industry, understanding the cyber aspects becomes increasingly vital. Kristin, Tia, and Jill discuss how enhancing cybersecurity measures is integral to safeguarding food production processes. They emphasize the need for leaders to be proficient not only in traditional food safety roles but also in combating potential cyber threats that could impact food integrity and safety. This conversation highlights the importance of a holistic approach to food safety, including robust cybersecurity practices, ensuring that the food industry can effectively face modern challenges.

Don’t miss this engaging conversation that connects the dots between creating efficient, safe food practices and nurturing the next generation of food industry leaders.

___________________________________________

Episode Key Highlights:

(00:50 - 02:58) Food Safety Leadership Development and Coaching
(13:29 - 14:48) The Importance of Catalyst in Industry
(16:45 - 17:34) Diverse Roles in Food Industry Leadership
(25:11 - 26:06) Personal Development and Self-Reflection
(28:37 - 29:26) Cybersecurity and Food Safety Discussions
(32:25 - 33:57) Consumer Education in the Food Industry
(43:29 - 46:02) Leadership and Empathy in Food Industry
(51:14 - 52:42) Navigating Uncertainty Together
(54:59 - 56:12) Future of Hybrid Food Safety Roles

___________________________________________

To learn more about Tia & Jill’s company, please check out their website Catalyst LLC and LinkedIn

Catalyst is a comprehensive and holistic coaching program for creating transformational change within people and organizations toward the ultimate food safety and quality culture.

You can find Tia Glave on LinkedIn and also find Jill Stuber on LinkedIn.

Catalyst Youtube: Ever wonder why food safety culture seems so challenging? or why technical experts aren’t, by default, technical leaders? Join us each week as we explore these topics and more!

___________________________________________

🌟NEW MERCH STORE! 🌟

Bites and Bytes Podcast website for additional show notes, blog, and more!

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 109: Teaser for the CNI Research Report with Chase Richardson
Pub date: 2024-05-14

We are delighted to have Chase Richardson, the VP of Consulting at Bridewell, back on the show today.

Bridewell boasts a rich history in industrials, offering comprehensive cybersecurity services across the entire cybersecurity spectrum, including operating technology.

Recently, Bridewell came up with an insightful report on cybersecurity within the US critical infrastructure. In this episode, Chase dives into the current state of cybersecurity regulations in critical infrastructure and shares the details and origin of the upcoming Bridewell report, which falls squarely within the interest of CSAI.

Tune in to learn more about this exciting project.

Show highlights:

How the attacks experienced by CISOs and cyber managers have decreased despite an increase in risk sentiment
The challenges small and mid-sized airports face when implementing regulations due to their limited cybersecurity budgets
How cybersecurity regulations in the US differ from those in the UK
What is the link between IT and OT security?
Why it is essential to implement a hybrid of IT and OT security measures to protect critical infrastructure
Why organizations need to comply with relevant cybersecurity standards and regulations
Chase shares key findings and insights from Bridewell's upcoming cybersecurity report for critical infrastructure.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Bridewell

Chase Richardson on LinkedIn

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cybercrime Magazine Podcast (LS 32 · TOP 5% what is this?)
Episode: Securing Space For A Better World. Cybersecurity For Satellites At The 2024 Texas Eclipse Festival.
Pub date: 2024-05-13

Cybercrime Magazine attended the recent Texas Eclipse Festival in Burnet, Texas, where we met with former NASA astronaut Nicole Stott, and Christina Corp, director of Space For A Better World. Together, we discussed the crucial, but often overlooked, topic of cybersecurity in satellites and other space technologies. To learn more about Space For A Better World, visit https://spaceforabetterworld.com. • For more on cybersecurity, visit us at https://cybersecurityventures.com.

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Click Here (LS 51 · TOP 0.5% what is this?)
Episode: 130. A wrinkle in time: GPS jamming in Ukraine and its ripple effects
Pub date: 2024-05-14

A story about satellites, electronic warfare, and a team of America techies who MacGyver-ed a way to keep the power flowing in Ukraine.

The podcast and artwork embedded on this page are from Recorded Future News, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: WE'RE IN! (LS 32 · TOP 5% what is this?)
Episode: Mara Winn on protecting America’s critical infrastructure from cyberthreats
Pub date: 2024-05-01

A first-of-its-kind 2016 cyberattack on Ukraine’s power grid was a wake-up call for countries around the world to shore up protection of vulnerable energy resources. Mara Winn, Deputy Director for Preparedness, Policy, and Risk Analysis at the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESAR), is in charge of acting on just that. From securing electric vehicles to safeguarding electric substations, Mara and her team help to ensure the resilience of the energy sector against cyber, physical and climate-based disruptions.

Mara takes a holistic approach to risk management, considering both physical and cyber threats. In the latest episode of WE’RE IN!, she cautions against focusing too much on the "flashy object of the day" and describes why she imbues diversity in risk management for the best outcomes.

Listen to hear more about:

Why early implementation of security measures in product development is necessary for distributed energy resources like solar, wind and battery technologies
How to educate investors, entrepreneurs and designers about understanding the full risk picture in business decisions
The role of the National Association of Regulatory Utility Commissioners and the Federal Power Act in defining federal and state responsibilities in the energy system

The podcast and artwork embedded on this page are from Synack, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4 Contexto del Caso Gestión de Ciberseguridad en la Cadena de Suministro Industrial
Pub date: 2024-05-13

En este episodio se presenta el contexto del caso: datos del entrevistado, riesgos de la cadena de suministro , complejidad y medidas para evaluar y mejorar su resiliencia.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Mikko Hypponen on a Decade of Corporate Ransomware Attacks
Pub date: 2024-05-13

Cybersecurity pioneer Mikko Hypponen joins the Claroty Nexus live at the RSA Conference to discuss a decade of ransomware attacks against corporate networks. Hypponen is Chief Research Officer at WithSecure, the former F-Secure for Business. He has observed and analyzed malware from its infancy when it was a merely a means of disruption and attention-seeking to today's enormously profitable ransomware services and gangs .

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: CWE for Zero Days - not CVE [The Industrial Security Podcast]
Pub date: 2024-05-08

The Mitre CWE - Common Weakness - database talks about kinds of problems that can show up in the future - future zero days - rather than CVE that talks about what vulnerabilities were discovered in the past. Susan Farrell walks us through the CWE and how both vendors and owners & operators use it.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Energy Talks
Episode: #79: Cybersecurity in the Power Grid – A 360° View | Part 7
Pub date: 2024-05-08

Cracking the code: How to uncover 99% of cyber attacks on your systemWelcome to the 7th episode of our Energy Talks miniseries, Cybersecurity in the Power Grid, in which we provide a 360-degree view of how power grids can best safeguard their infrastructures from cyber attacks.

In this episode, we will learn how an OMICRON team of cybersecurity experts goes about analyzing incoming alarms and how even the smallest indicators can reveal hidden dangers that threaten the safety and operations of an entire system.

This was tested by the Norwegian utility company Glitre Nett. They conducted an intrusion detection system (IDS) evaluation exercise at a live substation to compare the solutions of multiple vendors, including OMICRON.

OMICRON cybersecurity experts Ozan Dayanc, Christoph Rheinberger, and Lukas Schneider join us in this episode to describe their involvement in the project with Glitre Nett and discuss how they successfully completed it using OMICRON’s StationGuard intrusion detection system.

The project involved executing live attack simulations in the substation to compare the detection mechanisms of the various IDS solutions. Glitre Nett also wanted to ensure the detection response and support capabilities of the cybersecurity experts at each vendor company.

Stay tuned for upcoming episodes in our Cybersecurity in the Power Grid miniseries.

Learn more about OMICRON’s approach to cybersecurity in power grids.

The podcast and artwork embedded on this page are from OMICRON electronics GmbH, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Adm. Michael Rogers on Geopolitics and Cybersecurity
Pub date: 2024-05-09

Former NSA Director Adm. Michael S. Rogers (Ret. USN) joins the Claroty Nexus Podcast live from RSA Conference in San Francisco to discuss the current geopolitical climate, its impact on chief information security officers, and how they can and should response. Rogers discusses how the doctrines of adversaries are changing and that U.S. critical infrastructure is increasingly in the crosshairs. He also brings his experience and delivers practical advice for CISOs who are not only dealing with external adversaries but also potential legal liability in the event of breaches.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Danit Leybovich-Shati Founder @Alpha Forensics DE & “Why cyber!?” Podcaster on Cyber Forensics value
Pub date: 2024-05-08

פרק מיוחד בשיתוף עם הפודקסט "למה סייבר!?"

נחשון פינקו מארח את דנית ליבוביץ-שטי המייסדת של חברת אלפא חקירות דיגיטליות, מובילת הפודקאסט המצויין "למה סייבר!?". בשיחה על מה היא פורנזיקה דיגיטלית (כנראה לא מה שחשבתם), איך לבחור חברת מענה לאירוע סייבר, חשיבות הגיבויים ובדיקות חזרה מגיבוי באופן שוטף. ועוד

A special episode in collaboration with the podcast "Why Cyber!?"

Nachshon Pincu hosts Danit Leybovich-Shati, Alfa Forensics Digital Evidence's founder and the excellent "Why Cyber!?" podcast host. In a conversation about what digital forensics is (probably not what you thought), how to choose a response company for a cyber incident, and backup, backup, backup, and backup tests on an ongoing basis.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Energy Central Power Perspectives™ Podcast (LS 23 · TOP 10% what is this?)
Episode: “Quantum-Safe Networks for Utilities, Part 2" with Nokia’s Mauricio Subieta, Hansen Chan
Pub date: 2024-05-08

Note: this is a two part episode so we can fit in all of these experts’ tremendous insights. This marks part 2, so if you missed part 1 we invite you to check that out first at this link: https://soundcloud.com/energycentral/quantum-safe-networks-for-utilities-part-1-with-nokias-mauricio-subieta-hansen-chanThe importance of cybersecurity for the power grid is at the forefront of all utility decision makers’ minds. As the types of threats evolve and the nature of technology used by bad actors progress, so too must the preparations and the tools deployed by utilities to ensure the grid remains secure and resilient. Among the state-of-the-art adaptations utilities must now be considering are quantum-safe networks, a leveling up of the type of necessary technologies and protocols. Taking this leap to the new era of securing the grid can be much to grasp, which is why this episode of the Energy Central Power Perspectives Podcast brings in the industry leaders who can address and break down the necessary precautions. In this episode, Mauricio Subieta, Chief Technology Officer of Nokia's Energy Segment, and Hansen Chan, Product Marketing Manager at Nokia, join the podcast conversation to delve into the forefront of these digital utility topics in the face of continuing cyber threats to the grid. Listen in as Mauricio and Hansen join podcast host Jason Price and producer Matt Chester to demystify the concept of quantum-safe networks, exploring the intersection of quantum computing and cybersecurity. From defining quantum threats to unraveling the evolving threat landscape, they provide crucial insights into the necessity and urgency of quantum-safe security measures for power utilities. The conversation also includes practical steps for preparedness and ultimately the transformative impact of quantum-safe networks on utility business practices. Tune in to gain a deeper understanding of this critical facet of modernizing the energy sector.Key Links:Energy Central Post with Full Episode Transcript: Mauricio Subieta on Energy Central: https://energycentral.com/member/profile/mauricio-subietaHansen Chan on Energy Central: https://energycentral.com/member/profile/hansen-chanNokia on Energy Central: https://energycentral.com/NokiaSecuring IEC 61850 communications: https://pages.nokia.com/T009TB-securing-IEC-61850-communications.htmlAsk a Question to Our Future Guests: Do you have a burning question for the utility executives and energy industry thought leaders that we feature each week on the Energy Central Power Perspectives Podcast? Do you want to hear your voice on a future episode? Well starting in 2024, we’re offering you that opportunity! Head to this link where you can leave us a recorded message, including a question you’re eager to have answered on a future episode of the podcast. We’ll listen through them, pick out the right guests in our upcoming lineup to address them, and you’ll hear yourself as a part of the conversation! Energy Central on SpeakPipe: www.speakpipe.com/EnergyCentralPodcast

The podcast and artwork embedded on this page are from Energy Central, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Energy Central Power Perspectives™ Podcast (LS 23 · TOP 10% what is this?)
Episode: “Quantum-Safe Networks for Utilities, Part 1" with Nokia’s Mauricio Subieta, Hansen Chan
Pub date: 2024-05-07

Note: this is a two part episode so we can fit in all of these experts’ tremendous insights. This marks part 1, with part 2 set to be published later this same week. The importance of cybersecurity for the power grid is at the forefront of all utility decision makers’ minds. As the types of threats evolve and the nature of technology used by bad actors progress, so too must the preparations and the tools deployed by utilities to ensure the grid remains secure and resilient. Among the state-of-the-art adaptations utilities must now be considering are quantum-safe networks, a leveling up of the type of necessary technologies and protocols. Taking this leap to the new era of securing the grid can be much to grasp, which is why this episode of the Energy Central Power Perspectives Podcast brings in the industry leaders who can address and break down the necessary precautions. In this episode, Mauricio Subieta, Chief Technology Officer of Nokia's Energy Segment, and Hansen Chan, Product Marketing Manager at Nokia, join the podcast conversation to delve into the forefront of these digital utility topics in the face of continuing cyber threats to the grid. Listen in as Mauricio and Hansen join podcast host Jason Price and producer Matt Chester to demystify the concept of quantum-safe networks, exploring the intersection of quantum computing and cybersecurity. From defining quantum threats to unraveling the evolving threat landscape, they provide crucial insights into the necessity and urgency of quantum-safe security measures for power utilities. The conversation also includes practical steps for preparedness and ultimately the transformative impact of quantum-safe networks on utility business practices. Tune in to gain a deeper understanding of this critical facet of modernizing the energy sector.Key Links:Energy Central Post with Full Episode Transcript: Mauricio Subieta on Energy Central: https://energycentral.com/member/profile/mauricio-subietaHansen Chan on Energy Central: https://energycentral.com/member/profile/hansen-chanNokia on Energy Central: https://energycentral.com/NokiaSecuring IEC 61850 communications: https://pages.nokia.com/T009TB-securing-IEC-61850-communications.htmlAsk a Question to Our Future Guests: Do you have a burning question for the utility executives and energy industry thought leaders that we feature each week on the Energy Central Power Perspectives Podcast? Do you want to hear your voice on a future episode? Well starting in 2024, we’re offering you that opportunity! Head to this link where you can leave us a recorded message, including a question you’re eager to have answered on a future episode of the podcast. We’ll listen through them, pick out the right guests in our upcoming lineup to address them, and you’ll hear yourself as a part of the conversation! Energy Central on SpeakPipe: www.speakpipe.com/EnergyCentralPodcast

The podcast and artwork embedded on this page are from Energy Central, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 36: Securing SCADA Systems In The Cloud
Pub date: 2024-05-07

This is a story about how organizations are moving their SCADA systems to the cloud and how they need to secure them or they’ll be attacked. Chris Doman, co-founder and CTO of Cado Security discusses the new NSC guidelines on SCADA in the Cloud and whether the guidelines are prescriptive enough.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 4/4. Desenlace del caso Cómo proteger las cajas negras en un entorno OT
Pub date: 2024-05-05

En este episodio se muestran consideraciones una vez implementadas soluciones para proteger las cajas negras

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: Shipment
Pub date: 2024-05-03

In this episode of the OG of OT podcast, a young woman “Clara” (not her real name) is reunited with this dude “Harvey” (also not his real name). She was duped into taking part in a supply chain attack. He kinda remembers the equipment refresh and rumors of infected firmware. Decades later, they meet. Coincidence?

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: 2024 Threat Report – OT Cyber Attacks with Physical Consequences
Pub date: 2024-05-03

Waterfall Security Solutions and ICSSTRIVE put out an annual threat report that Dale Peterson believes is the best in OT. Why? It only includes incidents that had physical consequences on systems monitored and controlled by OT.

Dale and Andrew discuss:

What is in and out of scope for the report.
The breakdown of the 68 incidents that occurred in 2023 by industry sector, cause, threat actor and more.
The impact reporting requirements may have on these numbers in the future.
What percentage of OT cyber incidents with physical consequences are made public.
Ransomware on IT causing physical consequences, exfil v. encryption, and what asset owners should do given this represents 80% of the known incidents in the report.
And more.

Links:

2024 Threat Report: https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/2024-threat-report-ot-cyberattacks-with-physical-consequences/
ICSSTRIVE: https://icsstrive.com
S4 Events YouTube Channel: https://youtube.com/s4events

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Critical infrastructure: Pending legislation and risks and rewards from AI.
Pub date: 2024-05-01

Mandiant ties OT attacks to Sandworm. Russia-linked hackers target Texas water utilities. Belarusian hacktivists hit fertilizer company. CISA issues eight ICS advisories. Dave Bittner's Caveat podcast co host Ben Yelin joins him to discuss pending legislation with potential to affect critical infrastructure, as well as the Department of Energy’s assessment of the potential risks and rewards from AI. The Learning Lab is on a hiatus this episode, and will be returning soon!

Control Loop News Brief.Mandiant ties OT attacks to Sandworm.Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm (Mandiant)

Russia-linked hackers target Texas water facilities.Rural Texas Towns Report Cyberattacks That Caused One Water System to Overflow (SecurityWeek)

Russia-linked hacking group suspected of carrying out cyberattack on Texas water facility, cybersecurity firm says (CNN)

Belarusian hacktivists hit fertilizer company.Belarusian hackers claim to breach fertilizer plant in retaliation for support of Lukashenko regime (The Record)

CISA issues eight ICS advisories.CISA Releases Eight Industrial Control Systems Advisories (CISA)

Control Loop Interview.Host Dave Bittner and his co host from the Caveat podcast on the N2K CyberWire network, Ben Yelin, share some discussion about pending legislation with potential to affect critical infrastructure, and Department of Energy’s assessment of the potential risks and rewards from AI.

Links to articles:

Crawford puts forward bill on cybersecurity risks to water systems (The Arkansas Democrat-Gazette)
US DOE rolls out initial assessment report on AI benefits and risks for critical energy infrastructure (Industrial Cyber)

Control Loop Learning Lab.The Learning Lab is on a break and will be back soon. Stay tuned.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. It’s only 5 short questions. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Tehilla Shwartz Altshuler Senior Fellow @Israel Democracy Institute on “Phygital” cyber risks
Pub date: 2024-04-30

פרק מיוחד בשיתוף עם הפודקסט למה סייבר?! דנית ליבוביץ-שטי ונחשון פינקו מארחים את תהילה שוורץ אלטשולר, עמית בכירה במכון הישראלי לדמוקרטיה וראש תכנית דמוקרטיה בעידן המידע, בשיחה על עולם ה"פיגיטלי" החדש (פיזי פלוס דיגיטלי) וסיכוני הסייבר שבו. מדוע ישראל עומדת מאחורי מדינות המערב עם היעדר רגולציות סייבר ופרטיות? ועוד

A special co-created episode with Why Cyber?! Podcast Danit Leybovich-Shati and Nachshon Pincu host Tehilla Shwartz Altshuler, a Senior Fellow at Israel Democracy Institute and head of the Democracy in the Information Age program, In a conversation about the new “Phygital” (physical plus digital) world and its cyber risks. Why is Israel behind the Western countries with a lack of cyber regulations? And More

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 3/4 Acciones del caso Cómo proteger las cajas negras en un entorno OT
Pub date: 2024-04-29

En este episodio se presentan las estrategias o soluciones que se están considerando actualmente para proteger las cajas negras y recomendaciones.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Abel Archundia on Complexity in Critical Infrastructure
Pub date: 2024-04-29

Abel Archundia, chief technology officer and global head of advisory for Istari, joins the Claroty Nexus podcast to discuss the nature of complexity, technical debt, and regulation, and how it influences risk decisions in critical infrastructure environments. He explains the challenges complexity brings to manufacturing, pharmaceuticals, and other CI sectors, and how owners and operators may feel outmatched by technical debt.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: AI and Cyber Resilience in the Food Industry with Stuart King
Pub date: 2024-04-25

In this captivating podcast episode, host Kristin and her guest and fiancée, Stuart King, explore their rich experiences in cybersecurity, specifically focusing on the food industry. They discuss the transformative impact of AI and machine learning on security practices within this sector. The episode begins with personal stories that connect their professional paths to memorable food experiences, illustrating how these moments deeply intertwine with their work.

Stuart recounts his extensive career, starting with his initial experiences in the Royal Air Force and moving into significant roles in cybersecurity, particularly emphasizing his contributions to safeguarding food production systems. The conversation then shifts to their joint venture, “AnzenOT,” a tool they co-developed to simplify and democratize risk assessments for small to mid-size enterprises in the food industry. They discuss how AI enhances this process through improved analytics to give context to risk, which is essential for food manufacturers aiming to fortify their defenses against cyber threats.

The duo highlights the crucial need to understand the human side of cybersecurity in food manufacturing, advocating for solutions that address the daily challenges employees face on production floors. They discuss how AnzenOT uses AI to simulate realistic threat scenarios and offer practical, actionable insights, helping companies navigate the complex landscape of food safety and cybersecurity.

Throughout the episode, Kristin’s cat, Kai, also makes a charming presence, adding a touch of warmth as she quietly joins in, much to the amusement of both hosts.

As the episode wraps up, Kristin and Stuart invite listeners to join them at upcoming industry conferences, including RSA, where they will discuss cybersecurity and operational technology in the food industry. They encourage a broader dialogue about enhancing security measures to protect the vital processes that feed nations and maintain public health.

___________________________________________

Episode Key Highlights:

(02:52 - 03:53) Unforgettable Food Adventures in Japan

(06:13 - 08:23) Career Evolution and Shared Experiences

(13:44 - 15:56) Critical Infrastructure Vulnerabilities in Production

(17:56 - 20:09) Importance of Understanding Environment in Cybersecurity

(24:04 - 26:00) Risk Management and AI in Industry

(29:27 - 31:18) AnzenOT Tool Benefits and Features

(34:08 - 35:40) Value for Money and Risk Assessment

(37:45 - 38:41) Network Security Vulnerabilities From Unknown Applications

___________________________________________

How to connect with Stuart King:

LinkedIn and Email

Our talk on the S4 Main Stage, “Factories Are Families: How Does Security Join The Family?”

Panel at IC3 Games 2023 on protecting critical infrastructure.

___________________________________________

If you want to learn more about AnzenOT, please check the website or reach out on LinkedIn.

Also, if you would like to schedule a demo of AnzenOT or have a chat, please use this link to schedule a meeting.

___________________________________________

Additional Show notes and information are on the Bites and Bytes Website.

If you would like to schedule a meeting with Kristin to discuss the Bites and Bytes Podcast, please use this link.

Audience Survey can be found here.

Bites and Bytes Podcast Merch Shop!! (click here)

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Hatte der Energiesektor bei Cyberangriffen bisher nur Glück?
Pub date: 2024-04-25

OT Security Made Simple Host Klaus Mochalski spricht mit Stefan Grützmacher, der in den letzten Jahrzehnten mehrere Energieversorger geleitet hat. Für Stefan wird die OT-Sicherheit bei den Kritischen Infrastrukturen noch immer viel zu stiefmütterlich behandelt. Er stellt als Branchenkenner aber auch klare Anforderungen an Lösungen für den KRITIS-Sektor.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Insights with NDK Cyber
Episode: Rails & Resilience: Navigating Cybersecurity in Rail Travel with RazorSecure CEO, Alex Cowan
Pub date: 2024-04-25

In this episode, we welcome Alex Cowan, CEO of RazorSecure, where we discuss the intricate world of rail cybersecurity.

From legacy systems to cutting-edge digital infrastructures, Alex shares his wealth of knowledge gained from over a decade in the field. Additionally, we'll explore the impact of new NIST regulations on this dynamic sector.

Join us for another informative episode of Secure Insights!

The podcast and artwork embedded on this page are from NDK Cyber, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Data Breach Today Podcast (LS 32 · TOP 5% what is this?)
Episode: Major Areas of Cybersecurity Focus for Medical Device Makers
Pub date: 2024-04-24

Medical device makers submitting products for premarket approval by the Food and Drug Administration often struggle the most with cybersecurity in three major areas - design controls, providing a software bill of materials and testing, according to Nastassia Tamari of the FDA.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: The ICS Hacker
Pub date: 2024-04-23

Claroty is a cybersecurity company that helps organizations to secure cyber-physical systems across industrial (OT), healthcare (IoMT), and enterprise (IoT) environments: the Extended Internet of Things (XIoT).

In this episode, Bryson Bort sits down with Claroty director of research and industrial control system (ICS) vulnerability expert Sharon Brizinov to discuss everything ICS.

What are the most common vulnerabilities threatening ICS security? What’s the impact of cybersecurity controls standardization? And if he could wave a magic wand, what is one thing he’d change in the ICS industry?

“Don't expose ICS equipment over the Internet,” Sharon said. “That's my wish. To eliminate all the ICS Internet-exposed devices.”

Join us for this and more on this episode of Hack the Plant.

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: State Of NERC CIP, European Update and OT Security Community
Pub date: 2024-04-24

Patrick Miller has OT cybersecurity experience as an asset owner, PacificCorp. As a regulator and one of the first NERC CIP auditors with WECC. As a community organizer creating and leading EnergySec and the BeerISAC. And as an entrepreneur creating and leading a number of consulting practices. He is currently the Founder of Ampyx Cyber.

In this episode Patrick and Dale discuss:

Why Patrick changed the company name and selected Talinn as the location for the new European office.
The major differences in approaches to OT cybersecurity and risk management between Europe and the US. (more than just regulatory differences)
What has the EU learned or improved on regulation from NERC CIP.
What is the current state of NERC CIP regulatory risk? Are the regulated entities understanding and meeting the standards’ requirements?
The challenge of slow NERC CIP modifications, eg virtualization and cloud.
Bad standard & good regulator v. good standard & bad regulator.
Should water follow the NERC CIP model as recommended by AWWA?
How Patrick is dealing with AI.

Links

Ampyx Cyber: https://ampyxcyber.com
Patrick’s Critical Assets Podcast: https://amperesec.com/podcast
Subscribe to Dale’s ICS Security Friday News & Notes: https://friday.dale-peterson.com/signup
Advertise on Unsolicited Response: https://dale-peterson.com/advertising/

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Adam Gluck on Industrial DevOps
Pub date: 2024-04-23

Adam Gluck, founder and CEO of Copia Automation, joins the Claroty Nexus podcast to discuss the need for DevOps within industrial automation. DevOps practices are popping up more frequently in these environments, but there are still hurdles and challenges for developers and engineers to overcome. Adam covers those, and explains how DevOps can improve disaster recovery, lessen the introduction of vulnerabilities in new code, and mitigate risk by being proactive about reviewing code changes as they happen rather than later in the development lifecycle.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 35: Outsized Kinetic Response to OT Attacks
Pub date: 2024-04-23

If you knock down an email server, you could stand up a parallel server or you could find workarounds. If you knock down a factory floor, there is no real parallel, alternative to a factory floor. Dane Grace of Brinqa talks about how the risks to OT carries with it an outsized kinetic response in the real world. For example, what would happen if someone managed to put a botnet on a defibrillator?

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Work (LS 42 · TOP 1.5% what is this?)
Episode: How to get started in industrial control systems cybersecurity | Guest Robin Berthier
Pub date: 2024-04-22

Today on Cyber Work, we are talking operational technology, or OT, security with guest, Robin Berthier of Network Perception. From his earliest studies to his time as an academic researcher, Berthier has dedicated his career to securing the intersection between operational technology and network security, with some pretty imaginative solutions to show for it. In today’s episode, Berthier explains why modern OT security means thinking more about the mechanics of the machinery than the swiftness of the software solutions, the big conversation that infrastructure and ICS Security need to have about nation-state attackers (and finally are having!) and Berthier's best piece of career advice turns into some excellent thoughts on the importance of maintaining your network… and I don’t mean routing and switching!

0:00 - Industrial control systems cybersecurity
1:54 - How Robin Berthier got into tech
3:38 - Majoring in cybersecurity
4:55 - Intrusion detection systems
9:18 - Mechanical and cybersecurity tools
12:33 Launching Network Perception
17:03 - Current state of ICS and OT infrastructure
20:24 - Cyberattacks on industrial control systems
28:35 -Skills needed to work in industrial control systems
35:19 - Where are ICS security jobs?
36:39 - Getting into local OT systems
37:55 - Skills gaps in ICS
39:21 - Best piece of career advice
41:01 - Cultivating a work network
43:28 - What is Network Perception?
45:27 - Learn more about Robin Berthier
45:58 - Outro

– Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
– View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

The podcast and artwork embedded on this page are from Infosec, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 46: Matt Wiseman on the massive impact of OT decisions
Pub date: 2024-04-23

When it comes to OT cybersecurity, every decision can have massive impact on company finances,

human life and safety and more. In this episode of the ICS Pulse Podcast, we talk to Matt Wiseman of OPSWAT about getting IT and OT to work together and how AI/ML can help simplify the process.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4 Análisis del caso Cómo proteger las cajas negras en un entorno OT
Pub date: 2024-04-22

En este episodio se analizan cuáles son los riesgos de las cajas negras, así como consideraciones específicas al diseñar estrategias de protección.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: From Basics to Quantum: A Comprehensive Dive into Cybersecurity Trends
Pub date: 2024-04-19

SummaryThe conversation covers various topics related to cybersecurity, including offensive security, IoT devices, hidden threats in cables, advanced hacking devices, privacy concerns with smart devices, cyber hygiene, securing personal data, risks of social media platforms, importance of cybersecurity education, government regulations, and trends in cybersecurity for 2024. The conversation explores the prevalence of social engineering attacks and the effectiveness of generative AI in social engineering. It discusses the challenges of detecting phishing emails generated by AI and the difficulty of defending against AI-powered attacks. The role of password managers and firewalls in defense is highlighted, as well as the importance of recognizing the limitations of human perception. The conversation emphasizes the need for cyber defense measures in organizations and the vulnerability of the weakest link in the chain. It also addresses the risks associated with third-party vendors and the impact of cyber attacks on critical infrastructure. The importance of cyber-informed engineering and designing with security in mind is discussed, along with the challenges of securing outdated OT systems. This conversation covers various topics related to securing OT networks, including the challenges of upgrading OT systems, the complexity of OT networks, and the use of OT firewalls. The discussion also explores the importance of understanding OT protocols and the security risks of unencrypted OT protocols. Additionally, the conversation delves into the impact of Active Directory issues and the role of AI in cybersecurity. The future of AI and quantum computing in cybersecurity is also discussed.

More About The EpisodeHosted by: Aaron Crow

Guest: Duane Laflotte

Connect with Duane Laflotte:* Website: www.pulsarsecurity.com/ * LinkedIn: https://www.linkedin.com/in/duanelaflotte/

Connect with Aaron Crow:* Website: www.corvosec.com * LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:* Email: info@protectitall.co * Website: https://protectitall.co/ * X: https://twitter.com/protectitall * YouTube: https://www.youtube.com/@PrOTectITAll * FaceBook: https://facebook.com/protectitallpodcast

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Annual Intensity Global Group Conference 2024 part 3: The cyber defender view
Pub date: 2024-04-17

הכנס השנתי 2024 של קבוצת אינטנסיטי גלובל חלק חלק שלישי: ראיית

המגן למרות האיומים האירנים לאנשי הסייבר זו מאין שגרה. דריכות המתנה ושיוף היכולות עוד ועוד

מנחה: נחשון פינקו - אוונגליסט סייבר סמנכ"ל בכיר ליעוץ ושרותי מומחים בניאטק סייבר סקיורטי בע"מ.

משתתפים: אביבית קוטלר: סיסו ודי.פי.או - בשרותי בריאות כללית

יערה לבון: סיסו – אילון חברה לביטוח

אמיר ארד: סיסו - תנובה

ערן פלד: דירקטור מערכות מידע גלובלי – ננו דימנשן

רוני רויטמן - מייסד שותף ומנכ"ל אינטנסיטי גלובל

Intensity Global Group's 2024 Annual Conference Part Three: The Defender's View Despite the Iranian threats, cyberpeople have an ordinary routine: vigilance, waiting, and honing their skills repeatedly.

Moderator:

Nachshon Pincu - cyber evangelist, SVP @Niatech Cyber Security Participants:

Avivit Kotler: CISO & DPO at Clalit Health Services

Yaara Lavon: CISO at Ayalon insurance company

Amir Arad: CISO & Director of Cyber Security at Tnuva

Eran Peled: Global IT Director at Nano Dimension

Roni Roytman - Co-founder & CEO at Intensity Global

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Book Interview: Introduction To SBOM And VEX
Pub date: 2024-04-17

View Details

Podcast: All Things Considered
Episode: How Ukraine is keeping the power grid running amidst war with Russia
Pub date: 2024-04-17

The podcast and artwork embedded on this page are from NPR, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: Living off the Land
Pub date: 2024-04-15

In the last episode we talked about bad guys camping out in critical infrastructure networks, and now it's time to explore what they can do while they're there. This episode explores "Living off the Land" attacks and what that means in an industrial control network.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Examining CIRCIA and VOLTZITE.
Pub date: 2024-04-17

Chinese-manufactured devices in US networks see a 41% YoY increase. Ukraine-linked hackers deploy ICS malware against Russian infrastructure company. A look at cyberattacks that had physical consequences in 2023. Lessons from NERC’s GridEx exercise. Extension requested for comment period on CISA’s incident reporting rule. Guest Kate Ledesma, Senior Director Government Affairs at Dragos, talks about the Cybersecurity Incident Reporting for Critical Infrastructure Proposed rule (CIRCIA). The Learning Lab returns has part 2 of Mark Urban and Josh Hanrahan's discussion adversary hunting and VOLTZITE (aka Volt Typhoon).

Control Loop News Brief.Chinese-manufactured devices in US networks see a 41% YoY increase.“All your base are belong to us” – A probe into Chinese-connected devices in US networks (Forescout)

Ukraine-linked hackers deploy ICS malware against Russian infrastructure company.Unpacking the Blackjack Group's Fuxnet Malware (Claroty)

A look at cyberattacks that had physical consequences in 2023.2024 Threat Report – OT Cyberattacks with Physical Consequences (Waterfall)

Lessons from NERC’s GridEx exercise.GridEx VII: Lessons Learned Report (NERC)

Extension requested for comment period on CISA’s incident reporting rule.US Chamber of Commerce, industry groups call for 30-day delay in CIRCIA rules (The Record)

Control Loop Interview.Guest Kate Ledesma, Senior Director Government Affairs at Dragos, discussing Cybersecurity Incident Reporting for Critical Infrastructure Proposed rule (CIRCIA).

Control Loop Learning Lab.On the Learning Lab segment, listen to Dragos’ Mark Urban talking with Josh Hanrahan, Principal Adversary Hunter at Dragos, in part two of their discussion on adversary hunting and VOLTZITE (aka Volt Typhoon).

Resources:

VOLTZITE Threat Group’s Under the Radar Cyber Espionage on U.S. Critical Systems.

The 5 Critical Controls for ICS/OT Cybersecurity – SANS webinar.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. It’s only 5 short questions. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4 Contexto del caso Cómo proteger las cajas negras en un entorno OT
Pub date: 2024-04-15

En este episodio se presenta el contexto del caso, datos del entrevistado, que se consideran “cajas negras”, su importancia, complejidad y riesgos

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Beers with Talos Podcast (LS 43 · TOP 1% what is this?)
Episode: Stories from the Power Grid
Pub date: 2024-04-11

Power grid security expert Joe Marshall joins the crew today to talk all things, well, power grid security. But not before he gets an impromptu pop quiz from Matt in the roundtable.

Joe then tells some stories from his days working in electric utility, deploying new systems and his experiences with pentesting teams ("Wow, y'all need to stop!"). Plus, the team ask Joe about the risks with both aging infrastructure versus newer, smarter based infrastructure. And what happens when threat actors target critical infrastructure?

The podcast and artwork embedded on this page are from Cisco Talos, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Annual Intensity Global Group conference 2024 part 2: The cyber attacker view
Pub date: 2024-04-11

הכנס השנתי 2024 של קבוצת אינטנסיטי גלובל חלק חלק שני: ראיית התוקף

מנחה: נחשון פינקו - אוונגליסט סייבר סמנכ"ל בכיר ליעוץ ושרותי מומחים בניאטק סייבר סקיורטי בע"מ.

משתתפים:

אלברטו (דטו) חסון - סמנכ"ל CISO ב ICL Group

חן גיראט - CISO בחברת חשמל לישראל

ניר צ'רנוב - לשעבר CISO ב 8200 וזוכה פרס בטחון ישראל

דניאל סוויסה - לשעבר ראש מדור ביום אויב בחטיבת הסייבר

רוני רויטמן - מייסד שותף ומנכ"ל אינטנסיטי גלובל

Intensity Global Group's 2024 Annual Conference Part 2: The Cyber Attacker View

Moderator: Nachshon Pincu - cyber evangelist, SVP @Niatech Cyber Security

Participants:

Alberto (Deto) Hasson - VP CISO @ICL Group

Chen Girat - CISO @Israel Electricity Company (IEC)

Nir Chernov - former CISO @IDF 8200 and winner of the Israel Security Award

Daniel Suissa - former head of the Rad heat section @IDF cyber division

Roni Roytman - Co-founder and CEO of Intensity Global

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: Rails Redefined: Navigating the Cybersecurity Evolution in Transportation
Pub date: 2024-04-09

In this episode of Secure Tracks, join us as we explore the intricate world of rail cybersecurity with insights from Greg Adamson, Chief Information Security Officer at the Department of Transport and Planning in Victoria, Australia. With a career that transitioned from the federal government to the forefront of cybersecurity in the rail sector, Adamson sheds light on the evolving challenges and strategies essential for safeguarding our rail systems against emerging digital threats. We delve into the necessity of adaptive cybersecurity frameworks, the impact of technological advancements, and the innovative approach of zoning for asset protection.

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: S4x24 Closing Panel
Pub date: 2024-04-10

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 45: Steve Carroll and Dave Jennings on building automation cybersecurity
Pub date: 2024-04-09

In the modern, interconnected environment, almost everything is vulnerable to cyberattacks, including the buildings in which we live, work and play. In this edition of the ICS Pulse Podcast, we talk to Steve Carroll and Dave Jennings of Salas O’Brien about how to protect building automation systems and why standards are needed.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 34: Assessing Cyber Risk in OT Systems
Pub date: 2024-04-09

One of the problems with security is ROI. If I put in next gen this and next gen that and no security events happen, am I justified in making those expenditures? How do you quantify a risk like that? Padraic O’Reilly, founder and Chief Innovation Officer at Cyber Saint, walks us through the risk analysis for IoT and OT systems, and why it’s important to understand this as we secure our critical infrastructure.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Automation Chat (LS 26 · TOP 10% what is this?)
Episode: What’s Really Happening with Industrial Cybersecurity & What You Can Learn
Pub date: 2024-04-09

Manufacturing is now the #1 target for hackers. Smart, connected devices on the plant floor are high-value cyberattack targets because of the intellectual property they contain — and just one day of downtime can cost millions.

In this episode, Executive Editor Theresa Houck talks with Richard Springer, Director of Marketing, OT Solutions at Fortinet, about findings of its revealing study, “Advancing Digital Transformation in a Time of Unprecedented Cybersecurity Risk,” developed in collaboration with the Manufacturers Alliance Foundation.

They discuss key takeaways, cybersecurity trends, and lessons that can help manufacturers fortify their cybersecurity efforts. Also learn how IT/OT collaboration is a key to finding mutual goals that balance security and operational priorities. And discover what the U.S. SEC has to do with cyberattack reporting.

And as always, get your family-friendly, silly Joke of the Day.

Resources from this episode:

Download the report, “Advancing Digital Transformation in a Time of Unprecedented Cybersecurity Risk.”
Richard Springer’s blog: “Tracking Cybersecurity Progress at Industrial Companies.”
Richard Springer on LinkedIn.
Fortinet.
Manufacturer’s Alliance.
Subscribe to our 4 print magazines (Feb., May, July and Oct.) by e-mailing Anna Hicks at ahicks@endeavorbusinessmedia.com.
Subscribe to our 4 digital magazines at http://rok.auto/thejournal-subscribe.

You can also watch Theresa & Richard’s conversation on YouTube at https://youtu.be/esFAKPAbCSY.

Automation Chat is brought to you by The Journal From Rockwell Automation and Our PartnerNetwork magazine.

Find us on LinkedIn.

Find us on Facebook.

Find us on X (Twitter).

** Named Best Podcast 2 Consecutive Years! 2022 & 2023 Apex Awards of Publication Excellence.

View Details

Podcast: Bites & Bytes Podcast
Episode: Securing the Food Chain with Systems Thinking with Carl "CJ" Unis
Pub date: 2024-04-07

In this engaging episode of the Bites and Bytes Podcast, we welcome Carl 'CJ' Unis, a Systems Engineer with the U.S. Space Force and Principal at Unis Complexity Solutions. CJ brings over 20 years of expertise in systems engineering and infrastructure logistics to our conversation. He illuminates the critical role of systems thinking in enhancing cybersecurity within the food industry. His background includes analyzing cascading infrastructure failures for the Department of Homeland Security at Sandia National Laboratories and serving as a federal agent for the Department of Energy. Not to mention, CJ's experience in the U.S. Marine Corps adds a unique perspective to his insights.

This episode was pre-recorded in January 2024 and predates the current critical infrastructure incidents or challenges highlighted in recent media. CJ's insights offer a proactive perspective and underscore the strategic importance of resilience in system thinking, providing a valuable lens to view and address the evolving cybersecurity landscape.

Episode Key Highlights:

(00:29 - 01:24) System Engineering and Food Cybersecurity

(08:56 - 11:07) Food and Cyber Security Risks

(13:47 - 15:40) Rapid Technological Advancement in 2024

(18:01 - 18:46) Cybersecurity Impact on Food Industry

(23:22 - 25:03) Understanding Natural Cycles and Engineering

(29:06 - 31:12) Systems Thinking in Risk Management

(32:19 - 33:36) Food Industry's Wide-Reaching Impact

(37:48 - 39:37) Universal Industry Problems

(43:16 - 44:02) Unsung Heroes of Everyday Life

(45:38 - 47:06) Insider Threat and Vulnerability Analysis

How to connect with CJ: LinkedIn and Contact Card

Course CJ teaches: “Systems Thinking in Emergency Management.”

Article CJ co-authored: “Rethinking Future Food Chains: Systems Thinking and the Cascading Consequences of System Failure."

Research Paper CJ co-authored: “Building Food System Resilience within a Learning Organization.”

Systems Thinking Alliance

Additional Show notes and guest inquiry information are on the Bites and Bytes Website.

If you want to learn more about AnzenOT, please check the website or reach out on LinkedIn.

FKfxRoQqxr9G0n03s16G

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 4/4. Desenlace del Caso La importancia del contexto en la Ciberseguridad Industrial
Pub date: 2024-04-08

Este episodio presenta los pasos para establecer una estrategia, indicadores para evaluar su efectividad y actuaciones ante amenazas cambiantes por el contexto.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Forensic analysis in OT - a case study
Pub date: 2024-04-04

In this episode of OT Security Made Simple, Klaus Mochalski welcomes Digital Forensics Managing Director Dr. Frank Stummer. Frank talks about the importance of digital forensics in security incidents in OT, the challenges he faces and how he was able to thwart another security incident worth hundreds of millions of euros at a logistics service provider.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Securing Our Future: The Cyber Challenge in Aging Infrastructure
Pub date: 2024-04-04

SummaryThe conversation covers the challenges and risks associated with aging infrastructure, particularly in critical sectors such as power generation and water treatment. The lack of maintenance and neglect of infrastructure pose significant threats to public safety and national security. The integration of IT and OT systems in these sectors creates vulnerabilities that can be exploited by cyber attackers. The conversation emphasizes the need for a comprehensive strategy and funding to address these issues. Additionally, the importance of vocational education and job creation in the infrastructure sector is highlighted. The conversation covers various aspects of infrastructure, including the government bidding process, the slow process of infrastructure projects, the need for streamlining government processes, the importance of continuous maintenance and upgrades, the need for oversight and compliance, the importance of a proactive approach to infrastructure, the consequences of neglecting infrastructure, the impact of cyber attacks on infrastructure, personal journeys into cybersecurity, opportunities in OT cybersecurity, and a call to action to get involved in OT cybersecurity.Takeaways Aging infrastructure in critical sectors poses significant risks to public safety and national security. * The integration of IT and OT systems in critical infrastructure creates vulnerabilities that can be exploited by cyber attackers. * Comprehensive strategies and funding are needed to address the challenges and risks associated with aging infrastructure. * Vocational education and job creation in the infrastructure sector are crucial for addressing the maintenance and upgrade needs. Infrastructure projects involve a slow and complex government bidding process. * Infrastructure projects can take several years to complete and require continuous maintenance and upgrades. * Streamlining government processes and consolidating oversight can help expedite infrastructure projects. * Continuous maintenance and upgrades are essential to ensure the reliability and security of infrastructure systems. * Proactive measures are necessary to prevent infrastructure failures and mitigate the impact of cyber attacks. * There are job opportunities in the field of OT cybersecurity, and vocational education and training are available. * Engaging with experts and organizations in the field can provide valuable insights and guidance. More About The EpisodeHosted by:* Aaron Crow

Guest: Luther 'Chip' Harris

Connect with Luther 'Chip' Harris:* LinkedIn: https://www.linkedin.com/in/luther-chip-harris-49872035/

Connect with Aaron Crow:* Website: www.corvosec.com * LinkedIn: https://www.linkedin.com/in/aaronccrow

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Insights with NDK Cyber
Episode: Is there a skill-shortage in the OT Security space? Patrick Miller – CEO at Ampere Industrial Security
Pub date: 2024-04-04

In this week’s episode, we met with Patrick Miller, CEO at Ampere Industrial Security.

Patrick provides an overview of the present landscape of OT Security, identifies potential shortages in skills, and offers insights into how to establish a career in this industry.

The podcast and artwork embedded on this page are from NDK Cyber, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Q1: ICS Security In Review
Pub date: 2024-04-03

Emma Stewart joins Dale to discuss the 3 big OT & ICS security stories from the first quarter. They end by giving their win, fail and prediction for Q1.

View Details

Podcast: HouSecCast
Episode: Community Building with Roya Gordon
Pub date: 2024-04-03

Co-Host Sam Van Ryder flies solo for this episode with Executive Industry Consultant, Roya Gordon! They share insights on SBOMs and their significance in OT security, discuss what current security conferences are doing right (and where they could improve!), and the importance of building local cybersecurity communities.

Things Mentioned:

· Southern Company Builds SBOM for Electric Power Substation - https://www.darkreading.com/ics-ot-security/southern-company-builds-a-power-substation-sbom?mc_cid=4ef3664287&mc_eid=UNIQID

Do you have a question for the hosts? Reach out to us at podcast@houstonseccon.com

Keep up with HOU.SEC.CON:

· LinkedIn

· Twitter

· Facebook

· Instagram

· YouTube

Check out our other show:

· CyberSunday

Check out our Conferences and Events:

· HOU.SEC.CON.

· OT.SEC.CON.

· EXEC.SEC.CON.

· HSC User Group

Support or apply to our Scholarship Program:

· TAB Cyber Foundation

In this episode:

· Host: Michael Farnum

· Host: Sam Van Ryder

· Guest: Roya Gordon

· Editing by: Lauren Lynch

· Music by: August Honey

The podcast and artwork embedded on this page are from Michael Farnum and Sam Van Ryder, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: AI and Industrial Security in the Energy Transition [The Industrial Security Podcast]
Pub date: 2024-04-03

AI is coming and industrial security is an issue. Join us as Leo Simonovich VP at Siemens Energy joins us to look at both in the context of the energy transition - burning fewer fuels to achieve the same industrial process goals.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Annual Intensity global group conference 2024 part 1: Roni Roytman Co-founder & CEO
Pub date: 2024-04-04

הכנס השנתי 2024 של קבוצת אינטנסיטי גלובל חלק ראשון: הרצאה של מייסד שותף ומנכ"ל החברה רוני רויטמן על העליה החדה במתקפות סייבר על ישראל ולא רק, התמודדות, ניהול ארוע סייבר ומה הדרך הנכונה לבחור ולהפעיל חברת IR

The 2024 annual conference of the Intensity Global Group, part one: a lecture by the company's co-founder and CEO Roni Roytman on the sharp increase in cyber attacks on Israel and not only. Dealing with it, managing a cyber event and what is the right way to choose and operate an IR company

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: Inside
Pub date: 2024-04-01

Stories about nation-state adversaries "camping out" in the energy grid for as long as I can remember. What the deal? Is this truth? Fiction? Somewhere in between?

In this episode, the OGs talk to a bunch of people who claim to know.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Hunting adversaries.
Pub date: 2024-04-03

Sellafield nuclear waste site to be prosecuted for alleged cybersecurity failings. CISA issues draft proposal for cyber incident reporting by critical infrastructure entities. Threat actor targets Indian government and energy entities. Suspicious NuGet package appears to target developers in the industrial sector. Guest Eric Goldstein, Executive Assistant Director for Cybersecurity at CISA, shares their CIRCIA Notice of Proposed Rulemaking. The Learning Lab returns! Mark Urban and Josh Hanrahan discuss adversary hunting.

Control Loop News Brief.Sellafield nuclear waste site to be prosecuted for alleged cybersecurity failings.Sellafield nuclear waste dump to be prosecuted for alleged cybersecurity offences (The Guardian)

Sellafield nuclear site hacked by groups linked to Russia and China (The Guardian)

CISA issues draft proposal for cyber incident reporting by critical infrastructure entities.CISA releases draft rule for cyber incident reporting (CyberScoop)

Threat actor targets Indian government and energy entities.Operation FlightNight: Indian Government Entities and Energy Sector Targeted by Cyber Espionage Campaign (EclecticIQ)

Suspicious NuGet package appears to target developers in the industrial sector.Suspicious NuGet package grabs data from industrial systems (ReversingLabs)

Control Loop Interview.Guest is Eric Goldstein, Executive Assistant Director for Cybersecurity at CISA. Eric shares their CIRCIA Notice of Proposed Rulemaking that goes into effect this week.

Control Loop Learning Lab.The Learning Lab is back! On today’s segment, listen to Dragos’ Mark Urban talking with Josh Hanrahan, Principal Adversary Hunter at Dragos, in part one of their discussion on adversary hunting and VOLTZITE (aka Volt Typhoon).

Resources:

VOLTZITE Threat Group’s Under the Radar Cyber Espionage on U.S. Critical Systems .

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Work (LS 42 · TOP 1.5% what is this?)
Episode: Modern industrial control system security issues | Guest Thomas Pace
Pub date: 2024-04-01

Thomas Pace of NetRise talks about industrial control systems security. We’ll learn about Pace's time in the United States Marine Corps in cyber-intelligence, his move to forensics and then ICS and why the greatest asset a security professional can have is the ability to find, clearly see and create narratives. I always find ICS professionals to be fascinating, and Pace took us down some new paths, so if you’re also interested in ICS Security, keep it here for today’s episode of Cyber Work!

0:00 - Industrial Control Systems security
1:39 - How Pace got into cybersecurity
4:31 - The speed of cybersecurity's change
5:20 - Pace's career in cyber intelligence
10:08 - Importance of cybersecurity analysis
10:55 - Current state of ICS and infrastructure security in the U.S.
25:22 - How to work in ICS security
32:52 - Manufacturing security issues
38:00 - Security risks for cranes
40:51 - Best ICS security advice
44:09 - Best cybersecurity career advice
46:15 - What is NetRise?
47:40 - Learn more about Pace
48:25 - Outro

– Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
– View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

The podcast and artwork embedded on this page are from Infosec, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Greg Garcia on the Change Healthcare Cyberattack
Pub date: 2024-04-02

Greg Garcia, the executive director of the Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group, joins the Claroty Nexus podcast to discuss the Change Healthcare ransomware attack and what can be done from a policy perspective to minimize the impact of such attacks in the future.

Garcia has had a long career on the policy side of cybersecurity, and was the first presidentially appointed Assistant Secretary for Cybersecurity at the Department of Homeland Security. In this episode, he discusses where organizations are in terms of recovery from the impacts of the attack, longterm impacts on the healthcare sector, and how the HSCC's recently published five-year strategic plan for organizations in the crosshairs.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 3/4. Acciones del Caso La importancia del contexto en la Ciberseguridad Industrial
Pub date: 2024-04-01

Este episodio presenta cuáles son las estrategias y marcos de trabajo, el capital humano, la inteligencia artificial y la relación con terceros en el contexto.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Defender's Advantage Podcast (LS 35 · TOP 3% what is this?)
Episode: Hunting for "Living off the Land" Activity
Pub date: 2024-03-29

Host Luke McNamara is joined by Mandiant consultants Shanmukhanand Naikwade and Dan Nutting to discuss hunting for threat actors utilizing "living off the land" (LotL) techniques. They discuss how LotL techniques differ from traditional malware based attacks, ways to differentiate between normal and malicious use of utilities, Volt Typhoon, and more.

The podcast and artwork embedded on this page are from Mandiant, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: teissPodcast - Cracking Cyber Security (LS 31 · TOP 5% what is this?)
Episode: teissTalk: Assessing and mitigating risks in your OT environment
Pub date: 2024-03-29

Ensuring your risk management framework meets your organisation’s needs
Ransomware, legacy devices and remote access - risk trends for OT
Why you should prioritise risks based on the likelihood of exploitation as well as impact

This episode is hosted by Thom Langford https://www.linkedin.com/in/thomlangford/Syed Ubaid Ali Jafri, Head of Cyber Defence & Offensive Security, HBL - Habib Bank Limitedhttps://www.linkedin.com/in/ubaidjafri

Giles Dunn, Partner & OT Cyber Security leader, EYhttps://www.linkedin.com/in/giles-dunn-6485a2117/

Amir Preminger, VP Research, Clarotyhttps://www.linkedin.com/in/amir-preminger-207a0553/

Max Higginson, Cyber Security Manager (ICS/OT), Dominos UKhttps://www.linkedin.com/in/max-higginson/

The podcast and artwork embedded on this page are from TEISS, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: New Cyber Frontier (LS 27 · TOP 10% what is this?)
Episode: NCF-347 Cyber Physical Security
Pub date: 2024-03-27

Welcome back, everybody, to New Cyber Frontier. In today’s Episode we have guest Eslam Tawfik Ph.D. .Dr Tawfik. studied advanced technology in Egypt. Cybersecurity is frequently used to describe the defense of digital networks, systems, and data against harm, unwanted access, and attacks. On the other hand, protecting the hardware and infrastructure that underpin digital systems is referred to as the physical part of cybersecurity. Securing the Root of Trust is a term you will hear throughout the talk, this is what Dr. Tawfik, explains as the set of underlying credentials that the security in each device depends upon. Cyber Physical security as you will hear also includes defending against different attacks to hardware devices, server rooms, data centers, and network connections, among other physical assets. Organizations can establish a more comprehensive security posture to safeguard their digital assets and infrastructure from various threats by incorporating physical security considerations with traditional cybersecurity procedures. Listen to this fascinating episode where our guest provides some insight that will resonate with many of you interested in the security of IoT and Critical Infrastructure systems.

The podcast and artwork embedded on this page are from Logic Central Online, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4. Análisis del Caso La importancia del contexto en la Ciberseguridad Industrial
Pub date: 2024-03-25

Se analizan cuáles son los riesgos de no considerar el contexto, así como los métodos y herramientas que nos pueden ayudar a identificarlo.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 44: Lesley Carhart on the the regulations of AI in cybersecurity
Pub date: 2024-03-26

There have been a lot of questions surrounding artificial intelligence and how they will be regulated moving forward. In this edition of the ICS Pulse podcast, we talk to Lesley Carhart of Dragos about these implications, as well as exclusive research on AI in cybersecurity.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4. Contexto del Caso La importancia del contexto en la Ciberseguridad Industrial
Pub date: 2024-03-25

Se presenta el contexto del caso: datos de la organización, el entrevistado, tecnología, escenario y la importancia del contexto.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Alliance in Action: Industry Collaboration for Safer Food and Agriculture with Scott Algeier
Pub date: 2024-03-21

In this episode of Bites and Bytes Podcast, we're joined by Scott Algeier, an influential figure navigating the crucial intersection of cybersecurity, IT, policy, and operations. As the founder of Conrad, Inc. and the executive director for IT-ISAC and Food and Ag-ISAC (Information Sharing and Analysis Center), Scott brings unparalleled expertise in building bridges between organizations to help fortify their defenses against cyber threats.

Holding a Master’s degree in International Relations and European Studies from the University of Kent and an honors graduate from Gettysburg College, Scott’s journey into cybersecurity is as unique as it is inspiring. This episode explores the foundational stories behind the Food and Ag ISAC and IT-ISAC and highlights the pivotal role of cross-industry information sharing in building a resilient cybersecurity infrastructure.

Engage with us in this compelling dialogue that offers a deep dive into the mechanisms of securing our critical agricultural infrastructure through collective effort and strategic partnerships. Learn about the innovative measures Scott Algeier is spearheading to safeguard our food and agriculture sectors from cyber threats, ensuring a secure future for all. Join us for an exploration of how thoughtful collaboration and expert leadership are shaping the future of cybersecurity in agriculture, making our world safer, one byte at a time.

Key Episode Highlights:

(02:44 - 03:44) Formation of Food and Ag-ISAC
(05:48 - 06:53) Memorable Food Experiences and Recommendations
(12:13 - 14:02) Sharing Cybersecurity Insights With Smaller Businesses
(23:54 - 24:37) Importance of Collaboration With Academia
(28:44 - 30:25) Long-Term Success in Cybersecurity Industry
(31:22 - 32:35) Community and Security in IT

Learn More:

Food and Ag-ISAC
IT-ISAC
Connect with Scott on LinkedIn
Scott's company, Conrad, Inc.
Also, connect with Scott at RSAConference 2024 for his panel discussion

Water Sector discussion information:

EPA calls off cyber regulations for water sector

Cyberattacks are hitting water systems throughout US, Biden officials warn governors

White House Convenes States to Discuss Water Sector Breaches

🎉 NEW Bites and Bytes Podcast Website!! 🎉

For those who have been asking how to support the show, a donation tip jar is on the main page and about the show page. Thank you for all your support!

Wicked6 Cyber Games | 2024 Women's Global Cyber League

Learn more: https://www.wicked6.com/

WICKED6 is back for its fourth year, and it's packed with speaker sessions, career networking, cyber challenges, and a tournament that will have you on the edge of your seat. It's not just an event; it's a community, a learning experience, and a lot of fun!

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Wie entwickelt sich der OT-Markt (aus Investorensicht)?
Pub date: 2024-03-20

In dieser Episode von OT Security Made Simple begrüßen wir den Cybersecurity-Experten Dirk Seewald vom B2B-Investor eCapital. Dirk spricht über die Entwicklung des OT-Sicherheitsmarktes von 2006 bis heute, kommende Trends, warum Cyberversicherungen nicht der Weisheits letzter Schluss sind und die Bedeutung militärischer Forschung für Innovationen. Und er erklärt, warum Internationalisierung deutscher Startups von Tag 1 mitgedacht werden muss.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Navigating China's infrastructure risks in the energy sector.
Pub date: 2024-03-20

Researchers discover a way to hijack web-based PLCs. Threat actor targets manufacturing entities in North America. US Department of Defense launches CORA program. CISA issues ICS advisories. Guest Aura Sabadus, Senior Journalist at ICIS, joins us to discuss how energy insiders are approaching the renewed risks of China's ramp up toward potential attacks on critical infrastructure and what the energy industry is saying about these risks. The Learning Lab is taking a break and will return soon. Stay tuned.

Control Loop News Brief.Researchers discover a way to hijack web-based PLCs.Critical Infrastructure Systems Are Vulnerable to a New Kind of Cyberattack (Georgia Tech)

Threat actor targets manufacturing entities in North America.Blind Eagle's North American Journey (eSentire)

APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs (Trend Micro)

US Department of Defense launches CORA program.JFHQ-DODIN Officially Launches its New Cyber Operational Readiness Assessment Program (US Department of Defense)

CISA issues ICS advisories.CISA Releases Fifteen Industrial Control Systems Advisories (CISA)

Control Loop Interview.Guest Aura Sabadus, Senior Journalist at ICIS, joins us to discuss how energy insiders are approaching the renewed risks of China's ramp up toward potential attacks on critical infrastructure and what the energy industry is saying about these risks.

Control Loop Learning Lab.The Learning Lab is on break and will return in the near future. Stay tuned.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Process Safety with Trish & Traci (LS 29 · TOP 10% what is this?)
Episode: Tipisodes: 7 Steps To Better Cybersecurity
Pub date: 2024-03-19

In this episode, we offer 7 steps for better cybersecurity.

If you are a process control engineer, an IT professional in a company with an automation division, or a business manager responsible for safety or security, you may be wondering how your organization can get moving on more robust cybersecurity practices.

View the transcript for links to all the materials mentioned in this podcast.

https://www.chemicalprocessing.com/process-safety-w-trish-traci/article/33038811/tipisodes-7-steps-to-better-cybersecurity

The podcast and artwork embedded on this page are from chemicalprocessingsafety, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: Multiple Choice
Pub date: 2024-03-15

The story of a pen tester who actually got to put his grubby hands on a real working control system. That never happens! And the things he was able to do will make your head spin. This is unlike any pen test story that most of you have ever heard before, or will likely hear again.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Securing OT: Strategies for Prioritizing Vulnerabilities
Pub date: 2024-03-14

In this conversation, Bryson Bort discusses his background and the creation of Scythe, an offensive security platform. He also talks about the ICS Village and the Vulnerability Management Pavilion, as well as his collaboration with the Department of Energy on a vulnerability management research project. Bryson emphasizes the importance of prioritizing vulnerabilities in operational technology (OT) and understanding the risks in power plants. He also highlights the need to build trust with asset owners and gain leadership buy-in for cybersecurity initiatives. Finally, he discusses the importance of connecting technical expertise to business priorities. The conversation explores the importance of building trust and collaboration in the field of cybersecurity, particularly in the context of power utilities. It emphasizes the need for security professionals to be partners rather than adversaries, and highlights the role of organizations like the ICS Village in fostering collaboration and education. The conversation also delves into the concept of purple team exercises and the importance of starting small and growing in cybersecurity initiatives. Additionally, it discusses the significance of conversations with policymakers and the need for more cybersecurity professionals in the industry.

More About The EpisodeHosted by: Aaron Crow

Guest: Sevak Avakians

Connect with Bryson Bort:* Website: scythe.io * LinkedIn: https://www.linkedin.com/in/brysonbort/

Connect with Aaron Crow:* Website: www.corvosec.com * LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:* Email: info@protectitall.co * Website: https://www.protectitall.co * X: https://twitter.com/protectitall * YouTube: https://www.youtube.com/@PrOTectITAll * FaceBook: https://facebook.com/protectitallpodcast

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Show notes by NMP.

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Moty Cristal CEO @NEST on ransomware negotiation with hackers/attack groups: flipping the other side
Pub date: 2024-03-18

נחשון פינקו מארח את מוטי קריסטל מנכ"ל חברת אנ.אי.אס.טי. (אסטרטגיות מו"מ) מי שהתחיל את דרכו כנושא ונותן בצוותי המו״מ המדיני של לשכת ראש הממשלה רבין וכיום מבכירי מנהלי המשא ומתן בעולם במשברי סייבר ומפתח תורת המשא ומתן כתחום אקדמאי, בשיחה על ניהול מו"מ במצבי משבר בכלל ומשברי סייבר בפרט. איך מנהלים מו"מ מבלי לדבר (טונציה) או לראות (שפת גוף) את הצד השני ועדיין להבין מי נמצא מולך ומה אפשר להסיק מהודעות בכתב בלבד

Nachshon Pincu hosts Moty Cristal, CEO of NEST (negotiation strategies), who started his career as a subject and giver in the Israeli prime minister's office. He is now one of the most senior negotiators in the world and a developer of negotiation theory in an academic field, talking about managing negotiations in crises in general and Cyber in particular. How do you negotiate without speaking (voice tuition) or watching (body language) the other side and still understand who is in front of you and what can be concluded from written messages only?

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: The Future of AI: Determinism, Security, and Beyond
Pub date: 2024-03-05

Sevak Avakians, CEO of Intelligent Artifacts, discusses the limitations of neural networks and the need for a new approach to artificial intelligence. He introduces Gaius, a platform that replaces underlying neural networks with a transparent and explainable technology. Avakians highlights the challenges of regulating AI and emphasizes the importance of deterministic systems in critical industries. He also discusses the potential applications of AI in cybersecurity and the need for human involvement in AI decision-making. Looking ahead, Avakians is excited about the possibilities of AI but also acknowledges the concerns and risks associated with its implementation. The conversation explores the concerns and potential risks associated with autonomous aircraft and the use of AI and ML in safety-critical systems. Adversarial attacks are discussed as a potential threat, highlighting the need for robust safety regulations. The application of safety standards, such as the DO178C standard, to AI and ML technologies is proposed as a solution. On the positive side, AI is seen as a tool to enhance human capabilities and improve efficiency. The importance of training and wargaming exercises using AI is emphasized. The conversation concludes by discussing the balance between the risks and benefits of AI and providing information on how to learn more about AI.

About Sevak AvakiansAs the founder and CEO of Intelligent Artifacts, Inc., Sevak Avakians has been leading
the development and commercialization of a groundbreaking information processing and
AI/ML/R framework, GAIuS, since 2008. GAIuS is a deterministic, fully explainable, and
use-case agnostic symbolic connectionist AI solution that can be applied to mission and
safety-critical domains, such as defense, aerospace, healthcare, and law enforcement.

With a background in physics, telecommunications, information theory, cybersecurity,
and artificial intelligence, Sevak has a unique and comprehensive understanding of the
challenges and opportunities in the field of cognitive computing. He is passionate about
creating AI solutions that can act, interact, and adapt as information, goals, and
requirements evolve while providing full transparency and accountability for their
decisions and actions. Sevak's vision is to empower developers, customers, and end-
users with the ability to create, deploy, and maintain machine intelligence with ease,
efficiency, and confidence.

In 2010, Sevak founded Intelligent Artifacts initially as an R&D and consulting service for
cognitive computing. Over the years, he built the GAIuS Cognitive Computing Platform
as a commercial product launched in 2016. GAIuS Cognitive Computing Platform, allows
developers to rapidly create, test, deploy, and maintain machine intelligence, learning,
classification, predictions, analytics, etc. into their products.

In 2020, the team at Intelligent Artifacts built a reasoning engine into GAIuS, creating the
very first modular, repeatable, use-case agnostic, complete, Artificial Intelligence /
Machine Learning / Reasoning (AI/ML/R) platform that adheres to ExCITE AI principles.

GAIuS handles all the complexity of machine intelligence in 4 API calls. GAIuS agents
can be made and deployed in less than 3 minutes. Developers copy-and-paste a GAIuS
agent’s API URL into their application. GAIuS agents have DNA and evolve within their
environment, eliminating many of the hurdles to achieving true machine intelligence.

More About The EpisodeHosted by: Aaron Crow

Guest: Sevak Avakians

Connect with Sevak Avakians:* Website: https://intelligent-artifacts.com * LinkedIn: https://www.linkedin.com/in/avakians/

Connect with Aaron Crow:* Website: www.corvosec.com * LinkedIn: https://www.linkedin.com/in/aaronccrow

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Show notes by NMP.

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: HMI S&M
Pub date: 2024-03-01

The automation systems that control the world's critical infrastructures are pretty neat. Some might even say, sexy. If OT cybersecurity gets you hot, this episode is for you.

It has all sorts of implied figurative 'booms' that could cause all sorts of implied literal 'booms'.

Plus chickens.

My anaconda don't want none if you don't subscribe to OGOFOT, hon!

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Automation Chat (LS 26 · TOP 10% what is this?)
Episode: 5 Ways to Make Your HMI Secure
Pub date: 2024-03-19

In this episode of Automation Chat, written by Rockwell Automation, The Journal’s Executive Editor Theresa Houck discusses how to limit access to networks, processes and intellectual property by using modern human-machine interface software with security features for user authentication, mobile use and more.

And as always, get your family-friendly, silly Joke of the Day.

Resources from this episode:

Read the article online, “5 Ways to Make Your HMI Secure.”
Rockwell Automation white paper: “Improve Processes, Gain Greater Control with High-Performance HMI.”
Subscribe to our 4 print magazines (Feb., May, July and Oct.) by e-mailing Anna Hicks at ahicks@endeavorbusinessmedia.com.
Subscribe to our 4 digital magazines at http://rok.auto/thejournal-subscribe.

Automation Chat is brought to you by The Journal From Rockwell Automation and Our PartnerNetwork magazine.

Find us on LinkedIn.

Find us on Facebook.

Find us on X (Twitter).

Please leave us a 5-star rating and a review.

** Named Best Podcast 2 Consecutive Years! 2022 & 2023 Apex Awards of Publication Excellence.

View Details

Podcast: PrOTect It All
Episode: Navigating Cybersecurity Challenges: A Conversation with Ted Gutierrez on Bridging OT and IT
Pub date: 2024-02-27

In this conversation, Ted Gutierrez, the leader of Security Gate, discusses the challenges and strategies in implementing cybersecurity solutions in the critical infrastructure sector. He emphasizes the importance of common language and frameworks to bridge the gap between IT and OT. Ted also highlights the need for asset owners to start slow and focus on key controls, rather than aiming for maturity level 5 in all control frameworks. He discusses the challenges of scaling OT compared to IT and the need for consolidation in the market. Ted concludes by emphasizing the power of saying no and focusing on specific goals. In this conversation, Ted Gutierrez discusses his concerns and excitement for the future of cybersecurity. He expresses concern about the global state of conflict and its impact on cybersecurity. He also discusses the balance between order and freedom in the cyber industry. On the positive side, Gutierrez is excited about the increasing focus on the business side of cybersecurity and the growing understanding of cyber as a business problem. He emphasizes the importance of non-technical leaders understanding cybersecurity. Overall, Gutierrez is confident in the people working to protect the globe.

About Ted GutierrezTed Gutierrez is the CEO and Co-Founder of SecurityGate, the provider of the leading SaaS Platform for OT cyber improvement. He is dedicated to protecting what matters across operational sectors and aligning industrial cyber teams on their cyber improvement journey. With an extensive background as a compliance and risk auditor for critical infrastructure, he understands the pain associated with effectively maturing organizational resilience in a decentralized ecosystem. A United States Military Academy graduate at West Point and a veteran of the US Army as a reconnaissance and surveillance expert.

Takeaways* Common language and frameworks are crucial for bridging the gap between IT and OT in implementing cybersecurity solutions. * Asset owners should start slow and focus on key controls rather than aiming for maturity level 5 in all control frameworks. * The challenges of scaling OT compared to IT require a shift in perspective and planning. * Consolidation in the market is needed to address the challenges and inflated expectations in the cybersecurity industry. * The power of saying no and focusing on specific goals is essential for success in implementing cybersecurity solutions. Global conflict can have an impact on cybersecurity, but it is important to consider the balance between order and freedom in the industry. * The focus on the business side of cybersecurity is increasing, and non-technical leaders are starting to understand its importance. * Cybersecurity is now seen as a business problem and is being discussed in boardrooms. * The cybersecurity community is filled with dedicated and passionate individuals who are working to protect the globe.

Hosted by: Aaron Crow

Guest: Ted Gutierrez

Connect with Ted Gutierrez:* Website: https://securitygate.io * LinkedIn: https://www.linkedin.com/in/tedgutierrez/

Connect with Aaron Crow:* Website: www.corvosec.com * LinkedIn: https://www.linkedin.com/in/aaronccrow

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Show notes by NMP.

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: The Robot Rat Race
Pub date: 2024-02-15

Artificial Intelligence. It’s the golden child of the tech industry right now. Some say it’s the most disruptive force since the advent of the Internet itself. And it’s something we personally embrace here at OGOFOT.

But how useful is it in terms of cybersecurity, and specifically for O.T. environments? We have two guests this episode, Murdock and Hannibal. As always, these are not their real names.

Hannibal is going to explain how AI can be used to help detect threats. Howlin’ Mad Murdock is going to explain how AI can be used to develop new and more effective hacks against industrial control systems.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 4/4. Desenlace del Caso Realizando un test de intrusión en Sistemas de Control Industrial
Pub date: 2024-03-14

Cuarto episodio final en el que se presentan las acciones que implementan después del test de intrusión, como miden su efectividad y valiosas lecciones aprendidas.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Harnessing AI in Cybersecurity: Revolutionizing OT Protection
Pub date: 2024-02-20

Hosted by: Aaron Crow

Guest: Clint Bodungen

Clint Bodungen is a globally recognized cybersecurity professional and thought leader with 25+ years of experience (focusing primarily on industrial cybersecurity, red teaming, and risk assessment). He is the author of two books, "Hacking Exposed: Industrial Control Systems" and “ChatGPT for Cybersecurity Cookbook. Clint is a United States Air Force veteran and has worked for notable cybersecurity firms like Symantec, Booz Allen Hamilton, and Kaspersky Lab, and is currently the co-founder and CEO of a cybersecurity training startup, ThreatGEN. Renowned for his creative approach to cybersecurity education and training, he has been at the forefront of integrating gamification and AI applications into cybersecurity training, creating his flagship product, “ThreatGEN® Red vs. Blue”, the world's first online multiplayer computer designed to teach real-world cybersecurity. His latest innovation is AutoTableTop, which uses the latest generative AI technology to automate, simplify, and revolution IR tabletop exercises. As AI technology continues to evolve, so too does his pursuit to help revolutionize the cybersecurity industry using generative AI and large language models (LLM).

SummaryIn this conversation, Clint and Aaron discuss the value of tabletop exercises in cybersecurity and the development of auto tabletop, an AI-based tool for facilitating incident response tabletop exercises. They highlight the limitations of traditional tabletops and the benefits of using AI to enhance engagement and flexibility. They address concerns about AI in cybersecurity, such as data privacy and security, and emphasize the use of local language models to mitigate risks. They also discuss the future of AI in the industry and the workforce, emphasizing the importance of learning generative AI and prompt engineering for future job prospects. In this conversation, Clint discusses the automation of tasks using AI and the benefits of using AI as a tool to enhance human creativity. He also explores the future of AI and its potential for accelerating technological advancement. Clint acknowledges the concerns about the potential misuse of AI but emphasizes the importance of using it for good. He highlights the role of AI in reducing barriers to innovation and its significance in cybersecurity. Overall, the conversation highlights the transformative power of AI and its impact on various industries.

Takeaways* Tabletop exercises are important for testing incident response plans and should be conducted regularly for maximum effectiveness. * AI-based tabletop exercises, such as auto tabletop, offer increased engagement and flexibility compared to traditional tabletops. * Concerns about data privacy and security can be addressed by using local language models and fine-tuning models for specific tasks. * AI has the potential to enhance productivity and efficiency in the industry, but proper understanding and implementation are crucial. * Learning generative AI and prompt engineering can increase job prospects in the future. AI can automate menial tasks, allowing humans to focus on more valuable work. * AI has the potential to enhance human creativity and accelerate technological advancement. * The responsible use of AI is crucial to prevent misuse and ensure positive outcomes. * AI can reduce barriers to innovation and empower individuals to bring their ideas to life.

Connect with Clint Bodungen:* Website: https://threatgen.com/ * LinkedIn: https://www.linkedin.com/in/clintb/

Connect with Aaron Crow:* Website: www.corvosec.com * LinkedIn: https://www.linkedin.com/in/aaronccrow

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Show notes by NMP.

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: Teaser #3 - The AI are Coming!
Pub date: 2024-02-08

Our MC is getting fed up with all the anti-AI sentiment. Don't bother apologizing; make it up to her by subscribing today. That way you won't miss the 2nd episode of OGOFOT, which is all about artificial intelligence and how it help protect critical infrastructure ... or not.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: From Segmentation to SOC: a Multilayered Approach to Cybersecurity in Rail Operations
Pub date: 2024-03-13

In this episode of Secure Tracks, Roark Pollock sits down with Manvendra Singh from the National Capital Region Transport Corporation (NCRTC). From the foundational steps of network segmentation to the sophisticated implementation of SOC, listeners are guided through a comprehensive, multilayered approach to cybersecurity. The discussion emphasizes the importance of integrating IT and OT to protect against vulnerabilities and ensure the safety and reliability of rail operations.

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Exploring the OT Landscape: Insights from Building Management with Kyle Peters
Pub date: 2024-02-12

Kyle Peters is a recovering building automation and HVAC technician and programmer who was drawn to the dark side of cybersecurity and never looked back. Today he is the senior consultant for OT Cybersecurity, focusing on building automation systems at Intelligent Buildings. If you’d like to geek out on such things, reach out to Kyle via LinkedIn or email blackhole@secretdomain.xyz.

In this conversation, Kyle discusses the world of building management systems and the importance of cybersecurity in this field. He highlights the diversity of building systems and the interconnectedness of various components. The conversation emphasizes the need for a risk-based approach to security and the importance of policies and standards. Kyle also emphasizes the value of understanding the system and planning ahead to mitigate risks. The conversation concludes with a discussion on securing remote access and implementing segmentation. The conversation explores the lack of cybersecurity preparedness in organizations, the need to translate cybersecurity risks to business risks, the likelihood of attacks and targeting, the challenge of selling likely risks, exciting technological advances in cybersecurity, concerns about AI and rapid technological changes, and closing thoughts and a call to action.

TakeawaysBuilding management systems encompass a wide range of components, including HVAC systems, fire alarms, and lighting.

A risk-based approach to security is crucial in building management, considering the diverse systems and potential vulnerabilities.

Policies and standards play a significant role in ensuring the security and reliability of building management systems.

Simple solutions, such as proper cable management and backup plans, can greatly enhance the security and availability of building systems.

Understanding the system and planning ahead are essential for effective risk mitigation in building management.

Securing remote access and implementing segmentation are key measures to protect building management systems from cyber threats. Many organizations are not adequately prepared for cybersecurity threats, either due to limited budgets or lack of expertise.

It is important to translate cybersecurity risks into business risks to help organizations understand the potential impact on their operations.

Cyber attacks can come from various sources, including nation-state actors, but also from simple human errors or system failures.

Selling the importance of cybersecurity can be challenging, as the most likely risks may not be as sensational as nation-state attacks.

Exciting technological advances in cybersecurity are on the horizon, but they also bring concerns about the potential risks and implications of AI and rapid technological changes.

—

Connect with Kyle:

LinkedIn: https://www.linkedin.com/in/kyle-peters-2a7173116/

Connect with Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: www.protectitall.co
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Show notes by NMP.

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: WTF is OT?
Pub date: 2024-02-01

Okay so not the grittiest episode, but since so many people don’t really understand WTF the term “OT” really means, I figured I’d hit this first. Think you already know what OT means? Statistically, you’re wrong. Doctors have proven that 5 out of 6 self-proclaimed OT cyber experts are actually idiots.

For folks in the industry, this is a different take on OT cyber than your typical "CIA is AIC" tripe. For newcomers, this is a short introduction to "things that can go boom," and why they just might.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 3/4. Acciones en el Caso Realizando un test de intrusión en Sistemas de Control Industrial
Pub date: 2024-03-14

Tercer episodio en el que se presenta como priorizan en el test, que acciones de mitigación son más efectivas, como se involucra la dirección y la comunicación con los stakeholders.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Bridging the Gap: OT Cybersecurity in the Evolving Landscape of Industry and Recruitment
Pub date: 2024-02-05

With a focus on the OT Cyber Security recruitment space James is the Talent Solutions Director at NDK Cyber. NDK Cyber work with high-growth businesses in the USA, UK & EMEA to provide completely tailored cybersecurity talent attraction solutions. Specialising in long-term talent acquisition and strategy, we have mastered a blend of data insights, the latest technology and our own personal network mastered over 20+ years to build 100s of cybersecurity teams across the globe.

SummaryHosted by: Aaron Crow

Guest: James Morris, Director, Talent Solutions at NDK Cyber

In this conversation, Aaron Crow and James Morris discuss the transition happening in the field of OT security, with a growing need for dedicated OT security engineers and teams. They explore the challenges of budgeting for OT security and the importance of building trust and collaboration between IT and OT departments. They also emphasize the value of cross-disciplinary skills and the need for apprenticeships and on-the-job training to address the skills gap in OT security. The conversation highlights the importance of translating cybersecurity into business risk and the role of education and community in promoting OT security. The conversation covers various topics related to job descriptions, hiring challenges, helping people enter the OT space, companies being more open to training and transferable skills, excitement for the future of OT security, concerns about AI and ML in cybersecurity, and the importance of OT security in uncertain times.

Takeaways* There is a growing need for dedicated OT security engineers and teams. * Building trust and collaboration between IT and OT departments is crucial for effective OT security. * Cross-disciplinary skills and apprenticeships can help address the skills gap in OT security. * Translating cybersecurity into business risk is essential for gaining budget and buy-in for OT security initiatives. Job descriptions should be written in a way that encourages more people to apply, focusing on transferable skills and being more inclusive. * Companies should be open to training and developing employees who have the desire and raw skills needed for the job. * The OT security space is growing rapidly, and there are opportunities for individuals to enter the field and for companies to hire the right talent. * There is excitement about the future of OT security, but concerns exist about the potential risks associated with AI and ML in cybersecurity. * In uncertain times, it is crucial for companies to prioritize OT security and not cut back on investments in this area.

—

Connect with James:

Website: https://www.ndkcyber.com/
LinkedIn: https://www.linkedin.com/in/lets-talk-cyber-talent/

Connect with Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: www.protectitall.co
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Show notes by NMP.

Audio production by NMP. We hear you loud and clear.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OG of OT
Episode: OG of OT Official Teaser
Pub date: 2024-01-17

Announcing a new podcast from the OG of OT (Operational Technology). Through secure and anonymous interviews, we're bringing you the stories and conversations that you normally don't get to hear (and that a lot of people probably don't want you to listen to). Because it's 100% anonymous, all egos and agendas are left at the door. New episodes will drop on the 1st and the 15th of every month, starting Feb 1, 2024.

The podcast and artwork embedded on this page are from The OG of OT, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Dr Chuck Freilich Senior researcher @INSS on Iranian cyber threat & strategy effects on October 7th
Pub date: 2024-03-13

נחשון פינקו מארח את ד"ר צ'ק פרייליך, לשעבר סגן ראש המועצה לביטחון לאומי וכיום חוקר בכיר במכון למחקרי ביטחון לאומי, בעקבות פרסום מחקרו מזכר 231 על איום הסייבר האירני, בשיחה על אסטרטגיית הסייבר האירנית בכלל ועליית האיום המיידי על מדינת ישראל מאז ה-7 באוקטובר

Nachshon Pincu hosts Dr. Chuck Freilich, former deputy head of the Israeli National Security Council and currently a senior researcher at the Institute for National Security Studies (NISS), following the publication of his study Memo 231 on the Iranian cyber threat, in a conversation about the Iranian cyber strategy in general and the rise of the immediate danger to the State of Israel since October 7th

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: PrOTect It All
Episode: Welcome to PrOTect IT All
Pub date: 2024-01-23

In this episode, Aaron discusses:

His background in IT, cybersecurity, and operational technology
The vision of bridging the gap between OT and IT
The importance of securing various environments, from industrial floors to cloud and back office enterprises
The focus of the podcast on cybersecurity trends, challenges, compliance, risk management, and cutting-edge technologies
Future episodes featuring industry experts, thought leaders, and cybersecurity warriors

Key Takeaways:

Understanding the convergence of IT and OT
Insights into compliance, risk management, and cybersecurity technologies
The importance of staying vigilant and secure in the digital and physical domains

Connect with Aaron Crow:

Website: www.corvosec.com
LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about PrOTect IT All:

Email: info@protectitall.co
Website: www.protectitall.co
X: https://twitter.com/protectitall
YouTube: https://www.youtube.com/@PrOTectITAll
FaceBook: https://facebook.com/protectitallpodcast

To be a guest, or suggest a guest/episode please email us at info@protectitall.co

—

Show notes by NMP.

Audio production by NMP. We hear you loud and clear.

NMeojTx5cKjy9dOiv9sV

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Evaluating network segmentation strength [The Industrial Security Podcast]
Pub date: 2024-03-12

How hard is it for an attacker to dig around in my network? Robin Berthier of Network Perception joins us to look at new network segmentation evaluation and visualization technology that lets us see at a glance how much trouble, or not, we're in.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Ryan Pickren on New Web-Based PLC Malware Research
Pub date: 2024-03-06

Ryan Pickren, a Ph.D. student in the School of Electrical and Computer Engineering at the Georgia Institute of Technology, joins the Claroty Nexus podcast to discuss a recently published research paper that explains a new web-based malware attack against programmable logic controllers. Pickren, the lead author, along with colleagues Tohid Shekari, Saman Zonouz, and Raheem Beyah, explains how embedded webservers inside modern PLCs can be attacked to give remote attackers full control over the device.
Check out their paper: “Compromising Industrial Processes Using Web-Based Programmable Logic Controller Malware”

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Udi Roth CISO @Mekorot Israel National Water Company on cyber defiance in critical OT infrastructure
Pub date: 2024-03-06

נחשון פינקו מארח את אודי רוט הסיסו האגדי של חברת מקורות, מוותיקי הסיסויים בישראל, עם וותק וניסיון של מעל עשרים שנים בניהול אבטחת סייבר במערכות תפעוליות ואבט"מ, בשיחה על ההתמודדות היום יומית מול איומים גדלים והולכים מצד מדינות וקבוצות תקיפה במערכת מורכבת השנייה בגודלה רק לחברת חשמל. מה השתנה אם בכלל מאז ה-7 באוקטובר ואלו שינויים נדרשים בתפיסת ההגנה. ועוד

Nachshon Pincu hosts the legendary Udi Roth, the CISO of Mekorot Israel National Water Company, a veteran of CISO in Israel, with over twenty years of seniority and experience in managing cyber security in operational systems and IT, in a conversation about the day-to-day dealing with ever-increasing threats from countries and attack groups in a complex system that is only the second largest to Israel Electric Company. What has changed, if anything, since October 7th, and what changes are required in cyber defense attitude? and More

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Addressing maritime cyber threats.
Pub date: 2024-03-06

NIST releases Cybersecurity Framework 2.0. Biden administration issues executive order on maritime cybersecurity. Suspected Chinese threat actor continues to exploit Ivanti vulnerabilities. ThyssenKrupp sustains ransomware attack. Guests Liz Martin, Global Advisory Solution Architect at Dragos, and Blake Benson, Senior Director at ABS Group, talk through the latest Maritime Executive Order. The Learning Lab is taking a break and will return soon. Stay tuned.

Control Loop News Brief.NIST releases Cybersecurity Framework 2.0.NIST Releases Version 2.0 of Landmark Cybersecurity Framework (NIST)

Biden administration issues executive order on maritime cybersecurity.On-the-Record Press Call on the Biden-⁠Harris Administration Initiative to Bolster the Cybersecurity of U.S. Ports (The White House)

Biden to sign executive order on US port cybersecurity targeting Chinese-manufactured shipping cranes (CNBC)

Suspected Chinese threat actor continues to exploit Ivanti vulnerabilities.Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts (Mandiant)

ThyssenKrupp sustains ransomware attack.German Steelmaker Thyssenkrupp Confirms Ransomware Attack (SecurityWeek)

Control Loop Interview.Guests Liz Martin, Global Advisory Solution Architect at Dragos, and Blake Benson, Senior Director at ABS Group, talk through the latest Maritime Executive Order. For more information, review the Executive Order on Amending Regulations Relating to the Safeguarding of Vessels, Harbors, Ports, and Waterfront Facilities of the United States and White House’s FACT SHEET: Biden-⁠Harris Administration Announces Initiative to Bolster Cybersecurity of U.S. Ports.

Control Loop Learning Lab.The Learning Lab is on break and will return in the near future. Stay tuned.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: Claves para gestionar la ciberseguridad en la intersección de IT y OT
Pub date: 2024-03-04

En este episodio de Secure Tracks, Omar Benjumea conversa con Esther Mateo, Directora General de Seguridad, Procesos y Sistemas Corporativos en Adif, sobre la convergencia de IT (Tecnología de la Información) y OT (Tecnología Operacional) en ciberseguridad. Esther comparte su trayectoria hacia la ciberseguridad, comenzando con una pasión por la tecnología desde una edad temprana y llevándola hasta su significativo rol en Adif. La discusión abarca los desafíos de integrar la ciberseguridad en las tecnologías operacionales, especialmente en el sector ferroviario, enfatizando la importancia de los proyectos transversales, el cambio cultural dentro de las organizaciones y la gestión de incidentes de ciberseguridad a través de los entornos de IT y OT.

English description:

Esther Mateo's Insights on Leading Cybersecurity Management at the Intersection of IT and OT

In this episode of Secure Tracks, Omar Benjumea talks with Esther Mateo, General Director of Security, Processes, and Corporate Systems at Adif, about the convergence of IT and OT in cybersecurity. Esther shares her journey into cybersecurity, starting with a passion for technology from a young age and leading up to her significant role at Adif. The discussion covers the challenges of integrating cybersecurity in operational technologies, especially in the railway sector, emphasizing the importance of cross-functional projects, cultural change within organizations, and managing cybersecurity incidents across IT and OT environments.

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Working with Lightning (LS 26 · TOP 10% what is this?)
Episode: S2 E10 Meth and Giraffes
Pub date: 2024-03-04

In this episode we have special guest Chris. He is very knowledgeable about the electrical security side of the industry. He is a professional hacker and is a huge help in keeping our grid safe. Chris assisted with the under-submarine line in Texas to go under the international shipping channel. He tells us about one time that meth and a giraffe were involved in vandalizing stations causing millions in damage. Remember that safety rules are written in blood. When a problem arises at work or personal you can work it out over coffee and donuts or off the clock with Bourbon and BBQ.

Chris Sistrunk's LinkedIn: Chris Sistrunk | LinkedIn

Reminder:
Working with Lightning is partnering with Line Brother's Keeper on a fundraiser for their foundation. We will have a drawing on August 25th (Zach's burn-anniversary). To be entered into the drawing you go to https://linebrotherskeeper.org/ and press the button right at the top that says Working with Lightning Raffel. For every $25 you donate your name will be entered into the drawing.

Grand Prize: Wooden hooks handmade by Zach

Runner-up: a 20-QT cooler stuffed with two tumblers, koozies, zipper bag, hard hat stickers and more.

3rd Place: will receive a care package from Working with Lightning.

Please remember to spread the word, share our show and give a 5-star review.

Support the showThanks for listening. Please take the time to engage so we can continue to get better and become an ally/asset for our industry. You could help us immediately by taking a moment to follow, subscribe, and rate the show. We look forward to what comes next. We will be getting better hopefully each episode that gets published.

Reach out to us on:
Facebook: https://www.facebook.com/profile.php?id=100093577126022
LinkedIn: https://www.linkedin.com/in/working-with-lightning-podcast-a1bb1227b/
Instagram: https://www.instagram.com/working_with_lightning01/?igshid=MzNlNGNkZWQ4Mg%3D%3D
Website: http://workingwithlightning.com

Email us at: workingwithlightning@gmail.com

The podcast and artwork embedded on this page are from Jeremy, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Critical Assets Podcast
Episode: Energizing Cybersecurity Careers: Workforce Development in OT/ICS
Pub date: 2024-03-03

Join us for a discussion on Energizing Cybersecurity Careers: Workforce Development in the OT/ICS Community. Guests Cynthia Hsu and Erin Owens dive into the cybersecurity challenges facing Industrial Control Systems and Operational Technology asset owners. Through open conversations, we explore everything from skill gaps and career pathways to diversity, continuous learning, and the impact of new technologies. This session aims to provide insights into developing a skilled, diverse cybersecurity workforce – starting from the ground up – with a focus on practical strategies for professionals, educators, and anyone interested in the future of ICS/OT security.

Show links:

Cynthia Hsu LinkedIn profile https://www.linkedin.com/in/cynthiahsu33/

Erin Owens LinkedIn profile https://www.linkedin.com/in/erinowens/DOE CESER Cybersecurity Training for the Utility Workforce, free 3-day ICS Cybersecurity training for electric and ONG utility staff. Next training event: Buffalo, NY, April 23-25, Register at: Eventleaf | Event Registration Software and Mobile Event Apps

DOE CESER CyberStrikeTM professional cybersecurity training for operational technology environments: https://inl.gov/cyberstrike/

· LIGHTS OUT – focus on Ukraine attacks

· NEMESIS – focus on nation-state TTPs

· STORMCLOUD – focus on renewable energy

DOE CESER CyberForce® workforce development program for college students focused on building a pipeline of cyber professional candidates in operational technology cybersecurity: https://cyberforce.energy.gov/

Sandia National Laboratory

Tracer FIRE (Forensic Incident Response Exercise): https://github.com/sandialabs/Tracer-FIRE
Center for Cyber Defenders: https://www.sandia.gov/careers/career-possibilities/students-and-postdocs/internships-co-ops/institute-programs/titans-technical-internships-to-advance-national-security/titans-cyber/

Cyber Defense Center https://www.cyberdefensecenter.org/

The podcast and artwork embedded on this page are from Patrick Miller, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: AI on the Menu: Cybersecurity Innovations with Dr. Ryan Heartfield in the Food Industry
Pub date: 2024-03-01

Join us on the Bites and Bytes Podcast as we explore the impact of artificial intelligence on cybersecurity in the food industry with Dr. Ryan Heartfield. With a distinguished career that spans roles at Splunk, the UK Government, and groundbreaking research at the University of Greenwich, Dr. Heartfield is at the forefront of AI-driven cyber-physical solutions. This episode discusses how these technologies are essential in protecting our food supply chain from cyber threats and using AI to address more than cyber incidents. Dr. Heartfield shares insights from his work at Exalens, highlighting the importance of innovative cybersecurity in ensuring the safety and integrity of our food systems.

Key Episode Highlights:

(02:52 - 03:51) Tech Support and Wi-Fi at Olympics
(05:43 - 07:02) Pizza Preferences and Controversies
(13:06 - 14:52) AI-driven Research for Cybersecurity Challenges
(18:48 - 19:49) AI in Food Safety
(22:28 - 24:09) Industrial Control Technologies Explained
(25:44 - 27:29) Holistic Approach to Cybersecurity in Industry
(30:34 - 31:55) Advanced Monitoring Systems in Industrial Processes
(35:24 - 36:16) Building Psychophysical Monitoring Technology
(38:41 - 39:46) AI Analyst Enhances Network Security
(44:12 - 45:36) IoT Refrigerators and Food Safety

Connect with Dr. Ryan Heartfield:

Learn more about his work: Exalens
Follow him on LinkedIn: Ryan Heartfield
Join the Free Community Edition of Exalens

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 43: Xavier Mesrobian on connecting IT and OT
Pub date: 2024-02-28

IT/OT convergence has been a major topic of conversation amongst cybersecurity practitioners. For some, connecting IT and OT seems to be the next Industrial Revolution, or Industry 5.0. Today, we talk to Xavier Mesrobian of Skkynet about the benefits of connecting OT to IT and how to best connect them. Sponsored by: Skkynet

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: Securing, Defending, and Bringing Resilience to Infrastructure
Pub date: 2024-02-28

Psymetis creates Operational Technology (OT) security solutions that quickly and prevent electric grid outages and catastrophic infrastructure failures. Psymetis’ Werewolf system provides condition monitoring and threat mitigation for the power grid, detecting cyberattacks, equipment failures, and physical damage in real-time.

In this episode of Hack the Plant, Bryson sits down with Psymetis CEO Robert Shaughnessy to discuss his work with Psymetis, challenges to innovation in the private sector, and the role of government in developing new technologies.

What ecosystem problem is Psymetis solving? How is the federal government involved? What threats do our critical infrastructure systems face? How is China involved?

“We're not talking about shooting wars, we're talking about wars where adversaries–to include economic adversaries–can have advantage,” Shaughnessy said. “As we're looking out over the next couple of years… there's a lot of frightening indicators that want us to plan for these events, knowing the capabilities of our tier one adversaries.”

Join us for this and more on this episode of Hack the Plant.

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: S4x24 Preview
Pub date: 2024-02-28

View Details

Podcast: Secure Insights with NDK Cyber
Episode: Shahar Dumai: "In September 2023, there was a cyber attack on the maritime industry every 3 days"
Pub date: 2024-02-29

Don't miss the boat!

In this episode, we chat with Shahar Dumai, Head of Marketing at Cydome Maritime Cybersecurity. We cover all things Maritime, including safeguarding the shipping and maritime industry. Delving deep into the maritime landscape, we explore the unique challenges it faces, from major events to disruptive cyberattacks that they have had in the past few years.

Join us as we unravel the intricacies of maritime security and discuss how it differs from other sectors. Whether you're actively involved in the shipping space or simply harbor a keen interest in this dynamic world, this episode offers invaluable insights and actionable strategies that can be replicated across any industry.

The podcast and artwork embedded on this page are from NDK Cyber, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Tractors to Table Tops - Industrial Security in the Industry of Human Consumables [The Industrial Security Podcast]
Pub date: 2024-02-26

Precision farming is heavily automated, as are the "food factories" essential to feeding the world's population. Marcus Sachs at the McCrary Institute at Auburn University joins us to look at the threats, the challenges and opportunities to secure our food supplies from cyber risk.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cybercrime Magazine Podcast (LS 32 · TOP 5% what is this?)
Episode: Cybercrime Wire For Feb. 27, 2024. Cyberattack Hits German Steel Conglomerate. WCYB Digital Radio.
Pub date: 2024-02-27

The Cybercrime Wire, hosted by Scott Schober, provides boardroom and C-suite executives, CIOs, CSOs, CISOs, IT executives and cybersecurity professionals with a breaking news story we’re following. If there’s a cyberattack, hack, or data breach you should know about, then we’re on it. Listen to the podcast daily and hear it every hour on WCYB. The Cybercrime Wire is brought to you Cybercrime Magazine, Page ONE for Cybersecurity at https://cybercrimemagazine.com. • For more breaking news, visit https://cybercrimewire.com

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: SecurityWeek Podcast Series - Cybersecurity Insights
Episode: Palo Alto Networks Talks IT/OT Convergence
Pub date: 2024-01-29

In this episode, SecurityWeek editor-at-large Ryan Naraine interviews Del Rodillas, Senior Director of Product Management at Palo Alto Networks, about the integration of IT and OT in the ICS threat landscape. We discuss the evolution of cyber resilience, the challenges of merging IT and OT governance structures, process integrations for IT/OT security strategy, consolidated tech stacks for IT and OT, and the role of next-generation firewalls in an integrated IT/OT world.

Follow SecurityWeek on LinkedIn

The podcast and artwork embedded on this page are from SecurityWeek, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4. Análisis del Caso Realizando un test de intrusión en Sistemas de Control Industrial
Pub date: 2024-02-26

En este episodio, analizaremos como se aborda en EMASESA la planificación, los roles, las herramientas y el alcance de los test de intrusión en ICS.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Chen Girat CISO @IEC about cyber defiance in wartime on the most significant Israeli infrastructure
Pub date: 2024-02-24

נחשון פינקו מארח את חן גיראט הסיסו של חברת חשמל לישראל שהתחיל את דרכו בסייבר ב-770 (הרשות הממלכתית לאבטחת מידע) וניהל את האגף המבצעי במערך הסייבר. בשיחה על הגנה על התשתית הקריטית הגדולה ביותר בישראל בכלל ובזמן מלחמה בפרט.

ואיך הפכתי ממראיין למרואיין 😊

Nachshon Pincu hosts Chen Girat, the CISO of the Israel Electric Company (IEC), who started his career in cyber at the State Authority for Information Security, the base from which the Israel National Cyber Directorate grew, and managed the operations division INCD in a conversation about protecting the most significant critical infrastructure in Israel in general and during the war in particular.

And how I turned from interviewer to interviewee 😊

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Insights with NDK Cyber
Episode: Defensible Architecture: Crafting Your Security Blueprint with Harry Thomas, Founder & CS/OT Cybersecurity Expert
Pub date: 2024-02-21

This week as we sat down with Harry Thomas, a seasoned OT professional with over a decade of experience in the industry. Harry's journey from the red team to consultancy and advisory roles, and now a Founder, provides invaluable insights into securing OT systems.

In our conversation, we cover actionable strategies for securing OT systems, ranging from short-term wins to long-term goals. From gaining buy-in to overcoming budget challenges and maximizing limited resources, we explore the practical steps needed for success in this evolving landscape. He outlines all the moving parts, the difficulties, and targeting the 'necessary evil'.

Don't miss this insightful discussion as we unravel the complexities of OT security and provide tangible solutions for professionals navigating this dynamic environment.

Get in touch with Harry via Linkedin here
TO learn more about NDK Cyber visit our website

The podcast and artwork embedded on this page are from NDK Cyber, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Casos de Ciberseguridad Industrial
Episode: 1/4. Contexto del Caso Realizando un test de intrusión en Sistemas de Control Industrial
Pub date: 2024-02-20

Primer episodio del caso del podcast de CCI que presenta y expone con detalle la realización de un test de intrusión en sistemas de control industrial.A lo largo de los 4 episodios que conforman este caso, se contará con la participación de Alfonso López-Escobar, responsable de Ciberseguridad de EMASESA (Empresa Metropolitana de Abastecimiento y Saneamiento de Aguas de Sevilla S.A.), como experto entrevistado.Este caso es especialmente interesante al abordar uno de los sectores más sensibles y fundamentales de nuestra sociedad: el sector Agua.El episodio 1/4, titulado «Contexto», establecerá las bases del caso y proporcionará una visión detallada de la situación, ofreciendo una oportunidad única para explorar los test de intrusión en sistemas de control industrial.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Volt Typhoon and the Year in Review.
Pub date: 2024-02-21

Five Eyes publish report on Volt Typhoon. Volt Typhoon targets emergency management services in the US. Siemens and Schneider Electric issue patches. Guest is Magpie Graham, Principal Adversary Hunter Technical Director at Dragos, sharing the findings of Dragos Cybersecurity Year in Review report. The Learning Lab segment will return next episode.

Control Loop News Brief.Five Eyes publish report on Volt Typhoon.PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (CISA)

Volt Typhoon targets emergency management services in the US.VOLTZITE Espionage Operations Targeting U.S. Critical Systems (Dragos)

Siemens and Schneider Electric issue patches.ICS Patch Tuesday: Siemens Addresses 270 Vulnerabilities (SecurityWeek)

Control Loop Interview.Guest Magpie Graham, Principal Adversary Hunter Technical Director at Dragos, reviews the key findings of Dragos’ Cybersecurity Year in Review report. You can download a copy of the report here.

Control Loop Learning Lab.The Learning Lab segment will return next episode.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 108: Mastering Data Complexity: Insights from Chase Richardson and Martin Riley on OT Integration
Pub date: 2024-02-20

We are delighted to have Chase Richardson, Head of US Operations for Bridewell, and Martin Riley, Director of Managed Services for Bridewell, joining us today!

We are changing things slightly for this episode, with Martin and Chase diving into how to integrate OT systems into your sim rather than presenting our regular biographical format. Their focus today is predominantly on the increasingly relevant topic of managing data across diverse platforms, particularly in OT applications.

Join us as we explore this integration and unravel the challenges it presents.

Show highlights:

The evolution of cybersecurity technology
How the industry struggles with integrating IoT and OT data into security sims
Why integrating separate systems into one platform is crucial for security teams
How security and operational technology leadership teams converge
Why hybrid teams are essential for managing cybersecurity risks
The importance of asset visibility and understanding the architecture for effectively implementing security solutions
How AI and machine learning can help to reduce noise in security operations
Why threat intelligence is essential for business risk and control validation
The importance of threat intelligence in the cybersecurity industry

Links and resources:

(CS)²AI

Chase Richardson on LinkedIn

Martin Riley on LinkedIn

Bridewell

Derek Harp on LinkedIn

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | What is Zero Trust really (and does it work in OT)?
Pub date: 2024-02-19

Klaus Mochalski invited cyber security expert Stefan Sebastian from Zscaler to talk about the paradigm shift Zero Trust entails. Stefan Sebastian explains who Zero Trust would have prevented the cyber attack on the Danish energy sector in May 2023 from the onset and how companies can implement this security concept step by step and can get rid of the notoriously problematic VPN connections in OT.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: Defending Our Crown Jewels: Rail Cybersecurity in the Age of Industry 4.0
Pub date: 2024-02-14

In this episode of Secure Tracks, join host Roark Pollock as he engages in an insightful conversation with Susan Howard. Together, they delve deep into safeguarding light rail's most critical systems, often called the "crown jewels." From tunnel ventilation to traction power and beyond, they unravel the evolving challenges and strategies for fortifying these vital components against the ever-growing specter of cyber threats. Discover insights, anecdotes, and expert advice that illuminate the path toward ensuring the resilience and security of the operational rail technologies of Industry 4.0.

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Compromised Host
Episode: Where to start!?
Pub date: 2024-02-13

Industrial Cyber Assessment, what should we be talking about both with external vendors providing a service but also going away and looking at internally.

Alex

The podcast and artwork embedded on this page are from The Compromised Host, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Mike Rogers on Understanding a CISO's Personal Exposure in Cyber Incidents
Pub date: 2024-02-14

Hormel Foods Chief Information Security Officer and Director of Information Security and Compliance Mike Rogers joins the Claroty Nexus podcast to discuss why it's so important for CISO's to understand their personal liability during cybersecurity incidents. New regulations, including the SEC's cybersecurity rules, are driving this need for security leadership to evaluate to manage their personal exposure. Rogers provides his perspective on the SEC rules, how incident response is changing, and the ambiguity around exactly what constitutes a "material" incident.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 42: Lesley Carhart on the Impact of AI on Cybersecurity
Pub date: 2024-02-13

No matter which industry you work in, it seems like all everyone is talking about is artificial intelligence (AI). So let’s get into it. On this podcast, Lesley Carhart of Dragos discusses AI’s role in industrial automation, how AI is helping attackers target PLCs and what AI does well (and poorly).

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Cybersecurity in the AVEVA Enterprise SCADA Product - Going Deep [The Industrial Security Podcast]
Pub date: 2024-02-12

From supply chain to Active Directory to segmentation designing security into ICS products is hard. Jake Hawkes walks us through how security gets built into AVEVA Enterprise SCADA.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Itay Yanovski & Nimrod Luria Founders @IO01 on OT Cyber-Physical System CPS for Visibility & Control
Pub date: 2024-02-10

נחשון פינקו מארח את איתי ינובסקי ונמרוד לוריא מייסדי אי אוו אפס אחד, שניהם ידועים בתעשיית הסייבר הישראלית כיזמים מצליחים עם סטארטאפים בתחום אבטחת הסייבר שלהם לאורך העשורים האחרונים, ועדיין משתדלים להיות מתחת לראדר, בשיחה על הגנת סייבר למערכות תפעוליות ועל החשיבות של הכשרה מעשית למי שרוצים להצטרף לתחום

מהן מערכות סייבר-פיזיות (סי.פי.אס)

מדוע על התעשייה לשנות את הלך הרוח שלה מנראות לנראות ובקרה

מהו פתרון אבטחת הסייבר קדברה של אי אוו אפס אחד

מהי החשיבות של הכשרה מעשית כצוות כחול וצוות אדום עבור אלו המעוניינים להיכנס לתעשיית אבטחת הסייבר

ועוד

Nachshon Pincu hosts Itay Yanovski and Nimrod Luria Co-Founders and CEOs at IO01. Both are well known in the Israeli cyber industry as successful Entrepreneurs with their cybersecurity startups for the last two decades, in a conversation about OT cybersecurity defense and the importance of hands-on training for ICS/OT cyber specialists.

What is Cyber-Physical Systems (CPS)?

Why must the industry change its mindset from only Visibility, aka IDS, to Visibility & Control?

What is the CADABRA cybersecurity solution?

What is the importance of hands-on training as a blue team & red team for those wishing to enter the OT cybersecurity industry?

and more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Roni Roytman Co-founder & CEO @INTENSITY about Cyberwar since October 7th: OT cyber attacks are here
Pub date: 2024-02-10

נחשון פינקו מארח את רוני רויטמן מומחה לניהול משברי סייבר, יזם סדרתי, מייסד שותף ומנכ"ל בחברות העוסקות באבטחת סייבר וניהול משברים. בשיחה על המלחמה הקברנטית שנמצאת בעצימות שיא מאז ה-7 באוקטובר. התקפות על כול המגזרים, גם חלקן של מערכות תפעוליות לא נגרע

Nachshon Pincu hosts Roni Roytman, an expert in cyber crisis management and serial entrepreneur, co-founder, and CEO of companies dealing in cyber security and crisis management. In a conversation about the cybernetic war that has been at peak intensity since October 7th. Attacks on all sectors, including operational systems.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | Wer ist für Security by Design zuständig? (nicht wer du denkst)
Pub date: 2024-02-08

OT Sicherheitsexpertin Sarah Fluchs und OT Sicherheitsexperte Klaus Mochalski diskutieren in der neuesten Folge von OT Security Made Simple über Sinn und Unsinn von Security by Design und stellen die entscheidende Frage nach der Verantwortlichkeit. Ihre Antwort sieht nicht nur die Geräte- und Systemhersteller in der Pflicht.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Startup follow-up: Alexander Tartakovsky founder & CEO @iOT365 on OT cybersec defense change mindset
Pub date: 2024-02-07

Nachshon Pincu Hosts Alexander Tartakovsky the founder and CEO of iOT365 OT Cyber Security Platform delivered as a SAAS. We discussed changing the mindset for traditional and innovative OT infrastructure as part of Industry 4.0, Open PLC, and digital twin technologies.

Why should IDS and SIEM for OT cybersecurity Not be on two different platforms?

Why is there a need to remove the OT and cloud computing bindings?

How do you “play” safe when implementing OT cyber security solutions?

How do we get in the age of digital twins as labs for checking new firmware or training teams on their own OT infrastructure without risk?

And more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Operational Technology disruptions: An eye on the water sector.
Pub date: 2024-02-07

Volt Typhoon targets US critical infrastructure. Ransomware attacks in the OT sector. Ransomware attack against Johnson Controls cost $27 million. Bill would add ICS security to President’s Cup Cybersecurity Competition. Guest is Dragos CEO and Founder Robert M. Lee from the hearing before the U.S. Congressional Subcommittee on Cybersecurity and Infrastructure Protection on February 6, 2024. We share Rob’s opening statement before the committee. On the Learning Lab, we have the concluding part of a 2-part discussion on building community in OT that Dragos Mark Urban had with Dragos Strategic Accounts Director Sam Van Ryder.

Control Loop News Brief.Volt Typhoon targets US critical infrastructure.Exclusive: US disabled Chinese hacking network targeting critical infrastructure (Reuters)

Wray warns Chinese hackers are aiming to 'wreak havoc' on U.S. critical infrastructure (NPR)

Ransomware attacks in the OT sector.Dragos Industrial Ransomware Analysis: Q4 2023 (Dragos)

The Crisis of Convergence: OT/ICS Cybersecurity 2023 (TXOne Networks)

Ransomware attack against Johnson Controls cost $27 million.Johnson Controls says ransomware attack cost $27 million, data stolen (BleepingComputer)

Schneider Electric confirms ransomware attack.Schneider Electric confirms it was hit by ransomware attack (Silicon Republic)

Energy giant Schneider Electric hit by Cactus ransomware attack (BleepingComputer)

US sanctions Iranian officials for attacks on critical infrastructure.Treasury Sanctions Actors Responsible for Malicious Cyber Activities on Critical Infrastructure (OFAC)

US House Energy Subcommittee holds hearing on cyberattacks against water infrastructure.US House Energy Subcommittee holds hearing on safeguarding drinking water infrastructure from cyberattacks (Industrial Cyber)

Bill would add ICS security to President’s Cup Cybersecurity Competition.Senate HSGAC Approves Cyber, Software Bills (Meritalk)

Control Loop Interview.Dragos CEO and Founder Robert M. Lee testified at the hearing before the U.S. Congressional Subcommittee on Cybersecurity and Infrastructure Protection on February 6, 2024. We share Rob’s opening statement before the committee. The purpose of the hearing was to discuss threats to water and wastewater ICS/OT systems in the U.S. that have the potential to disrupt operations and pose safety risks and examine the steps needed to secure operational technology in the water sector.

Read the press release. Watch the video of the hearing: Securing Operational Technology: A Deep Dive into the Water Sector.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Strategic Accounts Director Sam Van Ryder to conclude their discussion of building community in OT. Learn more about Hou.Sec.Con. Learn more about the Dragos Community Defense Program which provides free access to Dragos OT cybersecurity technology for qualifying utility providers to better protect their communities from potentially destructive cyber attacks.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Trust Issues (LS 31 · TOP 5% what is this?)
Episode: EP 45 - OT Security's Digital Makeover
Pub date: 2024-02-06

In this episode of Trust Issues, the conversation revolves around the challenges and transformations in operational technology (OT) security. Guest Mike Holcomb, the Fellow of Cybersecurity and the ICS/OT Cybersecurity Lead at Fluor shares insights with host David Puner on securing legacy systems, the impact of generative AI – and the evolving threat landscape. From addressing security challenges in manufacturing plants to the skills gap in OT cybersecurity, the episode provides an overview of the current state and future prospects of securing critical infrastructure. Holcomb also emphasizes the importance of identity in OT security and offers practical advice for organizations looking to enhance their cybersecurity posture. Check out the episode to explore the dynamic intersection of IT and OT – and how it spotlights the urgent need for robust cybersecurity measures in an evolving digital landscape.

The podcast and artwork embedded on this page are from CyberArk, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 107: Keeping the Lights On: Carlos's Roadmap to Becoming an Energy Cybersecurity Pro
Pub date: 2024-02-06

We are thrilled to welcome Juan Carlos Buenano as our distinguished guest for today’s episode of the CS2AI podcast!

Carlos is the Chief Technology Officer for OT at Armis. He is a born technologist and an engineer by training. Beyond his professional endeavors, he embraces a life filled with adventure, enjoying many outdoor activities, including scuba diving, mountain biking, and exploring the scenic expanses of unspoiled nature.

Carlos was born in Venezuela and grew up in a small town outside Caracas. After graduating as an electronic engineer in Venezuela, he traveled to Australia to learn English, fell in love with the country, the lifestyle, and the nature, and has lived there for the last 23 years.

Carlos brings a unique perspective to today’s show, shaped by his professional and personal experiences. Join us for an engaging discussion as he shares his wealth of experiences and insights and explains how he serves his community.

Show Highlights:

Carlos shares his journey to becoming an engineer in the energy industry
How his interest in control systems began
Carlos recounts his early cybersecurity experiences in industrial systems during the early 2000s
The importance of keeping operating systems up to date to prevent vulnerabilities and ensure reliability
Why it is essential to understand how technology works in both physical security and cybersecurity
Carlos discusses the challenges of integrating cybersecurity into process control systems
Carlos offers advice for engineers who want to get into cybersecurity
The importance of mentorship and learning from others in their industry
Carlos discusses the weekly open mic Ask Me Anything sessions he does at work

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Carlos Buenano on LinkedIn

Armis

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Compromised Host
Episode: We get what we ask for
Pub date: 2024-02-01

Quick collection of my thoughts on what should we be asking System integrators for when building a new industrial process. We as security professionals and assets owners need to be asking for the right security

The podcast and artwork embedded on this page are from The Compromised Host, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: IoT Security Podcast
Episode: Securing Critical Infrastructure: Challenges and Strategies with Sean Tufts
Pub date: 2024-02-06

Sean Tufts is in the house, and we ask him to go all the way back. All the way. From his origins to the evolving challenges and security needs in IoT and OT environments, particularly in critical infrastructure. Your hosts, Brian Contos and John Vecchi, engage in a thought-provoking conversation with special guest Sean Tufts from Optiv. The discussion goes into Tufts' background, from his transition from an NFL player to a cybersecurity and critical infrastructure expert, to managing substantial programs at Optiv. Sean touches on the changing landscape of critical infrastructure, the challenges of IoT and OT security in the wake of COVID-19, and the evolving tactics in cyber attacks. He also shares insightful anonymized stories of cyber incidents, emphasizing the importance of effectively addressing vulnerabilities in IoT devices and legacy systems to mitigate risks.

After listening to the episode, be sure to subscribe to the Phosphorus IoT Security Podcast to stay updated on evolving cybersecurity challenges and strategies in the IoT and OT space. Share this impactful episode with colleagues and peers involved in securing critical infrastructure to spark insightful conversations and proactive measures for vulnerability management.

Let’s get into Things on the IoT Security Podcast!

Follow Brian Contos on LinkedIn at https://www.linkedin.com/in/briancontos
And you can follow John Vecchi at https://www.linkedin.com/in/johnvecchi

The IoT Security Podcast is powered by Phosphorus Cybersecurity. Join the conversation for the IoT Security Podcast — where xIoT meets Security. Learn more at https://phosphorus.io/podcast

The podcast and artwork embedded on this page are from Phosphorus Cybersecurity, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Feeding the Digital Age: Part 2 - Embracing Solutions with Dr. Darin Detwiler
Pub date: 2024-02-29

In Part 2 of our Bites & Bytes Podcast series, we continue our enriching discussion with Dr. Darin Detwiler, highlighting the essential themes of courage, overcoming shame, and maintaining integrity within the food industry regardless of your role. This episode not only focuses on technological innovations and strategies for food safety but also delves into the personal and ethical dimensions that drive industry leaders to champion security measures in the face of emerging digital threats. Join us for this impactful conversation that goes beyond the technical aspects, touching on the human elements critical to advancing food safety and security in today's digital world.

Key Episode Highlights:

(01:06 - 03:12) Food Safety and Technology Monitoring
(11:13 - 12:11) Intentional Acts in Food Safety
(19:07 - 20:04) Unregistered Food Plants in Texas
(24:28 - 25:18) Corporate Responsibility and Reputation
(31:37 - 33:18) Food Safety and Cybersecurity Vulnerabilities

How to connect with Dr. Darin:

Visit his Website

Visit his University Page

Connect on LinkedIn

Watch the Netflix Documentary, "Poisoned"

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: CISA’s Critical Infrastructure Protection Mission with Jen Easterly
Pub date: 2024-02-02

As America’s Cyber Defense Agency and the National Coordinator for Critical Infrastructure Security and Resilience, the Cybersecurity and Infrastructure Security Agency (CISA) leads the national effort to understand, manage, and reduce risk to the cyber and physical infrastructure that Americans rely on every day.

In this episode of Hack the Plant, Bryson sits down with CISA Director Jen Easterly to discuss her work on leading CISA’s critical infrastructure mission, implementing efforts to make products Secure by Design, and working with private companies to combat ransomware.

How has CISA’s role evolved since 2018? How do they advance critical infrastructure protection and cyber defense? What are Director Easterly’s priorities for 2024? And if she could wave a magic wand, what is one thing she would change?

“We need transparency so that we can all work together to protect the ecosystem, because the actors are not ever going to fight fair,” Easterly said. “We need all the collective strength of the community to keep Americans safe and secure.”

Join us for this and more on this episode of Hack the Plant.

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Insights with NDK Cyber
Episode: 'The future of OT Security is so exciting' with Danielle Jablanski OT Cybersecurity Strategist
Pub date: 2024-02-01

This week's episode is with the wonderful Danielle Jablanski, a specialist consultant in OT security strategy, ICS obsessed, idea lady and community builder.

We explored the challenges inherent in OT security, delving into the complexities of the current landscape and legacy technology. Danielle shares insights on why a one-size-fits-all approach falls short in the OT domain compared to the enterprise world, guiding us towards a more tailored strategy for businesses.

In our conversation, we peek into the future of OT security, envisioning its trajectory with a spotlight on smart cities and the developmental challenges they pose. Most importantly, we unpack the excitement surrounding the future of OT security.

Catch Danielle on Linkedin: https://www.linkedin.com/in/daniellejjablanski/

The podcast and artwork embedded on this page are from NDK Cyber, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 106: Top Gun Meets the Cloud: Ken's Guide to Keeping Your Airplanes (and Data) Safe
Pub date: 2024-02-01

We are delighted to have Ken Munro joining us from the UK today!

Ken is a Partner and Co-founder of Pen Test Partners. He is a seasoned technologist, the founder of multiple ventures, a pilot, a skier, and a dynamic and adventurous contributor to our community.

Ken brings a wealth of experience and expertise that promises to enrich our understanding of the evolving landscape in cybersecurity. In today's discussion, we dive into his remarkable career journey and explore his perspective on OT and ICS-related cybersecurity.

Join us for this informative session with Ken as he shares his valuable perspectives.

Show Highlights:

Ken discusses his cybersecurity industry journey
How Ken’s past Air Force experience relates to his current work in cybersecurity
The benefits of telling a story when communicating complex concepts
Ken shares a story to highlight the importance of safety and security within the aviation industry
Ken talks about the unique systems on board planes and their vulnerabilities
How the isolated protocols used in older aircraft systems are more robust and stable than the modern systems
How even simple display systems can cause airport outages
Ken shares his concerns about cybersecurity risks within cloud management platforms for industrial control systems
How including contractual language for liability in procurement contracts can protect organizations against cybersecurity risks
Ken shares his thoughts on the future of the cybersecurity industry

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Ken Munro on LinkedIn

Pen TestPartners

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 41: Itzik Kotler on the ABC’s of Cybersecurity
Pub date: 2024-01-30

Advancing technology has given the world multitudes of business improvements, but it also brings complexity, which opens up new vulnerabilities. How can you keep up your cyber hygiene so you’re prepared for the next inevitable cyberattack? On this podcast, Itzik Kotler of SafeBreach discusses legacy systems, incident response and why cybersecurity is no longer the “department of no.”

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: What's Next? A decision support tool for industrial security [The Industrial Security Podcast]
Pub date: 2024-01-29

We have a security program, we have a risk assessment, we see gaps and we have a limited budget. How do we use that budget most effectively? Jørgen Hartig, CEO at SecuriOT joins us to look at a decision support tool to help answer the question.

https://securiot.dk/securiot-irt

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: MBA-Business & Cyber program @Ono Academic College: Adv Rami Tamam hosts practical Law & cyber panel
Pub date: 2024-01-28

היה לי לכבוד להיות מוזמן על ידי עו"ד רמי תמם, ראש ההתמחות בתואר שני במנהל עסקים וסייבר במכללה האקדמית אונו להרצות ולהשתתף בפאנל פרקטיקה של משפט וסייבר לסטודנטים בתוכנית הייחודית

It was an honor to be invited by Adv Rami Tamam from Ono Academic College to lecture and be part of an expert panel about practical cyber and law to the students of the MBA in Business & Cyber unique program.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Compromised Host
Episode: Intro
Pub date: 2024-01-26

Welcome to the first episode of the Compromised Host podcast, short intro introducing myself the host Alex Fold and a little chat about my background in Automation and Control and how I moved into Industrial Cyber Security

Alex

The podcast and artwork embedded on this page are from The Compromised Host, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: HouSecCast
Episode: World Peace still Requires Changing Default Passwords with Marty Edwards
Pub date: 2024-01-21

In today’s episode Michael and Sam chat with HOU.SEC.CON. speaker and Deputy CTO of Tenable, Marty Edwards. Their conversation revolves around the need for collaboration between IT and OT teams, the importance of implementing cybersecurity fundamentals before investing in products and solutions, and the real-life consequences that result from not protecting critical infrastructure.

Things Mentioned:

· States and Congress wrestle with cybersecurity after Iran attacks small town water utilities - https://apnews.com/article/water-utilities-hackers-cybersecurity-1c475f5d2ef3b5d52410c93bdeab3aad

· HOU.SEC.CON. Tickets - https://www.houstonseccon.com/

· OT.SEC.CON. - https://www.otseccon.com/

· EXEC.SEC.CON. - https://www.execseccon.com

· HSC User Group - https://www.hscusergroup.com

· Marty Edwards HOU.SEC.CON. Talk - https://youtu.be/4jFyolZuYEg?si=r0bSyxVr7zFCjVGO

· Sponsorship Requests: sponsorwrangler@houstonseccon.com

Do you have a question for the hosts? Reach out to us at podcast@houstonseccon.com

Keep up with HOU.SEC.CON:

· LinkedIn

· Twitter

· Facebook

· Instagram

· YouTube

Check out our other show:

· CyberSunday

Check out our Conferences:

· HOU.SEC.CON.

· OT.SEC.CON.

· EXEC.SEC.CON.

Support or apply to our Scholarship Program:

· TAB Cyber Foundation

In this episode:

· Host: Michael Farnum

· Host: Sam Van Ryder

· Guest: Marty Edwards

· Editing by: Lauren Lynch

· Music by: August Honey

The podcast and artwork embedded on this page are from Michael Farnum and Sam Van Ryder, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Team82 Answers More of your OT Cybersecurity Questions
Pub date: 2024-01-25

Noam Moshe of Claroty Team82 is back to answer more listener questions about OT vulnerability research, threats and risks to OT networks and IoT devices, and the best mitigation and remediation strategies for defenders.
This is a follow-up podcast to an episode we recorded in December answering listener questions. You can listen to that episode here.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: Defendiendo el futuro: La ciberseguridad en ciclos de vida ferroviarios
Pub date: 2024-01-24

Únase al presentador Omar Benjumea mientras charla con Francisco Lázaro Anguis, CISO y DPO de RENFE, en el primer episodio en español de Secure Tracks. Explore el complejo desafío de proteger los sistemas ferroviarios a largo plazo. Descubra cómo la ciberseguridad se vuelve parte integral del diseño, las pruebas y el mantenimiento ferroviario, garantizando la resiliencia contra las amenazas que pueden evolucionar durante las próximas tres décadas. Descubra el delicado equilibrio entre seguridad y "safety" en el complejo mundo de las operaciones de tecnología ferroviaria.

English description:

Decades Defended: Embedding Cybersecurity to a 30-Year Rail Lifecycle

Join guest host Omar Benjumea as he sits down with Francisco Lázaro Anguis, CISO and DPO of RENFE, in Secure Tracks's first Spanish episode. Explore the intricate challenge of securing railway systems for the long haul. Discover how cybersecurity becomes integral to rail design, testing, and maintenance, ensuring resilience against evolving threats over three decades. Uncover the delicate balance between safety and security in the complex world of rail tech

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Building community in OT.
Pub date: 2024-01-24

An analysis of cyberattacks against Danish energy infrastructure. US government outlines threats posed by Chinese-manufactured drones. Vulnerability in Bosch thermostats. OIG says CISA needs to improve collaboration with the water sector. Guests Mark Stacey of Dragos and Charles Kano from WestCap discuss cyber insurance as an important part of your organization's security plan. On the Learning Lab, we have the first part of a 2-part discussion on building community in OT that Dragos Mark Urban had with Dragos Strategic Accounts Director Sam Van Ryder.

Control Loop News Brief.OIG says CISA needs to improve collaboration with the water sector.CISA needs better collaboration with the EPA and water sector, watchdog says (Nextgov)

Volt Typhoon targets end-of-life Cisco routers.Volt Typhoon Ramps Up Malicious Activity Against Critical Infrastructure (Dark Reading)

Cyberattacks against Israeli ports.Israeli Ports Hit in Cyberattack: Anonymous Sudan Takes Credit (The Cyber Express)

An analysis of cyberattacks against Danish energy infrastructure.Clearing the Fog of War: A Critical Analysis of Recent Energy Sector Attacks in Denmark and Ukraine (Forescout)

US government outlines threats posed by Chinese-manufactured drones.Cybersecurity Guidance: Chinese-Manufactured UAS (CISA)

Vulnerability in Bosch thermostats. Vulnerabilities identified in Bosch BCC100 Thermostat (Bitdefender)

Control Loop Interview.On this episode, we are joined by Mark Stacey of Dragos and Charles Kano from WestCap discussing cyber insurance as an important part of your organization's security plan.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Strategic Accounts Director Sam Van Ryder to discuss building community in OT. Learn more about Hou.Sec.Con. Learn more about the Dragos Community Defense Program which provides free access to Dragos OT cybersecurity technology for qualifying utility providers to better protect their communities from potentially destructive cyber attacks.

Control Loop Audience Survey.Please take a moment to fill out our super quick survey. Thanks!

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | The 4 types of OT monitoring and which to choose
Pub date: 2024-01-23

Raphael Arakelian has been testing OT monitoring system for their effectiveness for many years. He has developed a guide that identifies 4 categories of OT monitoring. In this episode of OT Security Made Simple, Raphael explains host Klaus Mochalski and our listeners the differences and which type works best depending on the operational goal(s) within a company.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: OT Security Made Simple Podcast
Episode: OT Security Made Simple | OT-Sicherheit aus Sicht eines Pentesters
Pub date: 2024-01-04

Klaus Mochalski hat dieses Mal Sascha Zinke vom Pentest-Dienstleister Splone zu Gast. Sascha gibt Einblicke in seine Erfahrungen mit Stadtwerken und Energieversorgungsunternehmen, skizziert die Herausforderungen und diskutiert mit Klaus Möglichkeiten, mit ruhigem Puls OT-Sicherheit in den eigenen Netzwerken zu etablieren.

The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Click Here (LS 51 · TOP 0.5% what is this?)
Episode: 102. Cyber Av3ngers and their unlikely targets
Pub date: 2024-01-16

We take a look at the part of the Israel-Hamas war that is harder to see – the battle raging in cyberspace. Hacktivists are joining forces with Iran-backed operators to target victims with gossamer connections to Israel.

The podcast and artwork embedded on this page are from Recorded Future News, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Feeding the Digital Age: Part 1 - Unpacking Cyber Risks with Dr. Darin Detwiler
Pub date: 2024-01-17

Welcome to Part 1 of our enlightening episode, where we delve into the intricate world of food safety and cybersecurity. Join us as we sit down with Dr. Darin Detwiler, a “food safety icon,” professor, and leading food policy and safety expert.

In this episode, Dr. Detwiler shares his personal stories and insights, setting the stage for a deeper understanding of the digital threats to our food supply. From his favorite food memories to his professional journey, he opens up about the challenges and complexities of ensuring the safety of our food in an increasingly digital world.

Key Episode Highlights:

(03:35 - 04:20) Retro Salad Nostalgia
(08:55 - 10:35) Food Safety and Consumer Perspectives
(13:30 - 14:13) Identifying Food Allergy Triggers
(18:17 - 19:29) Challenges in Food Safety Investigations
(25:48 - 27:10) Data Management for Disaster Prevention

How to connect with Dr. Darin:

Visit his Website

Visit his University Page

Connect on LinkedIn

Watch the Netflix Documentary, "Poisoned"

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Henning Kruse: When OT, Network Security and Automotive Meet
Pub date: 2024-01-17

We sat down with the Senior Manager for Technical Cyber Security at PwC Deutschland to discuss trends in OT security, AI, automotive cybersecurity, and everything in between.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 28: Why Mapping IT Security to OT Networks Doesn’t Always Work
Pub date: 2024-01-16

The Purdue Model used in OT is essentially network security from the 1990s. New threats and new tech however required us to rethink that on the network side so how do we bring that new thinking to work with legacy OT systems? John Taylor of Versa Networks explains how there's a lot of implicit trust in the IoT and OT devices themselves, yet they don't have antivirus. Or firewalls. Worse, you're basically depending on the manufacturer of that device to provide security updates if necessary, and oftentimes they don't. Perhaps it’s time for a new approach such as SASE or secure access service edge.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 105: Beyond Boundaries: Unveiling the Multifaceted World of Michelle Balderson
Pub date: 2024-01-16

We are excited to bring you another captivating industry leader interview today.

In this episode, we interview Michelle Balderson, the Principal Security Architect at Issquared. Michelle is a seasoned professional. In addition to having extensive experience as an established contributor and leader within the industry, she is a technologist, devoted mother, wife, chef, and a true jack of all trades. Beyond her contributions to the industry, Michelle finds joy in the great outdoors, whether she is conquering hiking trails, setting up camp, or enjoying four-by-four adventures.

In our discussion today, Michelle talks about her personal and professional journey, sharing insights she gained along the way and shedding light on the path that brought her to where she is in her current role as a security specialist.

Join us as we dive into the rich reservoir of wisdom and experience that Michelle brings to the table.

Show Highlights:

How moving around a lot while growing up allowed Michelle to develop an excellent rapport with others
Michelle describes her first experience with technology
Michelle shares her experience of working at Fortinet and SonicWALL
Work opportunities within the OT security space
Why a more holistic approach to security is needed
The importance of changing the culture within businesses to bridge the gap between different domains
How empathy and active listening can drive business success
Michelle discusses her role at Issquared
Michelle shares the advice she would give to her younger self

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Michelle Balderson on LinkedIn

ISSQUARED Inc.

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: USB Firmware Attacks [The Industrial Security Podcast]
Pub date: 2024-01-15

You plug in a USB drive and your laptop starts smoking - nasty. Mario Prieto Sanlés of AuthUSB joins us to look at the nastiest of USB attacks, and what we can do about them.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Data Breach Today Podcast (LS 32 · TOP 5% what is this?)
Episode: How the Merck Case Shapes the Future of Cyber Insurance
Pub date: 2024-01-11

Merck & Co.'s proposed settlement with insurers over a $1.4 billion claim related to the NotPetya attack will change the language the insurance industry uses to exclude acts of war in its policies, and organizations need to consider how those changes affect risk, said attorney Peter Halprin.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Energy Talks
Episode: #71: Cybersecurity in the Power Grid – A 360° View | Part 5
Pub date: 2024-01-11

Security engineering – building trust in digital products used in the power gridWelcome to the 5th episode of our Energy Talks miniseries, called Cybersecurity in the Power Grid, in which we provide you with a 360-degree view of how power grids can best safeguard their infrastructures from cyber-attacks.

In this episode, Andreas Klien, OMICRON cybersecurity expert and Business Area Manager of Power Utility Communication, discusses the security engineering of digital products used in the power grid with his guest, Sarah Fluchs, Chief Technology Officer at admeritia GmbH. Together, they debate the question, “Can power grid operators trust their manufacturers to ensure reliable cybersecurity?”

Andreas and Sarah conduct their discussion from the perspective of an OT security officer. They address the pending EU Cyber Resilience Act and how it can help better secure the power grid and other critical infrastructures by requiring manufacturers to build cybersecurity measures into their products and the significance of security certificates for digital products, especially OT devices.

They also discuss the growing use of a Software Bill of Materials (SBOM) and how it can help manufacturers be more transparent and enable power grid operators to identify possible security issues in products.

Lastly, Andreas and Sarah discuss the importance of open, 2-way communication between power grid operators and manufacturers to achieve security goals.

Stay tuned for upcoming episodes in our Cybersecurity in the Power Grid miniseries.

Learn more about our approach to cybersecurity in power grids: https://www.omicroncybersecurity.com/

The podcast and artwork embedded on this page are from OMICRON electronics GmbH, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: HouSecCast
Episode: OT or IT with Consequences – with John Burns
Pub date: 2024-01-10

About this episode:

In our first episode of 2024 Michal and Sam chat with Principal Industrial Hunter John Burns to talk about his presentation “The Distinct Imperatives of Threat Hunting in OT Environments”. In this conversation John also touches on his interesting industrial IT origin story, shares insights into his role as a principal industrial hunter, and emphasizes the consequences-driven approach to threat hunting in OT environments.

Things Mentioned:

· HOU.SEC.CON. Call for Papers will run from May 1 – 31, 2024

· If you’d like to sponsor this year’s conference please reach out to our sponsor wrangler

· MITRE Debuts ICS Threat Modeling for Embedded Systems

· You can watch John’s Talk on YouTube

Do you have a question for the hosts? Reach out to us at podcast@houstonseccon.com

Keep up with HOU.SEC.CON:

· LinkedIn

· Twitter

· Facebook

· Instagram

· YouTube

Check out our other show:

· CyberSunday

Check out our Conferences:

· HOU.SEC.CON.

· OT.SEC.CON.

· EXEC.SEC.CON.

Support or apply to our Scholarship Program:

· TAB Cyber Foundation

In this episode:

· Host: Michael Farnum

· Host: Sam Van Ryder

· Guest: John Burns

· Editing by: Lauren Lynch

· Music by: August Honey

The podcast and artwork embedded on this page are from Michael Farnum and Sam Van Ryder, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CYBER LIFE (LS 24 · TOP 10% what is this?)
Episode: Cyber Life Podcast Ep. 26 - Critical Infrastructure Cybersecurity with Chip Harris
Pub date: 2024-01-10

Chip is a senior level penetration tester that has over 20 years of experience in the cybersecurity world. Chip has done a lot of work for government agencies and has authored university textbooks.

He's written content for the University of Arizona cybersecurity Master's degree program and has decades of experience in the critical infrastructure space.

Ask me a Question Here: https://topmate.io/ken_underhill

Get better at job interviews and build your confidence with this short course.

https://cyberken23.gumroad.com/l/jbilol/youtube20

If you need cybersecurity training, here are some good resources. Please note that I earn a small affiliate commission if you sign up through these links for the training.

Learn Ethical Hacking skills https://get.haikuinc.io/crk0rg6li6qd

Get Ethical Hacking skills, SOC Analyst skills, and more through StationX.

https://www.stationx.net/cyberlife

cybersecurity #ethicalhacking

Support this podcast at — https://redcircle.com/cyber-life/donations

The podcast and artwork embedded on this page are from Ken Underhill, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: A free community initiative to protect small utilities.
Pub date: 2024-01-10

Responses to Aliquippa water authority attack. Predatory Sparrow disrupts Iran’s gas stations. MITRE launches a threat model for critical infrastructure embedded devices. Guest Dawn Cappelli, Head of Dragos's OT-Cyber Emergency Readiness Team shares details about the launch of Dragos’s free community initiative to protect small utilities that serve majority of Americans. Learn more about the Dragos Community Defense Program that includes Dragos Platform and Neighborhood Keeper. On the Learning Lab, we have the final part of the 3-part discussion on building automation systems that Dragos Mark Urban had with colleagues Daniel Gaeta and Zach Spencer.

Control Loop News Brief.Responses to Aliquippa water authority attack.States and Congress wrestle with cybersecurity after Iran attacks small town water utilities (AP)

Predatory Sparrow disrupts Iran’s gas stations.A suspected cyberattack paralyzes the majority of gas stations across Iran (AP)

Iran petrol stations hit by cyberattack, oil minister says (Reuters)

Israel-linked group claims cyberattack that shut down 70% of Iran’s gas stations (The Times of Israel)

Energy Department offers $70 million in funding for cybersecurity research.

Energy Department has cyber threats to infrastructure in mind with $70 million funding offer (FedScoop)

MITRE launches a threat model for critical infrastructure embedded devices.MITRE, Red Balloon Security, and Narf Announce EMB3D – A Threat Model for Critical Infrastructure Embedded Devices (MITRE)

US Department of Homeland Security’s Annual Threat Assessment.Homeland Threat Assessment 2024 (DHS)

Control Loop Interview.Guest Dawn Cappelli, Dragos's Head of OT-Cyber EmergencyReadiness Team, joins us this episode to discuss the launch of free community initiative to protect small utilities that serve majority of Americans. Learn more about the Dragos Community Defense Program that includes Dragos Platform and Neighborhood Keeper.

Control Loop Learning Lab.On the Learning, Mark Urban is back with part 3 of his discussion on building automation systems with Dragos' Daniel Gaeta, ICS/OT Cybersecurity Senior Solutions Architect, and Zach Spencer. Senior Enterprise Account Executive.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Juan Piacquadio on Securing Pharma 4.0
Pub date: 2024-01-10

Phlow Corp., CIO Juan Piacquadio joins the Claroty Nexus podcast to discuss the application of Industry 4.0 to pharmaceuticals, also known as Pharma 4.0. The industry is quickly adopting advanced technologies such as artificial intelligence, digital twins, and augmented reality to enhance the development of medicine and improve patient care. Along with that expansion of capabilities comes a wider attack surface, and Piacquadio spends a good deal of time explaining not only the threat landscape he envisions, but also how giant pharmaceuticals, the supply chain, and security providers must respond.
Subscribe to the Nexus Podcast here.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cybercrime Magazine Podcast (LS 32 · TOP 5% what is this?)
Episode: Talking Cyber. Hackers Cause Water Outage In Ireland. Heather Engel, Strategic Cyber Partners.
Pub date: 2024-01-09

Talking Cyber is a Cybercrime Magazine podcast series that covers the latest news and breaking stories on the cybereconomy, hackers, intrusions, privacy, security and much more. In this episode, host Amanda Glassner is joined by Heather Engel, Managing Partner at Strategic Cyber Partners, to discuss a cyber incident that left residents of a remote area on Ireland’s west coast without water. To learn more about today's stories, visit https://cybercrimewire.com • For more on cybersecurity, visit us at https://cybersecurityventures.com

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: Cybersecurity in Rail Operations: A CISO's Triumphs, Challenges, and Lessons Learned
Pub date: 2024-01-08

In this episode of the Secure Tracks Podcast, Joel Waugh, the CISO at the Washington Metropolitan Area Transit Authority (WMATA), shares insights into navigating the unique challenges of cybersecurity in rail operations. Emphasizing the shift in priorities compared to federal government protocols, Waugh highlights the importance of identifying critical systems, prioritizing cyber hygiene, and fostering a culture of communication and collaboration.

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Shimi Cohen CISO @UBTECH threat intelligence expert, Shimi’s cyber world & Hacker Republic founder
Pub date: 2024-01-08

Nachshon Pincu Hosts Shimi Cohen, the CISO of UBTECH, an ethical hacker and Cyber threat intelligence expert, the founder of “Shimi’s Cyber world” and “Hacker Republic” communities, talking about the cyber warfare in Israel since October 7th.

Understanding the mass cyber attacks on Israeli companies, critical infrastructure, and governmental websites.

The importance of Cyber threat intelligence, especially since October 7th

Who is attacking, and for what purpose?

And more

נחשון פינקו מארח את שימי כהן, הסיסו של חברת יוביטק, האקר אתי ומומחה למודיעין איומי סייבר, מייסד קהילות "עולם הסייבר של שימי" ו"האקר ריפבליק", בשיחה על לוחמת הסייבר בישראל מאז ה-7 באוקטובר

הבנת התקפות הסייבר ההמוניות על חברות ישראליות, תשתיות קריטיות ואתרים ממשלתיים מאז אוקטובר 7

החשיבות של מודיעין איומי סייבר, במיוחד מאז ה-7 באוקטובר

מי תוקף, ולאיזו מטרה?

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 27: Cyber Physical Security As A Shared Responsibility
Pub date: 2024-01-05

Flaws within the chips in our laptops, in our homes, and in our critical infrastructure could become the access one needs to steal data if not just shut down an assembly line, or hold up production of a vital resource like power or water. Josh Salmanson, senior vice president at Telos, discusses why we’re seeing more and more pre-compromised routers in critical environments today and what we might do to mitigate that in the near future.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: David Elfering on CISOs and Cyber Liability Insurance
Pub date: 2024-01-04

David Elfering, CISO at Carrix and former security and risk executive at Marsh, is back for another episode of the Claroty Nexus podcast to discuss cyber liability insurance. Elfering has extensive experience working not only as an enterprise cybersecurity executive, but also with one of the world's leading insurance carriers. Listen as he brings insight on that perspective, how carrier cybersecurity requirements align with risk reduction, red flags that can imperil coverage or claims, and how cyber insurance providers are looking at geopolitical conflict.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 40: Xavier Mesrobian on SCADA Security
Pub date: 2024-01-02

SCADA systems have evolved over the last 25 years. Today, more and more companies are talking about cloud-based SCADA. Given recent compromises, what steps should companies take to secure cloud-based SCADA? On this podcast, Xavier Mesrobian of Skkynet Cloud Systems discusses how you should manage the cloud when it comes to security. Sponsored by: Skkynet

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Managing Trust in Massive IIoT Systems [The Industrial Security Podcast]
Pub date: 2024-01-01

Smart meters, smart cities and the IIoT - when thousands of systems of millions of low-power devices need to talk to each other, and talk between systems, managing trust is hard. Dr. Chris Gorog of BlockFrame walks us through the problem and the work BlockFrame and the University of Colorado have been doing to solve the problem.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Todd Beebe: Beyond IT vs. OT, The Common Ground for Securing Any Environment
Pub date: 2023-12-28

About Todd Beebe: Todd Beebe, a cybersecurity veteran since the early 90s, commenced his journey by thwarting attempts to hack his BBS. His expertise led to pivotal roles with an international organization, securing remote access, fortifying websites, and pioneering firewall deployment. Later, at Ernst & Young, he spearheaded the Attack & Penetration practice in Houston, penetrating Fortune 500 clients and contributing to the precursor of the Hacking Exposed book series. Todd's entrepreneurial spirit thrived as he founded cybersecurity companies, notably inventing the telecom firewall 'TeleWall' and the web application firewall 'eServer Secure,' holding nine US patents. His career includes fortifying the White House and Pentagon against cyber threats and building cybersecurity programs for multiple Fortune 500 organizations.

In this episode, Aaron and Todd Beebe discuss:

Their journeys into cybersecurity careers
Navigating the convergence of IT and OT security
Finding common ground and overcoming historical hurdles
Shared labs for enhanced understanding and effective problem-solving
Cybersecurity challenges in critical infrastructure

Key Takeaways:

In addressing cybersecurity challenges, it's crucial for IT and OT teams to collaborate closely, recognizing that the threat landscape targets common denominators such as IP addresses, ports, and Windows systems, and adopting a unified approach to securing both environments is essential in the evolving landscape of cyber threats.
In navigating the convergence of IT and OT, the key lies in recognizing the shared technological foundation, fostering collaboration to merge expertise, and dispelling the misconception of a takeover, ultimately shifting the focus from being adversaries to allies in the pursuit of a secure and efficient operational landscape.
Fostering collaboration between IT and OT teams through shared advisory roles, regular communication, and the establishment of a collaborative lab environment not only enhances technical expertise but also builds trust, camaraderie, and a common language, ultimately contributing to a more resilient and stable organizational infrastructure.
While Todd is excited about the increasing diversity of people entering the cybersecurity field, he expresses concern about the SEC's decision to hold CISOs accountable for breaches and emphasizes the challenge of training junior analysts to effectively identify and respond to cyber threats in the evolving landscape.

"I'm ready to continue learning. I believe that's the most important part for anyone in cybersecurity. It's whether they have that mindset: it's not failure, it's learning. If we can get that into the mindsets of the next generation, I think then we've done what we needed to do." — Todd Beebe

Connect with Todd Beebe:

Email: tvbeebe@freeportlng.com

LinkedIn: https://www.linkedin.com/in/toddbeebe/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Encore: Active visibility into OT systems.
Pub date: 2023-12-27

Rockwell Stratix routers vulnerable to Cisco zero-day. SecurityWeek’s ICS Cyber Security Conference. Malware attacks against IoT devices increase by 400%. Nuclear power plant operator cited over cybersecurity plan. CISA’s ICS advisories. Guest Garrett Bladow, Distinguished Engineer at Dragos, joins us from the CyberCon 2023 event in Bismarck, North Dakota. Garrett discusses active visibility into OT systems. On the Learning Lab, Mark Urban shares the second part of his conversation about cyber threat intelligence with Paul Lukoskie, who is Dragos’ Director of Intelligence Services.

Control Loop News Brief.Rockwell Stratix routers vulnerable to Cisco zero-day.PN1653 | Stratix® 5800 & 5200 vulnerable to Cisco IOS XE Web UI Privilege Escalation (Active Exploit) (Rockwell Automation)

SecurityWeek’s ICS Cyber Security Conference.2023 ICS Cybersecurity Conference (SecurityWeek)

Malware attacks against IoT devices increase by 400%.Zscaler ThreatLabz 2023 Enterprise IoT and OT Threat Report (Zscaler)

Nuclear power plant operator cited over cybersecurity plan.UK Cites Nuclear Plant Operator Over Cybersecurity Strategy (Silicon UK)

Rockwell and Dragos announce partnership.Dragos and Rockwell Automation Strengthen Industrial Control System Cybersecurity for Manufacturers with Expanded Capabilities (Business Wire)

CISA’s ICS advisories.CISA Releases Two Industrial Control Systems Advisories (CISA)

Hitachi Energy’s RTU500 Series Product (Update B) (CISA)

CISA Releases Nine Industrial Control Systems Advisories (CISA)

Control Loop Interview.Guest is Garrett Bladow, Distinguished Engineer at Dragos, discussing active visibility into OT systems.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos’ Director of Intelligence Services, Paul Lukoskie, for part two of their discussion on cyber threat intelligence.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Malicious Life (LS 59 · TOP 0.5% what is this?)
Episode: How to Hack Into Satellites
Pub date: 2023-12-27

About a year ago, six academics from Ruhr University Bochum and the CISPA Helmholtz Center for Information Security set out to survey engineers and developers on the subject of satellite cybersecurity. But most of these engineers were very reluctant to share any details about their satellites and their security aspects. Why were satellite engineers so reticent to talk about cybersecurity? What was so secretive, so wrong with it, that they didn’t feel they could answer even general questions, anonymously? Because let’s be clear: if there’s something wrong with the security of satellites, that’d be a serious problem.

Advertising Inquiries: https://redcircle.com/brands

The podcast and artwork embedded on this page are from Malicious Life, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Alberto Deto Hasson, VP CISO @ICL Group, former Head of National CERT on civilian cyber defense at wartime
Pub date: 2023-12-22

Nachhson Pincu hosts Alberto (Deto) Hasson, VP CISO at ICL Group. I call him "The CISO of CISOs," one of the cybersecurity leaders in Israel and the former Head of Isreal National CERT. In a "Beat the expert " conversation about everything you should know about cyber defense in wartime, where hinterland, civilian networks, and critical infrastructure became the primary target for cyber attacks by attack groups, terrorists, and hostile governments.

נחשון פינקו מארח את אלברטו (דטו) חסון, סמנכ"ל סיסו בקבוצת כי"ל. אני קורא לו "הסיסו של הסיסויים", ממובילי אבטחת הסייבר בישראל ולשעבר המקים וראש הסארט הלאומי של ישראל

שיחת "הכה את המומחה" על כל מה שצריך לדעת על הגנת סייבר בזמן מלחמה, שכאשר העורף: אזרחים, מערכות אזרחיות ותשתיות קריטיות, הפכו למטרה מרכזית למתקפות סייבר של קבוצות תקיפה, טרוריסטים וממשלות עויינות.

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Ron Fabela: Secure Access That Makes Sense for Operations
Pub date: 2023-12-21

About Ron Fabela: Ron Fabela, a seasoned cybersecurity professional with over 20 years of experience, specializes in safeguarding Industrial Control Systems (ICS) and Operations Technology (OT). Currently serving as the Field CTO at XONA, Ron leads initiatives to establish secure industrial access, ensuring safe operations for asset owners globally. With a background rooted in hands-on experience across diverse critical infrastructure sectors such as power generation, offshore oil, and refineries, he excels in overcoming industry-specific challenges and possesses a unique skill set to articulate technical and business concepts effectively to a broad audience.

In this episode, Aaron and Ron Fabela discuss:

Adopting secure remote access in OT as an operational requirement
The complex landscape of active scanning in ICS
Building trust and bridging the gap between cybersecurity and OT
Balancing innovation, risk, and security in a changing landscape

Key Takeaways:

In the dynamic world of ICS, securing remote access is not just a cybersecurity necessity but a practical operational requirement, as witnessed through the evolution from air gaps to accepted industry practices, embracing the concept of zero trust while facilitating secure access is not only a cybersecurity feat but a collaborative effort aligning operational needs with stringent security measures.
The shift from passive to active scanning is crucial for effective threat detection and asset visibility; while skepticism persists, bridging the gap between security and operations through trust-building and advocacy is essential to navigate the challenges and seize the opportunities in securing critical infrastructure.
To establish trust and enhance cybersecurity in operational environments, genuine collaboration, understanding the challenges of control system engineers, and acknowledging small victories are crucial steps toward securing critical infrastructure and ensuring operational resilience.
The future of industrial cybersecurity brings excitement and concern with the shift to advanced systems like cloud, edge, and virtualization, offering scalability but inheriting a substantial attack surface. This underscores the importance of a strategic security approach in this evolving landscape.

"I appreciate where I'm at. That's why I stay in the community. I don't think I could ever go back to enterprise and have that same feeling of mission and importance without letting it get to you. Early on, a lot of us were like, "We're saving the world." It's like, "No, no, no. We're just trying to help people, and we're helping ourselves in the process." That's why I love the community." — Ron Fabela

Connect with Ron Fabela:

Email: ron@fabela.co (unofficial business) & ron@xonasystems.com (official business)

LinkedIn: https://www.linkedin.com/in/ronniefabela/

Twitter: https://twitter.com/ron_fab

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: El rincón de la viruta
Episode: 3X09 Ciberseguridad industrial con Edorta Echave
Pub date: 2023-12-20

🎙️En este capítulo de El Rincón de la viruta descubre por qué es esencial en el mundo industrial ¿Te preocupa la ciberseguridad? En este episodio de nuestro podcast, entrevistamos a Edorta Echave, experto en ciberseguridad industrial. Descubre las claves para proteger entornos industriales y cómo puedes formarte en este emocionante campo. ¡No te lo pierdas esta entrevista cargada de tips para mejorar la ciberseguridad de nuestra planta industrial! 🔒💻 #Ciberseguridad #ProtecciónIndustrial

The podcast and artwork embedded on this page are from Dani, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: Ensuring Cybersecurity for Amtrak
Pub date: 2023-12-19

I’m joined by Jesse Whaley, the Chief Information Security Officer at Amtrak, for this episode of Hack the Plant. Amtrak is the nation's largest passenger rail service provider and one of the most complex and critical transportation systems in the world.

We discuss what it takes to oversee Amtrak’s digital assets and infrastructure, and what it takes to keep them secure.

“The company had a safety culture. Before every meeting before every job site that workers went out to on the railroad to do work. They did safety briefings … I got alignment on hey, this should be our standard company safety and security briefing, but with a whole pillar of safety as being cybersecurity. Since I did that, before every meeting, before every crew goes out to a job site, before every activity, there is a safety and security briefing, and it follows this essential template which highlights and reinforces cybersecurity.”

We also cover the impressive talent pipeline and team and workforce development programs Jesse put into place to staff Amtrak’s cybersecurity efforts. Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Predictions Analyzed
Pub date: 2023-12-20

In this solosode episode Dale reviews the status of his three predictions from the Q1, 2 and 3 quarter in review episodes and answers a listener question.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 39: Dom Lombardi on Mobile Device Management
Pub date: 2023-12-19

As more people work from home and use their own devices, the threat landscape is increasing exponentially. Your networks should never go down because someone wants to watch their personal Netflix account. On this podcast, Dom Lombardi of Kandji discusses why mobile device management is necessary, why security needs to understand business goals and how to move slow

to go fast.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 26: Securing Railroad OT Systems
Pub date: 2023-12-20

Can your OT function if the IT system goes down? OT self-sufficiency is critical for infrastructure such as rail systems. Christopher Warner, from GuidePoint Security, discusses how this infrastructure resilience is important not only for the rail industry but for most of the other critical infrastructures in general.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Dining Digitally: Embracing Change Management in Food and Cybersecurity with Dr. Keera Godfrey
Pub date: 2023-12-19

Join us in this enlightening episode of the Bites & Bytes Podcast, where Kristin Demoranville and Dr. Keera Godfrey journey into the critical role of organizational change management in harmonizing cybersecurity and food safety. Dr. Godfrey, a seasoned change strategist, unravels the complexities of digital transformation in the food industry, emphasizing the importance of data, leadership, and innovative thinking. Discover how traditional food practices can coexist with digital advancements and why embracing change is pivotal for the future of food safety. Tune in for an insightful discussion that blends technical savvy with a human touch.

Key Episode Highlights:

(01:22 - 02:41) Favorite Food Memories and Culture Integration
(06:38 - 07:56) Exploring Emotional Connection to Food
(13:32 - 15:26) Balancing Innovation and Tradition
(24:07 - 25:50) Sustainable Change in Food Industry
(26:31 - 28:56) Leadership in Change Management
(35:54 - 37:37) Leveraging Change for Organizational Growth

Connect with Dr. Keera Godfrey

Follow her on LinkedIn

Learn more about her work at her website

Become a reader of Leaders & Thinkers Magazine

Also, check out her Leadership Academy

Check out her book "Leaving Normal: How to Let Go and Move the Heck On."

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Hadas Tamam Ben-Avraham Cyber crises expert Vice Dean & E-MBA Program Director @Ono Academic College
Pub date: 2023-12-17

נחשון פינקו מארח את אחת המובילות בישראל לרגולציה וניהול משברי סייבר, עו"ד הדס תמם בן אברהם, סגנית דיקן ומנהלת תכניות תואר שניבסייבר במכללה האקדמית אונו, בשיחה חופשית על המגה תרומה של נשים ב-7 באוקטובר ולאחריה, היום שינה את חיי כול הישראלים

מדוע ניהול אירוע סייבר ע"י שילוב של גבר ואישה יחד, הוא צוות ניהול משברי הסייבר הטוב ביותר

ניהול משבר סייבר בראייה של הרגולציה ותביעות היום שאחרי

תכנון ואימון לפני, מצמצמים דרמטית את השפעת משבר הסייבר על המנהלים

ועוד

Nachshon Pincu hosts one of Israel's leading experts for regulations and cyber crisis management, Lawyer Hadas Tamam Ben-Avraham, Vice Dean & E-MBA Programs Director at the Ono Academic College, in a free still conversation about women mega contributions in and after October 7th, the day changed every Israeli life.

Why is a man and a woman together the best cyber crisis management team? Managing a cyber crisis in the eyes of regulations and Lawsuits "the day after.

" Plan and train before dramatically reducing the impact of the cyber crisis on management.

And more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Schweitzer Drive (LS 35 · TOP 3% what is this?)
Episode: OT Cybersecurity: Understanding the Threat, Determining How Much Protection is Enough
Pub date: 2023-12-15

In this episode, guest host Nicholas Seeley talks with cybersecurity expert and author Andrew Ginter about the challenges of protecting operational technology used in industrial environments and critical infrastructure, like the power grid, from growing cyber threats.

The podcast and artwork embedded on this page are from Schweitzer Engineering Laboratories, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Made IT - Storie Italiane di Successo (LS 46 · TOP 1% what is this?)
Episode: #132 Basta un Solo Sì: Lezione di Perseveranza con Andrea Carcano, Co-Founder Nozomi Networks
Pub date: 2023-12-11

Andrea Carcano è il co-fondatore di Nozomi Networks, un'azienda italiana di sicurezza informatica che non solo ha conquistato la Silicon Valley ma ha anche ridefinito il panorama internazionale della cyber security.

Nozomi Networks è un'azienda specializzata nella cybersecurity per sistemi critici. Fondata a Varese con un investimento iniziale di 20mila euro, l'azienda si è rapidamente affermata nel settore come punto di riferimento. Ha raccolto oltre 150 milioni dollari di finanziamenti da fondi quali Planven, Lux Capital e GGV Capital e ha più di 250 dipendenti tra Europa e Stati Uniti.

Andrea condivide con noi i suoi esordi, raccontandoci di come la sua curiosità per i computer lo abbia portato a costruirsi da solo, il suo primo computer pezzo per pezzo per poi divertirsi con quello che viene chiamato white hacking quindi entrare nei computer degli amici per fare banalmente degli scherzi.

Ci racconta poi come decide di lasciare un lavoro nel team di cyber security da Eni per provare a costruire un suo prodotto che è convinto possa risolvere problemi enormi per società proprio come Eni.

Ci soffermiamo sui sacrifici fatti nei primi anni da founder, la difficoltà di trovare il primo cliente, il primo test con Enel, la ricerca del primo investitore e la determinante decisione di trasferirsi nella Silicon Valley. Affronteremo insieme le sfide di crescere Nozomi, esplorando anche il significativo cambiamento culturale vissuto nella Silicon Valley.

Ogni capitolo suo percorso è un'occasione per imparare preziose lezioni. Scopriremo come la sua determinazione, la capacità di superare le obiezioni e la fiducia nel proprio prodotto hanno reso Nozomi Networks un'icona di successo nel panorama della sicurezza informatica.

Che siate appassionati di tecnologia o aspiranti imprenditori, questa intervista promette di ispirare e fornire preziose lezioni che potrebbero plasmare il vostro percorso imprenditoriale.

SPONSORS

Made IT è powered by ⁠⁠⁠⁠Alchimia⁠⁠⁠⁠, società di investimento che opera principalmente nel settore del Venture Capital. Investono e co-investono in opportunità ad alto potenziale di crescita, offrendo capitale e risorse strategiche e operative dedicate.

⁠⁠Barberino’s⁠⁠ è molto più di un semplice barbiere, ha infatti trasformato una semplice necessità come tagliarsi i capelli o radersi in un’esperienza goduriosissima. Barberino’s ha deciso di regalare a tutti voi un fantastico omaggio! Con il codice MADEIT avete il 20% di sconto su⁠⁠www.barberinosworld.com⁠⁠fino al 24/12/23 su tutti i prodotti a marchio Barberino’s, senza minimo di spesa.

SOCIAL MEDIA

Se vi piace il podcast, il modo migliore per dircelo o per darci un feedback (e quello che ci aiuta di più a farlo diffondere) è semplicemente lasciare una recensione a 5 stelle o un commento su Spotify o l'app di Apple Podcast. Ci ha aiuta davvero tantissimo, quindi non esitate :)

Se volete farci delle domande o seguirci, potete farlo qui:

Instagram ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@madeit.podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

LinkedIn ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@madeitpodcast⁠⁠⁠⁠⁠⁠⁠⁠⁠

The podcast and artwork embedded on this page are from Inès Makula e Camilla Scassellati Sforzolini, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Secure Tracks: Rail Tech Security Conversations
Episode: Collaborative Defenses: Strengthening Rail Cybersecurity Together
Pub date: 2023-12-11

Launching the second season of the Secure Tracks Podcast, our guest is Colonel Alok Shankar Pandey from DFCCIL. Join Roark Pollock and Pandey as they explore the crucial domain of rail cybersecurity, discussing the essential requirement for collaborative defenses. From information sharing and technological integration to global standards and collaboration, Pandey uncovers the efforts underway to protect operational rail tech systems from evolving cyber threats.

The podcast and artwork embedded on this page are from Cylus, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Dan Gunter: Lessons Learned from Real-World Attack on Ukraine’s Critical Infrastructure
Pub date: 2023-12-14

About Dan Gunter: Dan Gunter, founder and CEO of Insane Forensics, is a seasoned cybersecurity professional renowned for his extensive expertise in the field. With a background as an officer in the United States Air Force, specifically with the Air Force Computer Emergency Response Team (AFCERT) and operational CYBERCOM teams, Dan has a wealth of experience in protecting critical infrastructure sites. His leadership extends to the private sector, where he served as the Director of Research and Development for Dragos Inc. before founding Insane Forensics. As a prominent speaker at major cybersecurity events, including Black Hat and ShmooCon, Dan shares his insights on incident response, threat hunting, consequence analysis, and security operations. Under his guidance, Insane Forensics provides a cutting-edge cybersecurity automation platform and services, catering to the unique challenges faced by industrial sites with limited cybersecurity resources.

In this episode, Aaron and Dan Gunter discuss:

Addressing the growing threat of cyber attacks on critical infrastructure, reflecting on Mandiant’s report on attacks in Ukraine
Navigating the complexities, resource limitations, and timely application of threat intelligence
Rethinking industrial cybersecurity
The intersection of cybersecurity, AI, and OT

Key Takeaways:

In the face of escalating cyber threats to critical infrastructure, exemplified by recent attacks like the Ukraine power grid incident, it is evident that a passive approach alone is insufficient; as attackers grow more sophisticated, understanding and actively monitoring both network and host activities become imperative for effective defense strategies.
The evolving landscape of OT cybersecurity demands a nuanced approach, addressing the historical lack of understanding, resource constraints, and the critical need for timely threat intelligence application, highlighting the urgency for industry-wide collaboration and the integration of advanced technologies like AI.
To navigate the integration of AI and ML in industrial settings, overcoming fear and resistance is key. Scaling incident response, fostering collaboration, and embracing proactive and reactive measures are essential for building a resilient security foundation in critical infrastructure.
In the next 5 to 10 years, the increasing scale and sophistication of cyber attacks, especially in critical infrastructure, pose a significant concern, requiring a holistic approach that combines people, processes, and technology to address evolving threats and vulnerabilities, emphasizing the need for proactive design considerations in new environments and fostering collaborative efforts to share knowledge and solutions.

"I worry about how we keep up. We're not going to do it by people alone. We won't do it by process or technology alone. It's going to be all three. It's going to be just us being smart about it and being open to the future." — Dan Gunter

Connect with Dan Gunter:

Website: https://insaneforensics.com/

Email: dan@insaneforensics.com

YouTube: https://www.youtube.com/channel/UCSBx8on8ffSm00kqUcTrRPA

LinkedIn: https://www.linkedin.com/in/dan-gunter/

Twitter: https://twitter.com/insaneforensics

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Robert Smigelski: Where Safety and Security Meet
Pub date: 2023-12-13

We sat down with Robert Smigelski, CISSP, MSEE, Manager Product Cybersecurity at B. Braun Medical, for a deep dive conversation about how he built the product security practice at B. Braun Medical, automation, and the intersection between safety and security.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Q4 ICS Security Quarter In Review
Pub date: 2023-12-13

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Utility attacks and electrical sector supply chain vulnerabilities.
Pub date: 2023-12-13

Iranian hacktivists hit Pennsylvania water utility. Attacks against water systems are an instance of a larger threat. Supply chain vulnerabilities in the electrical sector. Guest Nick Sanna of the FAIR Institute and Safe Security talks about the challenges the White House faces in attempting to harmonize critical infrastructure regulations. The Learning Lab has part 2 of the 3-part discussion on building automation systems that Dragos Mark Urban had with colleagues Daniel Gaeta and Zach Spencer.

Control Loop News Brief.Iranian hacktivists hit Pennsylvania water utility.Municipal Water Authority of Aliquippa hacked by Iranian-backed cyber group (CBS News)

Iranian-Linked Cyber Army had Partial Control of Aliquippa Water System (BeaverCountian)

A hack in hand is worth two in the bush (Securelist)

Cyber phases of hybrid wars spread beyond the theaters of operation.How cybersecurity teams should prepare for geopolitical crisis spillover (CSO)

And attacks against water systems are an instance of a larger threat.Iran-Backed Cyber Av3ngers Escalates Campaigns Against U.S. Critical Infrastructure (SentinelOne)

Anti-Israel hacking campaign highlights danger of internet-connected devices (CyberScoop)

Chinese operators intrude into infrastructure.China’s cyber army is invading critical U.S. services (Washington Post)

Supply chain vulnerabilities in the electrical sector.A Software Supply Chain Dependent on Adversaries (Fortress)

Control Loop Interview.Guest Nick Sanna of the FAIR Institute and Safe Security details the challenges the White House faces in attempting to harmonize critical infrastructure regulations.

Control Loop Learning Lab.On the Learning, Mark Urban is back with part 2 of 3 of his discussion on building automation systems with Dragos' Daniel Gaeta, ICS/OT Cybersecurity Senior Solutions Architect, and Zach Spencer. Senior Enterprise Account Executive.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on N2K Networks website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 64 - O fim do ICS Security Podcast
Pub date: 2023-12-12

https://www.linkedin.com/company/15089992/admin/feed/posts/

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 38: Xavier Mesrobian on the Microsoft DCOM hardening patch
Pub date: 2023-12-12

Since March 2023, many systems engineers have been struggling with the Microsoft DCOM hardening patch. How important is it? Does it really need to be installed? What’s the least disruptive way to address it? On this podcast, Xavier Mesrobian of Skkynet Cloud Systems walks you through everything you need to know about the patch. Sponsored by: Skkynet

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Making the Move into OT Security [The Industrial Security Podcast]
Pub date: 2023-12-12

Moving from IT or engineering roles into OT security is harder than it should be. Mike Holcomb of Fluor has written eBooks & provides a newsletter to help people with that transition. In this episode, Mike reflects on his own evolution into OT security and gives advice to others looking at making the move.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Thomas VanNorman: ICS Security Takes a Village - Building an OT Security Community
Pub date: 2023-12-07

About Thomas VanNorman: Thomas VanNorman, a seasoned professional with almost three decades of experience in OT, is currently leading the CyPhy Product group at GRIMM. His primary focus involves securing Industrial Control Systems and networking within this domain. Additionally, Tom is a co-founder of the ICS Village, a 501(c)(3) non-profit organization dedicated to Control System security and awareness, where he has volunteered for almost a decade. Tom retired from the Air National Guard after serving in Cyber Warfare Operations, capping off a diverse career that included working on airplane control systems for 12 years.

In this episode, Aaron and Thomas VanNorman discuss:

Starting up The ICS Village
Navigating the world of industrial control systems
Addressing the unique challenges of OT security
The chicken and egg dilemma in industrial cybersecurity
Insights from recent SEC actions and the role of CISOs in risk acceptance

Key Takeaways:

The ICS Village, founded eight years ago, focuses on educating and raising awareness about industrial control systems (ICS) and their security, using conferences, events, and roadshows to provide hands-on experiences, non-sales discussions, and tabletop exercises, with a mission to bridge knowledge gaps, address terminology variations, and emphasize the importance of both old and new threats in the ICS space.
Addressing cybersecurity challenges in the OT space, particularly with aging technology, requires a unique approach due to potential impacts on production and safety, leading to the launch of a four-year apprenticeship program initially targeting veterans to bridge the skills gap.
Navigating the challenges of cybersecurity in industrial settings requires a blend of technical expertise, an understanding of operational processes, and effective risk communication, as demonstrated by the importance of bridging the gap between IT and OT and addressing vulnerabilities in a context-specific manner.
In the ever-evolving landscape of cybersecurity, the role of CISOs is becoming increasingly crucial, with recent legal actions targeting them personally; however, it's essential to recognize that CISOs often lack the executive power to make decisions, highlighting the need for a shift in organizational dynamics and a deeper understanding of the risks being accepted.

"Our role as technologists is to explain the facts: Why does this matter? What happens if you fix it? What happens if you don't fix it? It may cost millions of dollars to fix it. It might be for an air handler that operates the warehouse, which doesn't matter much. Or it could be an air handler for that warehouse that does matter because it has to be climate-controlled. Things go south quickly. It's the same piece of hardware, the same piece of technology, but with different applications." — Thomas VanNorman

Connect with Thomas VanNorman:

Email: tom@icsvillage.com

Website: https://www.icsvillage.com/

LinkedIn: https://www.linkedin.com/in/thomasvannorman/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Team82 Answers Your Vulnerability Research Questions
Pub date: 2023-12-06

Team82 researchers Sharon Brizinov and Noam Moshe join the Claroty podcast for a special episode where they answer questions submitted by users. This Ask-Me-Anything style of podcast covers the team's OT and IoT vulnerability research process, resources for experienced and beginner vulnerability researchers, and insights from their point of view on the threat landscape for cyber-physical systems.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: CISA Attack Surface Scanning Service
Pub date: 2023-12-06

Dale is joined by Steve Pozza, CISA Section Chief of Operational Resilience, and Tom Millar, CISA Branch Chief of Resilience, to discuss some of CISA's security services for asset owners. They discuss:

The Internet accessible attack surface enumeration and vulnerability scanning surface.
Asset owners can buy products or services to do this. Why is the government doing this?
What CISA is doing with this attack surface data?
How is CISA measuring the success of this service offering?
Other broadly available services and tools, the cybersecurity performance goals (CPG assessment) ~500 done in 2023 (and their thinking about self-assessments), Malcom traffic analysis tool, and a couple of other tools.

Links

CISA Vulnerability Scanning Services
Malcolm Tool

View Details

Podcast: Advanced Manufacturing Now (LS 34 · TOP 5% what is this?)
Episode: Digital Transformation – Securing the Future of U.S. Manufacturing
Pub date: 2023-12-05

Berardino Baratta, CEO of MxD, joins Amy Bryson, contributing lead editor of Smart Manufacturing magazine, for a discussion about how U.S. small and mid-sized manufacturers can achieve digital transformation and mitigate cybersecurity risks that threaten domestic supply chains.

The podcast and artwork embedded on this page are from Advanced Manufacturing Now, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 104: Author Spotlight™ - An Interview with Andrew Ginter, Author of Engineering-Grade OT Security: A Guide for Managers
Pub date: 2023-12-05

Today, we are bringing you a fresh, new format called the Author Spotlight, where we focus on the authors within our community.

We are delighted to launch the Author Spotlight by shining our light on Andrew Ginter, the VP of Industrial Security at Waterfall Security Solutions. Andrew has been a steadfast CS2AI supporter since its inception, dedicating considerable time to CS2AI initiatives, and Waterfall is one of our oldest sponsors.

We are grateful to Andrew for generously sharing his insights and all the invaluable contributions he and his company, Waterfall, have made. Andrew's offerings include editing, reading, and committing much of his time to community projects.

Join us today as we explore Andrew's wealth of wisdom and experience.

Show Highlights

Andrew reflects on his writing process and discusses his new book, The Golden Black Book.
Andrew talks about a new approach of combining cybersecurity and engineering to manage risk.
How Andrew structured his book for a mixed audience of engineers and managers
The importance of using mathematical modeling when making cybersecurity decisions rather than relying on intuition or guesswork
Andrew highlights the lack of cybersecurity expertise within industrial settings.
How complex risks have created the need for a multi-faceted approach to cybersecurity
Andrew emphasizes the importance of security by design within product development.
Why it’s essential to understand the broader definition of vulnerability
Andrew discusses the challenges of writing a book on industrial cybersecurity

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Andrew Ginter on LinkedIn

WaterfallSecurity

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 37: Luis Narvaez on bringing SOAR/SOC to OT
Pub date: 2023-12-05

In OT, things that are standard to IT — such as cybersecurity SOAR processes and SOC — are less prevalent. Bringing SOAR and SOC standards to OT systems is critical as industrial cyberattacks increase in frequency and severity. On this podcast, we talk to Luis Narvaez of Siemens about how SOAR and SOC standards can help protect OT devices and networks.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 63 - ICS Identidade e Acesso
Pub date: 2023-12-01

Entre em contato com a Munio Security: contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Cultivating Heritage: Exploring AI’s Integration in Contemporary Farming with Nelson Estrada Hernandez
Pub date: 2023-11-30

Explore the world of AgriTech with Nelson Estrada Hernandez of Goodfarm in our latest Bites and Bytes Podcast episode. Explore the synergy of AI and agriculture as we discuss how cutting-edge technology revolutionizes farming methods and intertwines with cultural heritage. Nelson, an expert in IT and cybersecurity in agriculture, shares his journey from tech enthusiast to industry advocate. Discover insights into the role of cybersecurity in protecting agricultural data and the impact of AI on traditional farming practices. This episode is a treasure trove for those intrigued by the intersection of technology, food security, and cultural traditions in the modern agricultural landscape. Enjoy the episode!

Key Episode Highlights:

(02:09 - 02:59) Mexican Food Culture and Coca-Cola
(09:13 - 09:53) IT and Cybersecurity in Agriculture
(12:48 - 14:00) AI Impact on Agriculture and Safety
(19:27 - 20:12) Getting Involved in the Food Industry
(21:50 - 23:11) Learning to Drive Requires Hands-on Experience
(27:12 - 28:01) Increasing Awareness of Cybersecurity Measures
(31:45 - 32:31) Emotionally Driven Vegan Industry
(38:54 - 40:44) Adapting in IT and Cybersecurity
(43:17 - 44:17) Training and Technology in Cybersecurity

Connect with Nelson:

Follow him on LinkedIn

Check out GoodFarms

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Building Trust to Cooperate - at the EE-ISAC [The Industrial Security Podcast]
Pub date: 2023-11-30

Our enemies cooperate, and so must we. Aurelio Blanquet walks us through the activities of the European Energy ISAC, with a focus on building the trust that is essential to enabling the cooperation that we need to work together. Aurelio Blanquet - EE-ISAC Nov 21

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Don C. Weber: The Gray Area Between OT and IT
Pub date: 2023-11-30

About Don C. Weber: Don C. Weber is the Principal Consultant and Founder of Cutaway Security, LLC, an information security consulting firm based in Texas. With a master's degree in network security and a Certified Information Systems Security Professional (CISSP) certification, Don has a wealth of expertise gained over two decades. As a seasoned leader, he has spearheaded large-scale incident response efforts, overseen the certification and accreditation of classified federal and military systems, and managed distributed security teams safeguarding mission-critical Navy assets. A prolific contributor to open-source projects in the realm of information security and incident response, Don focuses his current efforts on assisting organizations in fortifying their critical infrastructure and operational technology environments through comprehensive vulnerability evaluations and strategic security solutions.

In this episode, Aaron and Don C. Weber discuss:

Navigating the convergence of IT and OT in cybersecurity
Addressing the gray area in OT and IT collaboration
Enhancing cybersecurity in control systems
Embracing cloud technology in ICS security

Key Takeaways:

Understanding the distinct languages, processes, and incident response approaches between IT and OT is crucial for effective cybersecurity in the evolving landscape, requiring a collaborative baseline to ensure efficient communication and decision-making during critical incidents.
The integration of OT and IT in cybersecurity strategies is crucial, and addressing the often overlooked gray area between these domains requires proactive collaboration, communication, and education to bridge the gap and ensure a comprehensive approach to security measures.
The integration of cybersecurity measures in control systems requires a holistic approach, involving clear requirements, collaboration between IT and OT experts, and a shift from the traditional "we've always done it this way" mindset to address evolving challenges and ensure the resilience and safety of critical infrastructure.
As industries rapidly transition to cloud-based solutions, failure to integrate IT and OT teams, train IT professionals about OT, and prepare for potential vulnerabilities in cloud services can lead to increased costs, heightened risks, and a competitive disadvantage in the evolving landscape of ICS security.

"Does the OT side understand anything about cloud? No, that's not their job. Whose job is it? It's the job, right now every company has an IT admin or an IT team, a full team for managing cloud within the corporate environment. If you don't accept, if you don't allow some leadership people from those teams in and start building out your cloud team, you're going to quickly fall behind the times, you're going to be deploying solutions that are vulnerable to remote attacks." — Don C. Weber

Additional Resources:

SANS Industrial Control Systems Security: https://www.sans.org/industrial-control-systems-security/

ICS Village: https://www.icsvillage.com/

Connect with Don C. Weber:

Email: don@cutawaysecurity.com

Website: https://www.cutawaysecurity.com

LinkedIn: https://www.linkedin.com/in/cutaway/

GitHub: https://github.com/cutaway-security

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 62 - ICS Security em Geral
Pub date: 2023-11-30

Entre em contato com a Munio Security: contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: HouSecCast
Episode: Secure by Design vs. Cyber Informed Engineering with Tony Turner
Pub date: 2023-11-29

About this episode:

We’re back with our regularly scheduled programming! This week our hosts sat down with Tony Turner, CEO of Opswright and HSC Speaker, to discuss his talk “Leveraging Historical Software Failures to Strengthen Cybersecurity: The Nexus Between Catastrophe and Cyber Resilience”. They also dig into OT infrastructure, how security fits into OT environments, and the challenges of combining the two.

Things Mentioned:

· Save the date for HOU.SEC.CON 2024! We’ll be at the George R. Brown Convention Center on September 24 – 25.

· The TAB Cyber Foundation is now accepting applications for students and veterans! Learn more on our site

· If you signed up for a free copy of Justin Hutchens book, “The Language of Deception: Weaponizing Next Generation AI” your copy will be delivered after the release date on January 4th, 2024. This offer was only available at HSC however you can order your own copy wherever books are sold.

· To watch all of the talks from HSC 2023 check us out on Vimeo or YouTube!

· Watch Tony’s talk here

Do you have a question for the hosts? Reach out to us at podcast@houstonseccon.com

Keep up with HOU.SEC.CON

· Houstonseccon.com

· LinkedIn

· Twitter

· Facebook

· Instagram

Check out our other show

· CyberSunday

In this episode:

· Host: Michael Farnum

· Host: Sam Van Ryder

· Guest: Tony Turner

· Editing by: Lauren Lynch

· Music by: August Honey

The podcast and artwork embedded on this page are from Michael Farnum and Sam Van Ryder, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Engineering-Grade OT Security with Andrew Ginter
Pub date: 2023-11-29

Andrew Ginter published his third book this year: Engineering-Grade OT Security. Dale interviews Andrew on the book including:

Who was the target reader that Andrew wrote the book for?
Do (should) professional engineers lose their licenses for poor and dangerous cybersecurity design and deployments?
The use of the term engineering grade, and how he defines it.
Unhackable protection and safety controls as a major part of engineering grade.
Unidirectional (one-way) network devices as the only security control listed as engineering grade. Is one-way from the enterprise network to the OT network engineering grade?
Given the ICSSTRIVE/Waterfall report that 75% of all cyber incidents affecting operations are due to ransomware on IT, should asset owners prioritize address this issue or engineering grade security first?
What is keeping Andrew working rather than retiring

Links

Complete this form to get a free copy of the book

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Building automation systems and maritime cyber regulations.
Pub date: 2023-11-29

GRU's Sandworm implicated in campaign against Danish electrical power providers. Paris wastewater agency hit by cyberattack. LockBit hits Boeing. Bletchley Declaration represents a consensus starting point for AI governance. The US Executive Order on artificial intelligence is out. Guest Austin Reid of ABS Group discusses Ship and Shore challenges for security and the current and emerging regulatory landscape. On the Learning Lab, Dragos Mark Urban part 1 of 3 discussing building automation systems with Dragos' Daniel Gaeta and Zach Spencer.

Control Loop News Brief.GRU's Sandworm implicated in campaign against Danish electrical power providers.The attack against Danish critical infrastructure (SektorCERT)

Exclusive: This pizza box-sized equipment could be key to Ukraine keeping the lights on this winter (CNN)

Paris wastewater agency hit by cyberattack.Greater Paris wastewater agency dealing with cyberattack (The Record)

Cyberattaque D'Ampleur Au SIAAP (SIAAP)

Iranian hacktivists claim an attack on a Pennsylvania water utility.Iranian-Linked Cyber Army Had Partial Control Of Aliquippa Water System (BeaverCountian.com)

Municipal Water Authority of Aliquippa hacked by Iranian-backed cyber group (CBS News)

LockBit hits Boeing.Ransomware groups rack up victims among corporate America (CyberScoop)

StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (CISA)

Bletchley Declaration represents a consensus starting point for AI governance.Can Rishi Sunak’s big summit save us from AI nightmare? (BBC)

The Bletchley Declaration by Countries Attending the AI Safety Summit, 1-2 November 2023 (Gov.uk)

The US Executive Order on artificial intelligence is out.Administration Actions on AI (AI.gov)

Control Loop Interview.Guest is Austin Reid of ABS Group discussing ship and shore challenges for security and the current and emerging regulatory landscape.

Control Loop Learning Lab.On the Learning, Mark Urban discusses building automation systems in part 1 of 3 with Dragos' Daniel Gaeta, ICS/OT Cybersecurity Senior Solutions Architect, and Zach Spencer. Senior Enterprise Account Executive.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 103: Diving into the Multifaceted World of Ron Fabela: From Cybersecurity Leadership to Goat Herding and Beyond
Pub date: 2023-11-28

We are thrilled to have another exceptional guest on the show today!

Ron Fabela is the Field Chief Technology Officer at Xona. He is a multifaceted individual who has been a stalwart contributor to the industry for many years. His impressive resume includes being an Industrial Security champion, a military veteran, and a technologist. Beyond his professional achievements, Ron is also a founder, a father, a husband, an astronomy expert interested in anything space-related, and, believe it or not, a goat herder.

Ron has had a wealth of experiences, making him an all-around fascinating guest. Get ready for a long-overdue and truly insightful discussion with Ron Fabela!

Show highlights:

How Ron’s interest in technology began
Ron discusses his career in the military and talks about his cybersecurity training
Ron offers advice for young people
The benefits of working for large organizations, doing internships, and doing volunteer work
How Ron progressed in his cybersecurity career
Why no opportunity for exposure to systems and networks should ever get squandered
How Ron’s military experience shaped his approach to work
Ron shares insights on the challenges of consulting
The importance of having hobbies and passions outside of work
Ron talks about his role as a Field CTO
How the control systems cybersecurity industry has evolved
Why it is essential to persevere with projects, even when facing challenges or the progress is slow

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Ron Fabela on LinkedIn

Xona

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Ron Brash: Understanding the Small Details to Define Risk
Pub date: 2023-11-23

About Ron Brash: Ron Brash, a renowned figure in ICS/OT cybersecurity and embedded vulnerability research, garnered acclaim as the recipient of the Top 40 under 40 award for Engineering Leaders 2020 from Plant Engineering. Serving as the VP of Technical Research & Integrations at aDolus Technology Inc., Ron aligns his passion for ICS/OT security by leveraging his extensive experience in advising major asset owners across industries such as oil & gas, manufacturing, energy, and aviation. His notable achievements include playing a pivotal role in creating datasets for the S4 ICS Detection Challenges, reflecting his commitment to advancing industry standards and fostering innovation in cybersecurity.

In this episode, Aaron and Ron Brash discuss:

Understanding and managing vulnerabilities in OT systems
Balancing risk, detection, and recovery
Exploring the intersection of cybersecurity, business risk, and vendor collaboration
Navigating challenges in industrial networks

Key Takeaways:

In the complex world of industrial cybersecurity, understanding and managing vulnerabilities is like conducting a home inspection or maintaining a car—focus on what matters most, prioritize based on critical assets, and approach it with a measured, pragmatic strategy rather than panicking in the face of a long list of issues.
Achieving zero incidents is an unrealistic goal, and the focus should shift towards proactive detection, deflection, and defense, along with a robust recovery plan, emphasizing the importance of people, processes, and technology, particularly in the context of evolving technologies and complex vendor landscapes.
The key to cybersecurity success lies in translating technical intricacies into tangible business value, effectively correlating cyber and architectural considerations to business risk, as demonstrated by a strategic approach involving transparency, attestation, and collaboration with vendors, ultimately leading to improved security measures and operational efficiency.
Navigating the challenges of aging industrial systems, transparency issues in software development, and evolving threat landscapes underscores the crucial importance of a collaborative community effort to ensure the resilience and security of critical infrastructure in the face of emerging threats.

"Some are very forward-leaning and some believe in the democratization of data, and some are more old school and don't want to share a thing. Within the realm of business, and to be truly fair, no business is homogenous. So, there are different business units that might be more modern and more open facing, and others that are like, don't touch this because you don't know what other industries we're working in." — Ron Brash

Connect with Ron Brash:

Email: ron.brash@adolus.com

Website: www.adolus.com

LinkedIn: https://www.linkedin.com/company/adolus & https://www.linkedin.com/in/ronbrash/

Twitter: https://twitter.com/ron_brash

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Ep. 36: Ganesh Chellappa on large language models in cybersecurity
Pub date: 2023-11-21

Artificial intelligence is beginning to play a larger role in protecting operational technology. From threat detection to vulnerability management, AI can speed up certain processes and prevent hacks and attacks. On this podcast, we talk to Ganesh Chellappa of ManageEngine about large language models and their role in protecting OT devices and networks.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: IoT Security Podcast
Episode: The "Original Cyber-Physical System": Legacy Devices and Key Trends in OT Cybersecurity
Pub date: 2023-11-21

She's no slacker. Danielle Jablanski has been an "expert" — she hates that word — in nuclear policy analysis (the "original Cyber-Physical System"), energy research, and now Nozomi Networks, where she plays the crucial OT cybersecurity strategist role.

John Vecchi and Brian Contos pick Danielle's brain on the ever- and never-changing trends and challenges, digging into the need for consequence-based security and collaboration between security professionals and OT engineers. The discussion also covers the growing concern about the security of IoT devices in OT environments, the importance of centralizing and managing security, addressing the issues surrounding legacy devices, and the evolving landscape of liability and insurance in cybersecurity.

Key Topics Covered:
1. Trends in cybersecurity and the importance of consequence-based security
2. Concerns about the security of IoT devices in OT environments and the role of centralization and management
3. Challenges with legacy devices in ICS and healthcare and the need for building controls and defense-in-depth
4. Evolving conversations about liability and insurance in cybersecurity

After tuning in to this episode, subscribe to the IoT Security Podcast, powered by Phosphorus, to stay informed about the latest trends and insights in IoT security.

Let’s get into Things on the IoT Security Podcast!

Follow Brian Contos on LinkedIn at https://www.linkedin.com/in/briancontos
And you can follow John Vecchi at https://www.linkedin.com/in/johnvecchi

The IoT Security Podcast is powered by Phosphorus Cybersecurity. Join the conversation for the IoT Security Podcast — where xIoT meets Security. Learn more at https://phosphorus.io/podcast

The podcast and artwork embedded on this page are from Phosphorus Cybersecurity, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Click Here (LS 51 · TOP 0.5% what is this?)
Episode: 94. They’re just hackers, living off the land
Pub date: 2023-11-21

There’s a specific kind of cyber attack targeting big industrial systems that is coming back into fashion: it’s called a ‘living off the land’ attack. What makes it particularly scary is that unlike traditional attacks in which bad actors break into a system and plant malicious code, in living off the land attacks, there’s nothing to find — bad actors leverage what’s already in the network.

The podcast and artwork embedded on this page are from Recorded Future News, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: Open Source Data Visualization for Cyber Threats
Pub date: 2023-11-21

I’m joined by Dan Ricci, founder of the ICS Advisory Project, for this episode of Hack the Plant.

The ICS Advisory Project is a free, open-source platform that helps asset owners across 16 critical infrastructure sectors stay secure by identifying threats in their environments.

“I saw a gap in the community. There's good data that's coming at us…but no one did anything to take and make that data more digestible through visualization. So I decided, okay, well, I'm just going to do it now. I’m going to take the the data that I have been cleaning up and monitoring for like the past two years, and I'm going to put it together and visualize it, trying to build a tool that's more practical and usable by that asset owner, who may not have a cybersecurity background.”

We discuss how data visualization translates into more accessible information for the ICS operators on the ground who need the information - and how the data in the platform is maintained.

Join us for an interesting - if technical - discussion about how data from CISA and other agencies can be utilized by asset owners through ICS Advisory’s platform.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Senate Podcast
Episode: Zero Trust in OT, discussion with Fortinet UK
Pub date: 2023-11-19

Cyber Senate Jamison Nesbitt speaks to Stefan Liversidge, OT SME of Fortinet UK about their recent presentation on the 10th annual Control Systems Cybersecurity UK EU conference in November 2023 in London UK.

OT trends typically follow IT and that’s a theme we have seen over the past couple of decades. As we look to improve Cyber Security maturity into OT then we see this trend continuing and so we start to see requirements building for Zero Trust in OT environments. To many the deployment of zero trust in OT sounds a daunting task and we start to see a fear of the unknown leading to resistance and a resulting fall back to classical approaches to securing OT environments.
In this presentation we will explore zero trust as a methodology and what a roadmap for zero trust adoption looks like.

Stefan Liversidge
Systems Engineer, OT Subject Matter Expert, Fortinet

The podcast and artwork embedded on this page are from James Nesbitt / Cyber Senate, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Michael Holcomb: The Journey from IT to OT and Strengthening IT-OT Partnership
Pub date: 2023-11-16

About Michael Holcomb: Michael Holcomb is the Fellow of Cybersecurity and the ICS/OT Cybersecurity Global Lead for Fluor, a prominent engineering, procurement, and construction company. In his current role, he focuses on securing vast ICS/OT environments, ranging from power plants and commuter rail to manufacturing facilities and refineries. Currently pursuing his Master’s thesis on Programmable Logic Controllers' attack surface with the SANS Technology Institute, he holds multiple cyber security and ICS/OT certifications like CISSP, GRID, GICSP, GCIP, GPEN, GCIH, and ISA 62443. Beyond his professional endeavors, he founded the UpstateSC ISSA Chapter and BSides Greenville conference, and authored and taught cyber security courses at Greenville Technical College, earning him the CyberSC’s MG Lester D. Eisner Award for Cyber Excellence in Leadership for South Carolina in 2023.

In this episode, Aaron and Michael Holcomb discuss:

○ Closing the IT-OT skills gap in cybersecurity

○ Navigating the path to cybersecurity expertise

○ The intersection of OT cybersecurity and networking

○ The evolving landscape of OT cybersecurity

Key Takeaways:

○ Bridging the gap between IT professionals learning to think like engineers and OT specialists embracing cybersecurity not only enhances collaboration but also strengthens our ability to secure critical infrastructures, a journey that demands time, dedication, and a shared commitment to a safer digital future.

○ Embracing a multidisciplinary approach and fostering collaboration between IT and OT professionals, along with hands-on experience and continuous learning, is the key to breaking into the rapidly evolving field of cybersecurity, transforming passion and knowledge into practical expertise.

○ Mastering networking fundamentals is the key to bridging the gap between IT and engineering, enabling the design of resilient systems that prevent costly operational disruptions, and emphasizing the need for continuous learning and collaboration in this dynamic field.

○ The integration of IT technologies into OT without adequate expertise has led to vulnerabilities; expecting OT professionals to handle cybersecurity is akin to asking a plumber to do electrical work. While progress is being made, the industry must prepare for a potentially catastrophic event to truly acknowledge the importance of cybersecurity in OT.

"One of the things that's sad to me about the OT cybersecurity industry, and this even goes for folks that are new to the industry and even some of the old players that have been out there for 20, 30, maybe 40 years plus, is that there's still, in some respects, not a lot of concern around what it's going to take for people to take cybersecurity and OT seriously. And so there's going to be that event one day, where people are going to die, right? That is going to finally force people to take cybersecurity and OT seriously." — Michael Holcomb

Connect with Michael Holcomb:

Email: michael.holcomb@fluor.com

Website: www.fluor.com

LinkedIn: www.linkedin.com/in/mikeholcomb

YouTube: https://www.youtube.com/@utilsec

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: teissPodcast - Cracking Cyber Security (LS 31 · TOP 5% what is this?)
Episode: teissTalk: Securing your Industrial IoT
Pub date: 2023-11-16

This is the audio-only version of our weekly cyber security talk show, teissTalk. Join us for free by visiting www.teiss.co.uk/teisstalk

The panel discussion is titled:
teissTalk: Securing your Industrial IoT

How cyber-threat actors are exploiting Industrial IoT, and what the profile of a typical attack looks like
Best practices for managing and mitigating vulnerabilities affecting Industrial IoT assets
The implications for the regulatory landscape

This episode is hosted by Thom Langford https://www.linkedin.com/in/thomlangford/

John Opala, VP & Global Chief Information Security Officer, Hanesbrands Inc.
https://www.linkedin.com/in/johnopalaphd/

Grant Geyer, Chief Product Officer, Claroty
https://www.linkedin.com/in/grantgeyer/

The podcast and artwork embedded on this page are from TEISS, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Asset Inventory, Lawyers, and AI
Pub date: 2023-11-15

This week is a Dale Peterson solosode.

Updates and Announcements

Dale provides updates about S4x24 ticket sales and announces the Women In ICS Security program and sponsor package.

Main Topics

Asset Inventory in Cybersecurity: Dale challenges the common security mantra "You can't protect what you don't know," using examples from both physical and cyber domains. He notes many of the comments on this week's article missed the main point, and he gives hints on the next two asset inventory articles.
Legal and Regulatory Issues in Cybersecurity: Dale emphasizes the importance of domain expertise whether it be cybersecurity or the legal profession. He previews upcoming keynote interviews with legal experts and advises cybersecurity professionals against making legal analyses without proper expertise.
Artificial Intelligence in Cybersecurity: Dale reveals that most AI submissions for S4 were broad and hand wavy. This isn't wrong, but most have heard this info by now. He then discusses the need for focusing on specific, real-world applications of AI and stresses the importance of measurable improvements in this age of experimentation.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Port disruption and a discussion of maritime and OT.
Pub date: 2023-11-15

A cyber incident disrupts Australian ports. Sandworm and Ukraine's power grid: 2022 attacks. Department of Energy hosts simulated cyberattack competition. CISA, FEMA, and Shields Ready. Cyber and electronic threats to space systems. Four cyber phases of a hybrid war. Guest Austin Reid of ABS Group discusses cyber risk and threats to Maritime Transportation Systems (MTS). On the Learning Lab, catch an encore of Dragos CEO Robert M. Lee and Mark Urban about the five critical controls for ICS.

Control Loop News Brief.Australian ports disrupted in a “cyber incident.”Major Australian port operator shuts down amid cyber security incident, impacting goods in and out of the country (ABC News)

Sandworm and Ukraine's power grid: 2022 attacks.Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology (Mandiant)

CaddyWiper: New wiper malware discovered in Ukraine (ESET)

Four cyber phases of a hybrid war..Cyber Escalation in Modern Conflict: Exploring Four Possible Phases of the Digital Battlefield (Flashpoint)

The Evolution of Cyber Attacks on Electric Operations (Dragos)

CISA, FEMA, and Shields Ready.Shields Ready (CISA)

DHS Unveils New Shields Ready Campaign to Promote Critical Infrastructure Security and Resilience (FEMA)

Department of Energy hosts simulated cyberattack competition.DOE hosting simulated cyberattack for students (CyberScoop)

Cyber and electronic threats to space systems.Space Operators Should Harden Cryptography Defenses, NSA Cyber Official Says (Via Satellite)

Cyber Security of Space Systems ‘Crucial,’ As US Space Force Official Notes Recent Attacks (Via Satellite)

Control Loop Interview.Guest is Austin Reid of ABS Group discussing cyber risk and threats to Maritime Transportation Systems (MTS).

Control Loop Learning Lab.On the Learning Lab, we share an encore of Dragos CEO Robert M. Lee and Mark Urban explaining the five critical controls for ICS.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Eddy Thesee: All About Rail Cybersecurity
Pub date: 2023-11-15

We sat down with Eddy Thesee, a world expert in rail cybersecurity. Eddy is the Vice President of Products & Solutions Cybersecurity at Alstom, a world leader in green, smart mobility rail solutions such as rail transportation and infrastructure. Eddy began his career as a network and systems consultant and then joined Alstom where he moved through the ranks all the way to becoming the company's VP of Products & Solutions Cybersecurity.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Tacos, Tenacity, and Trust: Navigating Cybersecurity in Food Defense with Megan Francies
Pub date: 2023-11-14

In this episode, we’re joined by Megan Francies, Global Food Safety Manager at Lamb Weston Inc., specializing in food defense and intentional adulteration. With over a decade of experience in food science and quality assurance, Megan deeply understands the complexities of food safety. We delve into how food safety and cybersecurity intersect, discussing the challenges and opportunities presented by digital technologies in the food industry. Megan, a Genetics and Cellular Biology graduate and a current student of Global Food Law, shares her expertise on food defense strategies, intentional adulteration, and the importance of a robust food safety culture. Join us for a thought-provoking discussion that sheds light on the behind-the-scenes efforts that ensure the safety of our global food supply.

Key Episode Highlights:

(03:07 - 04:17) Cybersecurity and Food Safety Collaboration
(07:05 - 09:39) Digitalization Challenges in Food Industry
(11:04 - 12:45) Understanding Food Fraud and Altered Food
(14:29 - 16:08) Exploring Food Defense and Cybersecurity
(20:48 - 21:37) Food Safety in Change Management
(29:21 - 30:14) Food Industry Budgeting and Security Challenges

Connect with Megan:

Follow her on LinkedIn

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Failures of Imagination - from 9-11 to the Aurora test [The Industrial Security Podcast]
Pub date: 2023-11-14

The industrial security initiative was triggered by the 9/11 attack on the World Trade Center. Aaron Turner, on the faculty at IANS Research, helped investigate laptop computers used by 9/11 attackers and joined up with Michael Assante to persuade government authorities to launch what has become today's industrial cybersecurity industry. Aaron takes us through the formative years - from 9/11 to the Aurora generator demonstration.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 102: Unveiling the Multifaceted Brilliance: A Dive into the World of Bill Lawrence
Pub date: 2023-11-14

We are delighted to have Bill Lawrence, the Chief Delivery Officer at Itegriti Corporation, joining us on the podcast today!

For those unfamiliar with Bill, he is a well-rounded and multifaceted individual. He is a technologist, artist, and a loving father and husband, in addition to being a talented singer, Navy veteran, and pilot.

Bill is known in the industry for his many achievements. In today’s conversation, we unveil the various layers of his experiences and perspectives, and he shares insights into the unique facets that have defined his professional and personal journey.

Stay tuned as we delve into the steps and milestones that have shaped Bill’s dynamic career!

Show highlights:

How Bill started programming in the fourth or fifth grade
How a movie inspire him to join the military
Bill shares some of his exciting fighter pilot experiences
Bill’s Naval Academy experiences included computer science studies and exposure to cybersecurity
Bill reflects on teaching cybersecurity at the Naval Academy
How he transitioned in his career after quitting the Naval Academy
Bill discusses his time spent as a project manager at NERC
How Grid X evolved and grew
Cybersecurity and compliance within the energy industry
The importance of reading books and applying them to life to make a positive impact
Why Bill finds quantum computing and AI exciting prospects

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Bill Lawrence on LinkedIn

ItegritiCorporation

Books mentioned:

The Ideal Team Player by Patrick Lencioni

How to Be Perfect by Michael Perry

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Cyber Awareness, Ep. 12: Madison Horn on Proactive Cybersecurity
Pub date: 2023-11-07

In the 12th and final episode of our Cybersecurity Awareness Month podcast series, we welcome first-timer Madison Horn, CEO of Critical Fault and Congressional candidate (OK-05). She discusses the need to move from reactive to proactive cybersecurity, the value of the shared responsibility model and the rise of quantum computing.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: New Cyber Frontier (LS 27 · TOP 10% what is this?)
Episode: NCF-334 Security Engineering for Industrial Systems
Pub date: 2023-11-13

Welcome back, everybody, to NewCyberFrontier. In today's episode, guest Andrew Ginter, Vice President of Industrial Security and Waterfall Security. Mr Ginter is also the author of a book titled, "Engineering Grade OT Security: A Managers Guide." He defines his book as sitting at the intersection of industrial systems and Engineering. These systems could range from inputs and outputs from computer systems such as power plants, Shoe factories, and high-speed passenger train rails. Mr. Ginter explains his book further by saying, "Small Shoe factories and High-speed train rail switches are very different on the Industrial system spectrum. What determines the difference is worst case consequences of compromise." What would be the worst outcome to a Shoe factory versus Passenger Train Rail switches if all commands to computer systems fail? Shoe factories might have to replace all the equipment and a couple million dollars worth of expenses that insurance could cover, but for the switches on a train, if all computer commands fail, this could result in massive casualties and two trains colliding, which insurance can not cover. These are two diverse examples of industrial systems that need to face different approaches to computer systems. Mr Ginter also explains in his book that Engineering Security is a public safety issue with no room for errors. "In recent years, we have been automating everything, which is not always the best option; we must have fail-safes in place with security and protection." We face many problems and cyber attacks in the engineering world that must be considered today. Thank you for watching NewCyberFrontier.

The podcast and artwork embedded on this page are from Logic Central Online, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Pulse Podcast
Episode: Cyber Awareness, Ep. 11: Steve Stone on Why Breaches Are Inevitable
Pub date: 2023-11-02

In the 11th episode of our Cybersecurity Awareness Month podcast series, we welcome Steve Stone, head of Zero Labs at Rubrik. He discusses how both sides will try to use generative AI, why you should assume breaches are inevitable and how the show “Parks and Recreation” tackled cybersecurity.

The podcast and artwork embedded on this page are from Industrial Cybersecurity Pulse, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep.61 - Entendendo e aplicando a IEC 62443
Pub date: 2023-11-10

Entre em contato conosco: contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Mandiant on Sandworm APT Attacks in Ukraine
Pub date: 2023-11-10

Nathan Brubaker, Mandiant and Google Cloud Head of Emerging Threats and Analytics, joins the Claroty Nexus podcast for a timely discussion on his team’s report published this week on the Sandworm APT’s activity in Ukraine.

Sandworm leveraged a new TTP—Living off the Land techniques—to target a Ukrainian energy company in October 2022 to cause a power outage. That outage also coincided with missile attacks by Russia against critical infrastructure in Ukraine.

Read Mandiant's Sandworm paper here.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Critical Assets Podcast
Episode: CIE: Architecting Infrastructure Immunity
Pub date: 2023-11-09

In this episode, we take a deep dive into the world of Cyber Informed Engineering (CIE), joined by Ginger Wright, Program Manager at Idaho National Laboratory. This episode unpacks CIE's strategic efforts to integrate cybersecurity into the very fabric of engineering critical infrastructure. We discuss the evolution of CIE and how it's transforming the approach to system design. We cover the synergy between engineers and cybersecurity experts and the implementation of engineering-based mitigations. Get insights on building resilience into critical systems from the ground up.

The podcast and artwork embedded on this page are from Patrick Miller, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Security Masterminds (LS 25 · TOP 10% what is this?)
Episode: Demystifying AI's impact on Cybersecurity with special guest Clint Bodungen
Pub date: 2023-10-31

Discover the untold dangers of AI in cybersecurity as expert Clint Bodungen uncovers the dark side of generative AI. Is our reliance on technology putting us at risk? Find out in this eye-opening discussion that will leave you questioning the future of cybersecurity.

"Technology, as much as we need it, enables complacency. The technology enables that complacency, and we've seen the consequences. We need a proper cybersecurity culture that aligns with our natural desire to do the right thing and help others. "
- Clint Bodungen

Discover how AI is revolutionizing cybersecurity and gain insights into its impact on threat detection and response.
Explore the relationship between organizational culture and cybersecurity practices, uncovering strategies to foster a security-conscious environment.
Unlock the potential of AI in cybersecurity and uncover innovative ways to enhance your organization's defense against cyber threats.

Connect with Clint Bodungen

LinkedIn: https://www.linkedin.com/in/clintb/
Twitter: https://twitter.com/R1ngZer0
Email: clint@threatgen.com
Organization: threatgen.com
CyberSuperHuman - AI Courses - https://cybersuperhuman.ai

Connect with us

Website: securitymasterminds.buzzsprout.com

KnowBe4 Resources:

KnowBe4 Blog: https://blog.knowbe4.com
Erich Kron - https://www.linkedin.com/in/erichkron
Jelle Wieringa - https://www.linkedin.com/in/jellewieringa
James McQuiggan - https://www.linkedin.com/in/jmcquiggan
Javvad Malik: https://www.linkedin.com/in/javvad
Music Composed by: Brian Sanyshyn - https://www.briansanyshynmusic.com
Announcer: Sarah McQuiggan - https://www.sarahmcquiggan.com

Show Notes created with Capsho - www.capsho.com
Sound Editing - James McQuiggan
This episode was edited by Matthew Bliss of MB Podcasts. If you'd like to ask Matt what he can do for your podcast, visit https://www.mbpod.com and schedule a consultation today!

The podcast and artwork embedded on this page are from Security Masterminds, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Kayne McGladrey: The CISO’s Role Is To Advise on Business Risk
Pub date: 2023-11-09

About Kayne McGladrey: Kayne McGladrey, CISSP, is a seasoned cybersecurity expert with over twenty-five years of experience and a senior member of the IEEE. As the field CISO for Hyperproof, he specializes in advising companies on upholding the implicit social contract to protect entrusted data. Kayne's transformative leadership has been instrumental in implementing robust security measures, disaster-recovery systems, and compliance standards, earning him recognition as a spokesperson for IEEE's Public Visibility Initiative and a prominent media presence. Additionally, his dedication to fostering diversity in cybersecurity has led him to develop educational programs and build effective teams, showcasing his commitment to expanding opportunities in the field.

In this episode, Aaron and Kayne McGladrey discuss:

Strategic alignment of cybersecurity with business risk
Navigating the changing landscape of cybersecurity
Empowering CISOs in the evolving landscape of cybersecurity
The challenges and opportunities of generative AI

Key Takeaways:

The key to a successful cybersecurity strategy lies in reframing it as a business imperative, focusing on aligning security efforts with business risks, engaging with cross-functional teams, proactively obtaining certifications, and leveraging control design expertise, ensuring a competitive advantage and effective risk management beyond mere compliance and technology concerns.
In today's dynamic cybersecurity landscape, CISOs must continually reassess their controls and their alignment with business risks, while also considering the personal liability they bear, making succession planning and strategic adaptability vital for maintaining effective security programs.
The role of a CISO is crucial, yet often misunderstood; empowering and respecting CISOs' authority is essential to effectively manage cyber risks and avoid potential disasters, as generic approaches and AI-driven risk registers fall short of addressing the unique challenges faced by businesses.
In a world where cybersecurity threats are inevitable, the key lies in fostering resiliency rather than aiming for an unattainable zero-risk goal; while a lot are excited about the potential of education and automation, the lack of regulatory control over generative AI poses a daunting challenge, risking societal upheaval and economic unrest.

"If we don't decide to manage the economic impacts of artificial intelligence, potentially a lot of industries could be at least partially automated. And that has the potential for a lot of social arm where people just don't have jobs. And when you get people who are automated out of a job, what are they going to go do? They're going to do something that everybody can do fine, but it doesn't pay well. Like you end up going and driving for a living or doing deliveries for a living. And you end up with a highly educated workforce that is unhappy. That's like a recipe right there for civil unrest." — Kayne McGladrey

Connect with Kayne McGladrey:

Email: kayne@hyperproof.io

Website: https://hyperproof.io

LinkedIn: https://www.linkedin.com/in/kaynemcgladrey/

YouTube: https://www.youtube.com/@hyperproof

Twitter: https://twitter.com/kaynemcgladrey

Kayne will be speaking at the GPSEC Columbus next week: https://go.guidepointsecurity.com/2023_11_14_GPSEC_Columbus_NC_01-Registration-Page.html

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Is The Purdue Model Dead (E)
Pub date: 2023-11-08

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 101: Exploring the IoT and OT Cybersecurity World with Dr. Jesus Molina: An Expert's Insights and Experiences
Pub date: 2023-11-07

We are delighted to have another remarkable guest joining us on the podcast today!

Dr. Jesus Molina, the Director of Industrial IoT at Waterfall Security Solutions, is a seasoned cybersecurity practitioner and well-known OT cybersecurity thought leader. He is a technologist and inventor driven by an insatiable curiosity. In addition to being a copious reader and an electrical engineer with a Master's degree and a Ph.D. in the field, Dr. Molina is a dedicated researcher, a sailor, an intrepid traveler, a compelling public speaker, and an ardent educator.

Dr. Molina’s passion for cybersecurity, particularly in the context of IoT and OT, is evident in everything he does. Join us today as we delve into the insights and experiences of this accomplished cybersecurity expert.

Show highlights:

Dr. Molina talks about his early life experiences
How his interest in cybersecurity began
Dr. Molina explains how he created a virus that infected every computer in his high school
Dr. Molina shares his experience of pursuing a Master's degree in the US after studying in Spain
A valuable lesson learned about remaining cautious and protecting a group or organization after a security breach
Cybersecurity challenges and solutions in various industries
How Dr. Molina discovered he could control every room in a hotel by exploiting a wireless network vulnerability
Dr. Molina shares a cautionary story about the importance of watching what you say around journalists
How curiosity drives creativity
Dr. Molina discusses his views on the future

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Dr. Jesus Molina on LinkedIn

Waterfall Security Solutions

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: How Managed Security Services Can Bridge the Cybersecurity Talent Gap
Pub date: 2023-11-02

Managed security services. Years ago, the mere thought of an outside organization watching over a manufacturing enterprise and ensuring the site was free and clear and not under attack would have been considered outrageous. Throw in increased connectivity and a shortage of cybersecurity talent and managed security services is a cost-effective way to secure your site.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: John Cusimano: Leveraging ISA/IEC 62443 to Quantify OT Risk
Pub date: 2023-11-02

About John Cusimano: John Cusimano is a seasoned business and thought leader, boasting over 30 years of expertise in process control, functional safety, and operational technology (OT) and industrial control systems (ICS) cybersecurity. With a track record of conducting numerous OT cybersecurity vulnerability assessments, he has played a pivotal role in establishing cybersecurity programs for numerous companies. As a prominent member of the ISA 99 cybersecurity standards committee, he chaired the subcommittee responsible for crafting the ISA/IEC 62443-3-2:2020 standard and developed multiple training courses on OT cybersecurity, showcasing his extensive knowledge and influence in the field.

In this episode, Aaron and John Cusimano discuss:

The challenges of quantifying risk in OT environments
Prioritizing cybersecurity risks and cybersecurity measures in industrial control systems
Identifying critical operational risks and mitigation strategies in industrial environments
Navigating risks and embracing opportunities in the face of technological advancements

Key Takeaways:

Understanding the complex interplay between physical and cyber risks is crucial; utilizing structured frameworks like the ISA 62443 Standard not only provides a starting point for overwhelmed organizations but also emphasizes the importance of tailoring security measures to the specific, high-impact vulnerabilities unique to each facility.
Prioritizing industrial cybersecurity involves breaking down complex systems, evaluating specific vulnerabilities, and engaging in focused discussions between experts and business stakeholders to identify critical risks, ensuring an effective security strategy.
In cybersecurity assessments, identifying and prioritizing risks is crucial; often, seemingly small oversights, like unsecured backups, flawed file transfer mechanisms, or unchecked permissions in asset management systems, can lead to significant vulnerabilities, emphasizing the need for comprehensive evaluation and proactive measures in securing critical infrastructure.
In the rapidly evolving world of control systems and cybersecurity, the key is to understand and manage risk rather than striving for absolute security, while also embracing technological advancements with caution and vigilance.

"The other approach that a lot of people take is just piling on every security control out there. And that's also not tenable either long term. Sometimes it's actually counterproductive to security because every tool you put in has access." — John Cusimano

Connect with John Cusimano:

Email: john.cusimano@armexa.com

Website: www.armexa.com

LinkedIn: https://www.linkedin.com/in/john-cusimano-icssec/ & https://www.linkedin.com/company/armexa

John will be speaking at the 18th Annual API Cybersecurity Conference for the Oil and Natural Gas Industry next week: https://events.api.org/18th-annual-api-cybersecurity-conference-for-the-oil-and-natural-gas-industry

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: Cyber Threat Intelligence Over the Past 25 Years
Pub date: 2023-10-31

I’m joined by Jason Healey, a Senior Research Scholar at Columbia University’s School for International and Public Affairs, for this episode of Hack the Plant. Jason is a pioneer of cyber threat intelligence, with experience spanning fifteen years across the public and private sectors.

Today, we discuss a recent article Jason published at Lawfare, looking at 25 years of White House cyber policies, from the Clinton to the Biden administrations. We explore how regulatory policy has become more sophisticated over time, and the evolving nature of threats.

“One of the biggest debates right now amongst the international affairs community – is cyber really dangerous? You've got some people that look at how cyber capabilities have been used over the past two decades, how it's currently being used in Ukraine, and say, ‘it’s difficult to use this stuff, and frankly it’s not as dangerous as we think.' I tend to be on the more pessimistic side … if you're targeting things made of ones and zeros or things made of silicon, cyber can often not be that big a deal. But with smart grids, industrial control systems, and other things connected to the internet, it's not just things made of ones and zeros and silicon. Cyber attacks can take down things made of concrete and steel.”

To what extent is cyber necessary as part of a defense strategy? How has our regulatory approach changed over 25 years? Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Kelly Shortridge - Security Chaos Engineering in ICS
Pub date: 2023-11-01

Kelly joins Dale to discuss her new book Security Chaos Engineering: Sustaining Resilience in Software and Systems. Kelly points out the second part of the title is the most descriptive, and she is not a big fan of the Chaos term that has taken hold.

They discuss:

A quick description of Security Chaos Engineering
Is there similarity or overlap with the CCE or CIE approach?
The value of decision trees
Her view of checklists of security controls like CISA's CPG
Lesson 1 - "Start in Nonproduction environments"
The experiment / scientific method approach and how it can start small
The Danger Zone: tight coupling and complex interactions
How should ICS use Chaos Engineering

View Details

Podcast: Hack the Plant (LS 34 · TOP 5% what is this?)
Episode: Architecting Threat Responses
Pub date: 2023-10-31

I’m joined by David Patrick Emmerich, the Principal Cyber-Physical Range Architect at the University of Illinois, for this episode of Hack the Plant.

We’re here today to talk about RADICS, a DARPA project. RADICS stands for Rapid Attack Detection, Isolation and Characterization Systems. We discuss David’s role in building automated data collection and set up simulations and testing, and how the process of doing vulnerability discovery for physical assets helps asset owners.

“ ‘These are ways that an attacker could get around it.’ ‘These are where your blind spots might be’ … We help them understand that so that they can better improve the security of their systems. Or go back to their boards or their management and say ‘these are the tools we need’ or ‘this is the equipment we need and this is why we need it to better improve our security posture.’ Their systems are already critical, but as they become even more critical.”

We delve into challenges of securing operational technology (OT) for asset owners, different kinds of threats they face, and more technical projects that RADICS ignited.

Join us for an interesting - if technical - discussion to learn more about how physical systems interact with data to support real-time threat response.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Active visibility into OT systems.
Pub date: 2023-11-01

SecurityWeek’s ICS Cyber Security Conference.2023 ICS Cybersecurity Conference (SecurityWeek)

Malware attacks against IoT devices increase by 400%.Zscaler ThreatLabz 2023 Enterprise IoT and OT Threat Report (Zscaler)

Nuclear power plant operator cited over cybersecurity plan.UK Cites Nuclear Plant Operator Over Cybersecurity Strategy (Silicon UK)

Rockwell and Dragos announce partnership.Dragos and Rockwell Automation Strengthen Industrial Control System Cybersecurity for Manufacturers with Expanded Capabilities (Business Wire)

CISA’s ICS advisories.CISA Releases Two Industrial Control Systems Advisories (CISA)

Hitachi Energy’s RTU500 Series Product (Update B) (CISA)

CISA Releases Nine Industrial Control Systems Advisories (CISA)

Control Loop Interview.Guest is Garrett Bladow, Distinguished Engineer at Dragos, discussing active visibility into OT systems.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos’ Director of Intelligence Services, Paul Lukoskie, for part two of their discussion on cyber threat intelligence.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Mint Chocolate-Chip Ice Cream, Risks, and Collaboration with Food Safety with James Nasella
Pub date: 2023-11-01

In this episode, James Nasella of Glanbia Nutritionals unpacks the intricacies of food safety in the ingredient space. As the Director of Supply Chain Quality with over a decade of experience in global food ingredients, flavor, and starch industries, James emphasizes the role of collaboration in risk management. Learn surprising facts about mint chocolate chip ice cream and get insights from a Drexel and Michigan State University alumnus. Explore the importance of inter-departmental cooperation in ensuring food safety, from IT to Cybersecurity to R&D. Whether you're in the food industry or just an ice cream enthusiast, this episode offers expert knowledge and delightful trivia.

Key Episode Highlights:

(00:24 - 00:54) Food Safety & Cybersecurity Parallels
(07:37 - 08:53) Food Protection and Cybersecurity Intersection
(13:42 - 14:53) Navigating Food Industry Digitalization and Cybersecurity
(16:55 - 18:02) Implementing Tech in Food Production
(22:30 - 23:14) Measuring Food Safety Culture and Cybersecurity
(25:32 - 26:15) Evaluating Multiple Risk Assessments in Company
(30:50 - 31:49) IT's Impact on Food Production

Connect with James on LinkedIn

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Advanced Manufacturing Now (LS 34 · TOP 5% what is this?)
Episode: Proactive Approaches to Cybersecurity in Manufacturing
Pub date: 2023-10-31

CyManII’s Chief R&D Officer Wayne Austad joins Smart Manufacturing Contributing Lead Editor Amy Bryson for a discussion about creating economically viable and pervasive cybersecurity practices to maintain resiliency and prepare for the future.

The podcast and artwork embedded on this page are from Advanced Manufacturing Now, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 100: Exploring OT Security and Cyber Practices with IBM's Rob Dyson
Pub date: 2023-10-31

We are delighted to welcome Rob Dyson as our special guest for the 100th episode of the CS2AI podcast!

Rob is the Global OT Security Services Leader for IBM. Beyond his corporate role, he is a military veteran, a tech enthusiast, a devoted father and husband, a proud grandfather, and an avid scuba diver.

His extensive experience overseeing key service areas within an industry giant like IBM makes Rob an exceptional guest for this milestone podcast. He joins us today to share his insights on control systems, operating technology, and cybersecurity practices.

Rob truly brings a wealth of knowledge and clarity to today’s discussion. Stay tuned for more!

Show highlights:

How Rob’s interest in technology influenced his desire to explore new things and push boundaries
The challenges of setting up a business continuity plan in a remote location
How security measures have evolved from the early days of network security to modern-day cybersecurity
The importance of understanding the network for OT security
How software developers can bring valuable skills to cybersecurity after mastering the fundamentals of networking
Rob shares his insights on entrepreneurship in the cybersecurity space
How Rob got offered a job with IBM in 2012 after a quick and unexpected interview process
Rob explains how he transitioned to full-time OT security work in 2016
Why is there a need for a different mindset and cultural understanding within the OT cybersecurity industry?
Rob offers advice for people who have recently begun their career journeys

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Rob Dyson on LinkedIn

IBM

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Safety, Security and IEC 62443 in Building Automation [The Industrial Security Podcast]
Pub date: 2023-10-30

Cybersecurity and IEC 62443 are increasingly relevant to building automation. Parking garages contain safety-critical CO2 sensors that control fans, the MGM breach is in the news and standards bodies are debating minimum security levels for different kinds of systems. Kyle Peters of Intelligent Buildings joins us to look at IEC 62443-2-1 style security assessments of modern buildings and what we can learn from those assessments.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: Don Weber on Security Culture in Control Environments, STAR Methodology
Pub date: 2023-10-26

Don Weber of Cutaway Security joins the Nexus podcast to discuss a trend in control environments where asset operators and engineers keep trained cybersecurity professionals at arm's length, citing safety concerns. As more control systems are connected and managed online, it's critical for certified security professionals to be included in overall safety and reliability activities. Otherwise new risk and vulnerabilities are likely to be introduced.
Weber also discusses a new methodology for assessing implementation vulnerabilities within industrial automation and control systems. Read more about IACS STAR:
IACS STAR Calculator
IACS STAR GitHub

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 24: Securing OT Devices In The Field
Pub date: 2023-10-26

When we think of massive compute power, we think of the Cloud when we really should consider the millions of unprotected OT devices with even greater slack computer power than all our current Cloud services combined. Sonu Shankar, Vice President of Product at Phosphorus Cybersecurity, talks about the challenge of communicating with PLCs and other devices, the risks from newer OT devices, and how all password-less OT devices really need to be protected. He says attacks aren’t just DDoS; today OT attacks can exfiltrate data as well.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Eric Smith: The Importance of Physical Security in Protecting Infrastructure
Pub date: 2023-10-26

About Eric Smith: Eric Smith is a dedicated Security Management Consultant and the founder of Business Karate, LLC, a Colorado-based company specializing in security planning and strategic development for organizations. With over a decade of experience in law enforcement, Eric is passionate about aligning security measures with business needs and has transitioned his expertise into healthcare security management, where he focuses on long-term strategic planning and enhancing workplace violence prevention programs. He is also an accomplished author, with his latest book titled "Workplace Security Essentials."

In this episode, Aaron and Eric Smith discuss:

The complex landscape of physical security
Navigating the intersection of physical and cybersecurity
The importance of organizational culture in promoting security and reporting incidents
Integrating AI in physical security

Key Takeaways:

Establishing robust security goes beyond physical barriers and gadgets; it's a holistic approach integrating people, processes, and technology, fostered by leadership support and a vigilant workforce, ensuring a proactive, not reactive, security culture.
In implementing effective security measures, constant evaluation and willingness to challenge established norms are vital; experienced professionals bring a critical eye, noticing overlooked details like misplaced cameras or flawed staffing strategies, highlighting the need for continuous improvement and outside perspectives.
A strong organizational culture, driven from the top down and bolstered by employees' confidence in their security team, is the key to encouraging timely reporting of security incidents, bridging the gap between physical and cyber security realms and ensuring comprehensive protection against potential threats.
Empowering employees to be vigilant and proactive in security measures is crucial, as advancements in integrated technologies and AI bring both promising solutions and potential risks, shaping the future of physical and cyber security.

"I think people are really starting to be more aware of the risk of workplace violence. So I think we're going to start seeing more training around that and hopefully good training, not just the kind of pencil-whipping lip service that too often happens, but something that's really going to benefit people that might find themselves in a bad situation at work." — Eric Smith

Connect with Eric Smith:

Email: eric@businesskarate.com

Website: www.businesskarate.com

LinkedIn: https://www.linkedin.com/in/ericsmithcpp/

Workplace Security Essentials: A Guide for Helping Organizations Create Safe Work Environments: https://www.amazon.com/Workplace-Security-Essentials-Organizations-Environments/dp/0124165575

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: IACS System Testing and Assessment Rating (STAR) Methodology with Don Weber
Pub date: 2023-10-25

Don Weber joins Dale Peterson to describe his IACS STAR Methodology to score the risk of a vulnerability to an ICS (or IACS in 62443-speak). It is a modification of the OWASP Risk Rating Methodology. Don has modified some of the 16-factors to create IACS STAR. The methodology and code is available on GitHub and a calculator is available on line.

Don and Dale discuss:

What Don likes about the OWASP Risk Rating
Potential issues with putting numbers to SME judgment
Differences between IACS STAR and the OWASP Risk Rating
The weighting of the 16 factors
The future of IACS STAR

Links

Slides Discussed In The Show: https://dale-peterson.com/wp-content/uploads/2023/10/IACS-STAR.pdf

IACS STAR GitHub Repo: https://github.com/cutaway-security/IACS_STAR_Methodology

IACS STAR Calculator: https://iacs-star-calculator.com/iacs_star_calculator.html

Cutaway Security Website: https://www.cutawaysecurity.com

ICS-Patch Decision Tree: https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 99: Exploring the Multifaceted World of Gary Kessler: From Cybersecurity Expert to Master Scuba Diver Trainer
Pub date: 2023-10-24

We are delighted to have Gary Kessler joining us as our special guest for today's episode of the CS2AI podcast show!

Gary is a multifaceted individual with a diverse array of interests. He has been involved in many different projects over time and has worn various hats under the umbrella of his company, Gary Kessler Associates.

His impressive literary contributions include over 75 articles and three books, establishing him as a prolific authority on cybersecurity. He started his journey as a computer programmer and continues to embrace that today. He is a former EMT firefighter, a passionate outdoorsman, an avid cyclist, and an accomplished master scuba diver trainer. He also is a boat captain, a retired college professor, and a dedicated husband and father.

Stay tuned for Gary’s interesting backstory and fascinating insights on maritime cybersecurity!

Show highlights:

Gary shares his backstory and cybersecurity journey
How Gary got into maritime cybersecurity
Some early computer security vulnerabilities and hacking techniques
Gary dives into current shipbuilding practices
Some potential maritime cybersecurity risks and threats
Gary discusses his initial focal point with maritime cybersecurity
Can a ship be hacked to gain potentially damaging data?
Security by design and resilience in engineering
Why bridge crews and officers have to be more technologically aware now than ever before

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Gary Kessler on LinkedIn

Gary KesslerAssociates

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: From Incident to Regulation: TSA Pipeline Regulations
Pub date: 2023-10-23

There is no doubt the Colonial Pipeline ransomware attack was a watershed incident for the oil and gas sector. As a result, the Transportation Security Administration released a prescriptive set of regulations for owners and operators of pipelines and LNG facilities which were very rigid. Then in July last year, after great consternation from the industry, a more flexible set of regulations released and now this July, another set of regulations released. Just what is the impact of the TSA Pipeline Security Directive on the Oil & Gas sector.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Bread, Bugs, and Bytes: Cybersecurity’s Role in Food Safety with Sabetha Wells
Pub date: 2023-10-20

We have the privilege of hosting Sabetha Wells, an expert in food safety with over two decades of experience in the field. Currently leading the charge as the Food Safety & Quality Director for Rise Baking Company, Sabetha's rich portfolio encompasses everything from cheese, yogurt, and dry mixes to sumptuous cakes, cookies, and fillings. Not just a Kansas State alumna, Sabetha is a dedicated wife, mother, mentor, ASQ Certified Manager of Quality & Organizational Excellence, and an FSPCA Preventive Controls Qualified Individual Lead Instructor. And if you're curious about her downtime? She's quite the crocheter!

Join us as we explore the fascinating crossroads of food safety and cybersecurity. From understanding the nuances of flour mites and bread production to diving into the pivotal roles played by people and processes, we highlight the significance of inter-sector collaboration. We discuss the food industry's unique community dynamics and discover how tech and food converge to ensure the bread on your table is not just delicious but safe.

Key Episode Highlights:

(02:46 - 03:16) Pumping Oxygen for Fish in Water
(06:26 - 07:52) Food Protection and Industry Journey
(08:41 - 10:01) Security Breach at Manufacturing Plant
(21:35 - 22:32) Security Risks of Personal Phones
(43:05 - 45:02) Personal Impact on Career Choices

Connect with Sabetha on LinkedIn

Connect with your host, Kristin, on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: וובינר מודעות סייבר: איך להתגונן מאיומים בדיגיטל בתקופת מלחמת חרבות ברזל ובכלל - מיי קמפלר ברוקס יוגב נחום איתמר שליו נחשון פינקו
Pub date: 2023-10-20

וובינר מודעות סייבר: חרבות ברזל, כיצד להגן על המרחב הדיגיטלי האישי והארגוני. השבועות האחרונים משפיעים על כולנו, ישראל עוברת טלטלה חזקה ועדיין אין ספק שננצח במערכה. בנוסף לאיומים הביטחוניים ישנן סכנות ואיומים רבים במרחב הדיגיטלי הנובעים מהמצב הרגיש בו אנחנו נמצאים ומסכנים כול אחת ואחד מאיתנו.

יוגב נחום מחברת וויזר יזם וובינר בהשתתפות פאנל מומחים למודעות סייבר עם מיי קמפלר ברוקס, איתמר שליו ונחשון פינקו על מנת להסביר את הסכנות ואיך לצמצם אותן למינימום.

פושעי סייבר בין אם יש להם קשר לאויבנו או לא מנצלים את האווירה המתוח לטובת פגיעה מורלית, הונאות פיננסיות והשתלטות על חשבונות במדיות החברתיות

איך הם עושים את זה
מהם האיומים המרכזיים על אנשים פרטיים, ארגונים וחברות
מה הפעולות הנדרשות (מרביתן פשוטות) להתמודדות עם האיומים

עם ישראל חי היום, מחר ולתמיד

נחשון

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CYBER LIFE (LS 24 · TOP 10% what is this?)
Episode: Cyber Life Podcast Ep.10 - AI and Behavioral Science for Cybersecurity with Dustin Sachs
Pub date: 2023-10-18

In this episode, award-winning cybersecurity professional and OT security expert Dustin Sachs breaks down how you can leverage artificial intelligence (AI) and behavioral science in your cybersecurity initiatives.

Ask me a question: https://topmate.io/ken_underhill

Learn how to be successful in job interviews in less than one hour, so you can get higher job offers.

https://cyberken23.gumroad.com/l/jbilol/youtube20

Schedule a mock job interview call with me at this link. https://topmate.io/ken_underhill/411153

If you need cybersecurity training, here are some good resources. Please note that I earn a small affiliate commission if you sign up through these links for the training.

Learn Ethical Hacking skills https://get.haikuinc.io/crk0rg6li6qd

Get Ethical Hacking skills, SOC Analyst skills, and more through StationX.

https://www.stationx.net/cyberlife

Support this podcast at — https://redcircle.com/cyber-life/donations

The podcast and artwork embedded on this page are from Ken Underhill, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 60 - ICS Security em Geral
Pub date: 2023-10-20

Entre em contato conosco: contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Nick Tsamis: Leveraging MITRE’s Adversary Emulation Platform in OT
Pub date: 2023-10-19

About Nick Tsamis: Nick currently serves as Department Chief Engineer within the Cybersecurity Infrastructure Protection Innovation Center (CIPIC) at The MITRE Corporation where he works to develop strategies for protection against emerging threats on critical infrastructure. Nick led the technical efforts for the first release of Caldera for OT. He holds degrees in computer science and aerospace engineering, and resides in Honolulu, HI.

In September, MITRE and CISA announced that MITRE Caldera™ for OT is now publicly available as an extension to the open-source Caldera platform, allowing security teams to run automated adversary emulation exercises that are specifically focused on threats to operational technology (OT).

Our nation’s critical infrastructure—including public transportation, commerce, clean water, and electricity—relies on operational technology, but that technology often has weak security spots. Caldera for OT empowers security teams with new tools to help ensure the safe and secure function of critical infrastructure, thus improving our nation’s resiliency posture.

Caldera for OT is now available on GitHub. As an open-source platform, Caldera for OT will continue expanding to new environments, protocols, and attacks. MITRE partnered with CISA through the HSSEDI (Homeland Security Systems Engineering and Development Institute) to develop the first set of modules and continues to work internally, with CISA, and other organizations to develop and release the next set of Caldera for OT open-source modules.

In this episode, Aaron and Nick Tsamis discuss:

Creating a common vernacular and building risk-appropriate solutions
Standardizing cybersecurity practices in OT environments
Enhancing OT security through customized Red Team assessments and protocol familiarization
Navigating the intersection of human expertise and machine learning in cybersecurity

Key Takeaways:

In bridging the worlds of IT and OT cybersecurity, the key is establishing a common language, understanding the crucial emphasis on availability and safety, and developing tools like Caldera to operate within OT protocols, ultimately shifting towards a balanced risk appetite in the industrial control sector.
The adoption of Caldera for OT marks a transformative shift in cybersecurity testing, enabling standardized, real-world simulations in operational environments, bridging the IT-OT gap, fostering collaborative language, and empowering organizations to take calculated, transparent steps toward robust cyber defense strategies.
Effective communication, trust-building, and tailored red teaming activities in OT environments empower teams to ask critical questions, understand protocols deeply, and conduct standardized tests, enhancing detection and asset identification, reducing barriers, and strengthening internal security.
In the evolving landscape of OT and cybersecurity, we must harness the power of machine learning to assist human operators while maintaining vigilance in verifying the trustworthiness of data to avoid misinformed actions.

"Misinformation is a real thing, and if we're not trusting the information that's being provided at real time, the actions that I'm taking from a cybersecurity perspective may potentially do more harm than good." — Nick Tsamis

Connect with Nick Tsamis:

Mitre Blog: https://medium.com/@mitrecaldera

Mitre Email: OT@mitre.org

Website: https://www.mitre.org/

Email: slytle@mitre.org

LinkedIn: https://www.linkedin.com/in/nicktsamis/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Physical Security Supports Cybersecurity [The Industrial Security Podcast]
Pub date: 2023-10-18

Adversaries who can physically touch a target have a huge advantage when it comes to compromising that target. Mike Almeyda of Force5 joins us to look at tools for physical security that support cybersecurity, especially for the North American NERC CIP standards.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Dave Whitehead On SBOMs, Manufacturing in the US, and more
Pub date: 2023-10-18

Dave Whitehead, CEO of SEL, joins Dale on the show to talk about:

The new SEL printed circuit board (PCB) factory in Idaho. Why they bucked the trend and did this. The benefits, the ROI, and more.
SEL's position on providing SBOMs to customers and their internal use of SBOMs - Where leaders tend to go wrong.
Substation shootings
Market acceptance of SEL's Blueframe virtual platform

Links

Dave Whitehead's previous appearance on the Unsolicited Response Show
Want to advertise on the Unsolicited Response Show in 2024?

View Details

Podcast: Cyberlandet
Episode: Cyberattacker mot VA
Pub date: 2023-10-18

Vatten är något som vi är oerhört beroende av – men eftersom det är samhällsviktigt är det också något som kan utsättas för en cyberattack. I detta avsnitt har vi med oss Mats Karlsson Landré, OT-säkerhetsexpert på AFRY, som förklarar vad effekterna av en attack mot en så samhällsviktig funktion kan vara.

The podcast and artwork embedded on this page are from advenica, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 98: Unlocking the Cybersecurity World with Vincent Riou: Insights and FIC Event Preview
Pub date: 2023-10-17

We are delighted to welcome Vincent Riou as our special guest for today’s CS2AI podcast!

Vincent is a distinguished figure within the cybersecurity industry who has profoundly impacted the field in recent years. He is a multifaceted individual with a passion for uniting people- even tens of thousands of individuals at times, for various causes. He is a French Navy veteran, a technologist, a founder, a dedicated father, a loving husband, a culinary artist, and above all, an all-around stand-up guy!

Vincent has a wealth of knowledge to share with us today! He joins us to discuss some pertinent cybersecurity issues and concerns and the upcoming FIC event in Montreal on October 25th and 26th.

Stay tuned for more!

Show highlights:

The story behind the FIC Conference that took place in Lille, France, just over a year ago
Why were the FIC events started?
How cybersecurity is part of the fabric of every type of business organization, institution, and government body
Vincent explains why he organizes open events focusing on those who rely on the digital transformation of the world
Vincent talks about the OT part of the Montreal event and explains how it started
Vincent explains what comes first when he organizes an event
How the Montreal event will differ from the event that took place in Lille last year
Vincent pulls back the curtain to reveal how the big conferences work and what it is like to run them
Vincent shares his future vision for news conferences in North America

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Vincent Riou on LinkedIn

SAVE THE DATE FIC North America – October 25 and 26, 2023

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: A look at a Whole-of-State cybersecurity strategy.
Pub date: 2023-10-18

Microsoft on the state of OT security. Israeli and Palestinian hacktivists target ICS. Coinmining as an (alleged, potential) front for espionage or stage for sabotage. EPA withdraws water system cybersecurity memorandum. Colonial Pipeline says new ransomware claims are due to unrelated third-party breach. Most organizations are struggling with IoT security. CISA views China as the top threat to US critical infrastructure. Improving security for open-source ICS software. CISA ICS advisories. Guest Kuldip Mohanty, CIO of North Dakota, joins us from the CyberCon 2023 event in Bismarck, North Dakota. Kuldip shares how critical infrastructure is treated within the "Whole-of-State” cybersecurity strategy his team implements in North Dakota. On the Learning Lab, Mark Urban shares the first part of his conversation about cyber threat intelligence with Paul Lukoskie, who is Dragos’ Director of Intelligence Services.

Control Loop News Brief.Microsoft on the state of OT security.Microsoft Digital Defense Report 2023 (Microsoft)

Microsoft Digital Defense Report: Behind the Scenes Creating OT Vulnerabilities (aDolus)

Zero-days affect industrial routers.10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows (Cisco Talos)

Israeli and Palestinian hacktivists target ICS.Hacktivists in Palestine and Israel after SCADA and other industrial control systems (Cybernews)

Coinmining as an (alleged, potential) front for espionage or stage for sabotage.Across U.S., Chinese Bitcoin Mines Draw National Security Scrutiny (The New York Times)

EPA withdraws water system cybersecurity memorandum.EPA withdraws cyber audit requirement for water systems (Nextgov)

Colonial Pipeline says new ransomware claims are due to unrelated third-party breach.Reports of second cyberattack on Colonial Pipeline false, company says (Fox 5 Atlanta)

Colonial Pipeline attributes ransomware claims to ‘unrelated’ third-party data breach (The Record)

Most organizations are struggling with IoT security.New Global Survey Reveals 97% of Organizations Face Challenges Securing IoT and Connected Devices (Keyfactor)

Ransomware attack on Clorox.Clorox Security Breach Linked to Group Behind Casino Hacks (Bloomberg)

Clorox Warns of a Sales Mess After Cyberattack (The Wall Street Journal)

CISA views China as the top threat to US critical infrastructure.China is top cyber threat to US utilities, other critical infrastructure: CISA (Utility Dive)

Improving security for open-source ICS software.Improving Security of Open Source Software in Operational Technology and Industrial Control Systems (CISA)

CISA’s ICS advisories.Mitsubishi Electric MELSEC-Q Series PLCs (Update A) (CISA)

CISA Releases Nineteen Industrial Control Systems Advisories (CISA)

Control Loop Interview.Guest is Kuldip Mohanty, CIO of North Dakota, discussing how critical infrastructure is treated within the “whole of state” security strategy used in North Dakota.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos’ Director of Intelligence Services, Paul Lukoskie, to examine cyber threat intelligence.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Bites & Bytes Podcast
Episode: Bites and Bytes Podcast: The Inception
Pub date: 2023-10-13

Join our host, Kristin Demoranville, in the debut episode of the Bites and Bytes Podcast, a unique platform that bridges the worlds of food and cybersecurity. At the heart of this podcast is a mission: to foster conversations between food and cybersecurity professionals to integrate cultures and fortify our food supply.

In a touching segment, Kristin shares personal anecdotes from cherished memories; these stories underscore the profound connection between food, memories, emotions, and experiences, reminding us that food is a universal language that binds us all. Listeners can anticipate casual, interview-style dialogues with a diverse range of professionals, from food quality experts and defense specialists to cybersecurity pros and educators. As Kristin navigates the challenges of podcasting, from technical hiccups to editing hurdles, she invites listeners to embark on this enlightening journey with her. In closing, Kristin encourages listeners to engage with the podcast, emphasizing the collective mission to make a difference in the food and cybersecurity realms.

Connect with your host, Kristin on LinkedIn

Connect on the Bites and Bytes Podcast website

The podcast and artwork embedded on this page are from AnzenSage, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Chris Bihary: Tapping Into Packet Level Data in OT
Pub date: 2023-10-12

About Chris Bihary: Chris Bihary is the CEO and Co-Founder of Garland Technology, a leading USA-based manufacturer specializing in Network TAPs, Network Packet Brokers, Hardware Data Diodes, and Inline Bypass solutions. With a rich background spanning over 30 years in IT and OT cybersecurity, Chris has fostered collaborative partnerships with tech firms to guarantee robust network performance and security across various industries. His entrepreneurial journey began by owning an IT reseller focused on constructing 9-1-1 call center network infrastructure, sparking his lifelong commitment to ensuring the resilience of all networks.

In this episode, Aaron and Chris Bihary discuss:

Leveraging TAPs for independent, reliable, and unintrusive network monitoring
Optimizing network security and operational efficiency
Exploring the importance of data diodes in critical infrastructure environments
Challenges and exciting developments in OT environments

Key Takeaways:

Implementing TAPs in OT networks offers a secure, independent, and foolproof method of monitoring critical assets, ensuring 100% packet capture and reducing the risks associated with relying solely on traditional methods like SPAN ports, making it essential for robust and reliable network security.
In navigating the complexities of network security, the key lies in strategically deploying purpose-built tools like data diodes and aggregators, ensuring comprehensive packet inspection without overwhelming IT staff; finding the delicate balance between data capture and streamlined management is the linchpin to effective and efficient cybersecurity.
Building a secure network foundation, tapping into live data, ensuring compliance without vulnerabilities, and centralizing access are vital for successful tech implementation in critical infrastructures, fostering adaptability and innovation in today's rapidly changing tech landscape.
Simplicity and ease of implementation are not just preferences, they're essential requirements; in an industry where awareness is growing, skilled personnel are scarce, and regulations are tightening, the ability to deploy robust, effective solutions quickly and efficiently is the linchpin to securing critical infrastructures worldwide.

"Some really good high tech companies that were never in OT are coming into OT and they're getting their folks trained up. They're educating them and this is super positive for our space. So I'm excited that the awareness is there and more and more people know they have to move forward. More people are getting involved in this space and I'm just looking forward to being part of it and seeing how we can help companies get their network secure, resilient, and reliable, and work with great companies." — Chris Bihary

Connect with Chris Bihary:

Website: www.garlandtechnology.com

Email: chris.bihary@garlandtechnology.com

LinkedIn: https://www.linkedin.com/company/garland-technology-llc/ and https://www.linkedin.com/in/chrisbihary/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Cyber Risk Quantification (CRQ) with Nicole Sundin
Pub date: 2023-10-11

Dale and Nicole Sundin of Axio discuss CRQ, how to deal with the precision challenge, Axio's prioritization of impact, ransomware on IT affecting operations as an example, and more.

They also discuss UX and the single pane of glass.

Links

Axio web site

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: Encore: Using Mentorship to Help Advance Your Cybersecurity Career with Susan Peterson Sturm
Pub date: 2023-10-10

Today, Derek Harp interviews Susan Peterson Sturm, the Chief Information Security Officer at Cognite.

Susan is a Transformational Operational Technology leader with 20 years of experience in profitably scaling innovative software-based businesses, including automation, IIOT, and cyber security. She has a proven track record of growing and structuring early-stage, profitable digital software-driven P&Ls in excess of $150M. She specializes in change management, product management, M&A, and strategic alliances. Susan serves on advisory boards of Cognite, Innosphere Ventures & One Warm Coat.

Susan is an incredible individual with vast experience! She’s an empath, DEI champion, mentor, board advisor, and volunteer focused on poverty alleviation.

In this episode, she discusses her background, talks to Derek about her professional journey, and offers helpful tips and advice.

You won’t want to miss this episode if you are considering a career in the cybersecurity space. Tune in to hear Susan’s fascinating story and benefit from her years of experience in the security field.

Show highlights:

Susan talks about her studies.
Her motivation for pivoting into energy after graduating from college.
What she gained from her career in international affairs.
Some of Susan’s interesting roles early on in her career.
The benefits of getting in-the-field experience.
There are many different leadership paths to be chosen within the industry.
What you can gain from working abroad with distributed teams.
Where security first intersected with Susan’s career.
Why it’s worth investing your time in networks.
How being vulnerable can help you develop valuable relationships.
The role mentorship has played in Susan’s career.
How Susan ended up in her current role as a CISO.
Motherhood can be very challenging for women in senior roles.
The importance of moving on from any workplace where you don’t feel safe to express your needs.

Links and resources:

(CS)²AI

Cognite

Susan Peterson Sturm on LinkedIn

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 379 - Cybersecurity information sharing – OT-ISAC Summit 2023 highlights
Pub date: 2023-10-08

In this interview, both John and Thian introduce the history of ISACs (formed in 1999, subsequent to the 1998 signing of U.S. Presidential Decision Directive-63), and in particular, the creation of OT-ISAC (Operational Technology Information Sharing and Analysis Centre) as one of the key trusts of the Cyber Security Agency of Singapore’s “OT Cybersecurity Masterplan 2019 to facilitate the sharing of information.

Reflecting on the journey from conceptualization to today, Thian Chin remarked that “OT-ISAC has become that safe harbour the platform for the organisations of the different parties with vested interest to different business lines come together to share, because their common goal is how do we then exchange information to reduce the risks that caused by threat actors.”

Other topics covered in the interview include:

• The types of information being shared – such as strategic threat landscape including cyber incidents and vulnerabilities, standards and best practices, and TTPs.

• Closing the cultural / communication gap between the engineers and the IT cybersecurity practitioners because “because the problem statement they're dealing with is the same. It's a threat actor out there to try to disrupt.”

• The maturing of conversations from beyond terminology such as zero trust, air gap to actual implementation

• What does success mean in information sharing - diversity of opinions – in particular, including C-suite in cybersecurity conversations, and more more stakeholders coming forward to share real-life case studies of actual incidences.

John Lee, Managing Director, Global Resilience Federation

John has more than 20 years of experiences in ICT and Information Security. He is currently the Managing Director of the Operational Technology Information Sharing Analysis Centre (OT-ISAC) that supports member organizations (public and private) in OT threat information. The centre was setup in 2019 and has members from Transport, Aviation, Maritime, Healthcare, Manufacturing, Water, Energy, Government etc. His past roles were in Information Security Governance, Risk Management, Security Operations, Infrastructure and Application Delivery. He has led teams in Asia-Pacific as well as managing global services. He is also a certified cybersecurity trainer for ISACA.

Thian Chin Lim Senior Director (Governance Group) GovTech

Thian Chin has over 20 years of experience in Information & Technology governance, risk management, resilience and compliance, and operational Technology cybersecurity.

Prior to his current appointment at GovTech, he led the Critical Information Infrastructure (CII) Division at the Cyber Security Agency of Singapore (CSA).

Before joining CSA in August 2015, he was responsible for the regional Technology Governance function in United Overseas Bank. He also led the Technology Risk function in GIC Pte Ltd from 2008 – 2013. In his earlier years, he was a manager leading a team of Information Technology auditors in Ernst & Young.

Thian Chin holds an Executive Masters in Cybersecurity from Brown University, Bachelor’s Degree in Computer Engineering from Nanyang Technological University and is an alumnus of the George C Marshall European Center for Security Studies. He is a certified CGEIT, CRISC, CISM, CISSP, CISA, CDPSE, GICSP and SABSA practitioner.

Recorded 7th Sept 2023, OT-ISAC Summit 2023, Voco Orchard, Singapore, 5pm.

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)
Episode: MITRE on Caldera for OT
Pub date: 2023-10-05

Misha Belisle and Blaine Jeffries of MITRE join the Claroty Nexus podcast to discuss Caldera for OT, a new set of operational technology plugins for the open source core Caldera adversary emulation platform. Caldera for OT supports the Modbus, BACnet, and dnp protocols, and Belisle and Jeffries hope to add future support for additional protocols. Red and purple teams may use Caldera for OT for adversary emulation in order to understand the exposure of these protocols to attacks.
Caldera for OT is available here.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Raphael Arakelian: Beyond the Tools - Maturing Implementation to Reduce Risk
Pub date: 2023-10-05

About Raphael Arakelian: Raphael Arakelian is a distinguished figure in the field of cybersecurity, serving as a manager within PwC Canada's OT & IoT cybersecurity team. With a national leadership role, he directs PwC Canada's efforts in OT monitoring implementation services, overseeing proof-of-concept evaluations and implementations across diverse industries. Raphael's unwavering commitment to securing critical infrastructure and industrial systems against cyber threats showcases his profound passion for advancing OT monitoring technology and staying at the forefront of cybersecurity innovation.

In this episode, Aaron and Raphael Arakelian discuss:

Evaluation OT security solutions beyond technological features
Maturing implementation considering technical requirements, business requirements, and organizational factors
Exploring the integration of active scanning in OT cybersecurity protocols
Achieving comprehensive OT asset management and cybersecurity monitoring
Bridging the gap between OT and cybersecurity
The evolving role of OT cybersecurity

Key Takeaways:

To build a robust OT cyber monitoring program, organizations must embrace a collective approach involving a combination of tools, people, active and passive methods, and meticulous asset inventory management to enhance their security posture in an evolving threat landscape.
In the world of OT cybersecurity, it's not enough to simply have tools; success hinges on a meticulous understanding of assets, ongoing monitoring, and a proactive approach to vulnerabilities, even if achieving 100% coverage remains elusive.
It's crucial to move beyond black-and-white thinking, embrace active scanning safely, involve vendors collaboratively, and establish hybrid roles to take ownership and advance visibility for more robust OT cybersecurity practices.
In the next 5 to 10 years, we'll witness a pivotal shift towards more comprehensive and collaborative OT cybersecurity practices, embracing advanced monitoring technologies and the active involvement of OEMs, as the critical importance of safeguarding operational technology becomes increasingly evident.

"Most of the time, it's too much of a burden to be able to take care of the technology parts, but also influence on both sides the culture to be able to have a successful OT cyber program." — Raphael Arakelian

Connect with Raphael Arakelian:

Email: raphael.arakelian@pwc.com

LinkedIn: https://www.linkedin.com/in/raphael-arakelian/

Raphael will be presenting a paper at S4 this March 2024 around active scanning of OT PLCs: https://s4xevents.com/page/4/?et_blog

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Canadian Cybersecurity Podcast
Episode: Episode 08 – Protecting Critical Infrastructure: A Guide to Operational Technology Security in Modern Environments. – With Andrew Ginter
Pub date: 2023-08-30

Andrew Ginter Andrew Ginter is renowned for his expertise in control systems and industrial cybersecurity. With a foundation laid at Hewlett Packard, he pioneered high-end control system products for the worlds largest pipelines and power grids. Transitioning into IT-OT middleware, Andrew established connections between control systems and business automation, revealing the cybersecurity implications that would […]

The podcast and artwork embedded on this page are from Daemon Behr, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: Encore: Leveraging Your Military Career to Carve Out a Cyber Security Career with Dr. Michael Chipley
Pub date: 2023-10-03

Dr. Michael Chipley, the Founder and President of the PMC Group, is the guest for today’s podcast.

Dr. Chipley has over 30 years of consulting experience in the areas of Program and Project Management, Cybersecurity, Energy and Environmental (LEED, Energy Star, and Carbon Footprint); Critical Infrastructure Protection and Analysis; Building Information Modeling (BIM) Technology; Base Realignment and Closure (BRAC), and Emergency Management/Disaster Recovery.

Dr. Chipley served 24 years as a Civil Engineer in the US Air Force and has been consulting since 2001. He is a former adjunct faculty member at George Mason University, where he taught the Infrastructure Security Engineering, Building Security, and Building Information Modeling courses.

Dr. Chipley grew up on a farm in Oregon. He is a long-time contributor to cybersecurity for control systems, civil engineer, US Airforce veteran, husband, father, grandfather, outdoor enthusiast, and wine enthusiast. He joins Derek Harp today to discuss his military background and career journey and share his insights and advice.

You will not want to miss this episode if you are leaving the military and considering a career in cybersecurity. Stay tuned to hear Dr. Chipley’s story and benefit from his breadth of experience!

Show highlights:

What Dr. Chipley did and studied during the 24 years he spent in the military.
Dr. Chipley talks about Shodan.io and what it can do.
Some advice about skills and opportunities in the control systems space.
How Dr. Chipley benefited from joining the military.
Why you can never stop learning in the control systems world.
Why women tend to excel in the cyber field.
How students can find opportunities to join internship programs.
Potential challenges that people in cybersecurity could face.
Some of the projects with which Dr. Chipley is currently involved.
What can young people do to add to their knowledge and education to increase their value five years from now?

Links and resources:

(CS)²AI

The PMC Group

Michael Chipley on LinkedIn

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Presidential Candidate Will Hurd
Pub date: 2023-10-04

Former Congressman and Presidential candidate Will Hurd is a rarity with a tech background in someone who was elected to the US Congress, and even rarer in someone running for President. Will graduated Texas A&M with Computer Science degree. Worked as a Senior Adviser to the cybersecurity company FusionX, which was acquired by Accenture. More recently he was on the board of OpenAI.

This is probably one of the most technical interviews with a Presidential candidate you will hear. Dale asks Will:

How he would rate CISA's performance (he co-sponsored the bill to create CISA)?
Does the Executive Branch have the authority required to secure critical infrastructure?
His views on Cyber Command / DoD policy of "defend forward"?
The current level of Congress's technical literacy?
What type of cybersecurity legislation, if any, Congress should pass?

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: When IT infrastructure translates into OT.
Pub date: 2023-10-04

Johnson Controls sustains cyberattack. Nearly 100,000 ICS services exposed to the Internet. FBI anticipates an increase in Chinese and Russian targeting of the energy sector. Joint advisory warns of Beijing’s “BlackTech” threat activity. CISA's push for hardware bills of materials. Cybersecurity in the US industrial base. Guest Michael Toecker, Cyber Security Advisor at the United States Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response, continues his discussion of community defense and Neighborhood Keeper. On the Learning Lab, Mark Urban is joined by Alex Baretta, a senior solution architect at Dragos, for part two of their discussion about secure remote access.

Control Loop News Brief.Homeland Security IG finds flaws in TSA pipeline security regulations.https://www.oig.dhs.gov/sites/default/files/assets/2023-09/OIG-23-57-Sep23-Redacted.pdf

https://www.cisa.gov/news-events/news/attack-colonial-pipeline-what-weve-learned-what-weve-done-over-past-two-years

Johnson Controls sustains cyberattack.Building automation giant Johnson Controls hit by ransomware attack (BleepingComputer)

Nearly 100,000 ICS services exposed to the Internet.Bitsight identifies nearly 100,000 exposed industrial control systems (BitSight)

FBI anticipates an increase in Chinese and Russian targeting of the energy sector.FBI warns energy sector of likely increase in targeting by Chinese, Russian hackers (The Record)

Joint advisory warns of Beijing’s “BlackTech” threat activity.CISA, NSA, FBI and Japan Release Advisory Warning of BlackTech, PRC-Linked Cyber Activity (CISA)

CISA's push for hardware bills of materials. Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management (CISA)

CISA task force aims to improve supply chain security with new hardware standards (Nextgov)

Cybersecurity in the US industrial base.Aprio Releases U.S. National Manufacturing Survey, Highlighting the Need for Improved Operational Excellence, Digitization and Cybersecurity Practices (Aprio)

Control Loop Interview.Guest is Michael Toecker, Cyber Security Advisor at the United States Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response, continues his discussion of community defense and Neighborhood Keeper.

Control Loop Learning Lab.On the Learning Lab, Mark Urban concludes his conversation about secure remote access with Alex Baretta, senior solution architect at Dragos.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Cybersecurity for Rail Systems - Harder than it sounds [The Industrial Security Podcast]
Pub date: 2023-10-03

From aging equipment to regulators who must approve every patch, securing safety-critical rail systems is hard, but has to be done. Miki Shifman, CTO and Co-Founder at Cylus, joins us to talk about the problem and what many owners and operators are doing solution-wise.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 97: Navigating Transportation Security: A Keynote with TSA Administrator David Pekoske
Pub date: 2023-09-26

We are excited and very grateful to have David Pekoske, the current Administrator for the Transportation Security Administration (TSA), joining us today to share a closeout keynote he recently delivered.

With a distinguished career spanning many years of dedicated service within the Coast Guard and the Department of Homeland Security, Administrator Pekoske has held various pivotal roles. Now, he stands at the helm of the Transportation Security Administration. With his wealth of experience and insights, this episode promises to offer a unique perspective on the challenges and innovations in transportation security. Stay tuned for more!

Show highlights:

What the TSA does for security beyond the aviation system
Administrator Pekoske discusses cybersecurity measures for critical infrastructure
What are the cybersecurity regulations for critical infrastructure?
The importance of cybersecurity and the need for a coordinated response to cyber attacks
Which measures have been put in place for cybersecurity in the transportation sector?
Cybersecurity regulations and compliance
Which cybersecurity measures in place for critical infrastructure?
What should the regulator have a basic understanding of and be willing to do to achieve their goals?
How insider threats within the aviation industry
Cybersecurity and workforce development in the aviation industry
Options for cybersecurity careers in the government and private sectors

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

David Pekoske on LinkedIn

TransportationSecurity Administration (TSA)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Jonathan Tubb: Unlocking Business Value at the Intersection of IT, OT, Operations, and Cybersecurity
Pub date: 2023-09-28

About Jonathan Tubb: Jonathan Tubb is a seasoned cybersecurity expert, renowned for his proficiency in crafting innovative solutions to address the most pressing security issues in the power generation sector. With a background in Computer Engineering from Ohio State University and a Professional Engineer (P.E.) license, he has over 15 years of hands-on experience. Currently serving as the Director of Industrial Cyber and Digital Security at Siemens Energy, Inc., Jonathan also imparts his knowledge as a lecturer for a master's course in Operational Technology Cyber Security at Duke University's Pratt School of Engineering.

In this episode, Aaron and Jonathan Tubb discuss:

Navigating the evolving landscape of OT cybersecurity
Implementing cybersecurity measures for small modular reactors in the energy industry
Cross-disciplinary expertise in OT cybersecurity and the need for specialized training programs
The future of IT-OT convergence

Key Takeaways:

In the evolving landscape of industrial cybersecurity, the shift from minimal compliance to recognizing the real-world impact and the urgent need for cross-training in IT and OT is crucial to bridging the knowledge gap and securing critical infrastructure effectively.
As the energy industry progresses with new technologies like small modular reactors, the existing regulatory frameworks and cybersecurity practices face challenges in adapting to these changes, highlighting the need for flexible and scalable cybersecurity solutions in critical infrastructure.
In the complex world of OT cybersecurity, the key to success lies in having the right people with a deep understanding of both engineering and cybersecurity, bridging the gap between the two worlds to protect critical infrastructure and ensure reliability in an ever-evolving landscape.
The future of IT/OT convergence holds both excitement and concern, as the integration of these systems could lead to unprecedented efficiencies and insights, but a heavy-handed approach may risk pulling the plug on progress, hindering the potential benefits for both cybersecurity and operations.

"I hope that the outcome of all this is positive for both sides of the industry, for practitioners, for the business side, like I see a destination where cybersecurity and operations are holding hands, skipping through a field." — Jonathan Tubb

Connect with Jonathan Tubb:

Email: jonathan.tubb@gmail.com

LinkedIn: https://www.linkedin.com/in/jonathan-tubb

Hackers Teaching Hackers Event: https://www.hthackers.com

GridSecCon 2023: https://www.nerc.com/pa/CI/ESISAC/Pages/GridSecCon.aspx

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: HouSecCast
Episode: HOU.SEC.CON Part 2 with Thomas Pace
Pub date: 2023-09-27

We’re just over 2 weeks away from this year’s conference and we’re bringing you another episode featuring one of our upcoming speakers, Thomas Pace! Tom chats with Michael and Sam about the relevance of college degrees in the cybersecurity industry, the big gap he saw in industrial control systems leading to the founding of Netrise, building a start-up in the middle of a global pandemic, and of course his upcoming talk. He’s developed a part 2 to last year’s very popular talk “The Vulnerability Disparity of ICS and OT Devices – There are many more than we think!”.

Things Mentioned:

You can read the article “Experiment: IT Companies Eager to Hire Self-Taught Pros” here
You can read the article “Apple CEO Tim Cook explains why you don’t need a college degree to be successful” here
You can find conference logistics here
You can find Tom’s talk from last year here
Tickets are sold out!

Do you have a question for the hosts? Reach out to us at podcast@houstonseccon.com

Keep up with HouSecCon

LinkedIn
Twitter
Facebook
Instagram
Threads

In this episode:

Host: Michael Farnum
Host: Sam Van Ryder
Guest: Thomas Pace
Editing by: Lauren Lynch
Music by: August Honey

Check out our other show:

CyberSunday

The podcast and artwork embedded on this page are from Michael Farnum and Sam Van Ryder, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Dadi Gertler ED of Tech Systems @INCD & Yuval Segev CISO @AIDOC on cyber methodology & technology
Pub date: 2023-09-28

Nachshon Pincu hosts Dadi David Gertler, Executive Director of Technology Systems at the Israeli National Cyber Directorate (INCD), Yuval Segev CISO at AIDOC Medical, and the Head of the cyber forum of the Israeli Directors' Union, former Director of advance technology at INCD in a conversation about cyber defense methodology and technology.How do you turn cyber defense methodology into a comprehensive one?

"Cyber intelligence" is a well-known service used mainly by large companies (sometimes out of a regulatory requirement). These are significant costs, but this is a considerable need for the organization's cyber protection. Help me convince CISOs and managers of the importance of the issue.

As you know, my motto is "Cyber protection is not technology." Cyberdefense technology is one of the last steps in the process. How do you cop with that say?

The million-dollar question is, how do you choose cyber defense technology, and what are the criteria?

We cannot ignore the Baz of AI, and there is a lot of talk about the subject and apocalyptic theories. How do you see it?

We are at the end of the third quarter of 2023. Please address where we head in cyber protection in the operational environments, emphasizing cloud connections under Industry 4.0 and vendors' push to IT-OT Convergence.

נחשון פינקו מארח את דדי דוד גרטלר, דירקטור בכיר למערכות טכנולוגיות במערך הסייבר הלאומי ואת יובל שגב סיסו בבי.אי דוקס וראש פורום הסייבר באיגוד הדירקטורים הישראלי, לשעבר דירקטור טכנולוגיות מתקדמות במערך הסייבר בשיחה על מתודולוגיות וטכנולוגיות להגנת סייבר

איך הופכים מתודולוגיית ליישום בהגנת סייבר

"מודיעין סייבר" הוא שירות מוכר המשמש בעיקר חברות גדולות (לעיתים מתוך דרישה רגולטורית). מדובר בעלויות משמעותיות, אך מדובר בצורך ניכר להגנת הסייבר של הארגון. עזרו לי לשכנע סיסויים ומנהלים בחשיבות ונחיצות הנושא

כידוע, המוטו שלי הוא "הגנת סייבר היא לא טכנולוגיה". טכנולוגיות סייבר הן אחד השלבים האחרונים בתהליך. איך אתם רואים את האמירה הזאת

שאלת מיליון הדולר היא, איך בוחרים בטכנולוגיית הגנת סייבר, ומהם הקריטריונים

אי אפשר להתעלם מהבז של ההי.אי. יש הרבה תיאוריות אפוקליפטיות, איך אתם מתייחסים לנושא

אנחנו בסוף הרבעון השלישי של 2023. אנא פנינו מועדות בהיבטים של הגנת סייבר בסביבות התפעוליות עם דגש על חיבורי ענן תחת תעשייה 4.0 ודחיפה של היצרנים להתכנסות אי.טי. ואו.טי

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Risk Management Podcast (LS 34 · TOP 3% what is this?)
Episode: EP 141: What's New in NIST CSF v2
Pub date: 2023-09-26

What’s going to be in version 2 of the NIST Cybersecurity Framework? Let's find out with your hosts Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

The podcast and artwork embedded on this page are from Kip Boyle, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 59 - ICS Security em geral
Pub date: 2023-09-21

Entre em contato com a Munio Security:

contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: ICS Security - Q3 In Review
Pub date: 2023-09-27

Patrick Miller of Ampere Industrial Security joins Dale to discuss the three big stories of the quarter and give their win, fail and prediction.

Stories

US National Cybersecurity Strategy Implementation Plan + CISA 2024-2026 Strategic Plan
The cybersecurity / OT cybersecurity vendor market news. We just had Cisco buy Splunk, plus the Dragos "extension", and SCADAfence selling to Honeywell. Seems like some tough times.
Ransomware again … Port of Nagoya, Clorox, hospitals, CISA Ransomware Vulnerability Notification Service

Links

S4x24 Ticket Sales
Ampere Industrial Security
Critical Assets Podcast

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 58 - Gestão de Riscos em Infraestrutura Crítica
Pub date: 2023-09-21

Entre em contato com a Munio Security:

contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Government Information Security Podcast (LS 27 · TOP 10% what is this?)
Episode: Inside Look: FDA's Cyber Review Process for Medical Devices
Pub date: 2023-09-29

Medical device makers in their premarket submissions to the Food and Drug Administration under the agency's new "refuse to accept" policy for cybersecurity should pay close attention to details such as a product's software bill of materials and vulnerability management, said Jessica Wilkerson of FDA.

The podcast and artwork embedded on this page are from GovInfoSecurity.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 96: Exploring the Depths of Industrial Cybersecurity with Joe Weiss: A Legendary Return to the Podcast
Pub date: 2023-09-19

Derek is thrilled to have a true industry legend returning to the podcast today!

Joe Weiss, the Managing Partner at Applied Control Solutions LLC, initially appeared on the show in episode 61. If you have not already done so, you can listen to that episode to learn more about his biography and personal journey.

Joe's reputation in the industry precedes him, as he is among the select few who can honestly claim to have dedicated more time and expertise to the field of cybersecurity field than almost anyone else. His career includes tenures at renowned organizations, and he is the curator of one of the world's largest incident databases.

As in the words of Paul Simon, there have been incidents, accidents, hints, and allegations, and Joe Weiss has been at the forefront of understanding and dissecting all of those challenges. Join us for a thought-provoking episode where we dive into the complexities of cyber incidents, attribution, and the ever-evolving landscape of industrial security.

You are in for an enlightening conversation today, so stay tuned for more!

Show highlights:

The story of how Joe started his database
Cybersecurity in the context of nuclear safety and control systems
Joe discusses his database of incidents, explaining how it provides valuable insights into the history of cybersecurity incidents.
Control system cybersecurity incidents and their causes
Cybersecurity threats and vulnerabilities in industrial control systems
The importance of securing sensors and actuators in industrial control system
Why do engineers need training on policies and procedures to address security concerns with field devices?
Security issues within the industry
Joe shares his frustration with the lack of progress in IoT security.
Ways to live with insecure systems and even turn them into money-making machines for end users
Why is Joe calling for a holistic approach to control systems?

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Joe Weiss on LinkedIn

Applied ControlSolutions LLC

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 57 - ENERGY SEC
Pub date: 2023-09-21

Entre em contato com a Munio Security:

contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Josh Varghese: Holistic, Scalable OT Network Design
Pub date: 2023-09-21

About Josh Varghese: Josh Varghese, founder of Traceroute, is a seasoned industrial networking expert who has dedicated himself to serving the dynamic industrial/OT market. With nearly a decade of experience as a technical lead at Industrial Networking Solutions, where he established their technical support and application engineering department, Josh cultivated a deep understanding of the industry. He now leads Traceroute, offering a comprehensive suite of services including consulting, design, solution architecture, and more, while maintaining invaluable relationships with clients and vendors forged during his career.

In this episode, Aaron and Josh Varghese discuss:

Navigating vendor dependence and networking complexity in industrial environments
Overcoming resistance to technology advancements in industrial settings
The challenges of IT-OT convergence and the importance of OT knowledge transfer
The importance of empathy and collaboration in an SDN-driven future

Key Takeaways:

In the world of industrial networking, the critical importance of bridging the gap between vendors, asset owners, and complex OT environments becomes glaringly evident, as a lack of expertise and responsibility often leads to network disasters and production outages, emphasizing the need for specialized support and education in this field.
Getting burned by poorly configured solutions in the industrial technology realm has led to a reluctance to embrace advancements; however, with proper configuration and understanding, these advancements can be highly beneficial.
Bridging the gap between IT and OT, and improving basic understanding of network concepts, is crucial for overcoming resistance to new technology adoption and ensuring operational resilience in a world where automation and physical processes intersect in every aspect of business.
In the evolving landscape of IT and OT collaboration, the key to success lies in fostering understanding, empathy, and effective communication between the two sides, rather than imposing complexity or hierarchies, while emerging technologies like SDN offer promise but must address the challenge of simplifying network management in the OT space.

"So much of what has happened in the last five to ten years in our space has been around wanting to look at lateral traffic movement or visibility to more traffic. And it's all been very difficult to accomplish because the architecture and the technology available in traditional networking makes it so. You and I have talked about wanting to fast forward to a scenario with sensors in the switch, full visibility, and all this stuff. SDN gets us there like in the snap of a finger." — Josh Varghese

Connect with Josh Varghese:

Website: www.traceroutellc.com

Email: josh@traceroutellc.com

LinkedIn: https://www.linkedin.com/in/varghesejm

Traceroute’s OT networking training in Dallas-Fort Worth on February 8-9, 2024:

https://www.traceroutellc.com/s/Traceroute-DFW-Training-Flyer.pdf

The best (or arguably “worst”) kept secret in OT networking is Software Defined Networking: https://www.linkedin.com/posts/varghesejm_industrialnetworking-otnetworking-otsdn-activity-6963503182421377024--52t/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: 401 Access Denied (LS 34 · TOP 3% what is this?)
Episode: 401 Access Denied Podcast Ep. 89 | Smart Hacking with Ken Munro
Pub date: 2023-09-20

Hear how hackers target everything from airplanes to talking dolls. Pen testing expert Ken Munro discusses ways to close security gaps and protect embedded systems and connected devices.

Connect with Ken Munro:

Ken Munro on LinkedIn

Twitter: @TheKenMunroShow

Connect with Delinea:

Delinea Website

Delinea LinkedIn

Delinea Twitter

Delinea Facebook

Delinea YouTube

The podcast and artwork embedded on this page are from Delinea, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 34 · TOP 5% what is this?)
Episode: Dale Peterson On The Sunspace Alliance Webinar
Pub date: 2023-09-20

Dale Peterson was recently interviewed by Jay Johnson of Sandia and Tom Tansy of the Sunspec Alliance as part of their distributed energy resources (DER) Sunspec webinar series. We covered a lot of issues and Dale was not shy in throwing out some analysis and opinions. After 5 minutes discussing the S4x24 ticket process, the topics discussed: * How DER will deal with the complex, large number of users and stakeholders PKI environment. * The Sunspec device security specification and the benefits of a limited, key set of security controls. * What is the role of government regulation to solve DER security issues? * The potential power of the utility companies to levy requirements and be a choke point for access. * The Patch Act, FDA and DER. * shift left and product liability due to security flaws * and more

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 56 - Erradicação de Riscos na OT.
Pub date: 2023-09-20

Entre em contato com a Munio Security:

contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Don't take energy for granted.
Pub date: 2023-09-20

Redfly cyberespionage targets a national grid. DHS Threat Assessment looks at critical infrastructure threats. A look at the ICS threat landscape. DoE grants for research into distributed energy cybersecurity. CISA offers free vulnerability scanning for water infrastructure. CISA issues ICS advisories. Guest Michael Toecker, Cyber Security Advisor at the United States Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response, discusses community defense. On the Learning Lab, Mark Urban is joined by Alex Baretta, a senior solution architect at Dragos, for part one of their discussion about secure remote access.

Control Loop News Brief.Redfly cyberespionage targets a national grid.Redfly: Espionage Actors Continue to Target Critical Infrastructure (Symantec)

China caught – again – with its malware in another nation's power grid (The Register)

China-Linked Hackers Breached a Power Grid—Again (WIRED)

DHS Threat Assessment looks at critical infrastructure threats.DHS warns of malicious AI use against critical infrastructure (CyberScoop)

A look at the ICS threat landscape.Threat landscape for industrial automation systems. Statistics for H1 2023 (Kaspersky)

DoE grants for research into distributed energy cybersecurity.Distributed Energy Resources Get Cybersecurity Boost With $39M DOE Funding (SecurityWeek)

DOE Announces $39 Million in Research Funding to Enhance Cybersecurity of Clean Distributed Energy Resources (Department of Energy)

Ransomware remains a threat to industrial operations.Massive MGM and Caesars Hacks Epitomize a Vicious Ransomware Cycle (WIRED)

US-Canada water org confirms 'cybersecurity incident' after ransomware crew threatens leak (Register)

CISA offers free vulnerability scanning for water infrastructure.Free Cyber Vulnerability Scanning for Water Utilities (CISA)

Control Loop Learning Lab.On the Learning Lab, Mark Urban discusses secure remote access with Alex Baretta, senior solution architect at Dragos.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 55 OT Network Architecture
Pub date: 2023-09-20

Entre em contato com a Munio Security:

contato@muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CYBER LIFE (LS 24 · TOP 10% what is this?)
Episode: Cyber Life Podcast Ep.4 - Big Mac Attack - Cybersecurity and Food Safety with Kristin Demoranville
Pub date: 2023-09-20

In this episode, we dive into the crucial relationship between food safety and cybersecurity with Kristin Demoranville.

It's important to recognize that the food industry encompasses everything from agriculture and food production to distribution and beyond.

This combination of cybersecurity with food safety ensures not only the protection of digital assets but also the safety and security of the food supply chain from production to delivery.

One of the key takeaways from our conversation is the importance of awareness and education. We need to make cybersecurity an integral part of the food protection culture. Just as we've learned to stop, drop, and roll in case of fire, we should aim for a similarly straightforward and universally understood approach to food safety and cybersecurity.

Kristin has a new podcast called Bites & Bytes Podcast launching soon that you can listen to at the link below.

https://www.anzensage.com/BitesandBytesPodcast

*Disclaimer: I may earn a few dollars from affiliate links in this description.

Learn Cybersecurity skills by playing in the Haiku game.

https://get.haikuinc.io/crk0rg6li6qd

If your team needs cybersecurity-skill training, StationX offers a robust catalog of cybersecurity training.

Learn more here: https://www.stationx.net/cyberlife

Cybersecurity in food industry, Food safety breaches, Cyber threats to food supply, Secure food supply chain, Food safety data protection, Cybersecurity for food processing, Food safety risk assessment, IoT in food safety, Cybersecurity for agricultural systems, Food safety traceability, Blockchain for food security, Food safety and digitalization, Cyber-physical food safety, Food safety incident response, Threats to food safety systems, Food supply chain resilience, Cybersecurity for food distribution, Food safety compliance and cyber risks, Data privacy in food safety, Food safety audit cybersecurity

Support this podcast at — https://redcircle.com/cyber-life/donations

The podcast and artwork embedded on this page are from Ken Underhill, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Cyber regulation Follow-up: Danny Lacker IL Water Auth. & Yossi Shavit MIN. Environmental Protection
Pub date: 2023-09-19

Nachshon Pincu hosts a two-year follow-up interview with Israel's most active cyber regulators, Danny Lacker, Head of Water Emergency & Cyber Security at Israel Water Authority, and Yossi Shavit, Head of ICS Cyber Security Department at the Ministry of Environmental Protection.

We last met on the podcast at the end of July 2021. Since then, there have been many changes in the cyber world. Today, we are much more mature in understanding the protection of critical infrastructures and factories with hazardous materials. Where do we stand today?

The program to enforce cyber regulation on factories entered a high stage. Today, your unit controls hundreds of factories. Do you see changes in factories' mental treatment of the cyber issue?

Implementing the required regulation for the water sector without stinging sanctions is difficult. How do you cope?

What is happening in the world regarding cyber regulations for the water sector?

The world is moving, and it seems that the connection of the OT to the Internet is inevitable and will be called at one point or another, whether it is necessary to change the existing regulation and how to continue protecting critical assets in the factory, especially for hazardous materials?

I see a lot of activity in increasing awareness of cyber risks with the water corporations. Do you feel that the ice is breaking and that the corporations are starting to respond?

SOC, Crisis management, and Incident Response (IR) are the three 2023 trends. Where do we find your units with those issues?

We cannot escape the topic of AI and the need to invest thought in assessments for the massive entry of AI-based technologies or the use of end users in technologies without understanding the risks. How do you plan to deal with this issue?

נחשון פינקו מארח ראיון המשך לאחר שנתיים עם רגולטורי הסייבר הפעילים ביותר בישראל, דני לקר, ראש תחום חירום מים ואבטחת סייבר ברשות המים, ויוסי שביט, ראש מחלקת אבטחת סייבר למערכות תפעוליות במשרד להגנת הסביבה

נפגשנו בפעם האחרונה בפודקאסט בסוף יולי 2021. מאז חלו שינויים רבים בעולם הסייבר. כיום, אנחנו הרבה יותר בשלים בהבנת ההגנה על תשתיות קריטיות ומפעלים עם חומרים מסוכנים. איפה אנחנו עומדים היום

התוכנית לאכיפת רגולציית סייבר על מפעלים נכנסה לשלב גבוה. כיום, יחידת הסייבר של משרד לאיכות הסביבה מטפלת כבר במאות מפעלים. האם אתה רואה שינויים בהתייחסות של המפעלים לנושא הסייבר

יישום הרגולציה הנדרשת למשק המים ללא סנקציות עוקצניות, קשה. איך מתמודדים? ומה קורה בעולם לגבי תקנות סייבר למשק המים

העולם זז, ונראה שהחיבור של המערכות תפעוליות לאינטרנט הוא בלתי נמנע ויקרה בשלב זה או אחר, האם יש צורך לשנות את הרגולציה הקיימת וכיצד להמשיך להגן על נכסים קריטיים במפעל, במיוחד עבור חומרים מסוכנים

אני רואה פעילות רבה בהגברת המודעות לסיכוני סייבר מול תאגידי המים. אתה מרגיש שהקרח נשבר ושהתאגידים מתחילים להגיב

סוק, ניהול משברים ותגובה לאירועים הן שלושת המגמות של 2023. איפה אנחנו מוצאים את היחידות שלכם בנושאים האלו

אנחנו לא יכולים לברוח מהנושא ההי.אי. והצורך להשקיע מחשבה בהערכות לכניסה מאסיבית של טכנולוגיות מבוססות אינטליגנציה מלאכותית או שימוש של משתמשי קצה בטכנולוגיות מבלי להבין את הסיכונים. איך אתם מתכננים להתמודד עם הנושא הזהו

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Michal Geva: Securing OTA
Pub date: 2023-09-19

We sat down with Michal Geva, General Manager, OTA and Cybersecurity at HARMAN International to discuss trends in automotive cybersecurity and OTA cybersecurity. Michal also discussed supply chain cybersecurity, EVs and provided her tips for women in cybersecurity roles.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Demystifying Cyber Jobs - In the Energy Sector [The Industrial Security Podcast]
Pub date: 2023-09-18

Job seekers say there are no OT security job postings. Hiring managers say nobody is applying to their posts. Amanda Theel and Eddy Mullins of Argonne National Labs walk us through recruiting issues, especially for fresh grads.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 29 · TOP 10% what is this?)
Episode: Fred Gordy: Protecting the Safety and Resilience of the Buildings We Live and Work In
Pub date: 2023-09-14

About Fred Gordy: Fred Gordy is a pioneering figure in the SmartBuilding industry, with two decades of expertise in developing and implementing secure control systems for Fortune 500 companies across the globe. A trailblazer in addressing the inherent cybersecurity risks posed by control system technology, he has authored over 100 articles on building control cybersecurity, with his insights featured in prominent publications like the Wall Street Journal, CNBC, and healthcare journals. Fred's extensive knowledge and commitment to the field have led him to develop cutting-edge control system cybersecurity assessment methodologies and tools, while also serving as a technical advisor on various industry boards and holding multiple certifications in control technology.

In this episode, Aaron and Fred Gordy discuss:

The critical intersection of convenience and cybersecurity in modern infrastructure and control systems
Building cybersecurity certifications and their impact on commercial real estate
Overcoming cultural barriers in implementing cybersecurity measures for critical infrastructure
The importance of people-centered approaches in business and cybersecurity

Key Takeaways:

In the ever-evolving world of technology and cybersecurity, the importance of resilience and adaptability shines through, reminding us that regardless of the specifics, whether it's elevators, critical infrastructure, or complex IT systems, preparedness and proactive action matter most when unexpected challenges arise.
Achieving bronze, silver, or gold certification levels is all about tailoring your security measures to the criticality of your building, ensuring that you're prepared to safeguard your occupants and assets accordingly, whether you're running a standard commercial office space or housing national security agencies.
In building cybersecurity, addressing the foundational questions of what you have, how it's connected, and who has access is crucial to building trust and resilience, even if it means challenging established cultural norms and embracing new technologies.
Embrace the power of compromise and understanding, for it's not about being right or wrong, but about collectively navigating the complex landscape to reach our desired destination, one step at a time, even as new technological challenges loom on the horizon.

"In the IT world, everything is CIA: confidentiality, integrity, and availability. In our world, you know, availability's number one. So confidentiality was never taken into account. So now you've got all of these systems being connected together as highly available as possible." — Fred Gordy

Connect with Fred Gordy:

Website: https://mbakerintl.com/en/

Email: fred.gordy@mbakerintl.com

LinkedIn: https://www.linkedin.com/in/fredgordy/

Twitter: https://twitter.com/FGordy

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code (LS 25 · TOP 10% what is this?)
Episode: EP 22: Applying Zero Trust to OT Systems
Pub date: 2023-09-12

How might we mitigate the risk to millions of unauthenticated devices already out in the field? Ron Fabela, Field CTO at XONA Systems, has some ideas about how to achieve zero trust in either legacy or new OT systems. Really, it’s just a matter of reducing the attack surface.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 95: Exploring the Tech Odyssey: A Conversation with Ron Gula, Co-Founder of Tenable
Pub date: 2023-09-12

Derek is delighted to welcome Ron Gula of Gula Tech Adventures and Co-Founder of Tenable as the guest for today’s show! His name is synonymous with innovation and expertise, and many listeners are bound to recognize the companies he has either birthed or influenced.

Ron is originally from upstate New York. He was born in Rochester, grew up in Syracuse, and went to Clarkson University. He has had a multifaceted background and has worn many hats throughout his career. First and foremost, he is a technologist, with his roots tracing back to his formal training as an electrical engineer. He is also a programmer, founder, and CEO.

Beyond his professional accomplishments, Ron is a military veteran after serving in the United States Air Force. He is a husband, father, podcasting enthusiast, masterful 3D animator, and scuba diver. He also indulges in cigar appreciation, holds roles as an investor, advisor, and board member across diverse ventures, and is a passionate champion of philanthropy.

Today's conversation promises to be enlightening and inspiring! Stay tuned as we delve into the multifaceted tapestry of Ron's life and myriad experiences!

Show highlights:

How Ron became a hacker
One of Ron’s worst experiences
The importance of understanding the mission of a company
Ron talks about Dragon, network security, and how Dragon got acquired by another company
Ron shares his motivation for starting his business and explains how he did it
Ron shares his advice for doing a startup
How Ron and his business partner co-founded Tenable
Why Ron called his company Gula Tech Adventures
What they do at Gula Tech Adventures

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Ron Gula on LinkedIn

Gula Tech Adventures

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Yosi Shneck Founder & CEO @YSICONS ex ICT SVP @ECI on OT CyberSec defense in critical infrastructure
Pub date: 2023-09-12

Nachshon Pincu hosts Yosi Shneck, Founder and CEO at YSICONS company, former Head of cyber Entrepreneurship and BIZ DEV, and SVP for information and communication technologies at Israel Electric Corporation (IEC) in a conversation about critical infrastructure cyber defense for systems that are 50 years old, build synergy between IT and OT cyber teams.

As a senior manager and one of the first to deal with cyber defense for critical infrastructures in the most significant infrastructure in Israel, what was the approach to cyber defense in such a conglomerate?

The OT world of an electricity company includes systems that are 50 years old or older without Cybersecurity in the planning and execution considerations. How can we protect and control planets that did not have "cyber by design" and without supporting cyber OT technologies?

What is the importance of divisional integration within the cyber IT and OT organizations?

You said the readiness is a matter for the whole company. Awareness alone is not enough. It also requires cyber knowledge, so every employee should be a cyber specialist?

The electric company is subject to many regulators (as many as 23). How do you enable practical progress in the face of so much regulation?

How do you perceive the role of CISO in the organization and not necessarily at the electric company?

You have proven there is room for business innovation, even in a company like IEC. How do you create an innovative business environment in a traditional corporation?

Tell us a little about your activity today at YSICONS.

נחשון פינקו מארח את יוסי שנק, מייסד ומנכ"ל חברת וי.אס.איקונס, לשעבר ראש תחום יזמות סייבר ופיתוח עיסקי וסמנכ"ל בכיר לטכנולוגיות מידע ותקשורת בחברת החשמל, בשיחה על הגנת סייבר בתשתיות קריטיות לעיתים בנות חמישים שנה. איך בונים סינרגיה בין צוותי סייבר של מערכות מידע ותשתיות קריטיות ואיך יוצרים "מוכנות" סייבר

כמי שהיה מנהל בכיר ומהראשונים להתמודד עם נושא הגנת סייבר לתשתיות קריטיות בגוף התשתיות הגדול בישראל, איך ניגשים בכלל להגנת סייבר בכזה קונגלומרט

המערכות התפעוליות של חברת חשמל כוללות מערכות בנות חמישים שנים ויותר כמו תחנת הכוח בחדרה שהוקמה בשנות השיבעים של המאה הקודמת, הגנת סייבר לא נלקחה בשיקולי התכנון והביצוע, איך מייצרים הגנה ובקרות במקום שלא תוכנן לסייבר וללא טכנולוגיות תומכות

עמלת רבות על ביצוע אינטגרציה ושת"פ חטיבתי בין ארגוני הסייבר למערכות המידע והמערכות התפעוליות, מה הייתה התבונה שהובילה אותך למהלך הזה

דיברנו על השקעה במוכנות ואמרת שזה עניין של כול החברה, מודעות בלבד אינה מספיקה אלא מחייבת גם ידע בסייבר, אז כול עובד צריך להיות סייבריסט

חברת החשמל כפופה לכמות עצומה של רגולטורים, כמדומני 23 ,איך מאפשרים התקדמות מעשית מול כול כך הרבה רגולציה

איך אתה תופס את תפקיד הסיסו בארגון ולאו דווקא בחברת החשמל

הוכחת שגם בחברה גדולה ומסורתית כמו חברת החשמל יש מקום להרבה חדשנות עסקית. נזכיר את סייברג'ים, חברת תקשורת הסיבים, מכירת עפר פחם והרשימה עוד ארוכה. איך מייצרים סביבה עסקית חדשנית בגוף מסורתי

ספר לנו קצת על הפעילות שלך היום ב וי.אס.איקונס, היות וכרגיל אתה לא נח על זרי הדפנה

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Jim LaBonty on the OT Security Stack
Pub date: 2023-09-10

Retired Pfizer Chief Information Security Officer Jim Labonty joins the podcast to discuss the operational technology (OT) security stack, and how it differs from IT. This episode provides especially important for the growing number of security leaders who are newly responsible for OT cybersecurity and the safety of cyber-physical systems.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Esti Peshin VP & GM @Cyber Division IAI-ELTA on cyber in aviation state CERTs and the love of flight
Pub date: 2023-09-07

Nachshon Pincu hosts Esti Peshin, VP and General Manager of the Cyber Division at IAI-ELTA, in a conversation about cybersecurity trends, cyber aviation challenges, and protection of state critical infrastructures.

What are the cyber trends and the assessments required?

On AI, we hear a lot of prophecies and, unfortunately, quite a bit of disinformation. Can you please make some order for us?

Cyber protection in the aviation industry came into our awareness years ago after white hacker Chris Roberts broke into airplane systems during a flight. Let's start with the challenges facing those in charge of cyber protection for civilian aircraft.

The regulation in the aviation industry is very tight. In the cyber issue, what are the trends of the regulatory bodies in Europe and the USA on this issue?

Elta's cyber division provides systems to manage cyber risks and alerts at the country level. What are the primary defenses between SOC at the country level and SOC for a company?

From where came the passion for flight and becoming a pilot?

נחשון פינקו מארח את אסתי פשין, סמנכ"לית באלתא-תעשייה אווירית ומנכ"לית חטיבת הסייבר בשיחה על מגמות אבטחת סייבר, אתגרי סייבר בתעופה והגנת סייבר ברמת מדינה מהן מגמות הסייבר העתידיות ומה היא ההערכות הנדרשות

נושא האינטלגנציה המלאכותית, אנחנו שומעים הרבה נבואות זעם ולמרבה הצער גם לא מעט דיסאינפורמציה. את יכולה בבקשה לעשות לנו קצת סדר

הגנת הסייבר בתעשיית התעופה הגיעה למודעות שלנו לפני שנים לאחר שההאקר הלבן כריס רוברטס פרץ למערכות מטוסים במהלך טיסה. מה הם האתגרים העומדים בפני האחראים על הגנת סייבר למטוסים אזרחיים

הרגולציה בענף התעופה מאוד הדוקה ואני מניח שגם בסוגיית הסייבר, מהן המגמות של הגופים הרגולטוריים באירופה ובארה"ב בנושא זה

חטיבת הסייבר של אלתא מספקת מערכות לניהול סיכוני סייבר והתראות ברמת המדינה. מה ההבדלים המרכזים בין סוק ברמת מדינה לבין סוק עבור חברה

מהיכן הגיע התשוקה לטיסה ולהיות טייסת

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Matthew Scott: Protecting Legacy OT in Mass Transit
Pub date: 2023-09-07

About Matthew Scott: Matthew Scott is a technical leader with over three decades of experience in industrial automation, specializing in the design, deployment, and maintenance of cutting-edge SCADA systems across critical infrastructure sectors such as transit, oil & gas, energy, and water/wastewater. His expertise spans a wide range of hardware and software platforms. A trailblazer in cybersecurity, Matthew's contributions extend beyond his role as an OT security professional, as he has authored peer-reviewed publications and presented at technical conferences. With a commitment to fostering innovation and promoting a "Fail Fast, Fail Forward" ethos, he leads cross-functional teams in the development of secure and resilient industrial control solutions that ensure the reliable delivery of essential services.

In this episode, Aaron and Matthew Scott discuss:

Implementing security by design in legacy industrial control systems
Enhancing OT cybersecurity through code quality and dynamic rule sets
A step-by-step approach to improve cybersecurity and system resilience
Balancing regulations and technological advancements in OT cybersecurity

Key Takeaways:

The crucial strategy for securing OT involves a holistic approach, combining identification of exploits, rule creation, and integrated defensive programming within system design to counter malicious actions and ensure process reliability and security, moving beyond mere patching or hardware replacements.
In the rapidly evolving landscape of OT cybersecurity, the fundamental importance of well-disciplined code and comprehensive input validation is resurfacing as a potent strategy, enabling organizations to proactively mitigate a substantial portion of vulnerabilities and exploits, with the potential for machine learning to dynamically adapt and reinforce security measures over time.
Recent progress in system security has shifted from insecure designs to security-focused thinking, bolstering code against vulnerabilities in complex environments, yet the challenge remains in safeguarding legacy systems and maintaining uniform standards.
Amidst the focus on looming threats, the key lies in addressing foundational cybersecurity concerns, highlighted by upcoming regulations for industrial control systems, while cautioning against prioritizing advanced tech over resolving core technical issues.

"I don't necessarily see that AI is gonna make malicious actors more prevalent and more powerful. But I think we're gonna see the emphasis move to that. So until we have a regulation that forces us to clean up our code and be disciplined, we're gonna see organizations go out and spend money." — Matthew Scott

Triton Malware Exploited Zero-Day in Schneider Electric Devices: https://www.securityweek.com/triton-malware-exploited-zero-day-schneider-electric-devices/

Connect with Matthew Scott:

Learn how to protect your ICS with PLC defensive programming techniques! Join Matthew and his colleague Tyler Lentz at the INCOSE Western States Regional Conference: https://www.pnnl.gov/events/incose-western-states-regional-conference

Website: https://plc-security.com/

Email: mjs672@nau.edu

LinkedIn: https://www.linkedin.com/in/matthew-j-scott-mcit/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Cyber-Physical Attacks with Marina Krotofil
Pub date: 2023-09-06

Marina Krotofil recently published the paper Industrial Control Systems: Engineering Foundations and Cyber-Physical Attack Lifecycle which is a detailed paper on cyber attacks that cause a physical impact on the system being monitored and controlled. It took Marina 1.5 years to write this paper, which is more accurately described as a short book. We discuss:

the work she is doing to help Ukrainian critical infrastructure security during wartime
what got Marina interested in cyber-physical security 10+ years ago
the current understanding of cyber-physical in the OT security community
Chapter 2: Engineering Foundations as a great intro for those in IT to understand basic automation principles
Chapter 3: Very detailed explanation of a specific process (we don't spend much time on this)
The Cyber-Physical Attack Lifecycle with emphasis on the Damage Loop. "Plant shutdown is risky for the attacker as it may instigate an investigation"
Chapter 4.6 is a great conclusion

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Intelligence services within the convergence of OT and IT.
Pub date: 2023-09-06

Crude "cyberattack" on rail control systems stops Polish trains. Energy One discloses cyberattack against its corporate systems. NIAC calls for a National Water Strategy. Department of Energy holds contest to provide cybersecurity funding for rural utilities. Researchers aim to secure US military’s power grids. A technical issue grounds the UK’s air traffic control system’s automated features. Guest Mark Ryland, Director of the Office of the CISO at Amazon Web Services, joining us as part of a Dragos webinar, Securing Digital Transformation: OT Cybersecurity Innovation and Resilience. On the Learning Lab, Mark Urban is joined by Dragos Vice President of Product Management Kimberly Graham in part three of their discussion on the convergence of OT and IT.

Control Loop News Brief.Crude "cyberattack" on rail control systems stops Polish trains.Two Men Arrested Following Poland Railway Hacking (SecurityWeek)

Century-old technology hack brought 20 trains to a halt in Poland (Cybernews)

Poland investigates hacking attack on state railway network (Reuters)

Poland investigates train mishaps for possible Russian connection (Washington Post)

Energy One discloses cyberattack against its corporate systems.Australian Energy Software Firm Energy One Hit by Cyberattack (SecurityWeek)

US energy company suffers third-party data breach.Eversource Data Breach: Utility Warns MA Customers (Patch)

NIAC calls for a National Water Strategy.Presidential Council Calls for Water Department to Address Cyber Threats (MeriTalk)

Department of Energy holds contest to provide cybersecurity funding for rural utilities.DOE launches cyber contest to benefit rural utilities (CyberScoop)

Researchers aim to secure US military’s power grids.Protecting the protectors: Virginia Tech researchers work to secure power grid communication on military bases. (Newswise)

A technical issue grounds the UK’s air traffic control system’s automated features.Cancelled flights: Air traffic disruption caused by flight data issue (BBC)

Flight chaos ‘to last for days’ after air traffic control failure (The Telegram)

Control Loop Interview.Our guest is Mark Ryland, Director of the Office of the CISO at Amazon Web Services, joining us as part of a Dragos webinar, Securing Digital Transformation: OT Cybersecurity Innovation and Resilience. You can view the entire webinar here.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Vice President of Product Management Kimberly Graham in part three of their discussion on the convergence of OT and IT.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Critical Assets Podcast
Episode: One Rule to Rule Them All
Pub date: 2023-09-05

Join Patrick Miller, CEO of Ampere Industrial Security and his guest Danielle Jablanski, OT Cybersecurity Strategist at Nozomi Networks as they continue their debate on the topic: "If you could have only one cybersecurity regulation, what should that be?" They cover everything from threat hunting, vulnerability management, attack surface management, incident response, breach notification, risk quantification, cybersecurity insurance, NIS2, NERC CIP, and what's best for corporate vs. public good.

The podcast and artwork embedded on this page are from Patrick Miller, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Large Data Centers - more than just protecting information [The Industrial Security Podcast]
Pub date: 2023-09-04

Data centers are critical information infrastructures, with a lot of associated physical infrastructure. Vlad-Gabriel Anghel of Data Center Dynamics Academy walks us through these very recent additions to critical infrastructures, and digs into industrial / OT security needs and solutions for the space.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Clint Bodungen: Cybersecurity Simulation As A Video Game, With AI Adversaries
Pub date: 2023-08-31

About Clint Bodungen: Clint Bodungen is a distinguished industrial cybersecurity expert, celebrated public speaker, accomplished author, and a trailblazer in the realm of cybersecurity gamification. With over 25 years of experience in the field, he has left an indelible mark as the Founder, CEO & Chairman of ThreatGEN® Red vs. Blue. A veteran of the United States Air Force, Clint is renowned for his expertise in industrial control systems and operational technology cybersecurity. Notably, he authored the influential book "Hacking Exposed: Industrial Control Systems" and the forthcoming "ChatGPT for Cybersecurity Cookbook." He envisions transforming cybersecurity education through gamification, as showcased in his groundbreaking product, the world’s first online multiplayer cybersecurity game, ThreatGEN® Red vs. Blue, aimed at imparting practical cybersecurity skills.

In this episode, Aaron and Clint Bodungen discuss:

Integrating gaming AI and machine learning for predictive risk management in cybersecurity simulations
Advancing cybersecurity through game theory, predictive analysis, and AI-driven risk mitigation
Building a living risk assessment system for OT cybersecurity
Large language models, quantum computing, and training for a superhuman future

Key Takeaways:

Using a powerful combination of gaming AI and machine learning, ThreatGEN's platform creates a dynamic, strategic cyber range that not only simulates realistic attack scenarios but also empowers users to predict and mitigate the most probable attack vectors, ultimately transforming cybersecurity into a proactive, AI-driven risk management endeavor.
Unlocking the potential of game theory and machine learning, cyber security enters a new era of real-time risk analysis, predictive modeling, and realistic training, paving the way for effective decision-making, optimal resource allocation, and proactive defense strategies.
Leveraging specialized large language models and AI can revolutionize cybersecurity in OT environments, enabling dynamic risk assessment, active change management, and predictive analysis, creating a living risk profile for informed decision-making and enhanced security.
The convergence of large language models and quantum computing holds both exciting potential for solving complex problems like diseases and understanding the universe, as well as concerning implications for accelerating cyber threats and destructive capabilities.

"We're nearing the ability to solve every disease, find the secrets of the universe, and finally determine whether or not we're living in a simulation or not. But, at the same time, I guess that also brings with it terrible destruction, right? We are also accelerating the ability of nutcases out there that want to destroy the world, you know, the accessibility and the speed at which they can develop something purely devastating." — Clint Bodungen

Connect with Clint Bodungen:

ThreatGEN® Red vs. Blue: https://threatgen.com

CyberSuperhuman.AI Courses: https://cybersuperhuman.ai

Get 50% off on Clint's courses by using the code AARONCROW23

Email: clint@threatgen.com

Book: https://www.amazon.com/Hacking-Exposed-Industrial-Control-Systems/dp/1259589714

YouTube: https://www.youtube.com/@CyberSuperhuman

LinkedIn: https://www.linkedin.com/in/clintb/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Hacking Exposed Industrial Control Systems: ICS and SCADA Security Secrets & Solutions

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Kirill Gelfand Senior Solutions Architect @Trend Micro on TxOne OT cyber defense & OT cyber attacks
Pub date: 2023-08-30

Nachshon Pincu hosts Kirill Gelfand, Senior Solutions Architect at Trend Micro, in a conversation about Trend Micro's TXone OT cyber defense strategy, when a cyber-attack is an OT attack, and the fundamental difference between IT and OT cyber defense (if any).

Who is Trend Micro company?

What is the protection concept of Trend Micro (TXone) for OT?

What is the difference in protecting IT versus OT? T

here are differences of opinion among professionals in the definition of an OT attack. Let's try to sort things out.

TXone protection strategy is by layers with different components in each layer. How does it work?

Is the connection between IT and OT a disaster or an inevitability?

The ATC engine was developed after the attack on power plants in Korea in 2014. What was the concept change?

What is the connection between AI and "Deep exploit"? Is it an attacker's innovation?

נחשון פינקו מארח את קיריל גלפנד, ארכיטקט פתרונות בכיר בטרנד מיקרו בשיחה על אסטרטגיית הגנת הסייבר של טרנד מיקרו לסביבות תפעוליות. מתי מתקפת סייבר תחשב כמתקפה על סביבות תפעוליות, ומה ההבדל המהותי בין הגנת סייבר על מערכות מידע וסביבות תפעוליות (אם בכלל)

מיהי חברת טרנד מיקרו?

מהי תפיסת ההגנה של טרנד מיקרו וסוויטת טי.אקס וואן לסביבות תפעוליות מה ההבדל בהגנת סייבר על מערכות מידע וסביבות תפעוליות

ישנם חילוקי דעות בין אנשי מקצוע בהגדרה של התקפה על סביבות תפעוליות, בוא ננסה לעשות סדר

אסטרטגיית ההגנה של סוויטת טי.אקס וואן היא לפי שכבות עם רכיבים שונים בכל שכבה. איך זה עובד

האם הקשר בין מערכות מידע לסביבות תפעוליות הוא אסון או בלתי נמנע

טרנד פיתחה מנוע ייחודי לאחר שהתקפת תחנות כוח בקוריאה ב-2014. מה היה שינוי הקונספט

מה הקשר בין אינטליגנציה מלאכותית לדיפ אקספלויט? והאם מדובר בחדשנות של התוקפים

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 94: Exploring Cybersecurity and Beyond: The Remarkable Journey of Robert Putman
Pub date: 2023-08-29

Step into the cybersecurity world alongside Derek today as he brings you another riveting discussion with an esteemed expert!

Rob Putman is the Global Manager of Cybersecurity Services at ABB Process Automation. At the core of his journey lies an unquenchable thirst for understanding that has fueled his prowess within the cybersecurity world and beyond. Apart from his impressive professional portfolio, his life encompasses interwoven threads of diverse experiences. He is a US Army veteran, a devoted father, a relentless technologist, a car enthusiast, an intrepid skier, adaring rock climber, and a masterful team builder.

With Rob hailing from the scenic Bainbridge Island in Washington State, just beyond the heart of Seattle, his insatiable curiosity about the mechanics of the world ignited his trailblazing path. With a penchant for dismantling and deciphering, he embarked on a lifelong mission to unravel the inner workings of things, often charting unorthodox courses to unveil hidden truths.

Rob's curiosity and unyielding quest for understanding demonstrate the boundless possibilities that emerge when dedication intersects with ingenuity. Join Derek in witnessing the blend of expertise and passion embodied by Rob's exceptional journey as he peels back the layers of his life and work.

This episode will enrich your understanding of cybersecurity and illuminate the transformative power of unbridled curiosity and purpose-driven endeavors! Stay tuned for more!

Show highlights:

Rob shares his superhero backstory.
The jobs Rob did early in his career.
How Rob transitioned into the tech world.
The benefits of being opportunistic.
How Rob managed to stay connected with interesting people as they moved around.
How did he get into industrial control?
The importance of having a diverse workforce to protect critical and control systems.
Building trust and building bridges within a company.
The challenges Rob faces and something he has to think about continuously in his current role.
Some sage advice from Rob.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Rob Putman on LinkedIn

ABB ProcessAutomation

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Stephen Reynolds on Protecting the CISO During Incident Investigations
Pub date: 2023-08-28

Stephen Reynolds, a partner at the law firm of McDermott, Will, and Emery, joins the Nexus Podcast to discuss some of the concerns and questions CISOs and other security executives may have about their personal liability and exposure during breach investigations. The short of it: Don’t panic, but don’t be unprepared either. In this case, preparation equates to having personal legal counsel available, and document everything during an incident.
Reynolds and Eli Lilly associate VP and assistant general counsel Nick Merker presented on this topic at Black Hat under the context of the case and conviction of former Uber CISO Joe Sullivan. Sullivan was convicted of obstruction of justice and misprision of a felony for his role in covering up a breach at Uber.
Reynolds cautions that CISOs always remember that corporate counsel represent the company, and any attorney-client privilege is to the company and not the individual. He also reminds leaders to document the facts and information available at the time key decisions were made during an incident.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Gate 15 Podcast Channel
Episode: The Gate 15 Interview EP 38: Jeff Troy, President, Aviation ISAC, on public service, cybersecurity, understanding threats (and… colonizing the ocean?)
Pub date: 2023-08-28

In this episode of The Gate 15 Interview, Andy Jabbour visits with Jeff Troy, President, CEO at Aviation Information Sharing and Analysis Center (A-ISAC). Over the past five years, Jeff has led the Aviation ISAC, a trust-based community focused on the sharing of threat intelligence and best practices. He has developed the strategic plans, driven the team’s expansion of services and overseen extensive growth in membership. He established relationships with global regulators, industry associations and private sector companies to drive cyber risk reduction across the aviation eco-system. He co-authored a white paper on Ransomware and continues to partner with international groups on the ransomware threat. Concurrently, Jeff is on the National Defense ISAC Board of Directors. Jeff spent 25 years as a Special Agent of the FBI. He served as Chief, Cyber Division, and retired as the Deputy Assistant Director for Cyber National Security and Cyber Criminal Investigations. · Jeff on LinkedIn. · Email: jtroy@a-isac.com · Web: a-isac.com

In the discussion we address: · Serving in the FBI and ideas for young people thinking about their futures · Transitioning from the public sector to the private sector · Key ideas on how to building a successful information sharing community · Understanding how to think about threats · Responsibly and thoughtfully reducing risk and building reslience · Blended Threats · The importance of patching and baking security into technology · The upcoming Aviation ISAC Summit in Ireland · The Ocean State · Deep ocean colonies · More!

Some links from our discussion include: · Aviation Cybersecurity Summit, 12-14 Sep 2023 in Dublin, Ireland · NBC News: FBI says mastermind of botnet nabbed, 27 Jul 2010

The podcast and artwork embedded on this page are from Gate 15, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Ian Frist: Beyond Buzzwords, Building Effective Programs in OT Security
Pub date: 2023-08-24

About Ian Frist: Ian Frist is the Cybersecurity Compliance Program Director at Corning, boasting a MS in Cybersecurity. With a dynamic background spanning both private sector and government roles, Ian's expertise encompasses NIST, CIS, and CMMC frameworks. Currently leading Corning's compliance team within the cybersecurity group, Ian's journey ventured from accidental entry into ICS/OT through the National Guard, where even as a medic, he embraced the cyber realm. Transitioning into compliance and GRC, Ian's enduring passion for ICS/OT continues, evident through speaking engagements at prestigious events like SANS conferences, reflecting his commitment to both fields.

In this episode, Aaron and Ian Frist discuss:

Navigating compliance and cybersecurity in the changing landscape of OT
Building effective cybersecurity programs
Integrating cybersecurity in OT
Implementing effective asset management and inventory in manufacturing

Key Takeaways:

Compliance is shifting from a mere checkbox exercise to a powerful lever that compels organizations, including manufacturing and utilities, to elevate their OT cybersecurity by setting a baseline of controls and risk management strategies, bridging the gap between different industries' cybersecurity maturity levels while emphasizing the imperative to safeguard critical operations and infrastructure.
In the complex landscape of cybersecurity, building a comprehensive program that understands and manages the unique assets, risks, and impact of your organization's operations is paramount, transcending mere reliance on tools and instead emphasizing a holistic approach to preparedness and response.
Building redundancy and preparedness into systems is common practice, but the often overlooked key is to integrate cybersecurity understanding, people, processes, and technology from the start to truly fortify against a wide range of potential incidents and ensure resilient operations.
Navigating the complexities of asset management and inventory in manufacturing requires acknowledging the need for an initial manual effort, understanding the limitations of automation tools, setting realistic and adaptable goals that balance compliance and risk, and embracing the ongoing commitment required for effective governance.

"Don't fall for a buzzword, build a program. I think we're going to have to keep watching out for that moving forward." — Ian Frist

Connect with Ian Frist:

Website: https://www.corning.com/worldwide/en.html

Email: fristis@corning.com

LinkedIn: https://www.linkedin.com/in/ian-frist-ms-cybersecurity-cissp-cmmc-pa-pi-3028a9181/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Real world stories of incident response and threat intelligence.
Pub date: 2023-08-23

Radiation sensor reports from Chernobyl may have been manipulated. South African power generator hit with malware. APT31 linked to attacks on industrial systems in Eastern Europe. Environmental regulation and increased maritime cyber risk. CISA Director warns of Chinese infrastructure attack staging. Threats to the power grid. CODESYS vulnerabilities.

Today's guest is Dragos’ Lesley Carhart, sharing their RSAC 2023 talk on real world stories of incident response and threat intelligence.

The Learning Lab continues the conversation between Dragos’ Mark Urban and Kimberly Graham about the convergence.

Control Loop News Brief.Radiation sensor reports from Chernobyl may have been manipulated.Seeing Through the Invisible: Radiation Spikes Detected in Chernobyl During the Russian Invasion Show Possible Evidence of Fabrication (Ruben Santamarta)

The Mystery of Chernobyl’s Post-Invasion Radiation Spikes (WIRED)

CISA Director warns of Chinese infrastructure attack staging.

Top U.S. cyber official offers 'stark warning' of potential attacks on infrastructure if tensions with China escalate (NBC News)

China's Volt Typhoon snoops into US infrastructure, with special attention to Guam. (CyberWire)

CODESYS vulnerabilities.Microsoft reveals severe vulnerabilities in CODESYS industrial automation software (The Record)

Multiple high severity vulnerabilities in CODESYS V3 SDK could lead to RCE or DoS (Microsoft)

South African power generator hit with malware.Focus on DroxiDat/SystemBC (Kaspersky)

Ransomware Trends in the HPH Sector - Q1 2022 (HHS)

Environmental regulation and increased maritime cyber risk.Navigating Cybersecurity's Seas: Environmental Regulations, OT & the Maritime Industry's New Challenges (Dark Reading)

Threats to the power grid.EXCLUSIVE: ‘Release our men’: Far-right used power grid threats to try and blackmail government into freeing neo-Nazi bank robbery suspects (The Daily Dot)

APT31 linked to attacks on industrial systems in Eastern Europe.Common TTPs of attacks against industrial organizations. Implants for uploading data (Kaspersky)

Control Loop Interview.Our guest is Dragos’ Technical Director for Industrial Incident Response, Lesley Carhart, sharing real world stories of incident response and threat intelligence from their RSAC 2023 talk.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Vice President of Product Management Kimberly Graham in part two of their discussion on the convergence of OT and IT.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: SBOMs & CycloneDX with Steve Springett
Pub date: 2023-08-23

Steve Springett is the Chair of the OWASP CycloneDX Core Working Group. CycloneDX is one of the two main machine readable formats that SBOMs are being created in, although CycloneDX can capture all sorts of BOMs.

In this episode we assume listeners know what a SBOM is and why it might be desired by a vendor and asset owner. The beginning of the show we cover some basics of CycloneDX

If you know the basics, skip to 14:24 where we get into the details

Statistics on who is generating and using CycloneDX SBOMs, and the impact of governement regulations on the use.
Steve's view of the NTIA Minimum Elements for SBOM v. CycloneDX elements.
How CycloneDX tries to capture the completeness of and confidence in the SBOM.
The naming problem. CPE, CVE, NVD, SWID, PURL and more. Steve describes the problem and what he thinks is the way forward.
Vulnerabilities ... and why Steve thinks VEX is a missed opportunity.
Outdated component analysis (this could be very useful in a procurement decision)
and more

Links

CycloneDX document: Authoritative Guide To SBOM

ICS-Patch (what to patch when in ICS / risk based decision tree)

S4x24 CFP

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Cyber Women-3: Sara Bitan D.Sc Co-Founder & CEO @CyCloak on women in cyber & PLC vulnerability research
Pub date: 2023-08-22

Nachshon Pincu hosts Sara Bitan D.Sc, Co-Founder and CEO at CyCloak, PLC (controllers) vulnerability researcher at Technion - Israel Institute of Technology, and Blackhat speaker, in a conversation about her experience as a woman in cyber. And the need for PLC vulnerabilities research.

Way must a woman demonstrate higher abilities than a man to receive a higher initial credit?

Following the previous question, you said, "A woman has to work harder than a man, there is no glass ceiling, but the road is more difficult." Why is that?

You told me that when you started your studies at the Technion, 50% of the students in your class were women. Where did they disappear in the world of employment?

You investigate the controller's weaknesses to show the industry, especially the controller manufacturers, their direction is wrong. Please explain.

From your research, the weakness that runs through all the studies is an attack on inscription key management. Please explain in a language that we laypeople can understand.

There is no technological challenge in attacking controllers; all the attacker needs, is the right motivation. How has that motivation?

The window of opportunity for a direct OT attack is opening more and more, mainly because of the connection of the OT network to the corporate network and the cloud. Does this mean OT attacks can only come through the corporate network/cloud?

The technological bar for cyber attacks, including OT attacks, is becoming lower than before. Attackers didn't know how to attack OT's old school. Today the situation has changed, and a new front has opened, like the attacks on Black Energy and the dam in Upstate New York. What to do?

And More

נחשון פינקו מארח את ד"ר שרה ביתן, ד"ר למדעים, מייסדת שותפה ומנכ"לית סייקלוק, חוקרת חולשות בקרים בטכניון ודוברת בבלאקהט, בשיחה על הניסיון שלה כאישה בסייבר. והצורך במחקר חולשות בבקרים.

מדוע אישה חייבת להפגין יכולות גבוהות יותר מגבר כדי לזכות בהכרה?

בעקבות השאלה הקודמת אמרת "אישה צריכה לעבוד קשה יותר מגבר, אין תקרת זכוכית, אבל הדרך יותר קשה". למה?

אמרת לי שכשהתחלת את לימודיך בטכניון, 50% מהתלמידים בכיתה שלך היו נשים. לאן הם נעלמו בעולם התעסוקה?

את חוקרת את החולשות של הבקר כדי להראות לתעשייה, במיוחד ליצרני הבקרים, שהכיוון שלהם שגוי. אנא הסברי?

מהמחקר שלך, הבעיה שעוברת כחוט השני בכל המחקרים היא התקפה על ניהול מפתחות הצפנה, אנא הסבירי בשפה שאנו ההדיוטות יכולים להבין.

"אין אתגר טכנולוגי בתקיפת בקרים, כל מה שהתוקף צריך הוא את המוטיבציה הנכונה". למי יש את המוטיבציה הזו?

חלון ההזדמנויות למתקפות ישירות על מערכות תפעוליות נפתח יותר ויותר, בעיקר בגלל החיבור של הרשתות התפעוליות לרשת הארגונית ולענן. האם זה אומר שהתקפות על הסביבות התפעוליות יכולות להגיע רק דרך הרשת הארגונית או ענן?

הרף הטכנולוגי למתקפות סייבר, כולל מתקפות על סביבות תפעוליות, הופך נמוך מבעבר. התוקפים לא ידעו איך לתקוף את הסביבות התפעוליות הישנות, כיום המצב השתנה, ונפתחה חזית חדשה, כמו ההתקפות על בלאק אנרג'י והסכר באפסטייט ניו יורק. מה עושים?

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Fortinet Cybersecurity Podcast
Episode: Take Five #74 - Predictive Analytics, AI, and Machine Learning: Operational Technology
Pub date: 2023-08-22

This episode was recorded on 8/22/2023

Welcome to the Take Five Podcast from Fortinet where we provide five cybersecurity tips and best practices for today’s technology leaders. This podcast series taps into the experience of our Fortinet Field CISO team and the work being done with and through our ecosystem of partners, customers, and industry experts.

In this episode, Fortinet Field CISOs discuss the role that artificial intelligence (AI) and machine learning (ML) are playing in operational technology. The conversation will encompass the utilization of AI and ML in OT, along with an analysis of the risks, limitations, and challenges it may present.

For more information about operational technology (OT), visit our website, www.fortinet.com/ot?utm_source=social&utm_medium=linkedin-org&utm_campaign=sprinklr

Read key findings from the 2023 Global Ransomware Report, brought to you by Fortinet: https://www.fortinet.com/blog/industry-trends/ransomware-protection-survey-for-organizational-prevention?utm_source=social&utm_medium=linkedin-org&utm_campaign=sprinklr

The podcast and artwork embedded on this page are from Fortinet Cybersecurity Podcast, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 93: Navigating Cybersecurity Realms: Unveiling Chris Kirsch's Multifaceted Journey
Pub date: 2023-08-22

In the captivating world of cybersecurity, where technology and innovation intersect to safeguard our digital landscapes, Derek is delighted to welcome today's distinguished guest, Chris Kirsch!

Chris is a man of multifaceted talents and roles. In addition to being the Co-founder and CEO of runZero , he is also a husband, a runner, a strategic social engineer, an unwavering devotee to cybersecurity, a seasoned member of various security ventures, and a masterful pizza chef specializing in the art of bread baking!

With his company serving as a bridge to the operational technology community, Chris's journey is a tale that weaves through diverse geographies. He grew up and went to primary school in Germany. He then attended boarding school in Switzerland, after which he continued his education in the United Kingdom.

As we journey through Chris's narrative, we dive into his role as a longstanding contributor to the cybersecurity landscape and his pivotal role in bridging the gap between the digital domain and operational technology.

Join us as we delve into the diverse facets of the narrative of Chris Kirsch, a remarkable force in the cybersecurity world! You’re bound to be enthralled by his unique story that intertwines his personal experiences with his unyielding commitment to the cybersecurity domain!

Show highlights:

Some lessons learned from PGP.
Bridging the gap between hardware and software.
How adding a second product to the sales process changes the hearts and minds of a sales team.
Transitioning from working with crypto-geeks to hackers. (18:51)
The value of cold-calling managers. (26:01)
Two essential attitudes you can have to an acquisition.
The benefits of being open and having conversations without expectations.
Fingerprinting flaky devices.
The importance of having a good inventory.
Chris’s advice to his younger self.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Chris Kirsch on LinkedIn

RunZero

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Work (LS 42 · TOP 1.5% what is this?)
Episode: ICS security, Blue Team Con and security work in the Air Force Reserve | Guest Lesley Carhart
Pub date: 2023-08-21

Lesley Carhart of Dragos, also known as Hack4Pancakes on social media, is a lifelong breaker and builder of things, and their insights on the deep mechanics of Industrial Control Systems are an absolute must-hear for any of you even considering this space. Carhart also talks about their keynote at this year’s Blue Team Con, the differences between incident response in the military vs. the private sector, and why standard cybersecurity studies won’t take you as far in ICS as it will to learn how train track switchers work. Seriously, this is one of the best episodes I’ve ever been a part of, and I can’t wait for you to hear it!

– Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
– View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - ICS security
3:40 - Getting started in cybersecurity
9:13 - The early days of the internet
11:05 - Air Force cybersecurity
12:50 - Military cybersecurity training
15:00 - Incident response work at Motorolla
18:40 - Technical director of incident response
23:30 - State of ICS
39:13 - Starting work in ICS
41:57 - Keynote speaker at Blue Team Con
46:46 - Bringing diversity into ICS
53:46 - Outro

The podcast and artwork embedded on this page are from Infosec, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Risky Business (LS 54 · TOP 0.5% what is this?)
Episode: Feature Interview: How Sandworm prepared Ukraine for a cyber war
Pub date: 2023-08-21

In this joint Risky Business and Geopolitics Decanted feature interview, Patrick Gray and Dmitri Alperovitch talk to Illia Vitiuk, the Head of the Department of Cyber and Information Security of the Security Service of Ukraine (SBU) about the cyber dimension to Russia’s invasion.

From turning off Ukraine’s power grid with a cyber attack in 2015 to the Viasat hack in 2022, Russia’s intelligence services are world renowned for executing creative destructive cyber campaigns. Despite this, after a year and a half of Russia waging war on Ukraine its power grid is up, its telcos are functioning and its banks are still processing transactions.

How has Ukraine been able to withstand Russia’s onslaught in the cyber domain? Vitiuk joins us to reveal insights into how Russian intelligence services are operating in Ukraine, and how the SBU is countering them.

The podcast and artwork embedded on this page are from Patrick Gray, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Team82 on NAS Research, OPC UA Exploit Framework
Pub date: 2023-08-20

Team82’s extensive research into network attached storage devices and the ubiquitous OPC UA industrial protocol came to a head recently in Las Vegas with a pair of presentations at Black Hat USA and DEF CON disclosing vulnerabilities in Synology and Western Digital NAS cloud connections and the unveiling of a unique OPC UA exploit framework.

In this episode of the Nexus podcast, researcher Noam Moshe explains how both research initiatives came to be, the implications of each for users, and how the respective ecosystems have been made safer.

Read our Synology research
Read our Western Digital research
Read about our OPC UA exploit framework
Download the framework

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Michael Weigand: From Planes to Power Plants, Protecting The Intersection of Physical and Digital
Pub date: 2023-08-17

About Michael Weigand: Michael Weigand is the visionary co-founder and Chief Growth Officer of Shift5, spearheading the realization of Shift5’s ambitious growth strategies. With a distinguished background, he spent eight years as an innovative leader in the U.S. Army, pioneering cyber operations and commanding specialized cyber units. Michael's pivotal contributions include shaping the Army's platform mission assurance program, pioneering expeditionary cyber forces, and fostering breakthrough projects in collaboration with the Defense Digital Service. He holds a BS in Computer Science from the United States Military Academy and possesses a unique ability to navigate both the digital realm and the skies, flying small airplanes into tight spaces.

In this episode, Aaron and Michael Weigand discuss:

Enhancing operational reliability and security in modern vehicle fleets
Securing critical infrastructure in the age of advanced technology
Strategies for successful onboarding of new assets
Enabling secure and adaptive OT for a changing landscape

Key Takeaways:

Shift5 pioneers cybersecurity solutions for modern vehicles, equipping defense systems, aerospace, and rail with transformative hardware and software that not only safeguard against cyber threats, but also harness unique data for proactive optimization, revealing a compelling convergence of security and operational efficiency.
In the intersection of physical systems and digital environments in OT, protecting assets like airplanes and power plants from vulnerabilities is crucial, demanding advanced anomaly detection and proactive responses to ensure security, safety, and operational stability amid rapid evolution.
Navigating the complex journey of onboarding new assets involves multidisciplinary collaboration, early integration for efficiency gains, and a keen focus on quantifiable value to maximize returns and operational effectiveness.
The future of cybersecurity holds exciting advancements in automated vulnerability identification and secure software development, but challenges lie in reconciling slow safety processes with the need for agile and rapid responses to emerging threats, as adversaries increasingly exploit AI-powered tactics.

"We encourage everybody to ensure they're tapping and monitoring everything, not only infrastructure but also those legacy and serial protocols that are quite obscure. We want everybody to ensure they can see themselves so they can defend their interests." — Michael Weigand

Connect with Michael Weigand:

Website: shift5.io

LinkedIn: https://www.linkedin.com/in/michael-weigand/ and https://www.linkedin.com/company/shift5/

Emails: andy.oare@shift5.io, mike@shift5.io, and jessica@shift5.io

YouTube: https://www.youtube.com/channel/UCNCrUBI5C0bWil1-uKJaXUg

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code
Episode: EP 21: Exploiting OPC-UA in OT Environments
Pub date: 2023-08-16

In a talk at Black Hat USA 2023, Sharon Brizinov and Noam Moshe from Claroty Team82, disclosed a significant vulnerability in the Open Platform Communications Universal Architecture or OPC-UA, a univsersal protocol used to synchronize different OT devices. In this episode they also discuss a new open source OPC exploit framework designed to help OT vendors check their devices in development.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: The OT Cybersecurity / Climate Nexus with Andy Bochman
Pub date: 2023-08-16

At S4x23 Andy Bochman gave a Main Stage performance on the OT Cybersecurity / Climate Nexus. It's a new idea and Dale wanted to dig into it and understand it better. The discussion looks at where there is a nexus/connection/overlap and where there may be parallel efforts where each side might learn from the other.

Links

Andy Bochman S4x23 Video

Slide used in this episode

Earlier episode with Dale and Andy discussing CCE

S4x24 Call For Presentations

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Assaf Hazan VP Technologies @Kaspersky Israel about Kaspersky’s ICS/OT cyber endpoint & PLC defense
Pub date: 2023-08-16

Nachshon Pincu hosts Assaf Hazan VP Technologies at Kaspersky Israel in a conversation about ICS/OT cyber defense. The difference between protecting IT and OT infrastructure. The need for safeguarding old and unsupported operating systems. Kaspersky's holistic defense point of view for ICS/OT.

About the Kaspersky Company (history, disengagement from Russia, technology)

What does it mean to protect computing in an OT environment, and how is it different from an IT environment?

What is Kaspersky's holistic defense concept for OT, and how is this reflected in the protection controllers?

Is it possible to install an agent on old-generation controllers?

What is the future in the face of the development of new controllers that already have clear signs of computing?

Examples of Kaspersky's activity with control manufacturers (firmware testing, certification, etc.)

And more…

נחשון פינקו מארח את אסף חזן, סמנכ"ל טכנולוגיות בקספרסקי ישראל בשיחה על הגנה על מערכות תפעוליות, הפערים והשוני בהגנה על סביבות מידע וסביבות תפעוליות, הצורך בהמשך מתן הגנה למערכות הפעלה ישנות שאינו נתמכות ע"י היצרן והתפיסה ההוליסטית

על חברת קספרסקי (היסטוריה וטכנולוגיה)

מה המשמעות של הגנה על סביבות תפעוליות ובמה זה שונה מסביבת אי.טי

מה תפיסת ההגנה ההוליסטית של קספרסקי לסביבות תפעוליות ואיך זה בא לידי ביטוי בהגנה גם על בקרים

האם ניתן להתקין איג'נט על בקרים מהדור הישן

מה העתיד מול התפתחות הבקרים החדשים שיש בהם כבר סממנים מובהקים של מחשוב

דוגמאות לפעילות של קספרסקי מול יצרני הבקרה - בדיקות קושחה, הסמכות וכדומה

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Fortinet Cybersecurity Podcast
Episode: Take Five #72 - Predictive Analytics, AI, and Machine Learning: OT Energy
Pub date: 2023-08-15

This episode was recorded on 8/15/2023

In this episode, Jaime Chanaga, Fortinet Field CISO for LATAM, Canada and the Caribbean joins Alain Sanchez, EMEA’s Field CISO for Fortinet to discuss the role that artificial intelligence (AI) and machine learning (ML) are playing in OT energy. The conversation will encompass the utilization of AI and ML in energy, utilities, and power companies, along with an analysis of the risks, limitations, and challenges it may present.

For more information about OT energy visit our website, www.fortinet.com/power-utilities?utm_source=social&utm_medium=linkedin-org&utm_campaign=sprinklr

The podcast and artwork embedded on this page are from Fortinet Cybersecurity Podcast, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Value of Managed Security Services
Pub date: 2023-08-15

Manufacturing’s mantra these days is everyone needs to keep the process moving – and that means security can’t get in the way. But at the same time, you want to make sure you keep the bad guys out. No easy task. Add on top of that, an expanding attack surface due to digitalization and a lack of qualified security professionals available and you have the potential for the classic low hanging fruit for attackers. That is exactly where managed security services comes in.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 92: From Military Service to Cyber Luminary: Bryson Bort's Inspiring Journey
Pub date: 2023-08-15

Step into the cybersecurity world with Derek Harp for another riveting episode of the CS2AI podcast show! Derek has welcomed a vast array of industry titans onto the podcast, and this episode is no exception!

Today’s show features Bryson Bort, the CEO and luminary Founder of Scythe. Bryson’s influence spans the domains he has touched, nurtured, advised, and meticulously built from the ground up. As the creator of the renowned ICS Village and the driving force behind Grimm, his story is an intricate tapestry of innovation and impact.

A military veteran from the US Army, a nurturing father, a culinary maestro hosting his own show, a kayaker, a relentless charity fundraiser, and an all-around exceptional individual, Bryson embodies a remarkable depth that will most certainly captivate all listeners!

Bryson spent his formative years in Germany and the Soviet Union. His linguistic journey began with German, followed by immersion language programs to master English, which was crucial for his educational pursuits. He spent his early years in Berlin until 1988, then in Moscow until 1990. His journey eventually culminated in the United States during his teenage years.

Grab a seat and tune in as Derek unravels the narrative that shaped the exceptional Bryson Bort!

Show highlights:

How Bryson got into cybersecurity.
How Bryson learned that procurement is your best friend.
The importance of building relationships and providing exceptional service.
Bryson shares his recommendations for working with individuals with technical backgrounds and getting them on board.
The importance of understanding the business and mission of the company you work for.
How cybersecurity eventually took over Bryson’s career path.
How Bryson got the nickname, Grimm.
Bryson talks about starting his company.
Bryson shares some advice for taking on new ideas.
Bryson explains what the ICS Village is all about.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Bryson Bort on LinkedIn

Scythe

GRIMM

Episode 79 withMegan Sanford

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Bishop Fox on OSDP Weaknesses Putting Secure Facilities at Risk
Pub date: 2023-08-13

In this episode of the Nexus podcast, Bishop Fox researchers Dan Petro and David Vargas explain their research into the Open Supervised Device Protocol (OSDP), meant to bring encryption to badge readers and controllers providing physical access controls at secure facilities.
Petro and Vargas explain a number of protocol weaknesses and vulnerabilities that defeat OSDP's promise of encryption and security. Through the attacks they describe, they're able carry out—among others—replay or downgrade attacks, which are enabled by severe key exchange vulnerabilities or weakened crypto keys as described in the protocol.
Petro and Vargas unveiled this research during a presentation at Black Hat USA in Las Vegas.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Cyber Women-2: Lia Tsur CEO @LT RISKMGMT risk management expert on cyber women & cyber business risk
Pub date: 2023-08-10

The second episode in the mini-series of "Women in Cyber."

Nachshon Pincu and Mally Bar host Lia Tsur, CEO at LT RISKMGMT, risk management academic lecturer at the University of Haifa, Reichman University (IDC Herzliya), and IFI-Israel Financial Institute, a cyber and business risk management expert, in a conversation about the challenges of a woman in cyber and managing business risks.

Why are there fewer women in cyberspace in 2023?

In the preliminary conversation, you said, "There is no life" How do you manage a career and a family? A question I have never asked a man. Is there a difference between women and men in cyber?

You actively promote women in Israeli cyberspace. What are the frameworks established in Israel for the issue?

Today risk management is an essential and even central pillar of cyber protection for the organization. Where do we start?

Why is there a need for business factors and business controls on cyber? The rise of the Business Information Security Officer (BISO), a new position to emphasize the security of the business process.

Is there a difference between IT and OT vis-a-vis the business entity?

You place a lot of emphasis on processes. The issue is familiar to us in OT since it is the basis of operations. How do you skip over the decades of habitude of the organization?

"from Leah's mind," developing a technological product, what is it about?

And More…

הפרק השני במיני סדרה נשים בסייבר

נחשון פינקו ומלי בר מארחים את ליא צור, מנכ"לית ל.טי. ריסקמגמט, מרצה אקדמית לניהול סיכונים באוניברסיטת חיפה, אוניברסיטת רייכמן (בינתחומי הרצליה), והמכון הפיננסי הישראלי, מומחית לניהול סייבר וסיכונים עסקיים, בשיחה בנושא האתגרים של אישה בסייבר ובניהול סיכונים עסקיים.

מדוע לדעתך יש פחות נשים בסייבר בשנת 2023

בשיחה המקדימה אמרת "אין חיים", איך באמת מצליחים לנהל קריירה ומשפחה? שאלה שמעולם לא שאלתי גבר, האם קיים הבדל בין נשים לגברים בסייבר

את פעילה בנושא קידום נשים בסייבר בישראל, מה המסגרות שהוקמו לנושא?

ניהול סיכונים מהווה כיום נדבך חשוב ואפילו מרכזי בהגנת סייבר לארגון, מאיפה מתחילים?

את מדברת הרבה על הגורם העסקי והצורך בבקרות של הגורם העסקי על הסייבר מאידך אנחנו רואים מתן דגש על בטחון התהליך העסקי ותפקידים יעודיים לטיפול בנושא. האם אין כאו סתירה

האם קיים הבדל בין מערכות מידע ל מערכות תפעוליות מול הגורם העסקי

את נותנת הרבה דגש על תהליכים, במערכות תפעוליות הנושא מוכר לנו היטב היות וזה הבסיס ליכולת הייצור, איך מתמודדים עם הנושא במערכות העיסקיות ומדלגים לעיתים על עשרות שנות הרגל בארגון

ועוד.....

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Daniel Bardenstein: Transparency and Trust With SBOM
Pub date: 2023-08-10

About Daniel Bardenstein: Daniel Bardenstein is the driving force behind Manifest, a pioneering software supply chain company revolutionizing how organizations manage SBOM lifecycles. As CTO and co-founder, he empowers enterprises to automate and streamline their processes. Daniel's remarkable journey includes pivotal roles such as Chief of Tech Strategy at CISA, where he orchestrated technology modernization and shaped critical cyber strategies. Notably, he spearheaded cybersecurity initiatives across the Department of Defense, safeguarding vital assets including COVID-19 vaccines. His expertise extends beyond tech, as he co-presides over Foresight Partners, providing essential cybersecurity aid to political campaigns.

In this episode, Aaron and Daniel Bardenstein discuss:

The importance of software bill of materials (SBOMs) in OT security
Leveraging SBOMs, VEX, and contextual data in OT
Transforming compliance checkboxes into actionable data insights
Exploring the shifting burden of cybersecurity

Key Takeaways:

SBOM is crucial for both IT and OT sectors, especially in OT where equipment longevity and reliability are paramount, enabling asset owners to proactively understand, manage, and respond to the intricate software dependencies, vulnerabilities, and risks within their critical systems, thereby enhancing security and operational continuity.
In the realm of OT and cybersecurity, embracing transparency through SBOMs, automating vulnerability data exchange (VEX), and utilizing contextual information can empower organizations to make well-informed decisions to safeguard their critical systems and maximize their cybersecurity efforts.
Harnessing the power of SBOMs as a transformative data asset, rather than a mere compliance checkbox, enables businesses to proactively manage vulnerabilities, enhance security, and streamline operations through informed decision-making and targeted action.
The shift towards proactive security through comprehensive asset management and transparency in the software supply chain promises a safer future, while the looming concern of cyberattacks transcending into the physical realm necessitates urgent preparation and action.

"Asset owners should feel fully empowered to push the responsibility for transparency onto their vendors. You buy cereal at the grocery store with no ingredients, well, you have to tell us what's in Raisin Bran and tell us if there's anything poisonous in it, right? It should be the responsibility of your vendors to tell you what's in the stuff that you're going to buy from them." — Daniel Bardenstein

Connect with Daniel Bardenstein:

Website: www.manifestcyber.com

LinkedIn: https://www.linkedin.com/company/manifestcyber/ and https://www.linkedin.com/in/bardenstein/

Twitter: https://twitter.com/manifestcyber and https://twitter.com/bardenstein

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Water Sector Cyber Risk with Gus Serino
Pub date: 2023-08-09

Gus Serino worked at a large water utility before joining Dragos in 2019. We're talking water sector so it's obligatory to start with Oldsmar (2:20), but we don't talk cyber. Instead we go through the physical portion of the water system assuming the attacker is able to issue the command to the pump to dump a lot of sodium hydroxide into the water system and what would likely happen. Importantly Gus identifies the simple, unhackable solution to this threat. A hard wired PH sensor that will shut off the pump regardless of the commands from the ICS.

After Oldsmar Dale and Gus discuss:

how small and medium water systems should approach cyber risk
the greater challenge to large water systems
the EPA's early steps on cybersecurity and future regulation - surprises in moving from a water utility to Dragos
what Gus's new I&C Secure company is doing

View Details

Podcast: Security Voices (LS 33 · TOP 5% what is this?)
Episode: Episode #57: Claroty’s Galina Antova on the global infrastructure war & building an $100M OT security juggernaut
Pub date: 2023-07-31

This past weekend, the New York Times posted an article explaining the United States is scrambling to clean government systems from a deep, pervasive infiltration of the country’s infrastructure by the Chinese. Much like the Russian attacks on Ukrainian infrastructure, the intent appears to be to disrupt any U.S. action that would be a response to Chinese military action in Taiwan. The role of nation state actors in driving the threat landscape has brought us to a place where the lines between physical and cybersecurity are no longer blurry, but simply erased.

Galina Antova, founder and Chief Business Officer of Claroty, shares her expertise in operational technology (OT) security with us in an hour long interview in the latest episode of Security Voices. We begin by walking through the recent industrial security threat landscape with an emphasis on INCONTROLLER/Pipedream and discuss the impact of the Russian/Ukrainian war, tracing its origins back to a landmark attack in 2015.

Galina and Dave explain the uncomfortable truths about the current state of OT security, starting with the fact that, other than nuclear energy facilities, air gaps are as common unicorns and other mythological beasts. Galina explains why OT security teams necessarily have to operate with older equipment and more caution than conventional IT security teams. Further, while we have not seen massive infrastructure disruptions to date, the real reason behind this offers us little comfort.

In the second half of our interview, Galina describes her journey as a founder of Claroty and what it took to build a $100M ARR company over 8 years. For a category decades in the making with notoriously long sales cycles and risk averse buyers, she takes us through the playbook she and her co-founders used to establish a beachhead and expand into a global OT security juggernaut. We pinpoint why the pandemic was a breakthrough moment for OT security, catapulting solutions providers to new heights and why this had little to do with new threats and everything to do with enabling digital transformation.

We bring the episode to a close with a dialogue on gender equity in cybersecurity and specifically how men can do their part by adjusting a couple key assumptions when interacting with women in business.

The podcast and artwork embedded on this page are from Security Voices, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Mentorship, internships, and apprenticeships in OT security.
Pub date: 2023-08-09

The Five Eyes outline the top exploited vulnerabilities. The Brunswick Corporation loses millions to cyberattack. Ransomware in the industrial space. The US Transportation Security Administration (TSA) updates security rules for oil and natural gas pipeline operators.

Our guest is Mea Clift of Woodard & Curran sharing her perspective on mentorship, internships, and apprenticeships with an eye on OT security.

The Learning Lab has the first part of a discussion about the convergence of OT and IT with Dragos’ Mark Urban and Kimberly Graham, Dragos’ VP of Product Management.

Control Loop News Brief.Five Eyes outlines top exploited vulnerabilities.2022 Top Routinely Exploited Vulnerabilities (CISA)

Brunswick Corporation loses millions to cyberattack.Marine industry giant Brunswick Corporation lost $85 million in cyberattack, CEO confirms (The Record by Recorded Future)

Brunswick Corporation (NYSE:BC) Q2 2023 Earnings Call Transcript (Insider Monkey)

Ransomware in the industrial space.Dragos Industrial Ransomware Attack Analysis: Q2 2023 (Dragos)

TSA updates security rules for oil and natural gas pipeline operators.TSA updates, renews cybersecurity requirements for pipeline owners, operators (TSA)

Control Loop Interview.The interview is with Mea Clift of Woodard & Curran sharing her perspective and efforts around mentorship and internship/apprenticeship with an eye on OT security and her experience in securing the water/utilities space.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Vice President of Product Management Kimberly Graham in part one of their discussion on the convergence of OT and IT.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: To The Point - Cybersecurity (LS 35 · TOP 3% what is this?)
Episode: The Cyber Satellite Threat with Mark Montgomery
Pub date: 2023-08-08

This week on the podcast, we’re joined by Mark Montgomery, senior director of the FDD’s Center on Cyber and Technology Innovation and director of the CSC 2.0. Mark shares about the different physical and cyber threats faced by satellites and space networks. He also shares considerations for classifying satellites as critical infrastructure and what the legislation required to do so might look like.

Mark Montgomery serves as senior director of the Center on Cyber and Technology Innovation, where he leads FDD’s efforts to advance U.S. prosperity and security through technology innovation while countering cyber threats that seek to diminish them. Mark also directs CSC 2.0, an initiative that works to implement the recommendations of the congressionally mandated Cyberspace Solarium Commission, where he served as executive director. Previously, Mark served as policy director for the Senate Armed Services Committee under the leadership of Senator John S. McCain, coordinating policy efforts on national security strategy, capabilities and requirements, and cyber policy.

Mark served for 32 years in the U.S. Navy as a nuclear-trained surface warfare officer, retiring as a rear admiral in 2017. He was assigned to the National Security Council from 1998 to 2000, serving as director for transnational threats. Mark has graduate degrees from the University of Pennsylvania and the University of Oxford and completed the U.S. Navy’s nuclear power training program.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e245

The podcast and artwork embedded on this page are from Forcepoint | Global Cybersecurity Leader | Security. Simplified., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: IoT For All Podcast (LS 39 · TOP 2% what is this?)
Episode: Bluetooth and Digital Tools in IIoT | Cumulus' Chiz Chikwendu | Internet of Things Podcast
Pub date: 2023-08-08

Chiz Chikwendu, CTO of Cumulus Digital Systems, joins Ryan Chacon on the IoT For All Podcast to discuss Bluetooth and digital tools in IIoT. They talk about IIoT adoption, Bluetooth vs Wi-Fi for the industrial sector, the remaining challenges in digital tool adoption, the need for a standard for communication, getting field workers to use new tools, and how security is handled for industrial solutions.

Chiz Chikwendu is the Chief Technology Officer and Co-Founder at Cumulus Digital Systems, leading a talented product development team. Prior to co-founding Cumulus, he was the Manager of the Electrical Engineering team at Shell TechWorks, Shell’s technology center in Cambridge, Massachusetts, focused on developing and deploying new technologies for Shell’s capital projects and operating facilities.

Before joining Shell, Chiz held various technical roles in the medical device and aerospace industries. Chiz earned his BS from Yale University and MS in Electrical Engineering from Rensselaer Polytechnic Institute.

Cumulus digitizes mission-critical construction and maintenance activities to ensure that work is done right the first time, every time. By integrating sensors, digital tools, and other IoT devices, their connected worker platform improves the productivity and quality of safety-critical workflows, such as bolt tightening, welding, and pressure testing.

To date, Cumulus has been used to manage over 7,000,0000 work completions across industries such as energy, construction, manufacturing, semiconductors, data centers, transportation, chemicals, renewables, and more. In addition to improving safety and sustainability, their technology also has been proven to reduce costs for quality control and data review by over 60%. Cumulus is headquartered in Cambridge, Massachusetts, with additional offices in Houston, Texas and Kuala Lumpur, Malaysia, and serves customers across the globe.

Discover more about Bluetooth and IoT at https://www.iotforall.com

More about Cumulus Digital Systems: https://cumulusds.com

Connect with Chiz: https://www.linkedin.com/in/chizuruoke-chikwendu/

Key Questions and Topics from this Episode:

(00:00) Intro to the IoT For All Podcast

(00:10) Introduction to Chiz Chikwendu and Cumulus Digital Systems

(01:35) Industrial IoT adoption

(04:06) Bluetooth vs Wi-Fi for industrial

(06:48) What gaps remain in adopting digital tools?

(09:08) The need for a standard for communication

(11:40) Challenges of getting field workers to adopt new tools

(15:14) How is security handled?

(18:45) What are you most excited for in the IIoT space?

(21:30) Learn more and follow up

SUBSCRIBE TO THE CHANNEL: https://bit.ly/2NlcEwm

Join Our Newsletter: https://www.iotforall.com/iot-newsletter

Check out the IoT For All Media Network: https://www.iotforall.com/podcast-overview

The podcast and artwork embedded on this page are from IoT For All, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 91: Explore How We Can Shape a Promising Future with Dr. Barton Miller
Pub date: 2023-08-08

In an ever-evolving world where progress accelerates exponentially, the pursuit of knowledge and an unwavering commitment to shaping a prosperous future have never been more vital.

Today, we have the distinct honor of hosting a true trailblazer in the field of academia and industry as Dr. Barton Miller, the esteemed Vilas Distinguished Achievement Professor at the University of Wisconsin-Madison, joins Derek to share his passion, talk about what he does in the industry, and discuss how we can create a better tomorrow.

Since first setting foot on the grounds of the prestigious Wisconsin-Madison University in 1984, Bart has spent nearly four decades at the forefront of research and innovation. With his roots in Southern California and his current abode in Johnson, his passion continues to burn as bright as the Californian sun he grew up under!

Join us for an enlightening journey as Bart embarks on a riveting conversation, unraveling his unwavering passion, pioneering contributions in the industry, and vision for a brighter future!

Get ready to delve into a world of cutting-edge ideas and explore how we can shape a promising future holding boundless potential!

Show highlights:

Bart shares his origin story.
Why is it essential to get early exposure to control systems and focus on a specific area of interest?
The value of resiliency and keeping systems up.
What is plus-testing?
Bart dives into how he uses terms like deep-fried security, crispy on the outside and juicy on the inside, when teaching.
Examples of physical attacks on industrial systems.
How did Bart get started in computer science?
Bart explains fuzz-testing.
The pros and cons of open source.
Bart gets into his Introduction to Software Security course.
Bart discusses something he has been looking at most recently- ransomware.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Dr. Barton Miller on LinkedIn

University of Wisconsin-Madison

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Jennifer Lyn Walker on Cybersecurity Risks in the Water Sector
Pub date: 2023-08-03

Jennifer Lyn Walker, Director of Infrastructure Cyber Defense for the WaterISAC, joins the Nexus podcast to discuss the state of cybersecurity within the water and wastewater critical infrastructure sector. Walker explains where the cybersecurity technology, funding, and skills gaps currently exist among smaller—and larger—water providers. She also covers recent improvements from water utilities, and what, in an ideal world, the cybersecurity industry and government could do to help.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: One-Way, SAIDI & S4x24 CFP
Pub date: 2023-08-02

This is a solo-sode where Dale reviews two articles from July with comments on comments and additional thoughts. The final section is a must listen if you are going to submit to speak on the S4x24 Stage. The times below are so you can skip to what you are interested in.

1:29 One-Way Data Diodes and School Zones

10:15 SAIDI: What Cyber Incidents Should Be Excluded From Metrics

16:05 Do's and Don'ts For Your S4x24 CFP Submission

Links

Subscribe to Dale's Friday ICS Security News & Notes

Info and Links for the S4x24 CFP

View Details

Podcast: Left to Our Own Devices
Episode: Joanna C. Cooper: The Power of “Yes”
Pub date: 2023-08-02

Joanna C. Cooper is the General Manager at Daimler Truck North America. Over the past 15 years, Joanna built multi-disciplinary industry experience, domestically and internationally, ranging from project management and component procurement, through manufacturing operations and engaging customer experience. She joined us to discuss the automotive industry, cybersecurity, and how to advance women in manufacturing roles.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code
Episode: EP 20: Securing Satellite Communications With Quantum Cryptography
Pub date: 2023-08-01

What would happen if someone stole the encryption keys for a major satellite? Well, it’d be game over. Unless the satellite used quantum cryptography. Skip Sanzeri from QuSecure explains how using “quantum tunnels” will allow even legacy satellites in orbit today to become secure in a rapidly approaching post-quantum world.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Moving Targets
Episode: Moving Targets | Jacob Marzloff | Episode 3
Pub date: 2023-07-31

Here's an awesome conversation @Carloine held with Armexa's President & Co-Founder Jacob Marzloff. Explore Jacob's background and accomplishments in depth. Learn about the process of launching a business, how to put together a winning team, the benefits and drawbacks of taking a holistic vs targeted consulting strategy, and how to implement an OT security plan from start to finish. This episode is jam-packed with information, making it a must-listen.

The podcast and artwork embedded on this page are from Dispel, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Active Defense in OT - how to make it work [The Industrial Security Podcast]
Pub date: 2023-08-01

Active defense or "intrusion prevention" deep into industrial networks has long been thought of as not workable. Youssef Jad - CTO at CyVault - joins us to talk about a new approach to OT active defense that is designed for sensitive OT / industrial environments.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Cyber Women-1: Tsofit Shachar VP Cyber strategy & BD @Cybecs - Women CISO challenges & create value
Pub date: 2023-08-01

Nachshon Pincu and Mally Bar host Tsofit Shachar, VP of Cyber Strategy and BizDev at Cybecs Security Solutions, former Global CISO at Elbit Systems, EL AL Airlines, Mekorot, and many other organizations, top Expert for critical infrastructure cyber security.

In a conversation about the challenges of women in cyber, life-work balance, OT What are the cyber challenges and create value for internal customers.

As one promoting women in Israeli cyberspace, is there a difference between women and men?

Why "Women who enter the cyber field make conscious choices about work-life balance."

What is the cyber status in 2023?

What are CISO challenges in large organizations?

Is there a difference between Israel and abroad in the status of the CISO, the organizational culture, and the female aspect?

The "new" cyber world versus the old one?

Trends in the cyber world in the coming years?

OT, What are the cyber challenges, and how do you create value for internal customers?

The conceptual shift from traditional cyber to cyber in a business sense?

And more...

נחשון פינקו ומלי בר מארחים את צופית שחר, סמנכ"לית אסטרטגיית סייבר ופיתוח עסקי בחברת סייבקס פתרונות אבטחה לשעבר סיסו גלובלית בחברת אלביט מערכות, אל על, מקורות וארגונים רבים נוספים. מומחית מובילה לאבטחת סייבר בתשתיות קריטיות. בשיחה על האתגרים של נשים בסייבר, איזון חיים-עבודה, אתגרי ההגנה על מערכות תפעוליות ואיך יוצרים ערך ללקוחות פנימיים

כאחת המקדמת נשים במרחב הסייבר הישראלי, האם יש הבדל בין נשים לגברים?

מדוע "נשים שנכנסות לתחום הסייבר עושות בחירות מודעות לגבי איזון בין עבודה לחיים".

מה מצב הסייבר ב-2023?

מהם אתגרי הסיסו בארגונים גדולים

האם יש הבדל בין ישראל לחו"ל במעמד הסיסו ובתרבות הארגונית בפן הנשי

עולם הסייבר ה"חדש" מול הישן

טרנדים בשנים הקרובות בעולמות הסייבר

מערכות תפעוליות, מהם אתגרי הסייבר וכיצד יוצרים ערך ללקוחות פנימיים

המעבר מסייבר מסורתי לסייבר בראי העסקי

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 54 - ICS Security em Geral
Pub date: 2023-07-27

Solicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Terence Gill & Roger Simmons: Bringing Texas Utilities Together to Strengthen The Grid Through Collaboration
Pub date: 2023-07-27

About Terence Gill: Terence Gill is a seasoned professional with 26 years of experience in technical roles across various industries. With a background in Computer Science and Finance, he has successfully designed and developed critical systems for organizations like Lockheed Martin, the New York Metropolitan Transportation Authority, and BNY Mellon. Currently, as the Program Manager of the Texas Cybersecurity Outreach Program, he collaborates with Cybersecurity Specialist Roger Simmons and the Public Utility Commission of Texas to enhance cybersecurity posture among almost 60 utilities across the state, transforming the program from a legislative bill into a pivotal force safeguarding the Texas grid.

About Roger Simmons: Roger Simmons, CISSP, C|EH, is a highly experienced Cybersecurity Specialist at Paragon Systems, boasting an impressive career spanning over 18 years. With a diverse background in both public and private sector organizations, he has played pivotal roles in establishing and fortifying security and compliance programs. Notably, he contributed to shaping the U.S. Department of Defense's cyber workforce requirements and co-chaired Texas's Statewide Information Security Advisory Committee on Security Workforce Development.

In this episode, Aaron, Terence, and Roger discuss:

Exploring the Texas Cybersecurity Outreach Program
Collaborative efforts in strengthening cybersecurity for power utilities
Asset management and its role in cyber resiliency for organizations
The importance of personnel identification for cybersecurity in the Texas grid

Key Takeaways:

The Texas Cybersecurity Outreach Program is a unique initiative bringing utilities together to cooperate on cybersecurity solutions, driven by government vision and legislative support, fostering a platform for knowledge exchange and mutual learning to bolster the security of electric utilities in Texas.
In the power utility industry, a strong culture of sharing and collaboration drives significant advancements in safety and reliability, as organizations unite to tackle challenges and bolster the grid's resilience, ultimately benefiting the greater good of society.
Asset management is the foundational key to enhancing cybersecurity resilience, understanding the true risks to the business, and building a more reliable system, and it requires continuous improvement and buy-in from the C-suite to ensure its effectiveness.
Effective cybersecurity in the energy sector requires comprehensive asset management, including identifying critical personnel responsible for managing assets during a crisis and fostering communication and collaboration between utilities.

"Not enough utilities are talking to each other, getting involved and talking to each other. That's really my main concern. Because, as we know, a lot of bad actors are out there, and they're working together. And they're doing whatever they can to penetrate our systems and to cause chaos and havoc......getting utilities to talk to one another, I think that's critical communication." — Terence Gill

"The first piece of asset management is understanding what you have and trying to divide that into bite-sized pieces. So, regardless of the size of your organization, unless you're like a one person, one computer shop, you're going to have to divide and conquer." — Roger Simmons

Resources Mentioned:

Texas Utilities Cybersecurity Monitor Outreach Program: https://parasys.com/cybermonitor/

Critical Infrastructure Cybersecurity Summit: https://parasys.com/cybersummit/

Public Utility Commission of Texas: https://www.puc.texas.gov/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: h

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 52 - Reais impactos de incidentes cibernéticos aos ambientes de operação
Pub date: 2023-07-26

Solicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Interview with HD Moore
Pub date: 2023-07-26

HD Moore is most famous for his creation of the Metasploit penetration testing framework. It began in 2003 and hit the OT world in 2011. HD is now the Founder and CTO of RunZero, another cybersecurity startup that is starting to play in the OT Space. In this episode we spend the first third of the show talking about Metasploit ... early reaction, OT modules, is Metasploit still necessary and useful today. We then shift to creating asset inventories in IT and OT, which is what RunZero does. * Why HD decided to run back into the cybersecurity startup world? * How it started as a solo shop with HD writing all the code. * How HD things Shodan and RunZero are different. * What technique does RunZero use to 'scan'. A term that many fear in OT. Check out their approach to 'fragile devices'. * The OT reaction to this type of scanning. * What role uses the RunZero product?

Links RunZero website S4x24 Call For Presentations

View Details

Podcast: Fortinet Cybersecurity Podcast
Episode: Take Five #69 - Predictive Analytics, AI, and Machine Learning: OT Manufacturing
Pub date: 2023-07-25

This episode was recorded on 7/25/2023

In this episode, Jim Richberg, Fortinet’s Vice President of Information Security and Field CISO for the Public Sector, teams up with Ricardo Ferreira, Fortinet's EMEA Field CISO, to delve into the present significance of artificial intelligence (AI) and machine learning (ML) in OT manufacturing. The discussion will cover various topics, such as the potential risks associated with adopting AI and ML, how AI/ML can help OT manufacturing industries ensure accuracy and reliability, and advice for CISOs looking to implement AI/ML in their organizations.

For more information about OT manufacturing, visit our website, www.fortinet.com/manufacturing?utm_source=social&utm_medium=linkedin-org&utm_campaign=sprinklr

The podcast and artwork embedded on this page are from Fortinet Cybersecurity Podcast, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 53 - Transformação Digital com CyberSecurity na Indústria 4.0
Pub date: 2023-07-26

Solicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: Compliance with an eye on OT security.
Pub date: 2023-07-26

An unnamed APT has a remote code execution exploit for Rockwell Automation ControlLogix communications modules. Court temporarily blocks water system cybersecurity mandate. Industrial controller vulnerabilities pose a risk to critical infrastructure. US Federal government issues voluntary IoT security guidelines.

Our guest is Mea Clift of Woodard & Curran discussing how compliance should not be a checkbox activity with an eye on OT security and shares her experience in securing the water/utilities space.

On the Learning Lab, Mark Urban is joined by Dragos Vulnerability Analyst Logan Carpenter in final part of three segments focused on vulnerabilities in the OT world.

Webinars.Webinar: Operationalizing OT Threat Intelligence – a Rockwell Automation ControlLogix Case Study

Join us for this exclusive behind-the-scenes look at how Dragos approaches this on a regular basis, using the recently disclosed Rockwell Automation ControlLogix EtherNet/IP (ENIP) communication module vulnerabilities (CVE-2023-3595 and CVE-2023-3596).

Webinar: Securing Digital Transformation: OT Cybersecurity Innovation and Resilience

As business and innovation come together, digital transformation isn’t a future concept - it’s happening right now. Join Dave Bittner and our friends from AWS, Splunk and Dragos on August 3rd @ 2pm EST for a live panel on “Securing Digital Transformation: OT Cybersecurity Innovation and Resilience” where we’ll dive into secure digital transformation, managing OT/IT cyber risk and the value and vision of Cloud resources.

Control Loop News Brief.ControlLogix RCE exploit.Rockwell warns of new APT RCE exploit targeting critical infrastructure (BleepingComputer)

Dragos Enabled Defense Against APT Exploits for Rockwell Automation ControlLogix (Dragos)

Court temporarily blocks water system cybersecurity mandate.EPA ’disappointed’ by hold on agency efforts to spur water systems cybersecurity (The Washington Post)

Industrial controller vulnerabilities pose a risk to critical infrastructure.Security flaws in Honeywell devices could be used to disrupt critical industries (TechCrunch)

Implementing the US National Cybersecurity Strategy.National Cybersecurity Strategy Implementation Plan (The White House)

US Federal government issues voluntary IoT security guidelines.Biden-⁠Harris Administration Announces Cybersecurity Labeling Program for Smart Devices to Protect American Consumers (The White House)

White House, FCC advance efforts to add security labels to connected devices (CyberScoop)

Control Loop Interview.The interview is with Mea Clift of Woodard & Curran discussing how compliance should not be a checkbox activity with an eye on OT security and her experience in securing the water/utilities space.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Vulnerability Analyst Logan Carpenter in final part of three segments focused on vulnerabilities in the OT world.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Data Breach Today Podcast (LS 32 · TOP 5% what is this?)
Episode: Managing Legacy Medical, OT, IoT Device Risk in Healthcare
Pub date: 2023-07-25

While patient safety risks posed by unpatched security vulnerabilities in legacy medical devices often grab headlines, healthcare entities shouldn't underestimate the serious business risks involving other poorly secured IoT and OT gear used in healthcare settings, said Mohammad Waqas of Armis.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 90: SBOM: The Future of Cybersecurity with Daniel Bardenstein
Pub date: 2023-07-25

Prepare yourself for another captivating episode of the CS2AI Podcast!

Today, we feature an exclusive interview with Daniel Bardenstein, a former USG official turned entrepreneur. Having recently launched a groundbreaking start-up centered on the critical concept of SBOM, Daniel brings a wealth of insider knowledge and experience to the table!

Daniel is the Co-founder and Chief Technology Officer of Manifest, a pioneering company specializing in comprehensive SBOM management. Their core mission is to facilitate organizations in embracing this innovative and relatively new concept with utmost simplicity and automation. Through their state-of-the-art solutions, Manifest empowers businesses to navigate the complexities of SBOM seamlessly, ushering in a new era of efficiency and ease.

In today’s riveting discussion, hosted by Bryson Bort, Daniel pulls back the curtain on what truly happens in the trenches of SBOM and unlocks the secrets to implementing his game-changing approach within organizations.

If you have ever wondered what SBOM is all about and how it could transform the way in which your organization operates, this interview is a must-listen! Get ready to dive into the nitty-gritty of SBOM as Daniel spills the beans on what is happening in the thick of it, offering invaluable insights on how to begin implementing this cutting-edge technology within your organization, starting today!

Fasten your seatbelt and gear up to elevate your cybersecurity game to unprecedented heights!

Show highlights:

What is an SBOM?
Why SBOM is essential for asset owners.
Two key ways to collect SBOMs.
Integrating vulnerability management with asset management.
Looking retroactively at legacy systems.
How SBOM makes vulnerability management better.
The importance of vulnerability management.
How to get started with internal product security.
How to get customers to take action.
How long will it take to see value?

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Daniel Bardenstein on LinkedIn

Manifest

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Doron Sivan, CEO & Co-founder @MADSEC security, and an author about OT cyber consulting & services
Pub date: 2023-07-25

Nachshon Pincu hosts Doron Sivan, CEO & Co-founder at MADSEC security and an author. Doron wrote books about networks and technology that became a must in training courses in Israel and sold over 140,000 copies in a conversation about OT cyber consulting, the need for regulation, and certification in this field.

What are the threshold requirements for cyber consulting and OT cyber in particular? Traditional cyber IT companies have also started offering consulting and services in cyber OT. A welcome phenomenon or a problem?

How do you recommend clients choose a cyber OT consulting firm?

The world of OT cyber surveys seems entirely breached, and there is a need to make some order. How would you attack the issue?

A more personal side of you as a writer, a hobby, or a second career. Your latest book, "Compasses Tuner," what is the book about?

And more…

נחשון פינקו מארח את דורון סיון, מנכ"ל ומייסד שותף ב-מדסק סקיוריטי וסופר. דורון כתב ספרים על רשתות וטכנולוגיה שהפכו לחובה בקורסי הכשרה בישראל ומכר למעלה מ-140,000 עותקים בשיחה על ייעוץ סייבר למערכות תפעוליות והצורך ברגולציה והסמכה בתחום זה

מהן דרישות הסף לייעוץ סייבר ולסייבר למערכות תפעוליות בפרט

חברות אי.טי. מסורתיות בתחום הסייבר החלו להציע גם ייעוץ ושירותים בתחום הסייבר למערכות תפעוליות, תופעה מבורכת או בעיה?

איך אתה ממליץ ללקוחות לבחור בחברת ייעוץ סייבר למערכות תפעוליות

עולם סקרי סיכוני הסייבר פרוץ, ויש צורך לעשות קצת סדר. איך ההיית תוקף את הנושא?

צד אישי יותר שלך כסופר, תחביב או קריירה שנייה

הספר האחרון שלך, "מכוון המצפנים", על מה הספר

ועוד…

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Dark Mode Podcast (LS 24 · TOP 10% what is this?)
Episode: #57 - Cybersecurity Challenges in Aerospace and Critical Infrastructure - Jordan Plotnek
Pub date: 2023-07-23

Gabe & Ben host Jordan Plotnek who is an esteemed expert in security risks to critical infrastructure, specializing in designing and operating resilient operational systems. With a background as an Air Force veteran and space systems PhD, he brings a wealth of knowledge to the field, particularly in the aerospace sector.

// SUPPORT THIS CHANNEL // 📧 ⁠Subscribe to the Marza-notes, and receive a copy of my favourite mental models⁠ 🌏 ⁠Website⁠

🎬 ⁠YouTube⁠ 🎙 ⁠Download Our Podcast⁠ 👾 ⁠LinkedIn⁠ 🌪 ⁠Ben Sullivan⁠ 🌪 ⁠Gabe Marzano

Show Notes: 00:00 - Introduction 02:18 - Jordan's Thesis - A Threat-Driven Resilience Assessment Framework and Security Ontology for Space Systems 5:02 - The Reliance on Space Systems and How Interwoven it is in our Daily Life 10:03 - What are the Space Security Threats? 16:13 - The First Space Race 20:17 - Evolving the space systems and Infrastructure 24:52 - Supply Chain Security 27:00 - Recent Examples of Compromises 30:38 - Electromagnetic Attacks & Hackers

Resources: 1. Dr Jordan Plotnek Website 2. Jordans Thesis

🔔 Turn on notifications to stay updated with new episodes discussing educational topics around Technology, Cyber Security and Universal Mega Trends shaping the future of humanity.

Send in a voice message: https://podcasters.spotify.com/pod/show/dark-mode-podcast/message

The podcast and artwork embedded on this page are from Gabe Marzano, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Mollie Breen: Accelerating OT Security, Reliability and Efficiency
Pub date: 2023-07-20

About Mollie Breen: Mollie Breen is the dynamic CEO and Co-founder of Perygee, a groundbreaking IoT/OT security platform that has garnered significant funding. With a strong background as an Applied Research Mathematician at esteemed organizations such as the Department of Defense and the National Security Agency, Mollie is a recognized expert in network exploitation and machine learning. Her passion for improving IoT device security and her involvement in shaping medical IoT standards through the IEEE Clinical IoT Data and Device working group reflect her dedication to making a lasting impact in the field. Through Perygee, Mollie is empowering security teams with an innovative solution that consolidates and streamlines data, enabling informed decision-making and enhanced cybersecurity measures.

In this episode, Aaron and Mollie Breen discuss:

Comprehensive security solutions for OT environments
Incremental automation and value-driven OT asset management in small organizations
Enhancing collaboration and efficiency in OT security
Breaking down information silos and fostering collaboration between IT and OT in organizations

Key Takeaways:

In the era of increasing connectivity and automation, the importance of comprehensive security solutions for OT environments cannot be overstated, addressing challenges such as visibility, contextual asset management, and automation based on accurate and integrated data to ensure security, resilience, and business continuity.
Implementing a comprehensive and incremental automation process in operational technology (OT) environments can provide immediate value, increase trust in automation, and alleviate the burden of manual processes, enabling organizations to enhance their security, reliability, and efficiency.
Computers excel in code analysis by swiftly identifying differences and patterns, enabling organizations to save time, enhance efficiency, reduce costs, and bridge the security and operations gap through collaborative knowledge sharing for improved OT security.
Facilitating collaboration between IT and OT in organizations is vital to boost efficiency, exchange valuable data securely, and implement gradual security measures that safeguard operations without jeopardizing proprietary information.

"I would wish upon everyone to have some awareness about cyber and an appreciation for not just what it's protecting against, but what it's also able to accelerate. I think we forget a lot about where security can help things move more quickly and help us embrace innovation more quickly." — Mollie Breen

Connect with Mollie Breen:

Website: https://perygee.com/

Email: mollie@perygee.com

LinkedIn: https://www.linkedin.com/in/mollie-caroline-breen/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: US Dept of Energy's OT Defender Fellowship Program
Pub date: 2023-07-19

Dale is often critical of the US Government's efforts and programs to address OT cyber risk. So it's a pleasure to highlight a program that is working.

Samantha Ravich, Chair of the Center on Cyber and Technology Innovation at the Foundation for the Defense of Democracies, joins Dale to discuss the US Department of Energy's OT Defender Fellowship Program.

They begin by describing the program, its goals, what are ideal candidates for the program, and the early results from the first few cohorts. Then Timothy Pospisil of Nebraska Public Power District and part of the 2022 OT Defender Fellowship cohort joins the show to discuss his experience in the program.

At the end we discuss how this could be expanded to address water, critical manufacturing and other sectors.

Link

OT Defender Fellowship Program

View Details

Podcast: Today with ISSSource
Episode: Resiliency in Cybersecurity
Pub date: 2023-07-18

There is no doubt attacks are becoming more targeted and more sophisticated toward OT, which means companies need to think how they can find an attack and remain as resilient as possible so they can keep operating. This way you don’t have to hear a company say they had to “shut down operations out of an abundance of caution.”

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: John Heldreth: Growing a 15,000 Strong Automotive Cybersecurity Group
Pub date: 2023-07-19

We sat down with the Car Security Operations at Volkswagen AG, and ASRG founder to discuss his journey into automotive cybersecurity, what he learned along the way, and why the upcoming Secure Our Street Conference is so important to the community.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 89: Putting Creativity and Problem Solving Skills to Use in Cybersecurity with Mike Radigan
Pub date: 2023-07-18

Get ready for another captivating interview with a true cybersecurity luminary!

Joining Derek on the podcast today is the multi-talented Mike Radigan! Mike is a seasoned cyber risk advisor at Cisco with a diverse background and a knack for problem-solving.

Mike's current role is impressive, and his entire journey has been nothing short of extraordinary! Renowned for his creativity and expertise, and with a background in electrical engineering, he has proven himself a formidable problem-solver. Beyond his professional pursuits, Mike is also an avid educator, a master networker, and a passionate connector within Ohio's business and security events. Additionally, he boasts a fascinating range of interests, from being a semi-retired basketball player to a devoted cigar enthusiast and dog lover.

With Derek having been privileged to know Mike for years, today’s interview promises to unveil intriguing insights and stories that will captivate cybersecurity enthusiasts and general audiences alike! Stay tuned to hear about Mike’s fascinating journey and learn from his many years of cybersecurity experience!

Show highlights:

How Mike became interested in technology.
When security first came into play at Cisco.
The evolution of cybersecurity from the early days to today.
Risk quantification and cybersecurity.
The importance of reliability in cyber security.
An agnostic model for defining how risk works.
How are those models applied in OT environments?
The importance of reliability in cyber security.
Why risk is a derived value.
Lessons learned from the DRC Organization.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Mike Radigan on LinkedIn

Cisco

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Refael Franco Former Deputy General Director @INCD & founder @CodeBlue about his new book ”PlanB”
Pub date: 2023-07-17

Nachshon Pincu hosts Refael Franco, Former Deputy General Director at Israel national cyber directorate (INCD), founder & CEO of CodeBlue, talking about his new book "PlanB" and cyber attack recovery.

What has changed in the cyber world during the last year?

How the book PlanB was born, and why you decided not to put it out for sale?

What is the book about?

All are talking about managing cyber crises and resilience, and then you try to change the discourse to "recovery." What is the "Torah" on one leg?

In our preliminary conversation, you said that the theory of recovery is similar to warfare and consists of do's and don'ts, "Whoever reads the book will take actions that are meaningful to him in the organization"?

On the one hand, we see more and more service providers entering the OT world, and on the other hand, there is still no sense of a significant awakening from the customers' side. How do you explain that, or maybe I'm wrong?

And more…

נחשון פינקו מארח את רפאל פרנקו, לשעבר משנה לראש מערך הסייבר הלאומי, מייסד ומנכ"ל קוד-בלו על ספרו החדש תוכנית שנייה והתאוששות מתקפות סייבר.

מה השתנה בעולם הסייבר בשנה האחרונה מאז הפודקאסט האחרון שערכנו

איך נולד הספר PlanB, ולמה החלטת לא להוציא אותו למכירה

במה דן הספר

כולם מדברים על ניהול משברי סייבר וחוסן, ואז אתה מנסה לשנות את השיח ל"התאוששות". מהי התורה על רגל אחת

בשיחה המקדימה שלנו אמרת שתיאוריית ההחלמה דומה ללוחמה ומורכבת מעשה ואל תעשה, אני מצטט מי שיקרא את הספר יבצע פעולות משמעותיות עבורו בארגון

מצד אחד אנחנו רואים יותר ויותר נותני שירות שנכנסים לעולם המערכות תפעוליות, ומצד שני עדיין אין תחושה של התעוררות משמעותית מצד הלקוחות. איך אתה מסביר את זה, או שאולי אני טועה

ועוד…

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Kathleen Moriarty on CIS' IoT Security Guidance
Pub date: 2023-07-16

Kathleen Moriarty, Chief Technology Officer of the Center for Internet Security (CIS) joins the Nexus podcast to discuss CIS' recently published IoT Embedded Security Guidance. The document walks vendors, developers, DevOps professionals through the most commonly used IoT protocols and analyzes them from a security perspective. The aim is to help vendors and developers with this selection process and assist with building security in at the protocol level.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Omree Wechsler Senior researcher: cyber policies & strategy @TLV University about AI & space warfare
Pub date: 2023-07-13

When we decided one minute before starting the podcast to move to English, it took a few minutes for the "CPU" in my head to switch. 😊

Nachshon Pincu hosts Omree Wechsler Cyber Threat Intelligence (CTI) analyst and Senior cyber policy and strategy researcher at Yuval Neeman Workshop for Science, Technology, and Security at Tel Aviv University. Talking about the new baz of cyber & AI and space cyber warfare.

AI has become the hawk of 2023 and will probably accompany us in the coming years. כםרfor the beginning, what's the difference between Machin Learning (ML), Deep learning (DL), and Artificial Intelligence (AI)?

What is the correlation between AI and cyber? Has Pandora's box been opened as many try to paint?

Can the attackers use AI technology as part of the attack (at this point)?

What is the importance of cyber research in the context of space?

We know there has been an arms race in space for several years. Cyber is part of the "game" and how it manifests itself.

Examples of satellite attacks. (Vsat, Ukraine war, etc.)

Are satellite attacks only state capabilities, or has the crime syndicate also entered the field?

And More…

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Eric Cosman On Dow, Open Automation, 62443 & More
Pub date: 2023-07-12

Eric Cosman had a 38 year career at Dow Chemical, was on the ISA 99 committee its inception, and then he retired. After retirement Eric joined ARC Advisory Group as a Contributing Consultant and got even more active with ISA. He is a long time co-chair of ISA99 and was President of ISA in 2020. Eric and Dale discuss: * Dow's in house developed DCS and SIS: MOD * Eric's top trend from 2022: The value of open automation and the Open Process Automation Forum * ISA/IEC 62433 + Eric's view they are "primarily engineering standards" + What Eric thinks about the safety / security analogies + His experience in being ISA President in the first year of COVID + ISA as "the home of automation" + Has ISA lost mindshare on ICS security standards to the US Government and training to SANS

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 33 · TOP 5% what is this?)
Episode: The IT/OT cultural divide in the federal space.
Pub date: 2023-07-12

Japan’s largest port disrupted by ransomware. Cl0p breaches Schneider Electric and Siemens Energy. Solar panel vulnerabilities. Threats and risks to electric vehicle charging stations. RedEnergy ransomware and information stealer targets industrial sectors. CISA advisories.

Our guest is Christopher Ebley from Blackwood returns to discuss the IT/OT cultural divide in the federal space and IT threats that are impacting OT systems.

The Learning Lab continues with part 2 of the 3-part discussion between Dragos’ Mark Urban and Vulnerability Analyst Logan Carpenter talking about vulnerabilities in the OT world.

Control Loop News Brief.Japan’s largest port disrupted by ransomware.Japan’s largest port stops operations after ransomware attack (BleepingComputer)

Japan's biggest port, Nagoya, hit by suspected cyberattack (Nikkei Asia)

Pro-Russian hackers target Port of Nagoya, disrupting loading of Toyota parts (The Japan Times)

Nagoya Port Resumes Some Operations After Ransomware Attack (Bloomberg)

Cl0p breaches Schneider Electric and Siemens Energy.Schneider Electric and Siemens Energy are two more victims of a MOVEit attack (SecurityAffairs)

Siemens Energy confirms data breach after MOVEit data-theft attack (BleepingComputer)

Solar panel vulnerabilities.Exploited Solar Power Product Vulnerability Could Expose Energy Organizations to Attacks (SecurityWeek)

IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits (Unit 42)

Actively Exploited Industrial Control Systems Hardware - SolarView Series (VulnCheck)

Threats and risks to electric vehicle charging stations.EV Charger Hacking Poses a ‘Catastrophic’ Risk (WIRED)

RedEnergy ransomware and information stealer targets industrial sectors.Ransomware Redefined: RedEnergy Stealer-as-a-Ransomware attacks (Zscaler)

CISA advisories.CISA Releases Three Industrial Control Systems Advisories (CISA)

Control Loop Interview.The interview is with Christopher Ebley of Blackwood talking about the IT/OT cultural divide in the federal space and IT threats impacting OT systems.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Vulnerability Analyst Logan Carpenter in part two of three segments on vulnerabilities in the OT world.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nuclear Explained (LS 28 · TOP 10% what is this?)
Episode: Nuclear Explained – Computer Security in the Nuclear World
Pub date: 2023-07-11

Digital technologies support operations and automation at facilities handling nuclear material or other radioactive material, potentially leading to increased operational efficiency, reduced labour costs, and better safety and security. However, digital innovations may also pose threats and risks, underscoring the need for robust computer security within a nuclear security regime. What does information and computer security look like in the nuclear world? What are the latest trends within the computer security community? How often do cyberattacks occur?

The podcast and artwork embedded on this page are from International Atomic Energy Agency, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: To The Point - Cybersecurity (LS 35 · TOP 3% what is this?)
Episode: Securing Electric Vehicles in the Federal Fleet and More! with Matt Bianco
Pub date: 2023-07-11

We absolutely love when we have return guests on the podcast. And we are so excited to have Matt Bianco, President of FedWay Consulting joining us again to talk about one of our favorite topics – electric vehicles (EV). Or, more specifically, the move to electric vehicles across the federal government. The Biden Administration has set a goal of a 100% electrified fleet by 2027. Matt shares insights on progress being made to date and what the next few years look like to achieve the goal. We also discuss some of the inherent challenges with anything connected to the internet such as cyber threats to EV charging stations and securing federal EV infrastructure. And we talk about what a future of EVs means for places such as gas stations and why we’re not quite there yet on solar powered cars.

Matt Bianco, President at Fedway Consulting Matt is a thought leader within the US Federal Government ecosystem related to Electric Vehicle (EV) Charging integration which includes strong knowledge of POV/GOV programs (workplace/fleet), hardware/software solutions, infrastructure, policy, etc. With partnerships across the industry including ChargePoint, Apollo Sunguard (SDVOSB), Beam Global, Freewire, etc, Matt has the ability to assist in formulating a plan that will cover every aspect of executing a flawless and easy Federal EV charging program. Other focuses include CyberSecurity initiatives and software solutions.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e241

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 88: CyberSecurity - The Passport to a Global Career with Omar Sherin
Pub date: 2023-07-11

You are in for a treat today because we have an extraordinary guest and true industry titan joining us!

Omar Sherin is a renowned cybersecurity expert. He is a partner at Ernst and Young Digital Solutions and Cybersecurity and former director of OT Cybersecurity for the same prestigious firm. However, Omar is multifaceted, and his story goes beyond his professional achievements. He is also a founder, dedicated father, adventurous scuba diver, and an avid lover of cars and motorcycles!

With his vast experience and diverse interests, Omar has traversed the realms of technology and exploration, making him a captivating and inspiring figure in the cybersecurity world. In today’s discussion, he sheds light on his journey and delves into his remarkable contributions as a regional leader, sharing intriguing insights from his region of the world. He also gets into an exciting topic that lies ahead- prepping for the World Cup!

Omar Sherin is not just a technologist but also a true adventurer and global citizen! Brace yourself for an enlightening conversation that transcends the boundaries of cybersecurity!

Show highlights:

How Omar got into cybersecurity.
Two occurrences in Omar's life triggered his professional momentum.
Omar discusses the incident that opened his eyes to the value of data.
Why state-sponsored attacks require state-sponsored defenses.
Omar shares his unique perspective on cybersecurity.
How safety culture is embedded in cybersecurity.
Omar talks about building an OT team in Africa.
The ramifications of holding a world cup in Qatar.
How to prepare for a major event.
Why is cybersecurity a golden opportunity for young people?

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: KBKAST (LS 27 · TOP 10% what is this?)
Episode: Episode 193 Deep Dive: Dr. Jordan Plotnek | The Intersecting Worlds of Critical Infrastructure and Space Security
Pub date: 2023-07-10

Securing space technology is no longer a luxury but a necessity for the smooth functioning of our increasingly interconnected world. In this episode of KBKast, we delve into the fascinating world of space technology and its connection to critical infrastructure. Dr. Jordan Plotnek talks about his journey, the challenges of space security, and emphasizes the need for a tailored and collaborative global approach to managing space system security that has humanity at its core. Dr Jordan Plotnek received a PhD in space systems security and resilience from the University of South Australia and a Bachelor of Engineering in Telecommunications and Electronics from Swinburne University in Melbourne. Jordan is an Australian Air Force veteran and has held senior Operational Technology security positions for private and public sector organisations internationally. Jordan is currently a space security researcher at the University of South Australia and the Lead Partner for Critical Infrastructure at Anchoram Consulting. Jordan’s research and professional interests are centred around space systems security, critical infrastructure resilience, and cyber-physical conflict.

The podcast and artwork embedded on this page are from KBI.Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: mnemonic security podcast
Episode: KraftCERT
Pub date: 2023-07-10

KraftCERT trusselvurdering 2023 | In Norwegian only

Our podcast guest this week is Espen Endal, previous mnemonic colleague and currently OT Security Analyst at the Norwegian energy sector CERT; InfraCERT (KraftCERT in Norwegian).

InfraCERT is an ISAC (Information Sharing and Analysis Center) and an IRT (Incident Response Team). Mainly working to update their members about relevant vulnerabilities and threats to make them able to better detect and respond to digital attacks. They are also part of the Norwegian national response organisation.

During their conversation, Robby and Espen discuss InfraCERT’s annual threat report, what they consider the most serious threats for their member organisations, both long term and short term, and what techniques they often see being used against their members.

Espen also talks about the push to the cloud, the trade-off this entails particularly in these sectors, as well as the impact NIS and eventually NIS2 will have on their members.

The podcast and artwork embedded on this page are from mnemonic, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Walter Risi on the CISO's Journey from IT to OT
Pub date: 2023-07-09

Walter Risi, Global OT Lead and the Technology and Cyber Security Consulting leader at KPMG in Argentina, joins the Nexus podcast to discuss the CISO's journey from IT to OT.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Roni Roytman Co-founder & CEO @INTENSITY Global Group, talks about OT Cyber Crisis Management & IR
Pub date: 2023-07-08

נחשון פינקו מארח את רוני רויטמן, יזם סדרתי שנבחר לאחד ממאה המנכ"לים הישראלים המשפיעים ביותר על ידי מגזין כלכליסט, יו"ר חברת האחזקות דיפנס1 הכוללת את

INTENSITY Global Group, Cycon Security, and CINCORE.

מייסד שותף ומנכ"ל החברות שהוזכרו לעיל העוסקות באבטחת סייבר וניהול משברים

הגישה לאירוע סייבר באופן כללי. מהי המתודולוגיה שלפיה אתה פועל, ואילו שיטות לדעתך צריכים ארגונים ליישם

באיזה שלב חברות צריכות לבחור בחברת ניהול אירועי סייבר

מעט מאוד חברות ,אי.אר מכירות את תחום הסביבות התפעוליות, ומי שפחות, ניגשים לאירוע בעיני ה-IT, מה שעלול לגרום לנזק משמעותי יותר מהתקיפה עצמה. מה צריך לשים דגש בטיפול באירוע סייבר לסביבות תפעוליות

מעבר לנזק לכאורה, אירוע סייבר הוא אירוע מודע. אני לוקח שתי דוגמאות מהפעם האחרונה, טכניון ותנובה, הראשונה חוותה אירוע תודעתי מטורף, והשנייה החליקה וירדה מתחת לרדאר כאילו כלום. אנא נתח את האירועים הללו למעננו

ועוד...

Nachshon Pincu hosts Roni Roytman, a serial entrepreneur chosen as one of the 100 most influential Israeli CEOs by Calcalist magazine, Chairman of DEFENSE1 holdings company, including INTENSITY Global Group, Cycon Security, and CINCORE. Co-Founder & CEO of the companies mentioned above engaged in cyber security and crisis management.

Let's start with the approach to a cyber incident in general. What is the methodology according to which you operate, and which methods do you think organizations need to implement?

At what stage should companies choose an IR and cyber incident management company?

Very few IR companies are familiar with the field of OT, and those who are less, approach the event in the eyes of IT, which can cause more significant damage than the attack itself. What should emphasize in handling an OT cyber incident?

Beyond the apparent damage, a cyber incident is a conscious event. I take two examples from the last time, Technion and Tnuva, the first experienced a crazy consciousness event, and the second slipped and went under the radar as if nothing happened. Please analyze those events.

And More..

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: ICS Security Quarter In Review Q2-2023
Pub date: 2023-07-05

Mark Hyman of Verge Management Group joins Dale to discuss the big 3 stories of Q2 along with their win, fail and predication.

Big Stories

The OT Security Layoffs (Mark is a recruiter specialized in ICS/OT security)
Still No US National Cyber Director?
The Merck NotPetya Insurance Claim Ruling

Plus they both have a win, fail and prediction at the end.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Pete Mauro: Designing System Security Before ‘Cyber’ Became Part of Everyday Vocabulary
Pub date: 2023-07-06

About Pete Mauro: Pete Mauro is a highly accomplished serial entrepreneur with extensive experience and successful exits in the defense industry. With a background spanning startups, system integrators, procurement, and program management, Pete is the CEO and Founder of DTCUBED, a startup consulting firm specializing in cybersecurity, predictive analytics, and digitally transformative technologies for defense and critical infrastructure markets. Prior to founding DTCUBED, he served as the Chief Innovation Officer and Chief Cyber Technology Officer for Gryphon Technologies, leading the company's technical advancements and marketing efforts. Pete's expertise in bringing technology to the federal market and aligning it with program requirements has earned him a reputation as a trusted partner. With over 33 years in the industry, Pete's strategic insight and tactical implementation have been instrumental in driving innovation and achieving success in various applications.

In this episode, Aaron and Pete Mauro discuss:

Cybersecurity in systems design and its parallels in critical infrastructure risk management
Demonstrating operational value in critical infrastructure cybersecurity and addressing the shortage of skilled engineers
Proactive and comprehensive conversations in cybersecurity for effective risk mitigation
Building a pipeline for cybersecurity talent

Key Takeaways:

The transition from traditional risk management to incorporating cybersecurity into systems design is a natural progression, as both share the common goal of ensuring availability and security, despite different terminology and attack vectors.
Operational value in cybersecurity for critical infrastructure requires a shift from fear-based tactics to tangible benefits, integrating cybersecurity as part of the solution, and investing in specialized training for skilled engineers who understand the unique challenges of OT and critical infrastructure.
Having open discussions about cybersecurity with all stakeholders during the early stages of system design and implementation is crucial, as is the necessity for a wide range of tools to successfully combat cybersecurity risks and safeguard critical infrastructure.
A strong cybersecurity talent pipeline is vital for addressing expertise shortages and protecting critical infrastructure. Collaboration between universities, industry, and government is crucial, as is effective communication among stakeholders.

"We have a shortage of talent, and I don't mean every engineer to be the cyber expert, but if we get every engineer coming out to try to understand security a little more, and then a pocket of those engineers become the expert." — Pete Mauro

Connect with Pete Mauro:

Website:www.d-t3.com

LinkedIn: linkedin.com/in/petergmauro

An Opportunity’s Knockin’, Inc. (A O.K.):www.AnOppKnock.org

Vert Properties, Inc.:www.vertproperties.com

Incutate Workplace:www.Incutate.com

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Risk in Context - When to Patch, When to Let It Ride [The Industrial Security Podcast]
Pub date: 2023-07-05

Patching is hard in many industrial / OT systems - the risk the new code poses to operations is comparable to the risk of a cyber attack. But - the vulnerability does not go away just because patching is hard. Rick Kaun, VP Solutions at Verve Industrial joins us to look at what to patch, when to patch, and automation to help make the whole process faster, easier and cheaper.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 87: Cyber Security for Transportation, Part 3 : Rails
Pub date: 2023-07-04

Today, we are excited to share a riveting panel discussion on cybersecurity for Rails!

We are honored to introduce our esteemed panelists, three remarkable individuals with a wealth of knowledge and expertise. Their diverse backgrounds and extensive experience in their respective domains make them invaluable contributors to today's discussion.

Miki Shifman holds the esteemed positions of CTO and Co-founder of Cylus, a company wholly dedicated to cybersecurity. With an impressive career spanning over 15 years, his expertise encompasses cybersecurity research and development, as well as communications and embedded systems. For the past six years, he has been at the helm of Cylus, focusing on rail cybersecurity and actively participating as a member of global standardization groups, advocating for awareness and best practices. Recognized as part of Forbes 30 under 30, Miki also enjoys indulging in the strategic game of chess.

Omar Sherin is a partner at EY. He leads the OT cybersecurity efforts for the MENA region. With an impressive 20-year track record in cybersecurity and a wealth of practical knowledge, his expertise extends to national security and the establishment of resilient infrastructures, including those within the rail systems.

Jo Dalton is a seasoned cybersecurity professional with 17 years of comprehensive industry experience. Her versatile background encompasses various facets of the field, from business compliance to operational components, along with the groundbreaking research conducted at Pen Test Partners.

Today’s enlightening panel discussion will provide a comprehensive view of the transportation industry, focusing on the scenarios within the rail sector.

Stay tuned for a thought-provoking exploration that will give you a broader perspective on railway transportation security.

Show highlights:

How the connected world has changed things.
The complexity of the rail industry.
Why do we need more detailed standards?
Global regulations for critical infrastructure.
How old is the technology in rail?
Challenges to be faced in the next three years.
The typical life cycle of a rail safety system.
The importance of having multiple companies working together.
Cyber resilience in the rail industry.
The need for industry-driven regulation of security.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Omar Sherin on LinkedIn

Ernst & Young (EY)

Jo Dalton on LinkedIn

Pen Test Partners

Miki Shifman on LinkedIn

Cylus

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: WE'RE IN! (LS 28 · TOP 10% what is this?)
Episode: Demystifying OT Cybersecurity with Danielle Jablanski
Pub date: 2023-06-29

The operational technology (OT) computer networks that support life as we know it are increasingly coming under threat. But despite the proliferation of malware aimed at critical infrastructure, Danielle Jablanski isn’t running for the hills. As an OT cybersecurity strategist for Nozomi Networks, Danielle helps critical infrastructure organizations understand and prioritize digital risks, whether they stem from a lack of visibility into industrial environments or a sophisticated cyberattack from a foreign nation-state.

Don’t miss the latest episode of WE’RE IN! to hear Danielle’s insights into industrial control systems (ICS) risk management, including the recently disclosed COSMICENERGY ICS-focused cyberthreat.

Listen to learn more about:

What makes the ICS security field “niche but not nebulous”
How Danielle’s background in nuclear weapons policy informs her approach to cyber incident planning
Why so few critical infrastructure operators know where equipment with known vulnerabilities may exist on their networks
Hacking satellites in space

The podcast and artwork embedded on this page are from Synack, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Josh Corman - Healthcare Security, SBOMs & More
Pub date: 2023-06-28

Josh Corman is the VP of Cyber Safety Strategy at Claroty, was the Chief Strategist of the CISA COVID Task Force, and founder of I Am The Cavalry. Josh and I dive into Healthcare Security, SBOMs and other topics.

Can OT in healthcare be treated in a similar way as the factory, power plant, water treatment plant, ... ?
The first fatality due to a cyber attack on a hospital.
Should we be focusing our efforts on reducing the impact if ransomware hits a healthcare facility? What is the equivalent to a steel reinforced cockpit door?
The PATCH Act (included in the Omnibus bill passed in Dec 2022) requiring medical device manufactures to provide a SBOM and a patching program. What is it? What will be the impact of this? (BTW, Josh changed my mind on this as a start to a long term impact)
Will the PATCH Act provisions delay approval of medical devices?
How accurate and complete are vendor generated SBOMs today? How will this be solved?
What will be the impact of SBOM mandates?
Differing views on the importance to society of attacks and outages in the agriculture / food industry
I Am The Cavalry turns 10.

We will need to have Josh back for a Part 2.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 32 · TOP 5% what is this?)
Episode: OT cybersecurity concerns in the federal space.
Pub date: 2023-06-28

The US Department of Energy was affected by Cl0p exploitation of MOVEit Transfer. Canada’s oil-and-gas sector is a likely target for Russian cyberattacks. Nuclear weapons cybersecurity is lacking. Access to a US satellite is being hawked in a Russophone cybercrime forum. ICS patches.

Today’s guest is Christopher Ebley from Blackwood talking with us about OT cybersecurity concerns for Federal IT leaders.

The Learning Lab has part one of a 3-part discussion between Dragos’ Mark Urban and Vulnerability Analyst Logan Carpenter talking about vulnerabilities in the OT world.

Control Loop News Brief.US Department of Energy affected by Cl0p exploitation of MOVEit Transfer.US government hit by Russia's Clop in MOVEit mass attack (The Register)

Energy Department among ‘several’ federal agencies hit by MOVEit breach (Federal News Network)

Canada’s oil-and-gas sector a likely target for Russian cyberattacks.The cyber threat to Canada’s oil and gas sector (Canadian Centre for Cyber Security)

Nuclear weapons cybersecurity is lacking.Nuclear Weapons Cybersecurity: Status of NNSA's Inventory and Risk Assessment Efforts for Certain Systems (GAO)

Access to a US satellite is being hawked in a Russophone cybercrime forum.Military Satellite Access Sold on Russian Hacker Forum for $15,000 (HackRead)

ICS patches.ICS Patch Tuesday: Siemens Addresses Over 180 Third-Party Component Vulnerabilities (SecurityWeek)

CISA Releases Four Industrial Control Systems Advisories (CISA)

Lessons learned from the electrical power sector.Electric Industry Cybersecurity: Lessons Learned from the Frontlines (Dragos)

Control Loop Interview.The interview is with Christopher Ebley of Blackwood talking about OT cybersecurity concerns for Federal IT leaders.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Vulnerability Analyst Logan Carpenter in the first of three segments to discuss vulnerabilities in the OT world.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Eng. Alexander Tartakovsky founder & CEO @IoT365, about the first OT cyber solution from level 0 to SIEM
Pub date: 2023-06-27

Nachshon Pincu hosts Alexander Tartakovsky, founder and CEO of IoT365 startup, in a conversation about what tools are missing in the OT/IoT cyber defense and why COOs and CISOs need a unified solution from level 0 to dedicated OT SIEM.

What is the problem IoT365 provides a solution to?

What is the IoT365 solution, and to whom is this solution addressed?

What is the most significant company/project you desire to participate in?

What financial difficulties do you have regarding the global economic recession?

Do you think OT cyber sector requires new players/startups? What is the future of the OT cyber?

And more...

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 86: Cyber Security for the Aviation/Aerospace Industry, Part 3
Pub date: 2023-06-27

Today, we have the pleasure of introducing two esteemed panelists poised to ignite our minds with their profound expertise on cybersecurity in the maritime sector.

Gary Kessler and James Cabe are two remarkable individuals who will shed light on the vast spectrum of applications that intertwine maritime operations and the crucial realm of cybersecurity.

Gary Kessler is a retired cybersecurity professor who has embraced diverse roles. With a remarkable career starting in the late 1970s, Gary has immersed himself in information security. However, his passion for maritime cyber has captivated his attention for the past five to six years. During the challenging times of the COVID-19 pandemic, Gary undertook a personal project close to his heart: writing a book on maritime cyber. Presently, he dedicates his life to exploring the depths of the water, both physically and intellectually, as he navigates the intricacies of cybersecurity in the maritime realm.

James Cabe is a seasoned cybersecurity specialist. He hails from a background deeply rooted in the history of the industry. Having spent his formative years at BBN Planet, James carries a wealth of experience. He ventured into diverse sectors during his career, including retail, foreign national critical infrastructure, and the oil and gas industry. He is currently immersed in the IoT realm, spearheading his own startup focused on developing a chaos-resilient Human-Machine Interface (HMI) independent of Windows. While James acknowledges his comparatively lesser experience in the maritime domain, his expertise in the oil and gas sector, particularly in anchoring systems, vibration analysis, and mud logging, adds a unique perspective to this distinguished panel.

In today’s exhilarating exploration, we delve into the intricate world where technology meets the high seas and discover how safeguarding our industry has become paramount in the face of emerging digital challenges. The diverse backgrounds and perspectives of the panelists ensure an engaging and comprehensive discussion on the topic at hand.

Stay tuned for an enlightening and dynamic conversation that promises to capture the essence of the maritime industry's cybersecurity landscape!

Show highlights:

The importance of cybersecurity in the maritime sector.
Why maritime is essential for national security, defense, energy, food security, and economic security.
Dealing with high-consequence events.
The cost of retrofitting new technologies onto old ships.
The push for autonomy on ships.
The dangers of relying on digital information.
The future of big boats and smart ships.
The lack of resiliency in maritime systems.
Automation and digitalization of the Maritime industry.
Building a cyber safety culture.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Gary Kessler on LinkedIn

Gary Kessler Associates

James Cabe on LinkedIn

ZPE Systems

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Critical Assets Podcast
Episode: Ghost in the Machine: a Future Look at AI and OT
Pub date: 2023-06-26

Join Patrick Miller, CEO of Ampere Industrial Security and his guest Amanda Freik, CRO of Altruistic as they discuss the need for collaboration and breaking down cultural barriers to effectively utilize data and drive innovation in the energy sector with AI/ML. We also touch upon the importance of approaching generative AI and language models like GPT with a strategic mindset, understanding the specific needs and goals of the organization before implementation. Additionally, we talk about the importance of recognizing and leveraging the untapped skills and potential within an organization to drive transformation and democratize access to meaningful work.

Show Links:

Amanda Freik LinkedIn - https://www.linkedin.com/in/amandafreick/

Altruistic Video Case Study - https://vimeo.com/733720685

Tony Robbins Book, Life Force - https://amzn.to/3qTXRfj

The podcast and artwork embedded on this page are from Patrick Miller, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: OTCEP Panel - Secure PLC Coding Practices
Pub date: 2023-06-21

This episode is a replay of a lively panel from the Cyber Security Agency of Singapore's OT Cybersecurity Expert Panel (OTCEP) last year. It begins with a great introduction to the Top 20 Secure PLC Coding Practices by Sarah Fluchs. At the 35 minute mark the panel discussion begins. There was a lot more disagreement and back and forth than the typical panel. This gives you a variety of points of view and positions to consider.

Paul Griswold moderated the panel of Dr. Ong Chen Hui, Joel Langill, Sarah Fluchs and Dale Peterson.

Links

Top 20 Secure PLC Coding Practices
2023 OTCEP Event Page, August 22 - 23 in Singapore
S4x24 Call For Presentations

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 85: Cyber Security for the Automotive & Trucking Industry, Part 2
Pub date: 2023-06-20

We are delighted to welcome you to a riveting panel discussion on a subject at the intersection of technology, security, and the boundless skies!

Today, we delve into the captivating realm of cyber security for aviation and aerospace! We are honored to introduce our three remarkable panelists, each of whom possesses a wealth of knowledge and expertise in their respective domain:

Jonathan Pollet is a renowned figure at Red Tiger Security, known for his 22 years of dedicated work in OT and industrial control systems cybersecurity.

Barbara Grofe hails from the esteemed Institute of Space and Cyber Research, where she specializes in space asset security and resiliency.

Shawn Goudge is a seasoned professional who has made significant contributions to physical security in aviation globally while actively exploring the convergence of physical security and cybersecurity.

This esteemed trio of experts joins forces to shed light on the vital connection between physical security and cybersecurity.

Stay tuned for today’s enlightening panel discussion on cyber security for aviation and aerospace that promises to unravel the intricacies of safeguarding our skies and beyond!

Show highlights:

Jonathan talks about a recent assessment of airport systems in Doha, Qatar.
Why is cybersecurity very immature from the aerospace and satellite perspective?
Who is responsible for OT cybersecurity at the airport?
There is a lot of confusion within organizations about who is responsible for looking at threats.
Why does cybersecurity legislation need to catch up?
How physical and cybersecurity systems do not intertwine properly.
Who is responsible for aviation security?
Are satellites still easy to hack if they are sophisticated and compartmentalized?
Do 5G and 6G pose specific risks for the aviation and aerospace sectors?
The most common types of attacks on airlines.
Barbara shares the key to addressing aerospace cybersecurity.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Jonathan Pollet on LinkedIn

Red Tiger Security

Barbara Grofe on LinkedIn

Institute of Space and Cyber Research

Shawn Goudge on LinkedIn

The Calgary Airport Authority

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Hacking the CANbus [The Industrial Security Podcast]
Pub date: 2023-06-19

Modern automobiles contain hundreds of CPUs and a CANbus network or three connecting these devices. Thieves are hacking the CANbus to steal cars. Worse is possible. Ken Tindell, CTO at Canis joins us to look at the problem and at what the automobile industry is doing about these embedded control systems.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Cyber Edu 4: May Brooks-Kempler Director @CRS ISC2 Instructor CISSP & HCISPP about CyberSec training
Pub date: 2023-06-17

נחשון פינקו ומלי בר מארחים את מיי (מיטל) ברוקס קמפלר דירקטורית בחברת סייבר באבו דאבי, יועצת, מרצה ומכשירה וותיקה לסיסויים למבחני אי.אס.סי בריבוע

מה הם האתגרים של הכשרת סייבר בישראל

מה המסלול הנכון למי שרוצה להיכנס לתחום הסייבר בישראל

עלויות ההכשרה לסייבר מהווה לא פעם חסם להתמקצעות. מדובר בהרבה אלפי שקלים עד עשרות אלפי שקלים. מדובר בנושא "כואב" ולא פשוט למי שאין את האמצעים, האם קיימת דרך לחסוך חלק מהעלויות?

את מראשוני/ות העוסקים בהכשרה להסמכות סייבר בינלאומיות בישראל. מעבר לתעודה, האם יש ערך מוסף לקורס

שעוסקים באתגרים של הכשרת לסייבר הנושא מועצם פי כמה וכמה שמגיעים לנושא הכשרת סייבר לסביבות תפעוליות. מאיפה מתחילים ומה לדעתך הדרישות המקדמיות ממי שרוצה ללמוד ולהיכנס לתחום הסייבר בכלל ומערכות תפעוליות בפרט

Nachshon Pincu and Mally Bar co-hosting May (Maytal) Brooks-Kempler, Director at Cyber Range Solutions inc (CRS) and ISC2 Instructor for CISSP ו& HCISPP. Discussing Cyber Security Education and training.

Cyber training in Israel, what are the challenges?

What do you think is the right path for those who want to enter the cyber field in Israel?

The costs of cyber training are often a barrier to professionalization. It is about many thousands of shekels to tens of thousands of shekels, and it is a "painful" issue and not easy for those who don't have the means. Is there a way to save some of the costs?

You are among the first to train for the CISSP exams in Israel and have invested a lot in the subject. Beyond the test and the certificate, is there any added value to the course?

We said that there are challenges in cyber training. The issue is often intensified in ICS/OT cyber training. Where do you start, and what are the preliminary requirements for those who want to study and enter the field?

And more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 32 · TOP 5% what is this?)
Episode: Unpacking cyber awareness syndrome.
Pub date: 2023-06-14

The Cyberspace Solarium Commission looks at obstacles to public-private collaboration in the industrial sector. Malware in the industrial sector increases. Organizations plan to increase their OT cybersecurity budgets. CISA and its partners have released a Joint Guide to Securing Remote Access Software. And the US DoD holds its Cyber Yankee exercise.

Today’s guest is Will Edwards of Schweitzer Engineering Labs discussing cyber awareness syndrome.

The Learning Lab has the conclusion off the discussion between Dragos’ Mark Urban, Principal Adversary Hunter Kyle O’Meara, and Principal Intelligence Technical Account Manager Michael Gardner on threat hunting.

Control Loop News Brief.Obstacles to public-private collaboration in the industrial sector.Revising Public-Private Collaboration to Protect U.S. Critical Infrastructure (CSC 2.0)

NERC’s role in public-private security collaboration can deter utilities from sharing information: report (Utility Dive)

Malware in the industrial sector increases.2023 Unit 42 Network Threat Trends Research Report (Unit 42)

CISA and partners release Joint Guide to Securing Remote Access Software.Guide to Securing Remote Access Software (CISA)

US DoD holds Cyber Yankee exercise.Cyber Yankee Prepares Military, Business for Cyber Threats (Air National Guard)

Control Loop Interview.The interview is with Will Edwards of Schweitzer Engineering Labs discussing cyber awareness syndrome.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Principal Adversary Hunter Kyle O’Meara and Dragos Principal Intelligence Technical Account Manager Michael Gardener to conclude their discussion on threat hunting.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: EPRI Current
Episode: 8. From Phishing to Fences: A Look at Cyber and Physical Grid Security
Pub date: 2023-06-14

In this episode, Cyber Security Program manager, Ben Sooter and Substations Program Manager Erika Willis talk about security, both the physical security of our infrastructure and cyber security of our energy system and grid. Listen in to learn about the types of threats the energy system may experience and what the incredible team at EPRI is doing to combat them.

Learn more at https://www.epri.com/

If you enjoy this podcast, please subscribe and share! And please consider leaving a review and rating on Apple Podcasts/iTunes.

Follow EPRI:

LinkedIn https://www.linkedin.com/company/epri/

Twitter https://twitter.com/EPRINews

The podcast and artwork embedded on this page are from EPRI, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 84: Cyber Security for the Automotive & Trucking Industry, Part 1
Pub date: 2023-06-13

We are excited to welcome you to our eagerly anticipated panel discussion on the ever-evolving automotive and trucking industries!

Today, we are privileged to host a remarkable trio of experts who will provide us with invaluable insights and diverse perspectives. We are delighted to introduce our esteemed panelists, Michael Clifford, Nikhil Bogam, and Antwan Banks. Each of these luminaries brings a unique perspective, promising a diverse and enlightening discussion that will unveil the inner workings of their respective organizations.

Antwan Banks joined the National Motor Freight Traffic Association (NMFTA) about two months ago. His primary role is advocating for security practices as the industry advances into autonomous trucks, electric vehicles, and interconnected networks. With the overarching aim of safeguarding the welfare of motor carriers, Antwan's mission aligns with the NMFTA's dedication to fostering a thriving and secure environment within the motor freight industry.

Nikhil Bogan is a seasoned professional with a remarkable career spanning 17 years in the automotive industry. He currently serves as a technical lead in functional safety and cybersecurity at Faurecia Forvia. With over six years dedicated to cybersecurity, Nikhil possesses a profound understanding of the intricate relationship between automotive technology and cybersecurity, recognizing its unique nature compared to conventional infrastructure security. He brings extensive expertise in the 21434 Standard, a recently published industry benchmark, and is actively involved in shaping forthcoming European regulations concerning automotive cybersecurity.

Michael Clifford is a highly regarded professional and principal researcher in cybersecurity and privacy at Toyota Infotech Labs, the prestigious advanced research and development division of Toyota. With a unique focus on long-term projections, Michael engages in projects that anticipate developments a decade or more into the future. His responsibilities involve predicting and addressing security challenges for technologies that have yet to materialize. Moreover, Michael takes on a leadership role in a consortium of universities dedicated to cutting-edge cybersecurity research, encompassing a diverse range of domains such as security theory, cyber-physical attacks and defenses, and machine learning. His extensive expertise in cybersecurity research dates back to 1998, and his interests span a wide spectrum, including security, privacy, machine learning, autonomy, ad hoc networks, energy efficiency, engineering, transportation, manufacturing, and user-centric design. With a wealth of knowledge and a forward-thinking mindset, Michael plays a pivotal role in driving innovation and ensuring the security of future technologies.

We invite you to join us as we embark on this compelling odyssey of knowledge and discovery and uncover the intricacies of the automotive and trucking industries and the remarkable visions that lie ahead. Stay tuned for more!

Show highlights:

The differences between trucking industrial control system cybersecurity and traditional cybersecurity.
Michael shares his thoughts on electric vehicle (EV) charging stations.
Security and privacy for autonomous vehicles.
Why the automotive industry needs to think about problems that will occur.
The evolution of the automotive industry.
The future of security in the transportation industry.
Does the automotive and trucking industry view federal rules as positive for cybersecurity or a hindrance?
Looking at standards within the industry.
Where automakers are, in terms of taking on cybersecurity for cars and trucks.
How AI plays into the future of the automotive industry.
Are common protocols and standards shared across the automotive industry?
Can EVs be used to spread malicious codes?

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Antwan Banks on LinkedIn

National Motor Freight Traffic Association

Nikhil Bogam on LinkedIn

Forvia Faurecia

Michael Clifford on LinkedIn

Toyota InfoTech Labs

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Mujeres en la onda
Episode: Belén Pérez en Radio Voz
Pub date: 2023-06-09

La coordinadora en Galicia del centro de ciberseguridad industrial explica los riesgos reales de internet para las empresas y los particulares. Pérez defiende que, desde negocios formados por un autónomo, hay que invertir en seguridad en internet. En el plano personal, hay que evitar colgar datos personales en la red. Los ataques digitales llegan ahora por todas partes.

The podcast and artwork embedded on this page are from La Voz de Galicia, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Government Accountability Office (GAO) Podcast: Watchdog Report (LS 41 · TOP 1.5% what is this?)
Episode: Nuclear Weapons Cybersecurity
Pub date: 2023-06-12

Nuclear weapons, along with other military weapon systems, are increasingly relying on software and other information technology to operate. But this increased reliance may make nuclear weapons and the systems they rely on more vulnerable to…

The podcast and artwork embedded on this page are from Government Accountability Office, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Cyber Edu 3: Kfir Tzukrel Cyber Security Architect tech lead @OTORIO on the transition from IT to OT
Pub date: 2023-06-11

Nachshon Pincu host Kfir Tzukrel (Tzuki), Cyber Security Architect tech lead @OTORIO, , and VP at the Israeli Chapter of (ISC)2, in a conversation about the transition from IT to OT cyber.

The journey into cyber and OT?

What are the essential differences between cyber IT and OT needed to consider when moving to cyber-OT?

There is no formal training (at least not in Israel) for CISO OT. How did you approach studying the subject?

Is it worth entering the field of cyber-OT? What should we expect for the future?

And More

נחשון פינקו מארח את כפיר צוקרל (צוקי), ארכיטקט סייבר ומוביל טכנולוגי באוטוריו, סמנכ"ל הסניף הישראלי של אי.סי.אס בריבוע שיחה על הכשרת סייבר והמעבר מסייבר למערכות מידע לסייבר במערכות תפעוליות

המסע להכשרת סייבר והמעבר לסייבר למערכות תפעוליות

מהם ההבדלים המהותיים בין סייבר למערכות מידע וסייבר למערכות תפעוליות, מה יש לקחת בחשבון בעת מעבר מקצועי לסייבר במערכות תפעוליות?

אין הכשרה רשמית (לפחות לא בישראל) לסיסו מערכו תפעוליות, איך ניגשת ללימוד הנושא

האם כדאי להיכנס לתחום הסייבר למערכות תפעוליות ומה העתיד צופן לתחום המיוחד הזה

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Danielle Jablanski: Navigating the Multitude of OT Technologies Considering Interoperability, Reliability, and Centralization
Pub date: 2023-06-08

About Danielle Jablanski: Danielle Jablanski is an accomplished OT cybersecurity strategist at Nozomi Networks, where she spearheads global research on cybersecurity and drives awareness of operational technology (OT) and industrial control systems (ICS) cybersecurity throughout the industry. She is a nonresident fellow at the Cyber Statecraft Initiative within the Atlantic Council's Scowcroft Center for Strategy and Security, further establishing her expertise in the field. Jablanski's commitment to advancing cyber-physical standards development, education, certifications, and labeling authority is evident through her active roles as a staff and advisory board member of the nonprofit organization Building Cyber Security. With a passion for emerging technologies, Danielle has independently consulted for the US government and technology startups, exploring novel applications in military, defense, and commercial sectors. Prior to her current endeavors, she contributed significantly to the creation and development of the Stanford Cyber Policy Center, showcasing her dedication to cybersecurity and policy.

In this episode, Aaron and Danielle Jablanski discuss:

Challenges and false assumptions in cybersecurity
Managing cybersecurity for operational technology (OT) with an overwhelming market of OT solutions to choose from
The importance of transparency, accuracy, and precision in overcoming challenges of OT cybersecurity
Prioritizing cybersecurity investments in a complex operational environment with limited resources

Key Takeaways:

The cybersecurity industry holds misconceptions and obstacles in the OT domain, requiring a change in perspective, modernizing systems, and reassessing market classifications to adequately tackle emerging threats and discover practical solutions.
With the overwhelming amount of OT technologies and tools available in the marketplace, understanding interoperability, reliability, and centralization will help you select the most appropriate ones for addressing issues in your environment.
The convergence of IT and OT cybersecurity requires a shift in mindset, prioritizing safety and business risk over technology, and addressing key challenges of interoperability, reliability, and centralization, while leveraging trusted advisors and independent consultants for effective solutions, especially for smaller organizations.
Focus on practical steps tailored to your financial capacity, risk assessment, and the unique demands of your organization, rather than mindlessly spending on costly products or solutions that may not fulfill your security needs.

"Collectively, cyber-physical security requires new strategic and tactical thinking to better inform decision-makers in cyber policy, planning, and preparedness." — Danielle Jablanski

Resources Mentioned:

Upcoming webinar by Nozomi Networks on The Next Generation of AI for OT Cybersecurity this June 14th: https://www.nozominetworks.com/webinars/the-next-generation-of-ai-for-ot-cybersecurity-launch-event/

Critical infrastructure cybersecurity prioritization: A cross-sector methodology for ranking operational technology cyber scenarios and critical entities: https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/critical-infrastructure-cybersecurity-prioritization/

Connect with Danielle Jablanski:

Website: https://www.nozominetworks.com/

LinkedIn: https://www.linkedin.com/in/daniellejjablanski/

Twitter: https://twitter.com/CyberSnark

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: 30sec recovery OT cyber startup: Salvador Tech co-founders Alex Yevtushenko CEO & Oleg Vusiker CTO
Pub date: 2023-06-08

A year OT cyber startup Follow-up: Salvador Technologies.

Nachshon Pincu hosts Salvador Technologies co-founders Alex Yevtushenko (CEO) and Oleg Vusiker (CTO) about their progress and roadmap in their endeavors and the change in the startup environment due to the economic failure.

How and what is Salvador Technologies?

What industries is the technology suitable for, and what is the feedback you receive from your customers?

What progress did Salvador achieve, and what is the roadmap for the future?

The economy has changed, and the focus has moved to AI technologies. How do you deal with that?

What trends do you see for the following years in OT cyber defense?

And more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Data Breach Today Podcast (LS 32 · TOP 5% what is this?)
Episode: Securing OT and IoT Assets in an Interconnected World
Pub date: 2023-06-06

In this episode of "Cybersecurity Insights," Antoinette Hodes of Check Point Research discusses the need to consolidate an organization's cybersecurity posture, gain visibility into OT and IT assets, and use cybersecurity education to increase worker safety.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Katie Boswell: When AI Meets Industrial Cybersecurity
Pub date: 2023-06-07

We sat down with the Managing Director, Cyber Security Services at KPMG, to discuss life on the front lines of securing the most critical national infrastructure, how AI will change security as we know it, and how her mother inspired her to become a leader in this field.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: News ClickCiber
Episode: T10x18 - 5G, Seguridad Industrial, CCI
Pub date: 2023-06-06

Nuestro experto Alfonso sigue dando pistas sobre la INTELIGENCIA ARTIFICIAL. Comentamos el mundo 5G y su relación con el mundo OT. Acabamos con nuestro invitado José Valiente, el Director del Centro de Ciberseguridad Industrial. Programa de radio semanal dedicado a la CiberSeguridad.

Con: Raúl Guillén, Carlos Valerdi y Alfonso Calvo.
Gracias a: Allot, CATO Networks, Forcepoint, F5, Trend Micro
Dirige: Carlos Lillo
clickciber.com

Send in a voice message: https://podcasters.spotify.com/pod/show/clickcibernews/message

The podcast and artwork embedded on this page are from News ClickCiber, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Cyber Edu 2: Hillel Kobrovski, cyber Academic Lecturer on how to get into Cyber & gain skills
Pub date: 2023-06-06

נחשון פינקו וכפיר צורקל מארחים את הלל קוברובסקי מומחה ומוביל דעה בקהילת הסייבר הישראלית, מרצה סייבר באקדמית אונו, חבר נשיאות בלשכה לטכנולוגיות המידע ומוביל מרכז המצוינות, פילוסוף ועתידן בשיחה על הכשרת סייבר ומצב הנשים בסייבר הישראלי

מה הם האתגרים בהכשרת סייבר בישראל

מה הדרך הטובה ביותר להכנס לתחום הסייבר

מה הדרישות המקדמיות ממי שרוצה ללמוד ולהכנס לתחום סייבר

2023 מצב הנשים בסייבר בשנת

ועוד

Nachshon Pincu and Kfir Tzukrel co-host Hillel Kobrovski, an expert and opinion leader in the Israeli cyber community, a cyber lecturer at the Ono Academy, a member of the presidency of the Bureau of Information Technologies and the leader of the Center of Excellence, a philosopher, in a conversation about cyber training and agin into cyber, and the situation of women in Israeli cyber.

What are the challenges in cyber training in Israel?

What is the best way to enter the cyber field?

What are the preliminary requirements for those who want to study and enter the cyber field?

The situation of women in cyberspace in 2023

and more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 83: Steve Mustard with Bob Radvanovsky: Latest Developments, Challenges, and Emerging Trends in Cybersecurity
Pub date: 2023-06-06

Welcome to today’s ground-breaking episode of the CS2AI podcast, where we have the privilege of hosting a dynamic duo of cybersecurity specialists who have dedicated their careers to protecting our critical infrastructure!

Steve Mustard is a seasoned automation engineer from Houston, Texas, with a passion for securing automation and control systems. Having served as President of the International Society of Automation in 2021, his commitment to this field runs deep.

Bob Radvanovsky is a true pioneer in industrial cybersecurity! He is the Co-founder of the renowned SCADASEC mailing list and the mastermind behind Project Shine. With his vast expertise in safeguarding control systems, IoT, and industrial IoT systems, Bob is currently at the forefront of fortifying our energy sector and protecting the grid.

In this innovative episode, Steve Mustard, with his unwavering commitment to the field, and Bob Radvanovsky, a true trailblazer in industrial cybersecurity, share their wealth of knowledge and experience in securing automation and control systems.

Stay tuned as Steve and Bob unravel the latest developments, challenges, and emerging trends in the ever-evolving world of cybersecurity!

Show highlights:

Why are we still having serious major incidents when there is so much awareness around cybersecurity?
Bob talks about the idea behind Skidmark, his publically-accessible database for collecting information about industrial cybersecurity incidents.
Staying up to date with cyber security.
Why is there a disconnect between CEOs and operations?
Managing cybersecurity on a risk basis.
Problems with remote access.
Do regulations actually help improve cybersecurity?
Why must people who help people have an intimate understanding of the subject?
What is a holistic approach to critical infrastructure?
Simple things that can prevent egregious attacks.
What can you expect from the fifth edition of Bob’s book, Critical Infrastructure, Homeland Security, and Emergency Preparedness?

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Bob Radvanovsky on LinkedIn

Steve Mustard on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

We'd like to thank our sponsors for their faithful support of this podcast. Without their support we would not be able to bring you this valuable content. We'd appreciate it if you would support these companies because they support us!

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Joy Ditto: The Evolution of Utility Cybersecurity with NERC CIP
Pub date: 2023-06-01

About Joy Ditto: Joy Ditto is a dynamic leader and influential figure in the energy sector. As the President and CEO of Joy Ditto Consulting, she advises companies on vital areas such as cyber and physical security, resilience, broadband, and clean energy development. With her strategic prowess, Joy helps organizations shape their engagement with the federal government and improve overall performance. Her exceptional track record includes being selected as part of a prestigious Blue-Ribbon Panel to assess the Tennessee Valley Authority's response to a major winter storm. Previously, as President and CEO of the American Public Power Association, Joy achieved remarkable milestones, including a substantial increase in revenue, tripled net worth, and securing a historic tax credit for clean energy development. Joy's expertise and media presence have garnered attention on crucial topics, and she has appeared in renowned outlets such as Bloomberg Radio and NPR. With a background encompassing Capitol Hill experience and influential roles in various organizations, Joy brings a wealth of knowledge and strategic insight to the energy sector.

In this episode, Aaron and Joy Ditto discuss:

The evolution of NERC CIP and the inclusion of cybersecurity.
Transformative progress of cybersecurity in the power utility industry.
Educating policy makers on OT and IT distinctions.
The impact of AI on policy and operations in the OT space.

Key Takeaways:

The formation of NERC CIP and the development of reliability standards in the power industry were driven by the need to address integration challenges, ensure economic benefits, and mitigate the risks of cascading effects on the transmission grid, with cybersecurity considerations being added later during the implementation phase.
The power utility industry has made significant progress in cybersecurity due to the implementation of NERC regulations, which have fostered an iterative and collaborative approach, enabling baseline maturity while allowing utilities to go above and beyond to protect critical assets.
Recognizing the significance of clear communication and education in intricate domains such as cybersecurity, IT, and OT, it becomes vital to present policymakers and decision-makers with simplified yet precise information, empowering them to make well-informed choices while sidestepping unintended outcomes.
Policy discussions surrounding AI in operational technology (OT) must carefully navigate its potential benefits in areas like cybersecurity and efficiency while addressing concerns about control, manipulation, and potential risks, emphasizing the importance of a balanced approach to its responsible implementation.

"Even though we see danger in deploying AI and maybe cutting jobs out from people, maybe there's gonna be a positive there too, like professionals who come into play, right? We need a diversity of people in our industry to be able to manage these challenges." — Joy Ditto

Connect with Joy Ditto:

Email: joy@joydittoconsulting.com

Phone: (703) 861-6361

LinkedIn: https://www.linkedin.com/in/joy-ditto-utc/

Twitter: https://twitter.com/joyditto?lang=en

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Saving money and effort automating compliance [The Industrial Security Podcast]
Pub date: 2023-05-31

NERC CIP, the new TSA pipeline and rail directives and other regulations can be very expensive - to comply with and to prove to an auditor that you comply. Kathryn Wagner of Assurx joins us to look at what and how we can automate this process to save time and money.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 32 · TOP 5% what is this?)
Episode: Taking a look at cyber insurance in the industrial space.
Pub date: 2023-05-31

China's Volt Typhoon snoops into US infrastructure, with special attention to Guam. Is CosmicEnergy just red-teaming, or is it a threat straight out of Red Square? Siemens patches a vulnerability endemic to the energy sector. An update on the Vulkan Papers. A cyberattack leads Suzuki to shut down its Indian production line. BlackBasta conducts ransomware attack against Swiss technology company ABB, and claims responsibility for Rheinmetall attack. Food and Agriculture Information Sharing and Analysis Center stands up.

Control Loop News Brief.China's Volt Typhoon snoops into US infrastructure, with special attention to Guam.People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection (Joint Cybersecurity Advisory)

Volt Typhoon targets US critical infrastructure with living-off-the-land techniques (Microsoft)

Chinese hackers spying on US critical infrastructure, Western intelligence says (Reuters)

CosmicEnergy, from Russia.COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises (Mandiant)

This newly-discovered malware could disrupt power generation — and do physical damage (Washington Post)

Siemens patches a vulnerability endemic to the energy sector.Command Injection Vulnerability in CPCI85 Firmware of SICAM A8000 Devices (Siemens)

An update on Russia’s NTC Vulkan: SIGINT, EW, and cyber ops.7 takeaways from the Vulkan Files investigation (Washington Post)

Russian Software Programs Threatening Critical Civilian Infrastructure (Dragos)

A cyberattack leads Suzuki to shut down its Indian production line.Suzuki Motorcycle India plant shut down after cyber attack, production affected (Hindustan Times)

Suzuki motorcycle plant shut down by cyber attack (Bitdefender)

BlackBasta conducts ransomware attack against Swiss technology company ABB.Multinational tech firm ABB hit by Black Basta ransomware attack (BleepingComputer)

BlackBasta claims responsibility for Rheinmetall attack.Arms maker Rheinmetall confirms BlackBasta ransomware attack (BleepingComputer)

Food and Agriculture Information Sharing and Analysis Center stands up.The food and agriculture industry gets a new center to share cybersecurity information (Washington Post)

Control Loop Interview.The interview is with Gerry Glombicki of Fitch Ratings talking about cyber insurance and his opinions on industrial space.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Brigadier General (res) Daniel Bren Co-Founder & CEO @Otorio about cyber defense, regulation, NIS2
Pub date: 2023-05-30

English Episode

Nachshon Pincu hosts Brigadier General (res.) Daniel Bren, Co-Founder and CEO at Otorio, In a conversation about cyber defense and regulation. Cyber security on a national scale and the significant role of IDF Cyber Defense Brigade.

About Otorio?

How to deal with critical infrastructure cyber defense on a national scale?

What is the significant role of the IDF Cyber Defense Brigade?

About EU Network and information security 2 (NIS2), what changed?

Way OT cyber attack risk to the market in all aspects?

And more...

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Noam Moshe on Teltonika 4G IIoT Router Cybersecurity Research
Pub date: 2023-05-30

Claroty Team82's Noam Moshe joins the Nexus podcast to discuss a recent research collaboration with OTORIO looking at Teltonika's 4G industrial routers and cloud management platforms. Eight vulnerabilities were uncovered and patched by the vendor in a recent update. Moshe discusses the vulnerabilities, attack vectors involved, and the state of secure development for IIoT routers.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: KBKAST (LS 26 · TOP 10% what is this?)
Episode: Security Round-up: Marty Edwards | Compliance Costs and Enhanced Protections: Australia's New Cybersecurity Protocol
Pub date: 2023-05-29

In this episode of KBKast, we take a look into the recent announcement from the Australian government about their new cybersecurity regulations for businesses. The new risk management protocol covers cybersecurity, physical security, personnel security, and supply chain security, all aimed at encouraging companies to enhance overall protection measures rather than punishing directors for noncompliance. Marty points out that Australia's situation with cybersecurity is similar to other countries in the world, with many governments implementing baseline standards to encourage better cybersecurity practices. However, some organizations have made progress in cybersecurity, while others need more government intervention to ensure critical infrastructure security. He also touches on the importance of investing in operational technology systems, including industrial control systems, which have been underinvested in cybersecurity, despite their vital role in operating electricity, gas, water, and transportation systems. As more governments require cybersecurity standards for these systems, both public and private sector organizations should invest in the security of these systems.Marty Edwards is a globally recognised Operational Technology (OT) and Industrial Control System (ICS) cybersecurity expert who collaborates with industry, government and academia to raise awareness of the growing security risks impacting critical infrastructure and the need to take steps to mitigate them. As Vice President of Operational Technology Security at Tenable, Edwards works with government and industry leaders throughout the world to broaden understanding and implementation of people, process and technology solutions to reduce their overall cyber risk. Prior to joining Tenable in 2019, Edwards—a 30‐year industry veteran—served as the Global Director of Education at the International Society of Automation (ISA). While at ISA, he was recognized by his industry peers with the SANS ICS 2019 Lifetime Achievement Award. Prior to ISA, Edwards was the longest‐serving Director of the U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS‐CERT). Edwards also served as a program manager focused on control systems security at the Department of Energy’s (DOE’s) Idaho National Laboratory (INL) and has held a variety of roles in the instrumentation and automation fields. Edwards holds a diploma of technology in Process Control and Industrial Automation (Magna cum Laude) from the British Columbia Institute of Technology (BCIT), and in 2015 received the institute’s Distinguished Alumni Award. In 2016, Edwards was recognized by FCW in its “Federal 100 Awards” as being one of the top IT professionals in the U.S. federal government.

The podcast and artwork embedded on this page are from KBI.Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Avi Weissman, founder and Co-CEO @See-Security InfoSec College about cyber education & training
Pub date: 2023-05-27

Nachshon Pincu and Kfir Tzukrel co-hosting Avi Weissman, founder, and Co-CEO @See Security InfoSec & Cyber Warfare College, in a conversation about cyber education & training

How did cyber education and training start in Israel?

Is it worth entering the cyber industry?

What is the future of cyber security?

Who is the cyber industry suitable for?

What is the best way to get cyber education and training: On your own, offline on study sites, online on college websites, F2F in college, or at university? What are the important things to look for in cyber training?

What percentage of SEE-Security College graduates who come to study without previous work experience manage to find a job in Cyber?

To what extent do the studies prepare them for the working world, and how much do they need to complete, such as taking additional tests such as CISSP?

There are advanced certifications such as CISO and Architect, are they intended for people who want to get these jobs, or for those who are in these jobs and want to deepen their knowledge?

What are "study levels" and "employment levels"?

How and when do you start working? Does the employer always look for experience?

What do you want listeners to take away from the conversation?

And more...

נחשון פינקו וכפיר צוקרל מארחים את אבי וויסמן מייסד ומנכ"ל משותף במכללת ללימודי סייבר סי-סקיורטי. אבי מוותיקי העוסקים בתחום הכשרת הסייבר בישראל בשיחה על איך נכנסים לתחום הסייבר, ואיזו הכשרה נדרשת

קצת היסטוריה, איפה התחיל נושא הכשרת הסייבר בישראל, והאם ידעתם שיגאל גויטע מחזיק בתעודה מספר 0001 בקורס הסייבר הראשון בישראל.

האם כדאי להיכנס לענף הסייבר? מה עתידו?

למי ענף הסייבר מתאים?

לבד? אוף-ליין באתרי הלימוד? און ליין באתרי הלימוד והמכללות? פרונטלי במכללה? באוניברסיטה? מה הדברים החשובים שצריך לחפש בהכשרת סייבר?

מה אחוז הבוגרים שלמכללת סי-סקיורטי המגיעים ללימודים ללא ניסיון תעסוקתי קודם, אכן מצליחים למצוא משרה בסייבר

עד כמה הלימודים מכינים בפועל לעולם התעסוקתי, וכמה הם נדרשים להשלים למבחנים בינלאומים כגון סי.אי.אס.אס.פי

מה הן קומות לימוד ומדרגות תעסוקה

איך ומתי מתחילים לעבוד? אם המעסיק תמיד מחפש ניסיון?

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Michael Welch: Tying Resilience, Availability, Compliance and Cybersecurity Together Into a GRC Program
Pub date: 2023-05-25

About Michael Welch: Michael Welch is the Director, GRCaaS within T&D Governance, Risk, Cybersecurity & Compliance group at Burns & McDonnell. He has over 25 years of professional experience in risk management, compliance, and critical infrastructure. Michael previously served as global chief information security officer for OSI Group, a privately-owned food processing holding company throughout 17 countries. In addition, he has worked with Duke Energy Corp and Florida Power & Light, among other companies.

In this episode, Aaron and Michael Welch discuss:

Integrating compliance, cybersecurity posture, and risk management in governance
Enhancing cybersecurity through asset inventory and collaborative communication for critical infrastructure protection
Managing cross-industry compliance for resilient risk management in operational technology (OT) environments
The importance of experience and knowledge in implementing large-scale programs and compliance for effective cybersecurity

Key Takeaways:

To effectively manage risk and ensure the resilience and availability of critical systems, compliance and cybersecurity need to collaborate within a comprehensive governance, risk, and compliance program, fostering teamwork among engineers, cybersecurity experts, and OEM vendors, especially in complex and retrofitting environments.
Building a strong rapport and fostering open dialogue between cybersecurity experts and operational personnel is crucial for safeguarding critical infrastructure, maintaining operational dependability, and harmonizing cybersecurity initiatives with business goals and operational needs.
It is crucial to promote a strong culture of safety and prioritize cybersecurity in operational technology (OT) environments in order to protect lives, infrastructure, and ensure the smooth continuation of business, while effectively managing compliance through collaboration and effective leadership within the organization.
Experienced professionals and organizations with knowledge in program implementations, compliance, audits, and regional variations can effectively manage risks, maintain compliance, and address cybersecurity challenges proactively to add value and stay ahead of evolving threats.

"We do have to adapt to technologies continuously changing. We've talked about it a little earlier that years ago, everything was manual. When technology came in, it's now more automatic. Business wants information, wants data. So that's never going to change, right? So we always have to make sure we're staying continuous. We're continually improving the way we do things." — Michael Welch

Connect with Michael Welch:

Email: mdwelch@burnsmcd.com

Website: https://www.burnsmcd.com/

LinkedIn: https://www.linkedin.com/in/michael-welch-93375a4/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 28 · TOP 10% what is this?)
Episode: Charles Carmakal on Cybersecurity Threats to Healthcare
Pub date: 2023-05-24

Mandiant Chief Technology Officer Charles Carmakal joins the Claroty Nexus podcast to discuss real-world threats to healthcare organizations. Mandiant has a unique vantage point as an incident response team involved in many high-profile cyberattacks. Based on that insight, Carmakal is able to comment on the conventional and opportunistic attacks healthcare delivery organizations and providers are dealing with. Some of those include multifaceted extortion as well as intellectual property theft. He also discusses whether attacks targeting medical devices are a reality.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 82: Shaping the Cybersecurity Industry Through Persistent Innovation with Jonathan Pollet
Pub date: 2023-05-23

Derek is super excited to welcome a true trailblazer in the world of cybersecurity today!

Jonathan Pollet is the Founder and Executive Director of Red Tiger Security. He is an invaluable pioneer and a long-time contributor to the cybersecurity community. He has been a guiding light for those who ventured into cybersecurity from traditional IP backgrounds over a decade ago.

Red Tiger Security is a focused SCADA Security consultancy, training, and research firm dedicated to the resiliency of national critical infrastructure and mission-critical business systems that must be available on a 24x7 basis. Red Tiger Security has developed and implemented a 6-layer Vulnerability Assessment approach that encompasses both Physical and Cyber security for ICS (Industrial Control Systems).

Hailing from the vibrant city of New Orleans, Louisiana, Jonathan’s upbringing was shaped by the unwavering dedication of his single mother. Determined to pursue a path in electrical engineering, he tirelessly sought opportunities to secure a full scholarship, ultimately leading him to the doors of Louisiana State University. Fortunately, his efforts paid off, and he emerged holding a four-year degree at the age of 21. Growing up in the lively streets of New Orleans instilled in him a belief that anything is possible when met with resilience and a zest for life!

With an illustrious background as a SCADA engineer, Jonathan has become an AI and OT security evangelist, leaving an indelible mark as an entrepreneur and business owner. In addition, he is also an instructor, speaker, scuba diver, and even a talented sax player!

Join us as we uncover the extraordinary life of Jonathan Pollet, a multifaceted force shaping the landscape of cybersecurity!

Show highlights:

How Jonathan got started in digital process control.
Jonathan shares a pivotal moment in his cybersecurity journey where he witnessed the entire system repeatedly crashing due to a network issue caused by a user in Australia attempting to draw a network diagram.
Jonathan explains how he taught himself cybersecurity and became an advocate for it.
What prompted him to create a course in cybersecurity?
Jonathan dives into his transition from working for Chevron to becoming an entrepreneur.
Why selling cybersecurity is not always easy.
Is the industry waking up to the importance of cyber hygiene?
How is OT learning from the IT world?
Jonathan explains how things will become more and more connected in the future.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Red Tiger Security

Jonathan Pollet on LinkedIn

Red Tiger Security on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Ph.D Larisa Tsirinsky Founder & CTO @Embedded Solutions about rethinking cyber defense technologies
Pub date: 2023-05-20

Nachshon Pincu hosts Ph.D. Larisa Tsirinsky, Founder & CTO @ E.S. Embedded Solutions 3000 Ltd, in a conversation about the need for changing cyber defense mindset and technologies.

Larisa has been well-known for over two decades as a top expert in real-time systems and encryption, providing services to Israeli defense industries.

About Embedded Solutions company?

An overview of OT cyber defense in 2023 and issues with the currently accepted approaches?

What are the “Embedded Solutions” solutions, and how do they differ from others in the OT defense market?

What are the challenges of using firewalls as the primary defense in 2023?

As a member of the 62443 community, what will be the main emphasis for the near future?

And more

נחשון פינקו מארח את ד"ר לריסה צירינסקי (דוקטור בקיברנטיקה ומתמטיקה), מייסדת ומנכ"לית אמבדד סולושנס בשיחה על הצורך בשינוי חשיבה וטכנולוגיות הגנת סייבר בסביבות תפעוליות. ד"ר לריסה מוכרת כבר מעל שני עשורים כמומחית מובילה במערכות זמן אמת והצפנה לתעשיות הביטחוניות הישראליות

פרופיל חברת אמבדד סולושנס

סקירה על הסייבר לסביבות תפעוליות ב-2023, והבעיות הקיימות בגישות המקובלות כיום

מה הפתרון של אמבדד סולושנס להגנת סביבות תפעוליות ובמה הוא שונה ממוצרים אחרים בשוק

מה האתגרים בשימוש בחומות אש כפתרון מרכזי בשנת 2023

כמי שחברים בועדת הסטנדרטים 62443 מה הדגשים לשנים הקרובות

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CyberWire Daily (LS 59 · TOP 0.5% what is this?)
Episode: Dawn Cappelli: Becoming the cyber fairy godmother. [OT] [Career Notes]
Pub date: 2023-05-21

Dawn Cappelli, OT CERT Director at Dragos, sits down to share what she has learned after her 25+ year career in the industry. She recalls wanting to have been a rockstar when she grew up, now she refers to herself as the fairy godmother of security. She shares some of the amazing things she got to work on throughout her career, including working with the Secret Service when the Olympics came to Salt Lake City, Utah in 2002. She shares how she was able to rise through the ranks to get to where she is now. Dawn talks about how she wasn't ready to retire quite yet because she loved the industry so much, saying "I retired, but I knew I still loved security. I have this passion for protection and so Dragos came along and they offered me this role of Director of OT CERT. I feel like I'm the security fairy godmother." She shares words of wisdom for all trying to get into the industry, saying that you need to always take the risk like she did when she first started her career. We thank Dawn for sharing her story with us.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Matt Wyckhouse: Behind the Cyber Shield: OT Security and the Importance of SBOM
Pub date: 2023-05-18

About Matt Wyckhouse: Matt Wyckhouse is a renowned cybersecurity expert with over 15 years of experience in offensive and defensive cyber operations. He is the co-founder and CEO of Finite State, a cybersecurity startup that focuses on illuminating the vulnerabilities and threats within complex software supply chains to protect the devices that power our modern lives. Prior to founding Finite State, Matt spent most of his career at Battelle, where he was the technical founder and CTO of their Cyber Security Division. Matt oversaw dozens of intelligence and security programs supporting strategic global missions, many of which were focused on discovering vulnerabilities in IoT and other embedded devices. Through his work, he recognized the potential devastation of IoT device attacks, leading him to create Finite State. Matt holds a BS in Computer Science and Engineering from The Ohio State University.

In this episode, Aaron and Matt Wyckhouse discuss:

The challenges of securing software in critical infrastructure.
What is SBOM and how can it be used to manage the risk in the software supply chain?
The importance of collaboration between asset owners and vendors to mitigate risk in industrial control systems.
The value of integrating vulnerability management into a larger program and understanding the value of accurate asset inventories in OT networks.

Key Takeaways:

Matt was motivated to create his cybersecurity startup because he saw a world where the most critical devices were also the most vulnerable, due to the shift from specific hardware functionality to general-purpose computers running software and operating systems inside of devices, making them easier to exploit.
An SBOM (Software Bill of Materials) is like a nutrition label for software, allowing asset owners to know what third-party software is inside a product to manage their own personal risk, and it is best to request an SBOM when purchasing software to understand the risk posture and evaluate different products.
Collaboration between asset owners and vendors is essential to mitigate risks associated with legacy equipment and ensure the safety of employees and customers, which can be achieved through standardization, approval, and testing of security solutions and a more open collaboration to mitigate risks.
Managing cybersecurity risks requires a well-rounded program involving people, processes, and technology, without any one solution, but rather multiple factors that work together to decrease vulnerabilities and handle incidents.

"I'm actually very optimistic about the security investments that vendors are making especially in the OT space. It might not feel like it today, but I can tell you, we work with a lot of vendors who are supplying OT equipment. And when we look at what's happened over the last few years, the amount of investment in this product security is going up a lot." — Matt Wyckhouse

Connect with Matt Wyckhouse:

Website: https://finitestate.io/

LinkedIn: https://www.linkedin.com/in/mattwyckhouse/

Twitter: https://twitter.com/mattwyckhouse

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Metrics: How Effective Is A Security Control?
Pub date: 2023-05-17

How much does a security control reduce cyber risk? What control or mix of controls provides the most efficient cyber risk reduction? Tough questions that a team of researchers at INL and Sandia tried to answer in a project.

Two of the researchers, Jay Johnson of Sandia and Jake Gentle of INL, join Dale on the show to talk about the metrics and results. The project was Cyber Resilience for Wind Installations, but the metrics and results are applicable to every sector. We get into the weeds on this episode and discuss:

how they created the test environment
the two attack scenarios (and why only two and how easy it would be to expand)
the physical resilience score
the cyber resilience score
the results from four different mixes of security controls
areas for further testing and improvement
and a tiny bit about trying to calculate an Expected Benefit from Cybersecurity Investment, which is a bit like ROI and how much money to spend.

Links

• Video: https://www.youtube.com/watch?v=bBLbLUFKzIc

• IEEE Access Journal Paper: https://ieeexplore.ieee.org/document/10043706

• POWER magazine article: https://www.powermag.com/cyber-resilience-for-wind-power-installations/

• 2-page flyer: https://www.researchgate.net/publication/367074443_Cyber_Resilience_for_Wind_Installations_A_Cyber_Resilient_Reference_Architecture

• Final project report: https://www.researchgate.net/publication/368599508_Hardening_Wind_Energy_Systems_from_Cyber_Threats-Final_Project_Report

View Details

Podcast: Automation Chat (LS 25 · TOP 10% what is this?)
Episode: In Case You Missed It: “How to Control an Electric Motor During a Network Failure”
Pub date: 2023-05-18

This is another episode in our regular series “In Case You Missed It,” where Executive Editor Theresa Houck brings the written word to life by reading a great article from The Journal From Rockwell Automation and Our PartnerNetwork magazine.

In this episode, Theresa reads, “How to Control an Electric Motor During a Network Failure.” Learn why programming in the appropriate motor state is crucial to prevent unexpected production losses when network communication issues arise.

And of course, get your family-friendly, silly Joke of the Day. (Pssst! You get a bonus Joke of the Day in this episode!)

If you like “Automation Chat,” please leave us a 5-star rating, and subscribe so you don’t miss a single episode.

Resources from this episode:

Read the article online: “How to Control an Electric Motor During a Network Failure.”
To subscribe to our 4 print magazines (Jan., Apr., July and Oct.), e-mail Carmela Kappel at ckappel@endeavorb2b.com.
Subscribe to our 8 digital magazines at http://rok.auto/thejournal-subscribe.

** Award of Excellence Winner for Best Podcast, 2022 APEX Awards of Publication Excellence.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Weekly Roundup 20.2023
Pub date: 2023-05-19

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: How cyber fits into big-picture risk [The Industrial Security Podcast]
Pub date: 2023-05-17

All physical processes involve risk - sometimes very big risk. Dr. Janaka Ruwanpura from the University of Calgary joins us to look at where cyber risks fit into the big picture of risk at industrial organizations, and at roles and responsibilities for managing risk throughout an organization.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 359 - Cybersecurity remains critical for Space Operational Technology
Pub date: 2023-05-18

We speak with Dr Daniel Floreani, Principal Consultant and Director of CyberOps, a security and blockchain consultancy.

Some of Daniel's achievements during 25+ years of experience in the communications industry, in very diverse roles include:

A PhD in communications and experience in the fundamental concepts of Networking and Defence communications.
Experience in very large Defence projects and complex engineering environments.
Exposure to Business Development and Market Creation activities in Space and Internet of Things domains

The Agora High-Tech with support by CyberOps and Flinders University Present is holding the First Australian Cyber Space Forum, Tuesday 10 October 2023.

The Australian Space Cyber Forum will provide an excellent opportunity for Australian stakeholders to meet and network with key national and international space cyber experts. Participation in this forum is targeted at researchers, entrepreneurs, academics, private consultants, public employers, and others with an interest in the space and cyber sectors.

The first national edition of the Space Cyber Forum will contain a welcome introduction followed by international speakers such as Prof. Olaf Maennel from Tallinn University of Technology in Estonia, Ms. Clemence Poirer and Mr. Marco Alberti from the European Space Policy Institute in Vienna, and more to come, followed by three specific panels. Each panel will include a discussion on approaches to solving real world issues to help organisations understand what the risks are and how to start to mitigate them, now and into the future.

· Panel 1 – ‘Space Cyber – The increasing use of cyber-attacks in the space domain’,

· Panel 2 – ‘Cyberspace and Outer Space: between regulation and militarisation’,

· Panel 3 – ‘Quantum in Space and its Security Impacts’,

Registration Link: https://lnkd.in/gNkAW7et

auspaceforum

australiainspacetv

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 358 - Maritime Cybersecurity – trends and emerging threats
Pub date: 2023-05-16

Michael Vrettos is a senior Marine Cyber Security Expert for RINA Classification Society in Piraeus.

He is responsible for Marine Cyber Security Services and represents RINA in IACS and EMSA related activities. ( IACS – International Association of Classification Societies, EMSA – European Maritime Safety Agency)

His past experience includes working for the EU, NATO & the Defense sector. Among other things, he’s been involved in developing a Network Security Operations Center and projects on Cyber Technologies for the European Defense Agency, European Space Agency, EU & NATO.

In this interview, Michael gave an introduction to the Maritime sector, and the stakeholders in the industry who are involved in setting the cybersecurity policy and technical standards (for example, IMO (International Maritime Organisation) and IACS (International Association of Classification Societies).

He gave a glimpse into how digitalisation in shipping with applications for route optimization, fleet performance and engine automation, (to name a few) driven by increased connectivity and bandwidth along with innovations in satellite technologies, have transformed the sector, with implications for cybersecurity. Hence, in some ways, the ship is increasingly becoming part of an overall “IoT” network.

Whilst the NotPetya incident that disrupted the sector in 2017 was an important lesson, Michael also noted the additional complexity of cyber defenses due to “Operational Technology” onboard ships using sensors, PLCs (programmable logic controllers), and various software to control ships systems such as bridge, ballast, engine, navigation, etc.

For example, the “always-on” mode means that systems cannot be easily scheduled for patching or for pen-testing in order to avoid an inadvertent disruption.

Besides basic cyber hygiene and standard cyber protection at network level, Michael also noted other vessels important systems such as the AIS (automatic identification systems) and ECDIS (Electronic Chart Display and Information System) operating with proprietary software thus making difficult to install typical cyber security measures such as antivirus or antimalware.

Wrapping up, Michael shares his views on the digital evolution and emerging cyber threats, such as those introduced by AI (artificial intelligence), and the importance of not only utilizing the benefits of technology but also investing in cyber security considering the potential risks.

Recorded 25th April 2023, 10.30am, Marina Bay Sands Singapore, Singapore Maritime Week 2023.

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 32 · TOP 5% what is this?)
Episode: Internal Network Security Monitoring (INSM) for the electrical sector.
Pub date: 2023-05-17

Ukraine argues that cyberattacks against civilian infrastructure should be classified as war crimes. The Five Eyes take down Turla and its Snake malware. An Iranian threat actor turns its attention to infrastructure. The Bitter APT may be targeting Asia-Pacific energy companies. A Colonial Pipeline retrospective. ETHOS: a new private-sector OT risk information-sharing platform. CISA requests comment on software self-attestation form. Guest is Patrick Miller, CEO of Ampere Industrial Security, discussing INSM (Internal Network Security Monitoring) as a concept for the electric sector. In the Learning Lab, Dragos’ Mark Urban is joined by Dragos Principal Adversary Hunter Kyle O’Meara and Dragos Principal Intelligence Technical Account Manager Michael Gardner to discuss threat hunting.

Control Loop News Brief.Ukraine argues that cyberattacks against civilian infrastructure should be classified as war crimes.Russia attacks civilian infrastructure in cyberspace just as it does on ground - watchdog (UKRINFORM)

Russians launch mass cyber attack on online service for queueing to cross border by trucks (Ukrainska Pravda)

Europe’s Air-Traffic Agency Under Attack From Pro-Russian Hackers (Wall Street Journal)

RSAC: Cyber-Attacks on Civilian Infrastructure Should Be War Crimes, says Ukraine Official (Infosecurity Magazine)

Five Eyes take down Turla and its Snake malware.Hunting Russian Intelligence “Snake” Malware (Joint Cybersecurity Advisory)

Iranian threat actor exploits N-day vulnerabilities, turns its attention to infrastructure.Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets (Microsoft)

Bitter APT may be targeting Asia-Pacific energy companies.Phishing Campaign Targets Chinese Nuclear Energy Industry (Intezer)

The Colonial Pipeline ransomware attack, two years later.The Attack on Colonial Pipeline: What We’ve Learned & What We’ve Done Over the Past Two Years (CISA)

ETHOS: a new private-sector OT risk information-sharing platform.OT Cybersecurity Leaders to Deliver First Open-Source Information Sharing for Collective Early Warning in Critical Infrastructure (Globe Newswire)

CISA requests comment on software self-attestation form.Request for Comment on Secure Software Self-Attestation Common Form (CISA)

OMB, CISA set to release common form for software self-attestation (Infosecurity Magazine)

Control Loop Interview.The interview is with Patrick Miller, CEO of Ampere Industrial Security, discussing INSM (Internal Network Security Monitoring) as a concept for the electric sector.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 81: Cyber Security for Railway Systems with Olivier De Visscher
Pub date: 2023-05-16

Derek is delighted to have a special guest calling in from Brussels today!

Olivier De Visscher is the current Head of Railway Industrial Cybersecurity at the Expleo Group. He joins Derek to shed light on the importance of cybersecurity for the railway industry and discuss its implications for the future.

With a total of 25 years of experience, Olivier has dedicated ten of those years to the field of Industrial Cybersecurity. He shares his expertise and promotes collaboration with the cybersecurity domain of the European Transportation sector. He remains closely connected to the railway community, including RU, IM, and the Industry, as it provides him with a valuable opportunity to work across different areas. Olivier continues to support various European initiatives in the field of railway cybersecurity.

As we kick off our focus on transportation this month, starting with a series of events, seminars, and podcast episodes on May 17th, we could not be more excited to have Olivier joining us. With over 25 years of experience in IT and technology, Olivier brings a wealth of knowledge and expertise in railway systems and other industrial applications. Stay tuned to learn more about Olivier and his insights on railway cybersecurity!

Show highlights:

Olivier discusses his background in cybersecurity.
What led Olivier to specialize in rail security?
Olivier dives into the need for a new cybersecurity standard for rail.
Why is cyber security so important in the transport sector?
The importance of a cybersecurity approach in the safety case.
Why you cannot protect against everything, especially when the threats are high-level.
What is the tech refresh rate?
Is ancient technology still in play?
What is going uniquely well in the rail industry?

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Expleo Group

Olivier De Visscher on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Fortinet Cybersecurity Podcast
Episode: Take Five #63 - Cybersecurity Strategies for Addressing Cyber Risk: Operational Technology
Pub date: 2023-05-16

This episode was recorded on 5/16/2023 Welcome to the Take Five Podcast from Fortinet where we provide five cybersecurity tips and best practices for today’s technology leaders. This podcast series taps into the experience of our Fortinet Field CISO team and the work being done with and through our ecosystem of partners, customers, and industry experts. In this episode, Willi Nelson, Fortinet's Field CISO for Operational Technology, and Bob Turner, Fortinet's Field CISO for Education, delve into cybersecurity in operational technology industries. They explore various strategies to tackle cyber risks, such as implementing segmentation to minimize potential targets for attacks and highlighting the positive impact of staff training and education. Further, they emphasize the importance of establishing a threat intelligence strategy to combat growing ransomware variants. For more information about operational technology, visit our website, www.fortinet.com/OT?utm_source=social&utm_medium=linkedin-org&utm_campaign=sprinklr Read key findings from the 2023 Global Ransomware Report, brought to you by Fortinet: https://www.fortinet.com/blog/industry-trends/ransomware-protection-survey-for-organizational-prevention?utm_source=social&utm_medium=linkedin-org&utm_campaign=sprinklr

The podcast and artwork embedded on this page are from Fortinet Cybersecurity Podcast, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 357 - Maritime and Port Authority of Singapore & Cybersecurity Initiatives
Pub date: 2023-05-15

Ong Chin Beng is the Chief Information Security Officer at MPA (Maritime Port Authority, Singapore). Prior to this, Chin Beng overseen cybersecurity across the transport sector at the Ministry of Transport. Chin Beng graduated from Mechanical Engineering at the National University of Singapore and Cybersecurity and Management at the University of Warwick.

In this interview, Chin Beng introduced the responsibilities and roles that Maritime Port Authority, Singapore (MPA) undertakes as well as the stakeholders that MPA collaborates with to develop and grow the maritime domain and Port of Singapore.

He also gave a glimpse into the rapid pace of digitalisation in the maritime sector and the benefits to improving supply chain efficiency, vessel performance, uplifting the welfare of seafarers, and aids to progression of decarbonisation goals.

As part of the designated 11 Critical Information Infrastructure under the 2018 Singapore Cybersecurity Act, Chin Beng elaborated on some of the initiatives taken by the maritime sector to respond to the regulations, support the risk management of critical information infrastructure of MPA and port operators, and enhance cyber resilience and readiness.

One example is “Exercise CyberMaritime”, which saw MPA, holding an inaugural sector-wide maritime cybersecurity exercise to put to test, the sector’s coordination on cybersecurity incident management, emergency response plans, and crisis communications – in events such as a ransomware.

Another is the establishment of “PACC-Net” (Port Authorities CIO Cybersecurity Network), a global network that involves 11 port authorities collaborating on maritime cybersecurity to facilitate early sharing of cyber threat information, such as rules of engagement and TLP (traffic light protocol).

Chin Beng also pointed out that MPA will establish the Maritime Cyber Assurance and Operations Centre (“MCAOC” - an expansion of the Maritime Cyber Operations Centre (“MSOC”) by 2025, to progressively raise cyber resilience of onshore information systems, vessel and offshore operational technology, through collaboration among industry players, research community and firms to undertake joint development projects.

Wrapping up, Chin Beng emphasized the importance of development skills and retaining talent, and shared initiatives on growing the talent pool through work with higher institutes of learning (HIL), as well as bridging the gap between “OT” and “ICT” specialists.

Recorded 27th April 2.30pm, Marina Bay Sands Singapore, Singapore Maritime Week 2023.

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 50 - Segurança em Redes de Automação Industrial
Pub date: 2023-05-13

Inscreva-se no Webinar - OT Zero Trust: https://bit.ly/3KBVPbmSolicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Sneer Rozenfeld, CEO @Cyber 2.0, a biology model as a cyber model & using the CHAOS theory
Pub date: 2023-05-14

Nachshon Pincu hosts Sneer Rozenfeld, CEO @Cyber 2.0 startup, in a conversation on OT cyber defense, the biology model as a cyber model, and the CHAOS theory.

Cyber 2.0 Who and What?

How are you different from other OT cyber protection products market approaches?

Using The biology model as a cyber model making use of the CHAOS theory, how does it fit in?

and more

נחשון פינקו מארח את שניר רוזנפלד מנכ"ל סייבר 2.0 בשיחה על הגנת סייבר בסביבות תפעוליות והשימוש במודלים ביולוגים ותאורית הכאוס כמודלים להגנת סייבר

מי ומה סייבר 2.0

מה הגישה השונה של סייבר 2.0 ממערכות הגנת סייבר אחרות

השימוש במודלים ביולוגים ותאורית הכאוס כמנגנון הגנת סייבר

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 51 - ICS SECURITY EM GERAL
Pub date: 2023-05-13

Na última quarta-feira, 03/05/2023, nosso CEO Eduardo Honorato conduziu mais uma gravação do ICS SECURITY PODCAST.Já estamos no episódio 51 e dessa vez vamos voltar a abordar diversos assuntos dentro do tema ICS.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Critical Assets Podcast
Episode: Breaking into the OT Cybersecurity Field
Pub date: 2023-05-11

Hear from an experienced ICS/OT Security Manager, Gabe Agboruche, on how to enter or upskill into the ICS/OT cybersecurity field. He answers questions such as… What training is available? What are the biggest obstacles? What are some common job roles? What are the best paying job roles? We also cover the asset owner’s perspective on how they can obtain and retain new cybersecurity professionals.SHOW LINKS:* Gabe Agboruche LinkedIn Profile * Gabe’s YouTube channel - Struggle Security * Malware Traffic Analysis * Free Network Emulators * ICSVillage * ICS Village Youtube Channel * Sans ICS Free Resources * SANS ICS Concepts * DNP3 Simulators * Scapy * CompTIA (Security+ and Network+ certifications)

The podcast and artwork embedded on this page are from Patrick Miller, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Weekly Roundup 19.2023
Pub date: 2023-05-12

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: S4x23 Closing Panel
Pub date: 2023-05-10

Ralph Langner, Megan Samford and Zach Tudor join Dale Peterson on the S4 Main Stage to close out S4x23. This Closing Panel is always an attendee favorite as none of these four are afraid to take a strong and even unconventional stance on at OT security topic or issue.

View Details

Podcast: Error Code
Episode: EP 15: Tracking Threats (and Risks) Against OT Devices
Pub date: 2023-05-09

This is the story about researchers who monitor the threats against IoT and OT systems, and the steps being taken to mitigate them. Ishmael Valenzuela, Vice President of the threat research and Intelligence Team at BlackBerry, shares the latest insights from his company’s Cybersecurity Global Threat Intelligence Report. We talk about threats from Latin America and elsewhere, how firewalls alone won’t necessarily protect OT devices, how attackers and defenders are using AI technology, and how hospitals are seeing perhaps the most increase in threats.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 80: Robots, Rails, Bytes and Risk A Modern ICS Success Story with Brent Huston
Pub date: 2023-05-09

We have a special treat for you today! Our friend and colleague, Brent Huston, joins Derek for an online CS2AI session to explore the fascinating modern ICS success story of robots, rails, bytes, and risk.

Brent Huston is a cybersecurity expert who has been a business owner in this space for over three decades. He has a deep technical background but can explain complex concepts in a way that is easily understandable by everyone.

In the 30 years he has been in the technology business, Brent has worked on various projects involving automated warehousing, inventory control systems, and point-of-sale systems. He also has expertise in cybersecurity and industrial automation.

With his years of experience and expertise in the field, Brent will take us on a journey through the evolution of ICS security and share some valuable insights on achieving success in this constantly evolving landscape. Stay tuned for more!

Show highlights:

Why warehousing is becoming a hot area for disruption.
How robots move at high speeds and are user-programmable.
Were there any considerations given to EMF attacks or sonic attacks?
Brent dives into staffing with a team used to OT protocols.
Using NLP to parse documentation and generate inventory reports and configuration maps.
Creating an initial attack surface map.
Using machine learning to analyze the network data to build a network map.
Brent talks about moving the same techniques from automated warehousing into production environments.
When they first got the system, everyone on the team expected the robots to be smarter than they are.
How much automation is available today?
Were there any considerations given to EMF attacks or sonic attacks?
Brent shares his prediction for the future of cybersecurity.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Brent Huston on LinkedIn

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Brigadier (res) Daniel Bren Co-Founder & CEO @Otorio: Industries needs change in OT Cybersecurity approach
Pub date: 2023-05-06

נחשון פינקו באירוח משותף עם כפיר צוקרל בראיון עם תא"ל (מיל') דניאל ברן, מייסד שותף ומנכ"ל באוטוריו, בשיחה על הצורך בשינוי פרדיגמה בגישת אבטחת הסייבר בתעשיות מסורתיות, כדי לתמוך טוב יותר בדיגיטליזציה המתמשכת שלהם

היכן עומדת ישראל לגבי איומי סייבר וסייבר הגנתי ב-2023

כרטיס ביקור וסקירה של אוטוריו

במה שונה אוטוריו בגישתך מחברות אחרות בשוק הגנת הסביבות התפעוליות

דוע רוב החברות העוסקות בסייבר לסביבות תפעוליות צומחות בישראל, שאינה מדינה תעשייתית כמו גרמניה, ארה"ב ובריטניה

ועוד

Nachshon Pincu Co-hosting with Kfir Tzukrel, Brigadier general (res.) Daniel Bren, Co-Founder and CEO at Otorio, In conversation about traditional industries, needs a paradigm change in their cybersecurity approach to better support their ongoing digitalization.

Where does Israel stand on cyber threats and defensive cyber in 2023?
Otorio business card and overview.
How is Otorio different in your approach from other companies in the OT protection market?
Why do most companies dealing with OT cyber grow in Israel, which is not an industrial country like Germany, the USA, and the UK?

And More...

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 32 · TOP 5% what is this?)
Episode: Puesh Kumar, Director of CESER at US Dept of Energy
Pub date: 2023-05-03

Dale Peterson interview CESER Director Puesh Kumar on the S4x23 Main Stage. We discuss a number of CESER programs how they are measuring success, what has not worked, why they are doing some things industry is already doing and more.

5:30 Where is the CESER CRISP program (detection and information sharing) today? Has it stopped or reduced the impact (outages and others) of cyber attacks on the electric sector? How will they measure the success of this program?

10:40 What has CESER tried, thought it would work, and ended up failing?

14:05 CESER's CyTRICS program is testing vendor equipment? Why, does GE and Hitachi need help? And the results have been trivial vulnerabilities that could be found in hours. Why is CESER spending millions on this?

19:25 Cyber Informed Engineering (CIE) is it the same as Secure By Design? This is a long process, what will the early wins look like? Two years from now how will we know if we are succeeding? Maintaining a manual capability dominated the examples in the document, why hasn't this been highlighted in the program? How can we accelerate this?

25:20 Clean Energy Cyber Accelerator is looking at solutions (OT detection and MFA remote access to OT) that are well established with vendor offerings and asset owner deployments. Why is CECA doing this and trying to accomplish?

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Weekly Roundup 18.2023
Pub date: 2023-05-05

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 32 · TOP 5% what is this?)
Episode: Asset inventory: Part of ICS network visibility and monitoring.
Pub date: 2023-05-03

Hacktivists versus irrigation. Maritime cybersecurity. JCDC and pre-ransomware notification. Ransomware at Fincantieri Marinette Marine. NSA warns of Russian ransomware disrupting supply chains. Guest Mike Hoffman is Technical Leader Global Services at Dragos & a SANS instructor. Mike will be discussing IT/OT misalignment.. In the Learning Lab, Dragos’ Mark Urban is joined by Dragos’s Senior Product Manager Jordan Wilkerson to dig into ICS network visibility and monitoring, which is the third of the SANS Institute’s 5 ICS Cybersecurity Critical Controls.

Control Loop News Brief.Hacktivists versus irrigation. Irrigation Systems in Israel Hit with Cyber Attack that Temporarily Disabled Farm Equipment (CPO Magazine)

Maritime cybersecurity. Full Steam Ahead: Enhancing Maritime Cybersecurity (CSC 2.0)

Cyber experts call for CISA to establish maritime equipment test bed (FedScoop)

JCDC and pre-ransomware notification. JCDC Cultivates Pre-Ransomware Notification Capability. (CISA)

Ransomware at Fincantieri Marinette Marine.Ransomware Attack Hits Marinette Marine Shipyard, Results in Short-Term Delay of Frigate, Freedom LCS Construction (USNI News)

Russian ransomware operations aim at disrupting supply chains into Ukraine.NSA sees ‘significant’ Russian intel gathering on European, U.S. supply chain entities (CyberScoop)

Control Loop Interview.The interview is with Mike Hoffman, Technical Leader Global Services at Dragos & SANS instructor, discussing the IT/OT misalignment that often occurs when IT counterparts take on the responsibility of carrying out vulnerability management in the OT space.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos Senior Product Manager Jordan Wilkerson to discuss the third of the SANS Institute’s 5 ICS Cybersecurity Critical Controls: ICS network visibility and monitoring.

Background link:

The Five ICS Cybersecurity Critical Controls

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from N2K Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Zion Harel and Leonid Cooperman Founders & Co-CEOs @IXDen on different OT Cyber & Operation approach
Pub date: 2023-05-02

Nachshon Pincu hosts Zion Harel and Leonid Cooperman, Founders & Co-CEOs at IXDen, discussing ICS/OT cyber security and continuous operation in the industrial environment.

Overview of the OT cyber situation in 2023.

IXDen business card.

IXDen solution and how it differs from other solutions and approaches in the OT cyber defense market?

And more…

נחשון פינקו מארח את ציון הראל ולאוניד קופרמן המייסדים והמנכ"לים המשותפים בחברת

אי.אקס.דן בשיחה על גישות מתקדמות להגנת סייבר והמשכיות תפעולית בסביבות תעשייתיות

סקירה של מצב הסייבר לסביבות תפעוליות ב 2023

חברת אי.אקס.דן כרטיס ביקור הפתרון שמציעה החברה ובמה שונה הגישה מחברות אחרות בשוק ההגנה על סביבות תפעוליות

ועוד

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Error Code
Episode: EP 14: Hacking the Power Grid
Pub date: 2023-04-26

There’s a lot of FUD around hacking the power grid. Most often, there’s a more common cause: Soot. Even Squirrels. Jori Van Antwerp, CEO of SynSaber. talks about the realities of the US power grid vs the myths. While there’s room to improve, there’s also a great amount of resilience already in the electrical system today.

The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Six steps to integrating IT & OT in mining [The Industrial Security Podcast]
Pub date: 2023-05-02

OT systems are critical to mining safety. Rob Labbe, the chair of the Metals and Mining ISAC joins us to look at six steps to integrating IT & OT networks and security programs in this very sensitive environment.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 25 · TOP 10% what is this?)
Episode: Lorrie Cranor on IoT Security and Privacy Labels
Pub date: 2023-04-27

Lorrie Cranor, Director and Bosch Distinguished Professor in Security and Privacy Technologies at Carnegie Mellon University's CyLab, joins the Nexus podcast to discuss an IoT security and privacy label initiative under way at CyLab. The labels are meant not only to help consumers make informed buying decisions, but also to nudge vendors and manufacturers closer toward delivering secure smart devices to market.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Weekly Roundup 17.2023
Pub date: 2023-04-28

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 49 - OT Zero Trust
Pub date: 2023-04-26

Inscreva-se no Webinar - OT Zero Trust: https://bit.ly/3KBVPbmSolicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 32 · TOP 5% what is this?)
Episode: Chris Blask: Cybersecurity Pioneer and Idea Man
Pub date: 2023-04-26

Chris Blask has a long career bringing new ideas to reality. He currently is Vice President of Strategy at Cybeats, who has a SBOM Studio product.

Cybeats is different in that SBOM Studio does not create SBOMs. This requires SBOMs to be available from somewhere, and Dale & Chris spend a lot of the podcast talking about the SBOM market today and in the future.

What percentage of the OT software solutions have SBOMs today? What will that number be in three years, five years, seven years?
When will the top 10% asset owners be able to be get value worth the effort from SBOMs and related tools and information?
What will the SBOM marketplace look like?
the DBOM.io project

Of course being Dale and Chris, they deviate into a lot of other topics. Such as Chris's quotes:

“Security comes through transparency and automation”
“2020, this is the last decade of cybersecurity” “the last decade when entirely new fields will be discovered” I think we have covered the field.

View Details

Podcast: (CS)²AI Podcast Show: Control System Cyber Security
Episode: 79: Achieving Leadership Roles in an Early Cybersecurity Career with Megan Samford
Pub date: 2023-04-25

Derek is delighted to have Megan Samford joining him today!

Megan is an executive experienced in Product Security programs, ICS/OT, PSIRTs, Threat Intel, and Critical Infrastructure Protection. She is currently the VP and Chief Product Security Officer of Energy Management at Schneider Electric.

Megan is a well-rounded and fascinating person! In addition to being a cyber-emergency manager, she is a critical infrastructure protection hero, the founder of many things, a mother, a rock hunter, and a genealogy enthusiast! She loves shopping, interior design, and cars-specifically 300zx!

In today’s episode, Megan tells her story, discusses her career trajectory, and shares her experience, insight, advice, and free resources for anyone considering a career in cybersecurity.

Show highlights:

How Megan's mother helped Megan grow into her full potential.
Megan talks about being part of the first graduating class of the world's first accredited degree program in Homeland Security and Emergency Preparedness at Virginia University.
How Megan gained a core foundation for critical infrastructure while doing an internship at the governor’s office in 2007.
Megan discusses her first encounter with policy work and explains how much she loved it.
Megan talks about being promoted to leading critical infrastructure for the Commonwealth of Virginia when she was only twenty-six.
What Megan did that allowed her to get promoted to lead critical infrastructure for the Commonwealth of Virginia at only twenty-six years of age.
Why do people like working with Megan professionally?
How Megan got to work at GE, and how she ended up working at Schneider Electric.
Megan dives into the work she does with ICS4ICS.
Megan shares free resources via ICS4ICS for FEMA online incident command system training.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Schneider Electric

Megan Samford on LinkedIn

ICS4ICS training

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Gate 15 Podcast Channel
Episode: The Gate 15 Interview EP 34: April is Water-palooza! Chuck Egli and Jen Walker talk WaterISAC!
Pub date: 2023-04-24

In this episode of The Gate 15 Interview, Andy Jabbour visits with Chuck Egli, Senior Director at Gate 15 and Director of Preparedness and Response for WaterISAC, and Jennifer Lyn Walker, Director of Cyber Defense for Gate 15 and Director of Infrastructure Cyber Defense for WaterISAC. About WaterISAC: The U.S. water and wastewater sector’s leading national associations and research foundations established the Water Information Sharing and Analysis Center (WaterISAC) in 2002, in coordination with the U.S. Environmental Protection Agency. That same year, it was authorized by Congress in the Bioterrorism Act. WaterISAC is the designated information sharing and operations arm of the Water Sector Coordinating Council. WaterISAC is the only all-threats security information source for the water and wastewater sector. Members provide water and wastewater service to most of the United States, as well as in Canada, Australia, and New Zealand. Membership is also open to organizations in the U.K. and the Netherlands. WaterISAC is a non-profit organization, governed by a board of managers comprising water and wastewater utility managers and state drinking water administrators who are appointed by the partner organizations shown above. Built from the ground up to serve the water sector, WaterISAC is uniquely positioned to understand and support the sector’s needs. Read more.WaterISAC: On Twitter: @WaterISAC Chuck: On LinkedIn Jennifer: On LinkedIn and on Twitter: @Gate15_JenTopics discussed: Chuck, Jen and WaterISAC’s backgrounds & the WaterISAC mission. The criticality of water – our most critical lifeline! WaterISAC’s evolution over the years, with great reports, resources, forums and events for the water and wastewater community. Physical and cyber threats to the Sector – from extremism and the Hard Reset to insider threats and a lot more! Adding to his comments in last month’s interview, Andy offers CISA more unsolicited guidance… Pirates, monuments, and favorite past times in Andy’s possibly nefarious social engineering game. WaterISAC About WaterISAC H2OSecCon 2022 Coming Soon! H2OSecCon 2023! Sign up for notifications and be there as a sponsor or participant! The Cybersecurity Evangelist, Episode 6 – The ISAC Edition/Series Part 2; A chat with WaterISAC CyberScoop: Did someone really hack into the Oldsmar, Florida, water treatment plant? New details suggest maybe not. 10 Apr 2023 Security Affairs: A cyber attack hit the water controllers for irrigating fields in the Jordan Valley, 11 Apr 2023 The Gate 15 Interview: Climate Change Threats with Dr. Jeff Masters. Sea Level Rise, Drought, the 2023 Hurricane Season, plus Devo, Watermelon and the beauty of the Havasupai Canyon!

The podcast and artwork embedded on this page are from Gate 15, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Phoenix: OT Security for Smaller Plants and Factories
Pub date: 2023-04-20

In this special episode, we are joined by Gabe Authier and Greg Valentine to introduce Industrial Defender's new product, Phoenix, an innovative OT security solution designed specifically for small to medium-sized businesses struggling with limited resources and budget. With the rise of attacks on operational technology and the crippling effects of cyber incidents on small businesses, Phoenix provides a cost-effective, all-in-one solution for industrial organizations to quickly and comprehensively view all their OT assets and associated cyber risks.

Gabe Authier is an accomplished CPO with over 20 years of experience in product management and IT. His passion for customer-centric software development has led him to spearhead the launch of multiple industrial cybersecurity technologies and SaaS cloud products. As CPO at Industrial Defender, he continues to drive innovation and shape the future of OT cybersecurity solutions with his expertise in creating innovative solutions for the industrial space.

Greg Valentine is a seasoned cybersecurity professional with over 30 years of experience in the software industry, including 15 years in cybersecurity. As SVP of Solutions Engineering at Industrial Defender, he builds technical solutions to ensure clients get the most effective and efficient implementations of the company's software. With two certifications, ISC2 - CISSP and GIAC - GRID, Greg has held cybersecurity roles at major companies such as Lockheed Martin, Capgemini, and Winternals Software.

In this episode, Aaron, Gabe, and Greg discuss:

Exploring the features and benefits of Industrial Defender's new solution for small to medium sized operations: Phoenix
Understanding the scalability and implementation process of Phoenix and its ability to seamlessly migrate to the full suite of products for larger asset counts
The versatility and practical applications of Phoenix for asset management and network monitoring in various industries
Phoenix as a lightweight and easy-to-use cybersecurity product

Key Takeaways:

Phoenix aims to provide basic-level asset visibility and management for smaller operations and customers who have not yet implemented cybersecurity on their industrial control system networks, while also offering an easy upgrade path for those who want to grow into the full suite of products.
The Phoenix hardware platform can scale from a small industrial PC to a full production platform with easy onboarding for smaller organizations.
Phoenix provides advanced capabilities, including passive monitoring of network traffic, IDS, asset management, and security events monitoring, to help water wastewater organizations and system integrators gain visibility into their plants and networks.
Phoenix offers automatic, up-to-date cybersecurity health monitoring, easy asset management, and minimal maintenance, specifically targeting the 25 to 200 asset level range, and can be deployed across multiple sites.

"The whole intent was to help smaller organizations – companies that have not really started, they may not have a cybersecurity person, let alone a cybersecurity team. So this is a fraction of somebody's job where the intent is to make this as easy, streamlined as possible." — Greg Valentine

Learn more about Phoenix: https://www.industrialdefender.com/phoenix

Connect with Gabe:

Email: gauthier@industrialdefender.com

LinkedIn: https://www.linkedin.com/in/gabeauthier/

Connect with Greg:

Email: gvalentine@industrialdefender.com

LinkedIn: https://www.linkedin.com/in/gvalentine/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the exp

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Weekly Roundup 16.2023
Pub date: 2023-04-21

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 32 · TOP 5% what is this?)
Episode: Unique OT characteristics and points of IT convergence.
Pub date: 2023-04-19

Cyberattacks against Canada’s agriculture sector. Hitachi ransomware incident. Africa’s industrial sector under cyberattack. TSA issues new aviation cybersecurity requirements. Ransomware Vulnerability Warning Pilot supports critical infrastructure operators. Patch Tuesday and OT. Guest JD Christopher, Dragos’ Director of Cyber Risk, discusses ICS security standards and regulations and how efforts finalized in 2022 will shape the OT programs of the next decade. In the Learning Lab, Dragos’ Mark Urban is joined by their CEO Robert M. Lee to talk about the unique characteristics of OT and points of IT convergence.

Control Loop News Brief.Cyberattacks against Canada’s agriculture sector.Safety Net: A flock of chickens, held for ransom — Growing cyberattacks on Canada's food system threaten disaster (Financial Post)

Hitachi ransomware incident.Hitachi Energy confirms data breach after Clop GoAnywhere attacks (BleepingComputer)

Africa’s industrial sector targeted with malware.Threat landscape for industrial automation systems. Statistics for H2 2022 (Kaspersky ICS CERT)

A border-hopping PlugX USB worm takes its act on the road (Sophos)

TSA issues new cybersecurity requirements for the aviation industry.TSA issues new cybersecurity requirements for airport and aircraft operators (PRNewswire)

Ransomware Vulnerability Warning Pilot supports critical infrastructure operators.CISA Establishes Ransomware Vulnerability Warning Pilot Program (CISA)

CISA now warns critical infrastructure of ransomware-vulnerable devices (BleepingComputer)

Patch Tuesday and ICS.ICS Patch Tuesday: Siemens, Schneider Electric Address Dozens of Vulnerabilities (SecurityWeek)

Control Loop Interview.The interview is with JD Christopher, Director of Cyber Risk at Dragos, sharing ICS security standards and regulations and how the efforts finalized in 2022 will shape OT programs of the next decade.

Control Loop Learning Lab.On the Learning Lab, Mark Urban is joined by Dragos CEO Robert M. Lee to discuss unique OT characteristics and points of IT convergence.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 32 · TOP 5% what is this?)
Episode: Edgard from Nozomi (Part 2)
Pub date: 2023-04-19

The August 2021 Unsolicited Response episode with Edgard Capdevielle, CEO of Nozomi Networks, was a fan favorite. So Dale invited Edgard back, like the first time it was a wide ranging and fun conversation. His budget analogy of OT security and a new child in the family was Dale's favorite part.

They cover a lot of ground including:

the OT visibility and detection market growth in the last two years
whether he stands by his 2021 view that a company that does "X, Y, Z and OT security" doesn't really do OT security
how much of the back end (non-sensor) part of the market is moving to the cloud now and what will it be in three years. Plus some disagreements / discussion on architecture
budget muscle and momentum
what sort of metrics should an asset owner use to determine the value of these OT visibility and detection solutions
how is the US Government affecting the market Enjoy!

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 78: How to Have a Cybersecurity Career in the Navy with Daniel Ricci
Pub date: 2023-04-18

Derek is delighted to have Daniel Ricci joining him on today’s podcast!

Dan wears many different hats. He is currently the Senior Information Security Officer and Senior System Security Engineer at Frequentis Defense. He is also the founder of the ICS Advisory Project, which focuses on providing small and medium size ICS asset owners with a free data visualization capability to track applicable vulnerabilities and secure Critical Infrastructure. Dan retired from the U.S. Navy after serving 21 years in the Information Warfare community. During his career, he supported and enabled full-spectrum Cyberspace operations, Naval Air, Sea, and Special Warfare operations.

Dan comes from a small town in the south suburbs of Chicago. In addition to being an engineer, he is also the founder of many things, a military veteran, musician, scuba diver, and data hound. He joins Derek today to discuss his background and career journey, share his insights and experience, and offer nuggets of advice for anyone considering a Naval cybersecurity career.

Show highlights:

Why Dan joined the Navy, and what he learned there.
Dan got introduced to security while in the Navy. He discusses the different aspects he focused on during his tours and the latter part of his Naval career.
Dan dives into the cybersecurity training opportunities available in the Navy.
Dan talks about his transition out of the Navy.
What Dan is working on in his current role.
Dan discusses the ICS Advisory Project he started.
Dan shares his vision and concerns for the future of his ICS Advisory Project.
Dan shares his vision for the future in general.

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Experience Using IEC 62443 Risk Assessments [The Industrial Security Podcast]
Pub date: 2023-04-17

Risk assessments are a staple of industrial security programs. Paul Piotrowski, a Principal OT Cybersecurity Engineer at Shell, walks us through a deep dive into his experience using IEC 62443-3-2 risk assessments and the lessons he's learned, with lots of examples.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Digitalization and Managed Security Services
Pub date: 2023-04-17

In this evolving digital world where increased connectivity is everywhere, security professionals continue to put out fires all the time. That raises the question: How can a manufacturer ensure a secure environment? With a lack of qualified security professionals available, plus the boom in connectivity brought on by the growth of digitalization and the threat of attacks on the rise, managed security services is in the process of becoming an important tool – if not the only tool – in a manufacturers’ tool box.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 77: ABB Ransom-Aware OT Defense Virtual Summit Keynote Preview with Derek Harp
Pub date: 2023-04-14

This special edition of the CS2AI podcast features the highlights of a recent interview with Derek, broadcast on the ABB Energy Pod podcast.

In this episode, Patrik Boo, the Portfolio Manager for Cybersecurity Services at ABB Process Automation, interviews Derek Harp, the Founder and Chairman of CS2AI, about his upcoming keynote presentation that will open the OT Cybersecurity Leaders Virtual Summit on ransomware, which will take place on April 19th, 2023.

Stay tuned to hear what Derek will cover in his keynote presentation at the OT Cybersecurity Leaders Virtual Summit.

The summit is hosted by ABB in collaboration with other sponsors.

Show highlights:

Derek discusses his main takeaways from the 2022 report.
Who are the greatest threat actors?
Derek dives into the need for OT cyber-informed training within the operating environment.
How ransomware is on the rise in all the different sectors.
The link between various groups of cyber criminals and the sharp increase in ransomware.
Who is at risk?
Other topics that will also be covered at the summit.

Links and resources:

(CS)²AI

Derek Harp on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 15.2023
Pub date: 2023-04-14

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Roya Gordon: Secure Connections: Why Human Interaction is Key to OT Security
Pub date: 2023-04-13

About Roya Gordon: Roya Gordon is a trailblazing cybersecurity expert, inspiring young women and people of color to pursue their passions in technology. With an impressive background that includes serving as an intelligence specialist in the U.S. Navy and working at Idaho National Laboratory and Accenture, Roya now holds the position of OT/IoT Security Research Evangelist at Nozomi Networks. Roya is also the founder of Steps2STEM, a company that aims to help young women and people of color break into the cybersecurity industry. With a Masters in Global Affairs focused on cyberwarfare from Florida International University, Roya is committed to sharing her insights and experiences to help others succeed.

In this episode, Aaron and Roya Gordon discuss:

The power of working together to protect our economy and infrastructure in cybersecurity
Why knowing the differences between IT and OT environments matters for industrial safety
Collaborative strategies for securing critical infrastructure in complex industrial environments
Hopes and concerns around the mainstream adoption of OT networks and the impact of AI on the industry's workforce

Key Takeaways:

People with different roles in cybersecurity, such as vendors, consultants, and asset owners, cooperate to safeguard critical infrastructure by utilizing their diverse abilities and viewpoints, ensuring victory over cyber threats.
It's not possible to combine IT products and OT environments due to various reasons, and this creates a risk for businesses, as demonstrated in the Colonial Pipeline incident.
Collaboration between consultants and vendors is key to securing critical infrastructure, where consultants provide guidance and vendors offer integrated solutions to meet policy requirements.
Roya believes that in the next five to 10 years, OT will become more mainstream, but worries about AI replacing human jobs in the industry, stressing the importance of adapting and continuously learning through emerging technologies to maintain relevance.

"We talk about ChatGPT and how threat actors can use it for bad, but a lot of people are using it for good too. I just think it gets a little bit dangerous where we want to remove the human element out of things and just trust AI because everything has bugs." — Roya Gordon

Connect with Roya Gordon:

Website: https://www.nozominetworks.com/

LinkedIn: https://www.linkedin.com/in/roya-gordon-16245437/

Twitter: https://twitter.com/RoyaGordon

The Importance of Physical Access Endpoint Detection: https://www.nozominetworks.com/blog/importance-of-physical-access-endpoint-detection/

2022 2H Security Report: https://www.nozominetworks.com/blog/nozomi-networks-researchers-take-a-deep-look-into-the-ics-threat-landscape/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: Interview with Gene Spafford
Pub date: 2023-04-12

Dale Peterson interviews cybersecurity legend Gene Spafford on the S4x23 Main Stage. Some of what they cover is:

how to deal with securing legacy systems
the incredibly productive 3 years of firsts including host IDS, network IDS, honeypot, network vulnerability scanner, and more. What led to this amazing production?
The upcoming 25th year of CERIAS
His new book Cybersecurity Myths and Misconceptions ... Avoiding the Hazards and Pitfalls that Derail Us and digging into some of those myths (Cyber Offense is Easier than Defense, Sharing More Threat Intel Will Make Things Better, Everyone Should Solve A Given Cybersecurity Problem In The Same Way)

View Details

Podcast: Nexus: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Dave Elfering on Cyber Liability Insurance
Pub date: 2023-04-10

David Elfering, senior vice president at Marsh, a global insurance broker and risk management company, joins the Nexus podcast to discuss the current state of cyber insurance. A longtime figure in information security, Elfering explains the current volatility around coverage, premiums, and exclusions. He goes deep into what can sometimes be contentious discussions about qualifications and controls that must be implemented in order to be eligible for coverage, in addition to policy exclusions.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Meital Arik COO @DiviceTotal former Head of Guidenes & Regulation Division @INCD about OT Sec & data science
Pub date: 2023-04-07

הכר את הסטארטאפ

נחשון פינקו מארח את מיטל אריק מהסטארטאפ דיוויס טוטל, לשעבר דירקטורית וראש תחום הנחייה ורגולציה במערך הסייבר בשיחה על ניהול סיכוני סייבר בעולמות התפעולים והחשיבות של עדכוני פאצ'ים

מה? מי? חברת דיוויס-טוטל, ואיך דאטה סיינס מתחבר לנושא ההגנה על סיבות תפעוליות

מה הפתרון שלכם ולמי הוא טוב

מה האתגר מול פגיעויות וניהול פאצ'ים

איפה אתם ממקמים את עצמכם ומה הערך שאתם מציעים ללקוחות שלכם

ועוד

Know the startup Nachshon Pincu hosts Meital Arik, COO @DiviceTotal startup, and former Chief Executive Director Head of Guidenes and Regulation Division @Israel National Cyber Directorate (INCD) in a conversation about OT risk management and keeping your OT patching updated.

DeviceTotal? In between OT defense and data science?
What is the DeviceTotal solution, and for whom is it good?
What are the challenges with OT vulnerabilities and patch management?
What is DeviceTotal goto market strategy?

And more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Rafael Maman, VP OT Security @Sygnia, about heading from the past to the future of OT cyber security
Pub date: 2023-04-06

Nachshon Pincu hosts Rafael (Rafi) Maman, VP of OT Security @Sygnia. An OT cyber security evangelist and for many an OT cyber Goro.

Rafi's article "The Future of OT Security" (https://blog.sygnia.co/the-future-of-ot-security) changed how cyber pros look at the cyber modules we are used to working with. What are OPAF and O-PAS?

You have been in the ICS/OT cyber industry for many years. What significant changes have taken place over the years?
Sygnia is a well-known IR and red teaming (RT) company. What is your actual role in Sygnia?
A summary and the highlight of the article "The Future of OT Security."
Some of our community describe this article as provocative why?
Where are we heading as OT security defenders? How do you think our industry will look in the coming years?

And more...

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Sustainability Podcast (LS 27 · TOP 10% what is this?)
Episode: Addressing Today’s and Tomorrow’s Industrial Cybersecurity Challenges
Pub date: 2023-04-06

Schneider Electric executives Mary Beth Connolly, VP Strategy, Process Automation and Jay Abdallah, VP Cybersecurity Services join Sid Snitkin, VP Cybersecurity Advisory Services in a discussion of how industrial companies can meet the challenges they face in ensuring the cybersecurity of their facilities and critical infrastructure. This includes dealing with the today’s increased risks of ransomware and nation state attacks, as well the people, process, and technology changes that companies should be considering to enable secure digitalization.

Would you like to be a guest on our growing podcast?

If you have an intriguing, thought provoking topic you'd like to discuss on our podcast, please contact our host Jim Frazer

View all the episodes here: https://thesustainabilitypodcast.buzzsprout.com

The podcast and artwork embedded on this page are from The Sustainability Team at ARC Advisory Group , which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Duane Laflotte: Simulating Real-World Attacks on OT with Red Teaming
Pub date: 2023-04-06

About Duane Laflotte: Duane Laflotte is a renowned Chief Technology Officer (CTO) and technology expert, currently leading the charge at Pulsar Security. With a deep understanding of complex technical issues and a constant thirst for staying at the forefront of emerging technologies, Duane is known for his innovative and creative solutions to even the most complicated challenges. His expertise spans across a wide range of technical domains, including cryptography, exploit development, networking, programming, and enterprise data storage. He has worked with prestigious Fortune 500 companies, government agencies, and military organizations such as Disney, Bank of America, the FBI, SOCOM, DARPA, and the NHL, serving in various roles such as solutions architect, red team lead, and presales engineer. Duane's extensive credentials include expert-level certifications, showcasing his exceptional technical prowess. His passion for continuous learning and curiosity-driven approach has resulted in prolonged growth and innovative solutions in the field of technology.

In this episode, Aaron and Duane Laflotte discuss:

Identifying cybersecurity vulnerabilities in businesses and organizations through personalized red team attacks
The transformation of OT manufacturing from relying on vendor-specific hardware solutions to utilizing off-the-shelf software
Ensuring security in remote work environments
Recognizing the critical importance of cybersecurity for businesses

Key Takeaways:

Red teaming often involves using personal information gathered from the internet to craft sophisticated attacks, highlighting the need for organizations to be vigilant about protecting their digital and personal information.
The move to off-the-shelf hardware and software in OT manufacturing has heightened vulnerabilities and supply chain risks, with customization prioritized over security, necessitating careful consideration and expertise for effective system management and security by organizations.
The growing use of IoT devices, remote work, and the inherent complexity and security gaps in home networks create challenges for organizations to safeguard against cyber threats, emphasizing the need for enhanced cybersecurity measures in home and work settings.
Business owners need to prioritize cybersecurity by making informed decisions, holding vendors and internal teams accountable, and seeking expert advice, as waiting until a security incident occurs is not a viable strategy.

"We cannot just keep throwing training and training and training at users, and they are going to get marginally better. But they are not going to get infinitely better." — Duane Laflotte

Connect with Duane Laflotte:

Website: https://www.pulsarsecurity.com/

Email: duane@pulsarsecurity.com

Show: https://podcasts.apple.com/us/podcast/security-this-week/id1578265009

LinkedIn: https://www.linkedin.com/in/duanelaflotte/

Twitter: https://twitter.com/dlaflotte

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 4.2023
Pub date: 2023-04-07

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 33 · TOP 5% what is this?)
Episode: ICS Security: Q1 in Review
Pub date: 2023-04-05

Marty Edwards joins Dale Peterson to discuss the big stories of the first quarter of 2023.

The US National Cybersecurity Strategy
ISA / ISASecure starting an OT Site Assessment Certification
Ransomware Affecting Operations (indirectly)

Marty and Dale then give their win and fail for Q1 and a prediction.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #48 - UTCAL - Energy CyberSecurity
Pub date: 2023-04-06

Inscreva-se no Webinar - OT Zero Trust: https://bit.ly/3KBVPbmSolicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 32 · TOP 5% what is this?)
Episode: The challenges of carrying out vulnerability management.
Pub date: 2023-04-05

The Vulkan Papers. The Cyberspace Solarium Commission recommends that CISA set up a test bed to improve maritime cybersecurity. Dragos CEO on critical infrastructure cybersecurity. The JCDC’s pre-ransomware notification efforts. GuestMike Hoffman, Technical Leader Global Services at Dragos & a SANS instructor, discusses challenges carrying out vulnerability management. In the Learning Lab, Dragos’ VP Product & Industry Market Strategy Mark Urban concludes his two-part discussion about industrial cyber threat intel & collective intelligence with Seth Lacy, Principal Threat Hunter at Dragos.

Control Loop News Brief.The Vulkan Papers.A Look Inside Putin's Secret Plans for Cyber-Warfare (Der Spiegel)Secret trove offers rare look into Russian cyberwar ambitions (The Washington Post)

Maritime cybersecurity.Full Steam Ahead: Enhancing Maritime Cybersecurity (Cyberspace Solarium Commission 2.0)

Cyber experts call for CISA to establish maritime equipment test bed (FedScoop)

Dragos CEO on critical infrastructure cybersecurity.Full Committee Hearing to Examine Cybersecurity Vulnerabilities to the United States' Energy Infrastructure (Senate Committee on Energy and Natural Resources)

JCDC and pre-ransomware notification.JCDC Cultivates Pre-Ransomware Notification Capability (CISA)

Getting Ahead of the Ransomware Epidemic: CISA’s Pre-Ransomware Notifications Help Organizations Stop Attacks Before Damage Occurs (CISA)

Control Loop Interview.The interview is with Mike Hoffman, Technical Leader Global Services at Dragos & SANS instructor, discussing challenges carrying vulnerability management.

Control Loop Learning Lab.In Part 2 of 2, Dragos’ VP Product & Industry Market Strategy Mark Urban speaks with Seth Lacy, Principal Threat Hunter at Dragos, about industrial cyber threat intel & collective intelligence.

Industrial Cyber Threat Intel & Collective Intelligence links:

Neighborhood Keeper in the Broader Context of Cyber Threat Intelligence
Using Trend Analysis to Operationalize OT Threat Intelligence with Neighborhood Keeper

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 76: A (CS)2AI Fellows Panel: S4 Takeaways and a Look Ahead at Our industry
Pub date: 2023-04-04

Today, Chris Blask, the Vice President of Strategy at Cybeats, and Patrick Miller, the CEO at Ampere, join Derek in an online seminar stimulated by a blog article Patrick wrote just after the last S4 conference.

Chris and Patrick are both (CS)²AI fellows who have attended many S4 events. In today’s online session, they review the latest S4 conference. They dive into various topics important for the industrial security and OT security communities, answer questions from listeners, and discuss the future of the cybersecurity industry.

S4 is one of the longest-standing annual cybersecurity conferences focused on control systems, OT, and ICS. Dale Petersen is the founder, creator, and MC of the S4 conferences.

Show highlights:

Chris shares a main takeaway from this year’s S4 event.
How technology is changing.
Why more people are needed to make cybersecurity work going forward.
Question: Are discussions of wireless security growing or declining at the conference? Is there a session (or sessions) dedicated to wireless yet?
Question: Within all OT and IT cybersecurity professionals, what would be the ratio of OT cybersecurity real professionals?
Why it is normal and expected not to know the answer to some things, and how to find the answer if there is something you don’t know.
Question: Tribal knowledge is a real threat to OT/ICS security. The aging workforce in OT engineering is part of this problem. What is the best way for organizations to address this challenge?
Chris and Patrick share their thoughts on executives taking the risk of solving ICS/OT security issues.
Question: What are your thoughts on Ford applying for a patent on a car that can repossess itself?
Chris and Patrick discuss metrics, risk management, and cyber insurance.
Patrick and Chris dive into diversity, equity, and inclusion in the OT space.
Question: When will we get past the notion that ICS pen-testing has to be a separate category?
Question: Looking forward, what would you foresee as the big themes of S4/24?

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Securing Software Via Data Diode
Pub date: 2023-04-03

One of the biggest fears facing manufacturers today is downloading an update or patched software or just plain downloading new software. Where can they do it and ensure they are not downloading tainted code? Straight from the software provider? Downloading code via removable media? That should be safe, right? Well, we are seeing sometimes that just doesn’t get the job done.Using a data diode could be one approach.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 33 · TOP 5% what is this?)
Episode: Managing Incident Responses to Critical Infrastructure Attacks
Pub date: 2023-04-03

For today’s episode, I’m joined by Lesley Carhart. Lesley is the Director of Incident Response for North America at the industrial cybersecurity company Dragos, Inc. She leads incident response and proactively hunts for threats in customers’ ICS environments. Lesley was the incident response team lead at Motorola Solutions, and retired from the United States Air Force.

Today, we dive into the kinds of active threats out there that incident response deals with:

“We see insider cases, both intentional and unintentional insider cases. We see a lot of crime ware. So crime actors are getting smarter about where they're doing things like ransomware attacks. They're less haphazard. There's probably less overall attacks now, but they're more smartly performed. So they're targeting more critical industries. They are targeting people who they think will have to pay…And then there's still adversary groups who are more state style, who are building their capabilities to launch attacks in the future. And conducting espionage, preparing to do sabotage. And that's still happening and they're getting better at it.” - Lesley Carhart

We explore the challenges of securing operational technology (OT) for asset owners, different kinds of threats, and the process of doing vulnerability discovery for these physical assets.

What do asset owners in critical infrastructure need to secure in the first place - and why is this so challenging to stay on top of? What kind of incident response plan is needed for OT in an industrial environment?

Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Shining a Light into the Dark [The Industrial Security Podcast]
Pub date: 2023-04-03

Getting an industrial site started on the cybersecurity road can be hard. Matthew Malone of Yokogawa joins us to look at strategies to shake loose funding, trigger conditions that can jump-start investments, and stumbling blocks and how to address them.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 415: Cyber Security for Building Automation Part 4
Pub date: 2023-03-31

Your building automation systems been compromised. What do you do now?

Whether it's by ransomware, exploits, or other attacks there is still hope.

In this episode of the Smart Buildings Academy Podcast we are going to look at the response to cybersecurity attacks and intrusions.

We will look at actions you can take right now to ensure you have the ability to recover from an attack, how to preserve the environment for forensic analysis, and how to clean your systems post attack. We look forward to seeing you at this live session.

The podcast and artwork embedded on this page are from Phil Zito Building Automation and Systems Integration Expert, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 13.2023
Pub date: 2023-03-31

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Bryson Bort: Security Is Defined By The Threat - Contextualizing Cyber Risks To Prioritize Security Efforts
Pub date: 2023-03-30

About Bryson Bort: Bryson Bort is a skilled cybersecurity professional with an impressive background as an entrepreneur and former U.S. Army Officer. He founded SCYTHE, a platform for next-generation attack emulation, and GRIMM, a cybersecurity consulting firm. Additionally, he co-founded the ICS Village, a non-profit organization dedicated to raising awareness about industrial control system security. Bryson has received numerous awards and recognitions, including being named one of the Top 50 in Cyber by Business Insider and a Tech Titan in Washington DC. He also served as a Battle Captain and Brigade Engineering Officer in support of Operation Iraqi Freedom during his military career. Bryson earned his Bachelor of Science in Computer Science with honors from the United States Military Academy at West Point and completed various professional education courses in tactical communications and information assurance. With his extensive experience in the cybersecurity industry, Bryson is a respected thought leader and advisor in the field.

In this episode, Aaron and Bryson Bort discuss:

The challenges and cultural divide in addressing cybersecurity issues in OT, why IT security solutions don’t work for OT, and why OT security is lagging behind IT security
Bridging the gap between OT and IT through education, but also listening and building trust.
Vulnerability management and patching versus risk mitigation
Ransomware in cars, geopolitical concerns, and positive developments in government efforts and regulation to support risk management in education and critical infrastructure's OT side.

Key Takeaways:

OT cybersecurity requires a different approach than IT cybersecurity due to the complex technical environment and the potential safety risks involved, and tools alone cannot bridge the cultural and skillset divide between OT and IT professionals.
When it comes to vulnerability management, IT emphasizes patching and is often compliance driven. In OT it’s important to recognize that systems in an operational environment often cannot be patched without disruption operations, so OT vulnerability management emphasizes risk mitigation, and putting safeguards around the vulnerability.
Security is defined by the threat. Security is measured and validated against how well that threat is mitigated. So it’s important to understand the behavioral characteristics of threats in order to take the actions that improve your security posture. Contextualizing what the security threat means to you is important for prioritization.
Relatively speaking, the cybersecurity industry is still young, and the U.S. Government's cybersecurity programs are even younger. We will continue to see more development and improvements with regard to unified cybersecurity programs in the near future.

"I think a lot of people forget how young this industry is and also how young the government's attempts are at this industry." — Bryson Bort

Connect with Bryson Bort:

Website: https://scythe.io/ and https://grimmcyber.com/

Show: https://podcasts.apple.com/us/podcast/hack-the-plant/id1528852909

LinkedIn: https://www.linkedin.com/in/brysonbort/

Twitter: https://twitter.com/brysonbort

Hack the Capitol 2023: https://www.icsvillage.com/hack-the-capitol-2023

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 32 · TOP 5% what is this?)
Episode: The OT SBOM Market
Pub date: 2023-03-29

Dale Peterson talks with Matt Wyckhouse, Founder and CEO, of Finite State about where the SBOM products and market is today and where it will go in the future. This discussion was informed by the SBOM Challenge at S4x23.

Who is the primary buyer of SBOM products and services today? (Hint: Matt thinks that 80% of the code in a product is third party)
How accurate are the products, and the Finite State product in particular, in creating a SBOM?
How much is the value of a SBOM degraded if it is not perfect? If it is missing software or has inaccuracies?
Are the offerings now a product? A semi-custom service that uses a developed product? (with an apt comparison to the detection market)
What will the US Government do with all these SBOMs if they actually get them? If they get an exponential increase in software inventory and the patching and cyber maintenance burden.
Will there be a separate/distinct OT SBOM market? Will there be a SBOM market in the long run or will it get subsumed in some sort of asset management market?
Early thoughts on the SBOM marketplace (a place to collect and distribute and respond to queries on SBOMs)
Where is the industry / products now on VEX?
Do configuration files belong in a SBOM?
Surprise data points from the SBOM Challenge

View Details

Podcast: Industrial IoT Spotlight (LS 35 · TOP 3% what is this?)
Episode: EP 171 - Integrating operations and IT to secure medical devices
Pub date: 2023-03-28

Our guest for this week is Shankar Somasundaram, founder and CEO of Asimily. Asimily is a medical IoT risk mediation platform that holistically secures mission-critical healthcare devices through inventory detection, cybersecurity management, and procurement to operation support.

In this episode, we discussed the unique challenges in securing the healthcare environment, from heterogeneous device fleets to the broad attack landscape and complex regulations. We also explored the importance of integrating operations in IT that can impact medical device performance.

Key Questions:

What areas need focus for cybersecurity companies to address new threats in the market?
How do you address the need to secure a hybrid and home healthcare environment?
Where does the liability lie for cybersecurity issues in the healthcare industry?

The podcast and artwork embedded on this page are from Erik Walenza: CEO, IoT ONE | Chair, IIC Smart Factory Task Group | Director, Startup Grind, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 75: Project Management and How It Can Fuel a Cybersecurity Career
Pub date: 2023-03-28

Today, Derek interviews Jonathan Tubb, the Director of Industrial Cybersecurity at Siemens Energy in Ohio.

Jonathan is an experienced Senior Lead with a demonstrated history of working in the power generation industry. He is skilled in Power Plants, Electric Power, Power Systems, Integration, and Research. He has strong project management skills and a Computer Science and Engineering degree from The Ohio State University.

Jonathan is a well-rounded and interesting individual! He is also a great contributor to the cybersecurity community and a true blue engineer, software engineer, tinkerer, bird and animal lover, Ohio State Buckeye, and art enthusiast. He joins Derek to discuss his background, education, and career trajectory, along with nuggets of advice for anyone considering a career in the cybersecurity space.

Show highlights:

Growing up, Jonathan spent much of his time focusing on science and technology.
How volunteering at the Museum of Science and Industry fed Jonathan’s curiosity and impacted his approach to technology.
How cybersecurity informed where Jonathan began his career.
Jonathan discusses his internship with American Electric Power.
What are the benefits of doing an internship?
Why must we utilize other people’s knowledge to help solve problems?
Jonathan discusses his transition to Siemens Energy.
Jonathan gets into what he has focused on for the last few years at Siemens Energy.
What makes a good cybersecurity practitioner?
Jonathan dives into the industrial cybersecurity apprenticeship concept Siemens Energy has put together but not yet implemented.

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Pipeliners Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 277: 3rd Edition of API 1164 Pipeline Cyber Security with Suzanne Lemieux
Pub date: 2023-03-28

This week’s Pipeliners Podcast episode features Suzanne Lemieux discussing the third revision of API, how TSA and API standards cohesively work together, and what we can expect to see in the future.

In this episode, you will learn about how API 1164 continued to reference past frameworks but included new standards, why it is considered performance based, and why a proper cybersecurity profile is crucial.

Visit PipelinePodcastNetwork.com for a full episode transcript, as well as detailed show notes with relevant links and insider term definitions.

The podcast and artwork embedded on this page are from Russel Treat, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 12.2023
Pub date: 2023-03-24

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Emilio Salabarria: Building Organizational Resilience through Comprehensive Cybersecurity Assessments for Cyber Florida
Pub date: 2023-03-23

About Emilio Salabarria: Emilio Salabarria is a highly accomplished expert in emergency management and cybersecurity. He's been serving as the Deputy Senior Executive Advisor at Cyber Florida since July 2022. Emilio brings a wealth of knowledge and expertise to the table when it comes to cybersecurity education, research, training and development, public policies, cybersecurity-related technologies, and critical infrastructure support. He's got some serious experience under his belt too - having previously worked at Tampa Electric Company, the Tampa Port Authority, and The Depository Trust and Clearing Corporation. Emilio's career began in 1985 as a firefighter, and he worked his way up to Division Fire Chief of Special Operations at Tampa Fire Rescue. During his time there, Emilio played a key role in the planning of major events such as the Gasparilla Parades, the 2012 Republican National Convention, and Super Bowl 43. Emilio's got a wealth of experience and education to draw on, and he's making a real impact in the fields of emergency management and cybersecurity.

In this episode, Aaron and Emilio Salabarria discuss:

Risk assessment programs for securing Florida’s critical infrastructure
The importance of participating in cybersecurity risk assessments and having a plan for the implementation of recommendations
Helping small counties prevent a cyber 9/11 by training and assessing them through tabletop exercises and the CSET tool
The potential impact of a comprehensive cybersecurity assessment tool for improving organizational resilience and preparedness

Key Takeaways:

Florida is assessing the cybersecurity risks of its public and private entities in 16 sectors to identify weaknesses and provide solutions to enhance preparedness against cyberattacks.
Participating in cybersecurity risk assessments, such as CSET, is crucial for Florida's critical infrastructure to identify risks and develop effective cybersecurity strategies, and is a low-friction and easy process.
Tabletop exercises are useful for cybersecurity training, but small counties with understaffed IT departments need more support to participate in them and prevent cyber attacks.
Completing the CSET tool for cybersecurity assessments to at least 90% can lead to benefits for participating organizations, regardless of whether they answer all questions, and the results from the program in Florida could be applicable to other states and industries.

"What we're trying to do here at Cyber Florida, we're trying to prevent a cyber 9/11. That's what we want to avoid, and that's the reason for the risk assessment, the training, and the report to the state to see what they will do." — Emilio Salabarria

Connect with Emilio Salabarria:

Website: https://cyberflorida.org/

Email: esalabarria@cyberflorida.org

LinkedIn: https://www.linkedin.com/in/emilio-f-salabarria-ms-cim-1816334/ and https://www.linkedin.com/company/cyberflorida/

Twitter: https://twitter.com/CyberSecurityFL

Instagram: https://www.instagram.com/cybersecurityfl/

CyberSecureFlorida Initiative: https://cyberflorida.org/cybersecureflorida/

Florida Cybersecurity Grant Program: https://digital.fl.gov/cybersecurity/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Vera Mens on Akuvox E11 Vulnerabilities
Pub date: 2023-03-22

Team82 researcher Vera Mens joins the Nexus podcast to discuss her research that uncovered 13 vulnerabilities in the popular Akuvox E11 smart intercoms. These devices are used to control access to offices, residential, and commercial establishments. The vulnerabilities range in severity, and pose serious privacy implications for users. Vera will discuss her research and a challenging disclosure withe vendor that began 15 months ago.
Read Team82's technical report on this research here.
Read Team82's blog here.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 32 · TOP 5% what is this?)
Episode: Puesh Kumar - Director of Dept of Energy's CESER
Pub date: 2023-03-22

Dale Peterson interviewed Puesh Kumar on the S4x23 Main Stage. Puesh is the Director of the US Dept of Energy's Cybersecurity, Energy Security, & Emergency Response (CESER). The lead US Government OT cybersecurity agency in the energy sector.

After Puesh gives a 3 minute overview on CESER, they dig into it.

How are they measuring CRISP's detection and analysis progress? Has it stopped or limited the impact of any attacks?
What is one of the CESER programs that didn't work and what did they learn from it?
Why is the US Government testing products for GE, Hitachi and other large companies and questioning the results.
The push for Cyber Informed Engineering and what success looks like
Competing with industy
and more ... CESER is tackling a lot so there was much to squeeze into 30 minutes

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 31 · TOP 5% what is this?)
Episode: The CISO evolution to incorporate OT.
Pub date: 2023-03-22

Cyberattacks against Canada’s agriculture industry. HItachi ransomware incident. African industrial sector targeted with malware. TSA issues new cybersecurity requirements for the aviation industry. CISA issues a guide for resilience in the maritime industry. Ransomware Vulnerability Warning Pilot supports critical infrastructure operators. Guest is JD Christopher, Dragos’ Director of Cyber Risk, talking about the CISO evolution. In the Learning Lab, Dragos’ VP Product & Industry Market Strategy Mark Urban kicks off his two-part discussion about industrial cyber threat intel & collective intelligence with Seth Lacy, who is a Principal Threat Hunter at Dragos.

Control Loop News Brief.Cyberattacks against Canada’s agriculture industry.Safety Net: A flock of chickens, held for ransom — Growing cyberattacks on Canada's food system threaten disaster (Financial Post)

HItachi ransomware incident.Hitachi Energy confirms data breach after Clop GoAnywhere attacks (BleepingComputer)

African industrial sector targeted with malware.Threat landscape for industrial automation systems. Statistics for H2 2022 (Kaspersky)

A border-hopping PlugX USB worm takes its act on the road (Sophos)

TSA issues new cybersecurity requirements for the aviation industry.TSA issues new cybersecurity requirements for airport and aircraft operators (TSA)

CISA issues a guide for resilience in the maritime industry.Marine Transportation System Resilience Assessment Guide (CISA)

Ransomware Vulnerability Warning Pilot supports critical infrastructure operators.CISA Establishes Ransomware Vulnerability Warning Pilot Program (CISA)

CISA now warns critical infrastructure of ransomware-vulnerable devices (BleepingComputer)

Control Loop Interview.The interview is with JD Christopher, Director of Cyber Risk at Dragos, discussing the CISO evolution.

Control Loop Learning Lab.In Part 1 of 2, Dragos’ VP Product & Industry Market Strategy Mark Urban speaks with Seth Lacy, Principal Threat Hunter at Dragos, about industrial cyber threat intel & collective intelligence.

Industrial Cyber Threat Intel & Collective Intelligence links:

Neighborhood Keeper in the Broader Context of Cyber Threat Intelligence
Using Trend Analysis to Operationalize OT Threat Intelligence with Neighborhood Keeper

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 47 - ICS Incident Response
Pub date: 2023-03-21

Inscreva-se no Webinar - OT Managed Detection and Response: https://bit.ly/3Zz0zmL

Solicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

Na última quarta, 15/03, aconteceu mais uma gravação do ICS SECURITY PODCAST.Nosso CEO Eduardo Honorato apresentou o Episódio #47 com o tema: ICS Incident Response.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 74: Tapping Into Natural Curiosity to Develop Your Cybersecurity Career with Chris Sistrunk
Pub date: 2023-03-21

Today, Chris Sistrunk joins Derek Harp on the podcast. Chris is currently the Technical Manager at Mandiant, which is now part of Google Cloud.

Chris is a Technical Manager in Mandiant's ICS/OT Consulting practice, focusing on cyber security for industrial control systems (ICS) and critical infrastructure. He focuses on helping secure ICS and critical infrastructure around the world.

Chris grew up in the hills and hollows of North Louisiana, surrounded by swamps, red clay, and pine trees. He is a relied-on expert in the cybersecurity space. He is also a husband and father, one of the co-founders of the BEER-ISAC, musician, dad joke-teller, bourbon aficionado, and an aspiring BBQ pit-master.

In this episode, Chris shares his backstory. He also discusses his education and career path and offers helpful advice for anyone interested in working with control systems and control systems security.

Show highlights:

Chris had an engineering mindset and was always curious about how things worked while growing up.
How he got into working with SCADA systems early on in his career.
How hurricanes taught Chris about instant response and disaster recovery, and prepared him for what he does today.
Chris offers advice, encouragement, and assistance to anyone who wants to work with control systems and control systems security.
What Chris learned while working for the power company.
The kind of thinking he employs when working with cybersecurity.
How Chris shifted from being an engineer to working with cybersecurity for control systems.
The various roles Chris has played and the steps he has taken along his career path.
How Chris got to work at Mandiant.
The importance of building trust, respect, and working together, to solve difficult problems.

Links and resources:

(CS)²AI

Mandiant

Chris Sistrunk on LinkedIn

Chris Sistrunk on Twitter

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Stakeholder-Specific Vulnerability Categorization (SSVC) [The Industrial Security Podcast]
Pub date: 2023-03-20

SSVC is a new standard decision process for deciding what to do about new vulnerabilities and patches. Thomas Schmidt of the German BSI joins us to look at how SSVC decision trees work, and where and why to use them.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 11.2023
Pub date: 2023-03-17

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Dan Gunter: How Our Growing Ability To Process Data Affects Cybersecurity
Pub date: 2023-03-16

About Dan Gunter: Dan Gunter is an accomplished cybersecurity professional with a wealth of experience in the field. As the founder and CEO of Insane Forensics, he is committed to providing digital forensics and threat-hunting services to help organizations protect themselves from cyber threats. Dan's expertise was honed through years of service in the United States Air Force, including as an officer in the Air Force Computer Emergency Response Team (AFCERT) and operational CYBERCOM teams. He also served as Director of Research and Development for Dragos Inc, where he oversaw detection engineering and reverse engineering efforts to protect critical infrastructure sites. Dan is a highly-regarded speaker and has presented at numerous events, including Blackhat, Schmoocon, S4, and CS3STHLM, where he has shared his knowledge on incident response, threat hunting, consequence analysis, and security operations.

In this episode, Aaron and Dan Gunter discuss:

The differences and challenges of incident response in IT vs OT environments, particularly in protecting critical infrastructure in OT systems
What a typical engagement looks like in an industrial environment for proactive and reactive security services
How asset owners of SMBs can secure their assets when they don't have an OT group, and what resources are available to help them
How different factors impact the response and success of a security incident in OT environments compared to IT environments

Key Takeaways:

OT and IT systems are often built with similar hardware and software, but on the OT side, the consequences of a system going down can be much more severe, so it's important to understand both the technical level and how humans interact with it, to protect and help asset owners and preserve life and safety.
Industrial sites can work with security consultants to prevent problems by taking proactive measures like threat assessments, network monitoring, and incident response retainers, but it's important to understand the environment and build trust to develop effective strategies.
To keep your business safe from cyber threats, consult with equipment manufacturers and follow their security guidelines, implement network monitoring and testing, and take proactive and reactive measures without overthinking.
Adapting IT and OT procedures to your organization's assets and requirements is crucial due to the significant variation across industries and sites, and a lack of accurate data sources and asset inventory can cause issues.

"Our ability to consume, to process, to push technology forward continues to grow. Whether you look at smart city stuff, both for security and also for power management and others, or you look at other systems like 5g and other things, we're able to move data around a lot easier. This combination of us being able to get more data but also process the data, I think it's going to have huge implications on the security side." — Dan Gunter

Connect with Dan Gunter:

Website: https://insaneforensics.com/

YouTube: https://www.youtube.com/channel/UCSBx8on8ffSm00kqUcTrRPA

LinkedIn: https://www.linkedin.com/in/dan-gunter/ and https://www.linkedin.com/in/dan-gunter/

Twitter: https://twitter.com/insaneforensics

Cost of a Data Breach 2022 Report: https://www.ibm.com/reports/data-breach

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 32 · TOP 5% what is this?)
Episode: Book Interview: Industrial Cybersecurity with Steve Mustard
Pub date: 2023-03-15

Steve Mustard took his 30 years of experience and wrote Industrial Cybersecurity: Case Studies and Best Practices, published by ISA. After talking about who the book is for and the writing process, Dale and Steve dig into the details.

Given Steve's longtime involvement and leadership with ISA, it's not surprising the book leans heavily on ISA/IEC 62443. They talk chapters on architecture, certification, optimism / pessimism, risk management and a fundamental misunderstanding of IT by OT. Some agreement, some disagreement, and always a civil discourse.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 73: Navigating Cybersecurity Start Ups and Scaling to $100M with Jose Seara
Pub date: 2023-03-14

Today, Derek Harp interviews Jose Seara, the Founder, and CEO of DeNexus.

Jose is an entrepreneur with 25+ years of experience building enterprises around critical infrastructure assets across different technologies and geographies. He turned a start-up concept into an international corporation with $100M in revenues. He is now building the global standard for Industrial Cyber Risk quantification at DeNexus and bridging the chasm between cyber threats and business impact.

Jose comes from Spain. He was born in Barcelona and grew up in Madrid. He is an intriguing person with a fascinating background. In addition to being an entrepreneur, he is also a husband, father, sailor, scuba diver, pilot, skier, builder, runner, and biker. He joins Derek today to discuss his background, professional journey, and the interesting work that gets done at DeNexus. He also shares his experience and offers nuggets of advice for budding entrepreneurs.

Show highlights:

Jose discusses his career journey, which began with him studying Naval Engineering at a college in Madrid.
Even though he is not very technologically savvy, Jose got exposed to technology through various work ventures.
Jose explains what brought him into the technology and cybersecurity space.
Jose explains how he shifted from working with traditional energy to becoming an entrepreneur working with wind and solar energies.
Jose explains how risk-taking has always taken him out of his comfort zone.
Learning lessons the hard way ensured Jose never forgot what he had learned.
How Jose inadvertently planted the seeds for DeNexus before starting it.
Jose reflects on his own entrepreneurial journey and offers advice for entrepreneurs new to the cybersecurity segment and entrepreneurs and CEOs selling cybersecurity to the OT space.
The various steps Jose took before launching DeNexus.
What are they doing at DeNexus?
The role the insurance industry plays in the control systems space.
What excites Jose about the future?

Links and resources:

(CS)²AI

Jose Seara on LinkedIn

DeNexus

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Slade Griffin: Securing the Industrial World: Challenges and Strategies for Cybersecurity Assessments
Pub date: 2023-03-09

About Slade Griffin: Slade Griffin is a highly experienced cybersecurity expert with a career spanning more than two decades. He currently serves as the Director of Security Assessments at Contextual Security Solutions, overseeing the company's cybersecurity assessment and penetration testing practice. His expertise in vulnerability assessments, penetration testing, risk assessment, security program development, forensic analysis, and incident response is matched only by his passion for the field. Besides, he is an enthusiastic cybersecurity professional who regularly shares his expertise on emerging threats and attack vectors through various forums, including conferences, training courses, and universities. Before joining Contextual Security Solutions, Slade has worked in multiple positions within the information security field and served in the United States Navy for six years. Additionally, he is the founder of Cyphoss Security, a cybersecurity services practice that uses his extensive experience to help clients overcome their cybersecurity challenges.

In this episode, Aaron and Slade Griffin discuss:

Exploring the challenges and differences on the IT and OT sides of business operations
Emphasizing the need for a practical and strategic approach in conducting cybersecurity assessments for OT environments
Building trust and communication between technology experts and non-experts, particularly with non-technical decision-makers in government and industry
Highlighting the significance of defense in depth and compartmentalization in cybersecurity, as evidenced by recent security breaches, such as the LastPass hack

Key Takeaways:

To succeed in industrial environments, it's helpful for consultants and blue teamers to collaborate with engineering experts, develop precise methodologies, and understand the unique challenges of working with industrial control systems, where any minor mistake can have catastrophic consequences.
Besides patching and updating systems, other measures like adding security layers, monitoring logins, whitelisting rules, and hiring cybersecurity personnel are also important to maintain cybersecurity as solely relying on tools isn't enough.
In unregulated environments, segmented networking is seldom done and can be compromised by weak links, such as individuals having weak passwords, making it important to understand the purpose and have the necessary security measures in place.
When creating software, it's crucial to prioritize safety and security while minimizing user burden to avoid any problems and ensure smooth functioning with constant monitoring and security measures.

"There are bad folks out there who want to do bad things, but there are more good folks who want to learn and do good things and defend things the right way." — Slade Griffin

Connect with Slade Griffin:

Website: https://contextualsecurity.com/

LinkedIn: https://www.linkedin.com/in/sladegriffin/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 10.2023
Pub date: 2023-03-10

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Critical Assets Podcast
Episode: Simplifying ICS Security Metrics
Pub date: 2023-03-09

Getting started with ICS and OT security metrics can be hard. What do you measure? How do you represent it? Do you even have the data? In this podcast, we talk with Erin Torruella to share her experience from building and managing metrics for multiple different sectors. She provides great advice on where to start and how to get the effort going in the right direction.

ChatGPT response was…

Operational Technology (OT) and Industrial Control Systems (ICS) are crucial components of critical infrastructure, and their security is essential for ensuring the safety, reliability, and availability of essential services. To measure the success or failure of an OT/ICS security program, several metrics can be considered, such as:

Vulnerability Management Metrics: This metric measures the number of vulnerabilities identified, the number of vulnerabilities remediated, and the time it takes to remediate the vulnerabilities.
Incident Response Metrics: This metric measures the effectiveness of the incident response process. It includes the time it takes to detect, contain, and resolve an incident, as well as the number and severity of incidents.
Compliance Metrics: This metric measures compliance with relevant security standards, regulations, and policies. It includes the number of audits conducted, the number of non-compliances identified, and the time it takes to remediate non-compliances.
Risk Management Metrics: This metric measures the effectiveness of the risk management program. It includes the number and severity of risks identified, the number of risks mitigated, and the time it takes to mitigate the risks.
Awareness Metrics: This metric measures the effectiveness of the security awareness program. It includes the number of training sessions conducted, the number of employees trained, and the level of understanding demonstrated by employees.
Asset Management Metrics: This metric measures the effectiveness of the asset management program. It includes the number and types of assets identified, the level of asset classification, and the accuracy of the asset inventory.
Performance Metrics: This metric measures the performance of the OT/ICS infrastructure. It includes uptime, availability, and response time.

Thanks for listening!

Show links:

Erin Torruella...

LinkedIn - https://www.linkedin.com/in/erin-torruella/

Twitter - https://twitter.com/LadySqrrl

Mastodon - https://infosec.exchange/@ladysqrrl

JD Christopher SANS talk on ICS Security Metrics - https://www.youtube.com/watch?v=gIsLP_Dtv7M

JD Christopher SANS blog post on ICS Security Metrics -https://www.sans.org/blog/mature-ics-security-with-metrics/

S.M.A.R.T. Methodology - https://en.wikipedia.org/wiki/SMART_criteria

DHS CISA Cross-Sector Cyber Performance Goals - https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

The podcast and artwork embedded on this page are from Patrick Miller, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #46 - ICS Threat Intelligence
Pub date: 2023-03-07

Inscreva-se no Webinar - OT Managed Detection and Response: https://bit.ly/3Zz0zmL

Solicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Adm. Mike Rogers on the National Cybersecurity Strategy
Pub date: 2023-03-09

Adm. Mike Rogers, USN (Ret.) joins the Nexus podcast to discuss the recently released National Cybersecurity Strategy, the first such strategy from the Biden administration. The strategy codifies many of the cyber-physical systems security initiatives the White House has produced since 2021 in the aftermath of the Colonial Pipeline ransomware attack. Adm. Rogers shares his past contributions to previous strategies, and provides insight into the document's five pillars and how they will impact critical infrastructure security in the near term.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 72: Industrial Security Road Trip - Perspectives from Around the World: Post Seminar Q&A with Tilo Kaschubek
Pub date: 2023-03-07

On the 7th of December last year, (CS)²AI hosted a symposium where more questions got asked than could get answered within the allotted time. Tilo Kaschubek was one of the speakers at the event. He joins Derek today on the podcast to respond to some of the unanswered questions.

Tilo is currently the Director of Cloud Ecosystem and Regional Alliances in EMEA for AVEVA. He was previously with OSIsoft before the merger. (AVEVA is now a subsidiary of a large recognized equipment manufacturer.)

In this episode, Tilo discusses his role in the recent AVEVA transaction, describes the (CS)²AI symposium in detail, and dives into some of the questions he did not get to answer at the event.

Show highlights:

Tilo discusses the changes that recently occurred with AVEVA.
Tilo summarises his presentation at the (CS)²AI symposium.
Question: How do you see IIoT (Industrial Internet of Things) playing a role via cloud models for predictive analytics to enhance decision-making for owner-operators?
Question: On a personal level, big data analytics has raised huge privacy and legal issues. How can these issues not be exacerbated in a commercial market of trading companies’ data into sellable products?
Tilo discusses the best approach to data vulnerabilities.
Question: Help me visualize a 100% on-prem PI deployment with all of its virtual machines versus a 100% on-cloud PI deployment. In terms of hybrid, what does that mean, in the sense that I only have on-prem systems talking to the PI on-premises virtual machines, and what exactly is running in the cloud? Alternatively, is the cloud-based solution offered as SaaS, or would the asset owner deploy their favorite cloud?
Question: Regarding the AVEVA data, is that similar to the AWS Marketplace? For instance, if an organization built a digital twin of a transformer system from Utility Hacks, is the data hub created going to make it easy for Utility Hacks to publish the model so others can use or vie? If not, is there an AVEVA marketplace where organizations can build or share models?
Question: As an oil and gas control system engineer and user who has applied software for many years, I’d like to know if you have already adopted this new solution and used it for any oil and gas company.
Tilo explains the PI system philosophy.
What has AVEVA done to overcome the existing legal constraints and make it easier to share operational data?
Question: What do ISACs (Information Sharing and Analysis Centers) do?
What are the benefits of the subscription model?
What is available for auditing, testing, and verifying technologies like unidirectional gateways and data diodes?

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 31 · TOP 5% what is this?)
Episode: National Cybersecurity Strategy released.
Pub date: 2023-03-08

The White House has released its National Cybersecurity Strategy. MKS Instruments discloses a ransomware incident that spread to some of its vendors. Ransomware hits the Dole Food Company. CISA runs a red team assessment against a critical infrastructure organization. And LockBit has claimed responsibility for an attack on a water utility in Portugal. The CyberWire's Tré Hester shares the news this week. Guest Tom Winston, Dragos’ Director of Intelligence Content, recently spoke with Dave Bittner about Dragos’ recently released 2022 Year in Review report. In the Learning Lab, Dragos’ VP Product & Industry Market Strategy Mark Urban completes his two-part discussion about the importance of incident response planning with Vern McCandlish, who is a Principal Industrial Incident Responder at Dragos.

Control Loop News Brief.White House releases the National Cybersecurity Strategy.National Cybersecurity Strategy (The White House)

Cranes as a security threat.Pentagon Sees Giant Cargo Cranes as Possible Chinese Spying Tools (Wall Street Journal)

EPA Memo requires water systems to include cybersecurity in their safety audits.EPA Takes Action to Improve Cybersecurity Resilience for Public Water Systems (EPA)

MKS Instruments discloses ransomware incident.Applied Materials will take a $250M hit to sales this quarter, thanks to a cyberattack at one of its suppliers (Silicon Valley Business Journal)

Semiconductor industry giant says ransomware attack on supplier will cost it $250 million (The Record)

Ransomware hits a major food producer.Cyberattack on food giant Dole temporarily shuts down North America production, company memo says (CNN)

Dole Experiences Cybersecurity Incident (Dole)

Red-teaming critical infrastructure.CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks (CISA)

LockBit claims attack on water utility in Portugal.LockBit gang takes credit for attack on water utility in Portugal (The Record)

Control Loop Interview.The interview is with Tom Winston, Director of Intelligence Content at Dragos, sharing their recently released 2022 Year in Review report.

Control Loop Learning Lab.In Part 2 of 2, Dragos’ VP Product & Industry Market Strategy Mark Urban speaks with Vern McCandlish, Principal Industrial Incident Responder at Dragos, about the importance of incident response planning.

Industrial Cyber Threat Intel & Collective Intelligence links:

Neighborhood Keeper in the Broader Context of Cyber Threat Intelligence
Using Trend Analysis to Operationalize OT Threat Intelligence with Neighborhood Keeper

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response (LS 32 · TOP 5% what is this?)
Episode: Cyber Persistence Theory
Pub date: 2023-03-07

Dale's interview with Michael Fischerkeller, co-author of the bood Cyber Persistence Theory. The first half of the interview digs into Cyber Persistence Theory.

Why Michael believes cyber is a new and third strategic environment (in addition to conventional and nuclear)
What is meant by cyber being an environment of exploitation and not coercion
The theory's different use of initiative and why the theory believes it is the important element to winning ("initiative rather than restraint is necessitated")
How a series of smaller, fait accompli, actions that are not responded to can have a strategic-level cumulative effect

The second half of the interview looks at what the world will look like and what asset owners should do if multiple nations believe in and act on this Cyber Persistence Theory.

Michael argues it already is in place and the US is late to the game
Persistence presence in critical infrastructure would not "cross the threshold"
How organizations will reach a cyber agreed competition
Will this be escalatory (Michael says no)

Dale believes this is an incredibly important theory to understand because it is taking hold in the world's major powers.

Links

Cyber Persistence Theory book

View Details

Podcast: Hack the Plant (LS 32 · TOP 5% what is this?)
Episode: Idaho National Labs and the Next Generation of Critical Infrastructure Security
Pub date: 2023-03-06

For today’s episode, I’m joined by Zach Tudor, the Associate Laboratory Director at Idaho National Laboratory (INL). INL is a Department of Energy national laboratory, is the nation's leading center for nuclear energy research and development. Zach is responsible for INL’s Nuclear Nonproliferation, Critical Infrastructure Protection and Defense Systems missions.

We discuss how INL partners with the private sector to test challenges to critical infrastructure, and the cutting edge work INL is doing to secure the next generation of critical infrastructure.

"Honeywell has been one of the big players that has been working with us for quite a while. And Hitashi. Schneider Electric. They will provide us some of their systems that are critical in energy critical infrastructure, industrial control systems, and we will tear it down in a methodological process that we have developed here…[to] start building an understanding of where the risks are and the supply chain of our critical energy infrastructure." - Zach Tudor

Other topics we cover: What work is INL doing to secure the next generation of critical infrastructure? How can we make our critical infrastructure systems more resilient? How is data security managed with emerging technologies such as 5G, or self-driving cars? What strategies should the government and private industry use to categorize risk and mitigate it in a way that actually has measurable impact?

Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Bridging industrial Cybersecurity Workforce Gaps [The Industrial Security Podcast]
Pub date: 2023-03-06

Different kinds of organizations in different stages of their cybersecurity evolution need to look for different kinds of people to contribute to their industrial security programs. Jason Rivera a Director at Security Risk Advisors joins us to look at workforce capability gaps and different approaches needed to fill those gaps in different scenarios.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 9.2023
Pub date: 2023-03-03

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Kurt Sanger: Safeguarding Cyberspace: A Legal Perspective on Cybersecurity Challenges and Information Sharing
Pub date: 2023-03-02

About Kurt Sanger: Kurt Sanger is a highly respected cybersecurity, national security, and information leader, known for his expertise in solving complex and high-stakes problems under demanding circumstances. With over two decades of experience serving in the U.S. Marine Corps, Kurt has a unique perspective on the responsibility of providing safety and security for American families. During his tenure, he served in a variety of roles, including as a cyber operations attorney, criminal defense counsel and prosecutor, and adviser to the Afghan National Army. Kurt is also a sought-after speaker, guest lecturer, and author and has worked with international, domestic, and local leaders in the private and public sectors. As the founder and director of Integrated Cybersecurity Partners, LLC, he continues to provide information technology and national security consultancy services. Kurt is also a cybersecurity board member and advisor for Cowbell Cyber Insurance and Batten Safe Corporation.

In this episode, Aaron and Kurt Sanger discuss:

Understanding the challenges faced by attorneys in cyberspace within the Marine Corps
The value of information sharing in cybersecurity to prevent future attacks and protect infrastructure
Balancing cybersecurity regulations to protect against threats while managing costs.
Tying cybersecurity incidents to business risks and justifying investments in cybersecurity resources from a legal perspective

Key Takeaways:

As a cyber lawyer, Kurt finds it necessary to constantly think of fresh ways to safeguard people and assets while keeping cyberspace open, which implies approaching each scenario with a unique outlook
Creating cybersecurity laws is challenging due to insufficient information on past attacks and how they were handled, which limits the industry's ability to learn from those experiences and prevent future attacks
Insurance companies can assist small and medium-sized businesses in enhancing their cybersecurity, but regulations must consider the expenses of compliance and the limitations of government's expertise while prioritizing the need for improved security
Reporting cyber incidents helps businesses understand risks and consequences, and tying it to a business risk with legal accountability elevates cybersecurity as a business issue, ensuring everyone in the organization understands the impact it can have

"In the next five to 10 years, I hope we will see that the cybersecurity tools can be used to make the system, the greater system, more reliable. And that's what I'm working for right now, as I think we all are in this community." — Kurt Sanger

Connect with Kurt Sanger:

LinkedIn: https://www.linkedin.com/in/kurt-sanger-311970115/

NSA’s Cybersecurity Collaboration Center: https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 32 · TOP 5% what is this?)
Episode: OT Managed Security Services - 1898 & Co.
Pub date: 2023-03-01

Matt Morris and Mark Mattei of 1898 & Co. joined Dale to talk OT Managed Security Services as 1898 recently introduced an OT Managed Threat Protection and Response service. The discussion included:

what they are monitoring in the OT environment
the OT MSP competitive landscape (OT detection vendors, ICS vendors, large consulting vendors, ...)
can you / should you monitor OT separate from IT
how 1898 deals with competing partners (such as Claroty, Dragos and Nozomi) that they resell and install and competing against them for MSP
the active response and threat hunting services and how that is accepted in the generally conservative
and more

View Details

Podcast: Cybercrime Magazine Podcast (LS 31 · TOP 5% what is this?)
Episode: Threat-Informed Cyber Defense. OT WORLDS. Al Graziano, CYBER RANGES & Tom VanNorman, GRIMM.
Pub date: 2023-02-28

Threat-Informed Cyber Defense is a Cybercrime Magazine podcast series brought to you by CYBER RANGES. In this series, we’ll focus on the acceleration and validation of cyber capability and resilience by discussing the virtuous circle of threat intelligence and threat-informed simulations to demonstrable measurable abilities centered on next-generation cyber ranging technology. Joining host Hillarie McClure on today's episode is Al Graziano, CEO, at CYBER RANGES Corp., and Tom VanNorman, Senior VP at GRIMM. To learn more about our sponsor, CYBER RANGES, visit https://cyberranges.com

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 71: Leadership and Executive Development in the Cybersecurity Industry with Willi Nelson
Pub date: 2023-02-28

Derek Harp interviews Willi Nelson in this episode. Willi is currently the Field CISO of Operation Technology at Fortinet, one of the oldest and longest-standing sponsors of the (CS)²AI organization.

Willi is a Security/Technology/Visionary who focuses on thought leadership and executive influence for Fortinet. He is responsible for developing security thought leadership, strategy, threat, vulnerability & mitigation insights, and world-class practices for the cybersecurity community and business executives.

Willi is a technologist, military veteran, woodworker, bee-keeper, outdoorsman, fisherman, metal artist, hunter, cyclist, husband, and father.

In this episode, he shares his backstory and unpacks what he does for the industry. He also offers valuable nuggets of advice for people with an OT and engineering background who don’t know cyber and those with a cybersecurity background with no knowledge of control systems and OT.

Show highlights:

Willi joined the US Army immediately after graduating high school. He gets into what he learned there and why he left.
Why resiliency is essential.
How Willi got into computers.
Willi discusses the importance of education and explains what prompted him to return to college at 27.
The power of being humble, having a thirst for knowledge, and a work ethic in the workforce.
Qualities Willi looks for when recruiting people.
Where OT and cybersecurity first intersected with Willi’s career.
How he got the opportunity to step into leadership while spending some time working in financials.
The difference between influential and mandatory leadership.
What operational technology means in the context of Willi’s current line of work.
What makes Willi optimistic about the future?

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #45 Energy Sec: Detalhando a Rotina Operacional do ONS
Pub date: 2023-02-24

Solicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

Na quarta feira, 15/02/2023, tivemos mais uma gravação do ICS Security Podcast! Nosso CEO Eduardo Honorato abordou um tema muito pedido pelos ouvintes: Energy Sec: Detalhando a Rotina Operacional do ONS.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 8.2023
Pub date: 2023-02-24

The role of cyber attacks in Russia's war in Ukraine, a decrease in ICS vulnerabilities, supply chain disruption at Dole, and more

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 32 · TOP 5% what is this?)
Episode: Interview with Bill Fehrman of Berkshire Hathaway Energy
Pub date: 2023-02-23

Bill Fehrman is the CEO of Berkshire Hathaway Energy, co-chair of the Electricity Subsector Coordinating Council, and chair of the E-ISAC.

The major topics Dale and Bill discuss include:

The US Government / Electric Sector information sharing program around detection information and threat intel. Have they stopped or reduced the impact of attacks? What are the metrics they are using to determine if these resources are worth it?
How is the industry and BHE positioned to recovery from a major outage due to a cyber attack? The mutual assistance agreements in the electric sector … the transformer and critical sparing programs. BHE has drills that take away technology and see if they can still deliver power.
Who will pay for all this cyber risk reduction? Will there be rate increases due to these efforts? Does customer demand for climate change actions or security actions drive investment? Be required for investment? What does he think of the FERC incentives to get utilities to invest in security?
Is the single point person representing the electric sector, now Bill, by design and a good idea?

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 31 · TOP 5% what is this?)
Episode: Adding some color to incident response.
Pub date: 2023-02-22

Dragos has released its ICS/OT Cybersecurity Year in Review for 2022, finding a rise in ransomware attacks targeting industrial organizations. Forescout discloses two vulnerabilities affecting the Unity line of Schneider Electric’s Modicon programmable logic controllers. Dozens of vulnerabilities in industrial internet-of-things (IIoT) devices. Tim Starks from the Washington Post's Cybersecurity 202. discusses the upcoming White House National Cyber Strategy and its possible effects on critical infrastructure. In the Learning Lab, Dragos’ VP Product & Industry Market Strategy Mark Urban begins his two-part discussion about the importance of incident response planning with Vern McCandlish, who is a Principal Industrial Incident Responder at Dragos.

Control Loop News Brief.Dragos releases its ICS/OT Cybersecurity Year in Review for 2022.2022 ICS/OT Cybersecurity Year in Review (Dragos)

Russian-linked malware was close to putting U.S. electric, gas facilities ‘offline’ last year (Politico)

Schneider PLC vulnerabilities.Deep Lateral Movement in OT Networks: When Is a Perimeter Not a Perimeter? (Forescout)

The return of ICEFALL: Two critical bugs revealed in Schneider Electric tech (The Record)

Wireless IIoT devices at risk from vulnerabilities.Industrial Wireless IoT - The direct path to your Level 0 (Otorio)

Control Loop Interview.The interview is with Tim Starks from the Washington Post's Cybersecurity 202 discussing the upcoming White House National Cyber Strategy and its possible effects on critical infrastructure.

Control Loop Learning Lab.In Part 1 of 2, Dragos’ VP Product & Industry Market Strategy Mark Urban speaks with Vern McCandlish, Principal Industrial Incident Responder at Dragos, about the importance of incident response planning.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 70: OT Monitoring Tools- A Case Study on How to Choose One- Post Q&A with Raph Arakelian
Pub date: 2023-02-21

Raphael Arakelian joins Derek Harp today for a slightly different podcast.

Raphael is currently the Manager of OT and IoT Cybersecurity at PwC Canada. He is a cybersecurity practitioner specializing in Operational Technology (OT), the Internet of Things (IoT), and Industrial Control Systems (ICS).

It has always been challenging for purchasers and end-users to understand how to differentiate between various OT products and determine which tools to select. Raph has developed a methodology for comparing monitoring tools. On the 25th of January this year, he did a CS2AI online show with Derek called OT Monitoring Tools: A Case Study on How to Choose One. It was a popular event, and many questions got submitted. Unfortunately, all the questions could not get answered within the allotted time. So they decided to follow up with a collaborative bonus session to get to the bottom of more of those questions.

In his episode, Raph discusses his systematic methodology for overcoming the challenge that organizations often face when looking at different vendors in the OT security space to select the right tool for a given situation. He also responds to several unanswered questions from the online CS2AI event.

Show highlights:

Raph shares the idea behind his systematic approach and explains what led him to devise it.
The nine technical areas that get evaluated with Raph’s methodology.
The nuances that led Raph to the three candidate vendors with whom he did his proof of concept.
Raph recaps his methodology, discusses the source of truth data critical for the assessment, and explains what happens if an organization does not have the asset inventory beforehand.
How to differentiate between IT and OT assets.
Raph gives a quick explanation of industrial protocols.
Question: During the proof of concept, was there a concern about connecting the tools and a laptop to an active utility system? Was port mirroring enough to ensure one-way communication?
How to address devices that are not active on the network.
Question: “Based on your study, How is Asset Characterization for OT Monitoring Tools it seems that there could be a lot of manual edits needed to fix mischaracterization.”
Raph shares his thoughts on the following: “For most tools, it seems that CDE detection and remediation guidance has a shotgun approach without regard to the hardware on which the CDE is found.”
Instances in which vendors will be willing to update their products.
Why Raph believes OT monitoring tools are helpful.

Links and resources:

(CS)²AI

PwC Canada

Raphael Arakelian on LinkedIn

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: #100 Engineering-Grade security in the US DOE Cyber Informed Engineering Strategy [The Industrial Security Podcast]
Pub date: 2023-02-20

The new US Department of Energy Cyber Informed Engineering Strategy includes unhackable safeties, manual operations, and other engineering-grade protections, in addition to traditional cybersecurity. Join Cheri Caddy, USA Deputy Assistant Cyber Director as we look at a strategy to develop a discipline of security engineering.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CyberWire Daily (LS 59 · TOP 0.5% what is this?)
Episode: Modernizing the U.S. Navy's cybersecurity posture. [Special Edition]
Pub date: 2023-02-20

Dave Bittner had a conversation with Commander Brandon Campbell of US Navy Cyber Defense Operations Command and Captain Steve Correia, Commanding Officer of Naval Network Warfare Command. They discussed the Navy’s cybersecurity advances and how they have implemented them.

Commander Brandon Campbell is the former Operations Director at Navy Cyber Defense Operations Command and Task Force 1020 where they protect, detect, and respond to global cyber threats against Navy networks.

Captain J. Steve Correia is the Commanding Officer of Naval Network Warfare Command and the Commander of Task Force 1010 under the U.S. Navy’s Fleet Cyber Command where they execute tactical-level command and control to direct, operate, maintain and secure Navy communication and network systems.

The podcast and artwork embedded on this page are from CyberWire, Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 406: Cyber Security for Building Automation Part 2
Pub date: 2023-02-20

In this episode of the Smart Buildings Academy Podcast we continue our multipart series on cyber security.

In today's episode we are going to dive deeper into reconnaissance, which is the first phase of a cyber security attack.

Here we will be looking deeper into techniques and tools that are used to actively and passively gather information on potential targets.

We will explore how to protect your building automation system and your BAS employees from this initial phase of attack.

As always please ask any questions you have.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 405: Cyber Security for Building Automation Part 1
Pub date: 2023-02-17

Cyber Security is not that hard.

Over the next several episodes we are going to be exploring cyber security concepts and tying them to building automation.

My hope is that by the end of this series you will have an understanding of cyber security theory and processes.

This is meant to be an interactive episode so be sure to tune in and ask questions as we explore this topic.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Admiral TJ White: Keeping People Safe Is The Heart Of Cybersecurity
Pub date: 2023-02-16

About Admiral TJ White: Vice Admiral TJ White is a retired 30-plus-year national security practitioner, strategist, and cyber operations expert. He has commanded at all levels within the Navy and on joint service, including as the commander of US Fleet Cyber Command, US Tenth Fleet, and US Navy Space Command, as well as the commander of the US Cyber National Mission Force of US Cyber Command. White is a former intelligence director for US Indo-Pacific Command and has served globally in various combat zones and conflict areas supporting competition dynamics. A nonresident senior fellow in the Forward Defense practice of the Atlantic Council's Scowcroft Center for Strategy and Security, White's consulting practice, OneNetworkConnection, LLC, leverages his technical acumen, operational horizon, and strategic vision to assess and manage current and future risk. He is an expert in talent management, risk assessment, and consequence management concerning cybersecurity, critical infrastructure, supply chain, technology policy, and trust relationships. His mission is to bridge the accelerating divide between a digital information technology ecosystem and the genuine impact on human organizational design and enterprise decision-making.

In this episode, Aaron and Admiral TJ White discuss:

Exploring solutions to overcome challenges in navigating cybersecurity and critical infrastructure complexities.
Managing ongoing threats and resources for effective cybersecurity in slow-moving industries.
The importance of prioritizing OT to protect physical processes, human life, and national defense and sovereignty.
Assessing the impact of vulnerabilities in an organization through the interplay of cybersecurity and organizational factors.

Key Takeaways:

The biggest and most challenging step in understanding cyberspace is recognizing it as a strategic imperative, and ensuring that the C-suite and board members are invested in developing a comprehensive understanding of the company's mission, vulnerabilities, and exposure to cyber threats.
Improving cybersecurity has been an ongoing journey for the US government, industries, and large companies since the Y2K era. This journey involves continuous adaptation to new threats through strong leadership and attention, with the Department of Defense being a successful example through their persistent engagement and defend forward strategies.
The power industry, in particular, is a prime example of how technology can lead to increased efficiency, dependability, and performance.
Cyberspace is not just technology, but a business risk that ties into the financials, safety, confidentiality, and overall business process. Understanding the vulnerabilities and their impact on the organization is valuable for making informed decisions on how to protect against them.

"I'm very confident that more and more as a leader, if you just demonstrate and display that you're cognizant that this is a real thing and that there is a place that it is impacting everything that you do. I think the people on your team will want to become knowledgeable about it." — Admiral TJ White

Connect with Admiral TJ White:

Email: tj@onenetworkconnectionllc.com

LinkedIn: https://www.linkedin.com/in/tjwhite01networkconnection/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 7.2023
Pub date: 2023-02-17

This week we have a potential solution for the ICS security professional shortage, a new member of the IC Hall of fame, Trickbot, Chernovite, WIP26, and more

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 69: From Military Service to the Commercial Cybersecurity Industry with Billy Rios
Pub date: 2023-02-14

Today, Derek Harp interviews Billy Rios, the Co-Founder of QED Secure Solutions.

Billy is an experienced technical leader with a strong background in successful strategic security planning, security program development, and security program execution. He excels at seeing the big picture, identifying gaps, and managing initiatives. He is comfortable managing security initiatives for high-profile, high-visibility products and services. He plays an integral role within organizations by providing collaboration, motivation, and direction across teams in diverse and demanding environments.

Billy’s Dad was in the army, so his family moved around a lot while he was growing up. He currently lives in Colorado. As well as being a long-term contributor to the cybersecurity field, Billy is a former military veteran, active reservist, technologist, author, entrepreneur, security ninja, snowboarder, Jiu-Jitsu brown belt, a well-known researcher in the cybersecurity space, husband, and father.

He joins Derek today to discuss his background, career journey, and career highlights. He also offers many valuable nuggets of advice for entrepreneurs and anyone in military units looking to break into the commercial cybersecurity industry.

Show highlights:

Billy explains how his entry into cybersecurity started with hacking video games as a young kid.
Billy received scholarships for the Airforce and Marine Corps. He shares his motivation for choosing the Marine Corps and discusses what he did while serving there.
Billy talks about his study program at the University of Washington.
Billy has focused on cybersecurity since he left active duty in the Marine Corps almost 20 years ago.
Billy discusses the guidance he received from leaders and mentors in the organizations he worked for before becoming an entrepreneur.
How Billy’s diverse roles and experiences shaped his perspective and helped him get to where he is today.
Billy shares advice for anyone interested in becoming an entrepreneur.
What do they do at QED Solutions?
Billy shares his advice for those who want to transition from military to corporate cybersecurity.
Billy gets into the awesome yet scary things about being a researcher.

Links and resources:

(CS)²AI

QED Secure Solutions

Billy Rios on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Research Saturday
Episode: Knocking down the legs of the industrial security triad.
Pub date: 2023-02-11

Pascal Ackerman, OT Security Strategist from Guidepoint Security, joins Dave to discuss his work on discovering a vulnerability in the integrity of common HMI client-server protocol. This research is a Proof of Concept (PoC) attack on the integrity of data flowing across the industrial network with the intention of intercepting, viewing, and even manipulating values sent to (and from) the HMI, ultimately trying to trick the user into making a wrong decision, ultimately affecting the proper operation of the process.

In this research, they are targeting Rockwell Automation’s FactoryTalk View SE products, trying to highlight the lack of integrity and confidentiality on the production network and the effect that has on the overall security of the production environment.

The research can be found here:

GuidePoint Security researcher discovers vulnerability in the integrity of common HMI client-server protocol

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Nexus: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Katherine Gronberg on the Federal Government and OT/IoT Cybersecurity
Pub date: 2023-02-09

Katherine Gronberg, head of government services at cybersecurity venture capital firm NightDragon, joins the Nexus Podcast to discuss what's driving the federal government's renewed interest and investment in OT and IoT cybersecurity. Katherine brings insight from her unique perspective on these issues, especially as it pertains to upcoming requirements facing asset owners and operators, how vendors must respond to mandates put out by the White House, and what might be in the impending national cybersecurity strategy from the White House Office of the National Cyber Director.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Debbie Gordon: Practicing Cybersafety Through Simulated Environments
Pub date: 2023-02-09

About Debbie Gordon: Debbie Gordon is the founder and CEO of Cloud Range, the industry-leading cybersecurity simulation training solution that helps organizations reduce cyber risk. A globally recognized technology entrepreneur, Debbie founded Cloud Range on the premise that simulation training is as integral in cybersecurity as it is in other fields like medicine, aviation, or the military. The result was that Cloud Range led the development of a new category in cybersecurity. Only three years later, organizations around the globe are incorporating the company’s cyber readiness solution as a core element of their security programs.

A graduate of Vanderbilt University where she earned her degree in human and organizational development, Debbie has focused her work on businesses that improve people’s lives. Her career began in technical education and certification, and she has built and sold several companies in eCommerce, IT asset management, and training. She is currently on the board of directors of Entrepreneurs’ Organization - Nashville. Debbie is a frequent speaker on cybersecurity readiness, simulation training, and team effectiveness at conferences and seminars all around the world. She has also been featured in many podcasts, has authored many articles, and has been quoted in major publications including Fox News, Wall Street Journal and Forbes.

In this episode, Aaron and Debbie Gordon discuss:

The three elements of learning
Cybersecurity awareness in the OT world
Practicing cybersecurity responses in a simulated environment
Adapting the organization to cybersecurity

Key Takeaways:

When it comes to cybersecurity, knowledge and ability are great but may not be enough. The gap must be filled with experiential learning, which means they’ve got to practice their knowledge and skills in a simulated environment in order to be adequately prepared for real-world events.
An example of cybersecurity awareness in the IT world is telling people to be wary of phishing emails. In the OT world, cybersecurity awareness is all about letting people know that when things are going wrong and alarms are going off in machines and systems, it might be a cyber attack.
Nothing could prepare somebody more for a cyberattack than to experience it first hand in a simulated event. By practicing in a safe environment, they could test themselves, take risks that they otherwise wouldn’t in a real situation, and improve by making their solution more efficient and effective as they practice more and more.
Cybersecurity is the job of every member of an organization. Technology and processes have to be honed and trained, but there are fundamental organizational changes that must happen in order to create a safe

"This is cybersafety. This isn't just about protecting data. This is protecting lives and our livelihoods." — Debbie Gordon

Connect with Debbie Gordon:

Website: https://www.cloudrangecyber.com/

LinkedIn: https://www.linkedin.com/in/degordon/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 6.2023
Pub date: 2023-02-10

This week we have an ESXiArgs advisory, wireless IIoT vulnerabilities, Cl0p ransomeware might be coming for your linux system, and two cybersec vendors team up to make a super-solution.

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 31 · TOP 5% what is this?)
Episode: Insight from the ISACs.
Pub date: 2023-02-08

Multiple strains of Russian wiper malware are targeting entities in Ukraine. A high-severity command injection vulnerability affects Cisco devices. The IoT supply chain is threatened by exploitation of Realtek Jungle SDK vulnerability. And US Congressman Andrew Garbarino will serve as the new Chairman of the Subcommittee on Cybersecurity and Infrastructure Protection. In Part 2 of 2 in our interview segment from Dragos’ Ask the ISACs discussion led by Dawn Cappelli, Dragos’ Head of OT-CERT, panelists Tim Chase from the MFG-ISAC, Eugene Kipniss from MS-ISAC, Jennifer Lyn Walker from Water ISAC, and Matt Duncan from E-ISAC return. In the Learning Lab, Dragos’ VP Product & Industry Market Strategy Mark Urban concludes his discussion with Lesley Carhart, Dragos’ Director of Incident Response for North America, about creating an ICS/OT specific incident response plan.

Control Loop News Brief.Russian wiper malware targets Ukraine.Russia’s Sandworm hackers blamed in fresh Ukraine malware attack (CyberScoop)

APT Activity Report for T3 2022 (ESET)

Cyber attack on the Ukrinform information and communication system (CERT-UA)

Command injection vulnerability affects Cisco devices.When Pwning Cisco, Persistence is Key - When Pwning Supply Chain, Cisco is Key (Trellix)

Cisco IOx Application Hosting Environment Command Injection Vulnerability (Cisco)

Congressman Andrew Garbarino to serve as Chairman of the Subcommittee on Cybersecurity and Infrastructure Protection.Garbarino Selected To Chair Cybersecurity Subcommittee (Office of Andrew Garbarino)

IoT supply chain threatened by exploitation of Realtek Jungle SDK vulnerability.Network Security Trends: August-October 2022 (Unit 42)

Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats (Unit 42)

Control Loop Interview.The interview is the second part from Dragos’ Ask the ISACs discussion led by Dawn Cappelli, Dragos’ Head of OT-CERT, with panelists Tim Chase from the MFG-ISAC, Eugene Kipniss from MS-ISAC, Jennifer Lyn Walker from Water ISAC, and Matt Duncan from E-ISAC.

Control Loop Learning Lab.In Part 2 of 2, Dragos’ VP Product & Industry Market Strategy Mark Urban speaks with Lesley Carhart, Dragos’ Director of Incident Response for North America, about creating an ICS/OT specific incident response plan.

Control Loop OT Cybersecurity Briefing.A companion monthly newsletter is available through free subscription and on the CyberWire's website.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 68: Using Engineering + OT to Launch Your CyberSecurity Career
Pub date: 2023-02-07

Today, Khalid Ansari joins Derek Harp. He is a Senior Engineer of Industrial Control Cybersecurity at FM Approvals in Boston.

Khalid Ansari is an ICS/OT Cybersecurity Engineer with in-the-trenches experience in industrial automation, control systems, and MES. He is a proponent of secure-by-design products and a secure software development lifecycle.

Khalid has been working in the control systems field for 25 years. He grew up and went to school and university in a small city in Southern India. In addition to being an engineer and a long-time contributor to the OT control systems cybersecurity community, he is also a husband, father, coder, lifetime learner, avid reader, outdoor enthusiast, and struggling skier.

In this episode, Khalid shares his modern-day superhero backstory and discusses his education path and career journey. He also shares his insight and offers valuable nuggets of advice for anyone considering a career in cybersecurity.

Show highlights:

Khalid was first exposed to technology when his dad bought him a Commodore 500 during high school.
Khalid did his first paid job while he was in college.
Khalid discusses his educational experiences in India, the UK, and the US.
What would Khalid do differently today? (In terms of his studies.)
Khalid discusses a job opportunity that arose because he was active on the control systems bulletin board while doing his MBA.
Khalid talks about moving to the Middle East to gain the asset-owner experience he lacked in his portfolio.
Khalid offers a global perspective on cybersecurity for control systems.
Khalid shares his view on government regulations within the industry.
Some suggestions for certifications and other ways for young professionals to acquire knowledge and gain career experience.
The benefits of volunteering, and how to go about it.
The role mentorship has played in Khalid’s career.

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Safety First
Episode: Episode #64: Norms and Standards for Automotive Cybersecurity
Pub date: 2023-02-06

Christian PahlkeNew cars, new risks: Modern vehicles are connected with the outside world – and this makes them vulnerable to manipulation by cyberattacks. Autonomous driving and the use of AI increase the complexity of software architecture in vehicles.

Christian Pahlke, Head of Future Vehicle Technologies at TÜV SÜD, explains how new standards and norms help to improve cybersecurity risk management.

More details about TÜV SÜD's cybersecurity solutions for the automotive industry: https://www.tuvsud.com/en/themes/cybersecurity/automotive

The podcast and artwork embedded on this page are from TÜV SÜD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Critical Assets Podcast
Episode: What to do about FERC's new INSM Order 887
Pub date: 2023-02-08

FERC has issued Order 887, directing NERC to create new Critical Infrastructure Protection (CIP) cybersecurity standards for Internal Network Monitoring Systems (INSM). In this episode, Patrick Miller, CEO of Ampere Industrial Security talks with Carter Manucy, IT/OT Cybersecurity Director for Florida Municipal Power Authority (FMPA). Hear from a real electric utility asset owner, on what this Order means for the industry and what you should do next.

Show links:

Carter Manucy LinkedIn Profile - https://www.linkedin.com/in/cmanucy/

FERC Order 887 - https://www.ferc.gov/media/e-1-rm22-3-000

FERC INSM NOPR - https://www.federalregister.gov/documents/2022/01/27/2022-01537/internal-network-security-monitoring-for-high-and-medium-impact-bulk-electric-system-cyber-systems

National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems - https://www.amperesec.com/blog/industry-brief-national-security-memorandum-on-improving-cybersecurity-for-critical-infrastructure-control-systems

NERC INSM Practice Guide - https://www.nerc.com/pa/comp/guidance/CMEPPracticeGuidesDL/CMEP%20Practice%20Guide%20-%20Network%20Monitoring%20Sensors.pdf

The podcast and artwork embedded on this page are from Patrick Miller, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast (LS 23 · TOP 10% what is this?)
Episode: [Bonus] Patrick Miller, CEO of Amperesec
Pub date: 2023-02-06

About Patrick Miller: Patrick Miller is a renowned expert in the critical infrastructure protection and cybersecurity industries. With over 35 years of experience, he currently leads Ampere Industrial Security as CEO, offering independent security and regulatory advice for industrial control systems across the globe. He is an active volunteer, public speaker, and member of several critical infrastructure security working groups and has received numerous awards for his work. With deep roots in telecommunications, Patrick has held key positions in regulatory agencies, private consulting firms, and commercial organizations. Today, he is also an instructor for the ICS456 NERC CIP course offered by the SANS Institute.

In this episode, Aaron and Patrick Miller discuss:

The implications of each company having its own interpretation and implementation of compliance and how the latest FERC directive to update NERC-CIP relates to this
The challenges around writing technology-agnostic and long-lasting standards
How companies should think about investing in and managing resources for compliance programs
How developments in operational technology is like a new phase of the Industrial Revolution

Key Takeaways:

Compliance policies vary significantly among companies, consultants, and regions, leaving many gray areas for auditors to navigate.
Implementing new compliance standards is challenging due to the constantly evolving technology landscape and the difficulty in writing a technology-agnostic and flexible standard. Organizations must find a successful and auditable compliant approach that satisfies the minimum standards and can adapt over time.
To ensure your network is secure, visible, and user-friendly, it's essential to have a platform that balances these factors with proper licenses, trained personnel to handle these, and professional services. This will take time to set up, but the effort will pay off in operational benefits and reduced resource waste.
Integrating new technologies, such as digital twins, artificial intelligence, and machine learning, into the power system transforms every component of the generation process to the end user.

"I am excited about all the interesting new technologies we're introducing into power systems. There is a lot of really cool, interesting stuff happening, not just in the distribution space but even upwards into the transmission and generation space. Our ability to understand our equipment and prevent maintenance issues and problems is going to go through the roof. Just our ability to see all of this, we will call it another layer of the industrial revolution. Because it will give us a way to interact and use and build our machines in ways that we have never been able to do before." — Patrick Miller

Connect with Patrick Miller:

Website: https://www.patrickcmiller.com/

Email: patrick@patrickcmiller.com

YouTube: https://www.youtube.com/channel/UCPpxHyyVzgJUjlHGAzkkuMw

LinkedIn: https://www.linkedin.com/in/millerpatrickc/

Twitter: https://twitter.com/PatrickCMiller

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrial Cyber Weekly Roundup
Episode: Week 5.2023
Pub date: 2023-02-03

This week, new guidance for MITRE ATT&CK mapping; issues in the US Healthcare sector; disrupting the Hive; and more. Get the full stories and more at industrialcyber.co

The podcast and artwork embedded on this page are from industrialcyber.co, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep #44 Gestão de Riscos na TA com a ISA IEC 62443
Pub date: 2023-02-02

Inscreva-se no Webinar - ICS RISK ERADICATION: https://bit.ly/40mdObl
Solicite o contato de um Especialista da Munio Security: https://bit.ly/3x6am7H

Nada como voltar falando de Gestão de Riscos Cibernéticos nos ambientes de Automação Industrial e Operações. Nesta quarta, a partir das 19h, nosso CEO Eduardo Honorato comandará mais um podcast da Munio Security ! Venham com a gente!

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: IIoT Firmware Visibility - Under the Hood [The Industrial Security Podcast]
Pub date: 2023-02-01

Windows and Linux operating systems provide a lot of detail as to what software & versions of the operating system, applications & libraries are installed. Most firmware provides almost nothing - only a single firmware version number. Thomas Pace, Co-Founder and CEO of Netrise joins us to look at gaining visibility into industrial device firmware and vulnerabilities.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: FORGING CONNECTIONS
Episode: Dale Peterson Talks Current and Future States of OT Cybersecurity
Pub date: 2023-01-26

The podcast and artwork embedded on this page are from HONEYWELL FORGE, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 67: Coding as a Springboard Into Cybersecurity with Matt Wyckhouse
Pub date: 2023-01-31

Today, Derek Harp interviews Matt Wyckhouse, the Founder and CEO of Finite State.

Before founding Finite State, Matt spent 15 years leading and developing advanced solutions to some of the hardest problems in cyber security, with experience across the spectrum of offensive and defensive cyber operations. Notably, he was the technical founder and CTO of Battelle's Cyber Innovations business unit. Throughout his career, Matt has spearheaded complex national security programs ranging from the detection of malicious integrated circuits in the supply chain to next-generation intrusion detection systems for automotive systems. Matt directed numerous intelligence programs related to the security of embedded and IoT devices and has been a speaker on the subject at security events.

Matt grew up in Ohio, in a small suburb outside of Toledo. In addition to being an entrepreneur and technologist, he is also a husband, chef, foodie, world traveler, and water sports enthusiast! In this episode, he shares his backstory, discusses his education and professional journey, and offers nuggets of advice for anyone looking to get into cybersecurity.

Show highlights:

Matt was in a gifted program in elementary school and started writing codes. He also did a fair amount of programming on the side when in high school.
Matt did an internship and spent 13 years with the Battelle Center for Science, Engineering, and Public Policy at the Ohio State University.
Matt explains why he believes in the power of internships.
Matt discusses the benefits of mentorship and explains how it played out for him early on and the role it plays today.
The various projects and programs Matt worked on at Battelle.
How did Matt become a technical leader of the brand-new cybersecurity business unit at Battelle?
What led to Matt leaving Battelle?
Matt talks about what he did after leaving Battelle and before founding Finite State.
Things Matt was afraid of when thinking of starting a company.
Matt offers advice for anyone contemplating starting a company.
What does it take for entrepreneurs to raise capital to start a business?
What does Finite State focus on, and who do they serve?

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast
Episode: Lucian Niemeyer: Making Cyber Safety A Part Of Culture
Pub date: 2023-01-25

Over three decades, The Honorable Lucian Niemeyer has served in the White House, the Pentagon, and in Congress providing budget, policy, and management leadership for U.S. national security programs. He continues his public service as the Chief Executive Officer of Building Cyber Security, a private sector, non-profit organization enhancing global safety through the development of cyber security protections for the built environment.

In this episode, Aaron and Lucian Niemeyer discuss:

Bringing cybersecurity to OT systems
Maintaining and improving cybersecurity
Why seeing vulnerabilities is important
Addressing cyber safety in society

Key Takeaways:

In IT, systems are designed to be secure. A lot of OT systems have been around for 40 and 50 years, back when security wasn’t even a concept much less designed into the architecture.
Cybersecurity is not just a one time thing, it needs to be maintained and it needs to be upgraded and allowed to evolve. It’s like a fitness routine, you don’t get healthier or more fit by visiting the gym only once in your life.
Pointing out vulnerabilities in a building’s cybersecurity is a huge benefit to the owner. In the most dangerous scenario, somebody could get hurt and in other more probable scenarios, the news of a cyberattack on a building could significantly impact its value.
We as a society need to address cyber safety the way that we look at safety in other aspects of our culture. In some areas, safety isn’t an option and we should look at cyber safety the same way.

"There are processes in place already in our society where we're rewarding good behavior. So the goal is how we can apply that to cyber safety within a building." — Lucian Niemeyer

Connect with Lucian Niemeyer:

Website: https://buildingcybersecurity.org/

LinkedIn: https://www.linkedin.com/in/lucian-niemeyer-307aa65/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Inside Digital Transformation
Episode: Industrial cyber security for the Industrie 4.0 transformation with Andrew Ginter (English)
Pub date: 2023-01-17

In this episode we spoke to Andrew Ginter, VP Industrial Security at Waterfall Security Solutions. We talked about a topic that many people probably consider either as a roadblock for their digital transformation or do not have on their transformation agenda at all, which exposes them to high risks. We addressed the issue of security, and in particular the security of our industrial networks.

The podcast and artwork embedded on this page are from Industrie 4.0 Maturity Center, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: ICS/OT incident response plans: Don't get caught unprepared.
Pub date: 2023-01-25

The NOTAM outage was reportedly caused by a corrupted file. The World Economic forum sees geopolitical instability as a source of cyber risk. The Copper Mountain Mining Corporation is working to recover its IT systems following a ransomware attack. DNV's fleet management software sustains a ransomware attack. Ukrainian hacktivists conducted DDoS attacks against Iranian sites. And a cyberattack against a Nunavut power utility.Our interview segment is part one of two from Dragos’ Ask the ISACs discussion led by Dawn Cappelli, Dragos’ Head of OT-CERT, with panelists Tim Chase from the MFG-ISAC, Eugene Kipniss from MS-ISAC, Jennifer Lyn Walker from Water ISAC, and Matt Duncan from E-ISAC. On part 1 of 2 in the Learning Lab, Dragos’ VP Product & Industry Market Strategy Mark Urban speaks with Lesley Carhart, Dragos’ Director of Incident Response for North America, about creating an ICS/OT specific incident response plan.

Control Loop News Brief.NOTAM outage appears to have been caused by a system error.US Aviation System Meltdown Tied to Corrupted Digital File (Bloomberg)

Here's the latest on the NOTAM outage that caused flight delays and cancellations (NPR)

The WEF’s Cybersecurity Outlook for 2023.Global Cybersecurity Outlook 2023 (World Economic Forum)

Mining company resumes operations after ransomware attack.Copper Mountain Mining Provides Operational Update on Ransomware Attack (Copper Mountain Mining Corporation)

DNV's fleet management software sustains ransomware attack.Cyber-attack on ShipManager servers – update (DNV)

Ukrainian hacktivists conduct DDoS against Iranian sites.Iranian websites impacted by pro-Ukraine DDoS attacks (SC Media)

Iran’s support of Russia draws attention of pro-Ukraine hackers (The Record)

Cyberattack hits Nunavut energy company’s IT systems.Quilliq Energy Corporation Impacted by a Cyberseurity Incident (QEC)

Premier comments on QEC cyber-security incident (Nunavut Department of Executive and Intergovernmental Affairs)

Control Loop Interview.The interview is part one of two from Dragos’ Ask the ISACs discussion led by Dawn Cappelli, Dragos’ Head of OT-CERT, with panelists Tim Chase from the MFG-ISAC, Eugene Kipniss from MS-ISAC, Jennifer Lyn Walker from Water ISAC, and Matt Duncan from E-ISAC.

Control Loop Learning Lab.In Part 1 of 2, Dragos’ VP Product & Industry Market Strategy Mark Urban speaks with Lesley Carhart, Dragos’ Director of Incident Response for North America, about creating an ICS/OT specific incident response plan.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast
Episode: Roundtable Discussion with Jay Williams, Alex Bagwell, and Gabe Authier
Pub date: 2023-01-19

In this episode, Aaron Crow, Jay Williams, Alex Bagwell, and Gabe Authier discuss:

Who is Industrial Defender?
What’s coming soon from Industrial Defender?
Asset data as the foundation for security

Key Takeaways:

Industrial Defender has built a reputation for being trusted by the largest industrial organizations and critical infrastructure operators in the world. Particularly as a leader in NERC CIP compliance monitoring and reporting.
However, Industrial Defender isn’t just NERC CIP. Their value extends beyond that today, as they’ve developed industry-leading capabilities for gathering and understanding OT asset data, driving better outcomes for the safety, availability and security of critical operations.
Industrial Defender is the leader in providing deeper-level asset data and vital endpoint information, which represents the core foundational aspects of most cybersecurity programs. While asset management and contextual data alone isn’t security, you can’t protect what you can’t see.
The focus of Industrial Defender is to be the single source of truth for all OT asset data, enabling goals around OT asset management, change and configuration management, vulnerability management, and policy compliance. It’s their mission to protect their customers’ reputations and competitive edge as the cyber-physical landscape evolves.

"If you have a lot of assets, you can't know and properly manage those assets without knowing their existence, and at least having some contextual data around them." — Jay Williams

Connect with Aaron (CTO)

LinkedIn: https://www.linkedin.com/in/aaronccrow

Connect with Jay (CEO)

LinkedIn: https://www.linkedin.com/in/jaywilliiams111/

Connect with Alex (CRO)

LinkedIn: https://www.linkedin.com/in/abagwell2/

Connect with Gabe (CPO)

LinkedIn: https://www.linkedin.com/in/gabeauthier/

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/podcast

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: mnemonic security podcast
Episode: ICS in the Cloud
Pub date: 2023-01-23

Industrial Control Systems (ICS) in the cloud

Can the cloud fundamentally revolutionize Operational Technology (OT) security?

To help Robby understand some of the nuances of OT security and help connect the dots between IT and OT, we’re joined by Vivek Ponnada from the OT, ICS & IoT security company Nozomi Networks.

Vivek shares from his 24 years of experience working with ICS, and explains how much cloud is and is going to be utilised within OT in the years to come.

He also shares what threats is he seeing in the OT space, and tries to answer the question; what’s up-and-coming in OT security?

The podcast and artwork embedded on this page are from mnemonic, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: RSA Conference
Episode: Can Satellites Be Hacked?
Pub date: 2023-01-18

Cybersecurity and the resiliency of space assets are a priority because of the critical infrastructure services they provide. This session will discuss the attack vectors and mitigation approaches of exploits that can impact them as well as how the cyber security and space asset resiliency range will be used to test and validate their confidentiality, integrity, and availability.Speakers:Barbara Grofe, Lead Designer, Spartan CorpKacy Zurkus, Content Strategist, RSAC

The podcast and artwork embedded on this page are from RSA Conference, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 65: How the S4x23 Conference Can Help Your CyberSecurity Career
Pub date: 2023-01-18

Dale Peterson, the Founder of the S4 Conference, joins Derek Harp today.

Dale was on an earlier podcast last year where he spoke about the founding and history of the S4 Conference. Today, he joins Derek to discuss the S4x23 Conference coming up shortly. It will open with a preliminary day on February 13th, and the event will take place on the 14th, 15th, and 16th of February.

For more than 15 years, Dale Peterson has been on the leading/bleeding edge helping security-conscious asset owners effectively and efficiently manage risk to their critical assets. He has pioneered numerous ICS security tools and techniques, such as the first intrusion detection signatures for ICS that are now in every commercial product. In 2007 Dale created the S4 Events to showcase the best offensive and defensive work in ICS security and build a community. S4 is now the largest and most advanced ICS event in the world. Dale is constantly pushing and prodding the ICS community to move faster and get better.

The S4 Conference has been growing and evolving for many years. In this episode, Dale dives into what to expect and look forward to for this year’s S4x23 Conference.

Show highlights:

Dale gets into what to expect from the upcoming S4x23 Conference
Dale discusses what excites him about the upcoming event
Dale talks about the women’s social event that will take place on the night of Monday the 13th
There will be a My Favorite Metric game show on the morning of Thursday the 16th
There will be 100 free tickets for women in ICS
There will be a special space for worthy cause exhibitors
Who the event is geared toward

Links and resources:

(CS)²AI

Dale Peterson’s website

Dale Peterson on LinkedIn

Go to www.s4xevents.com for more information about the upcoming S4x23 Conference.

Books mentioned:

Start with Why: How Great Leaders Inspire Everyone to Take Action by Simon Sinek

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: RedCast | O podcast de Segurança da Informação
Episode: Episódio #33 | OT, o custo de não proteger
Pub date: 2023-01-19

Talvez o grande desafio dos ambientes de OT e sistemas de controle industrial seja o seguinte: proteger a linha ou só investir para que a produção siga? São milhões investidos para que um parque industrial funcione bem. E protegê-lo exige mais um montante considerável que nem sempre a empresa pode ou está disposta a investir. E há outras questões: obsolescência do parque, softwares de automação que dependem de sistemas operacionais antigos para funcionar, riscos altíssimos e a gestão desses riscos, como proteger uma operação que não pode parar. Nesse episódio do RedCast, "OT, o custo de não proteger", você vai entender com os especialistas convidados sobre a importância de uma abordagem específica de segurança e como fazer essa gestão de risco em ambientes industriais. Não perca!Com Eduardo Lopes - CEO da Redbelt Security, Nycholas Szucko - Executivo da Nozomi na América Latina, Vitor Sena - CISO e DPO na Gerdau e Matheus Borges - CCO da Redbelt Security.

The podcast and artwork embedded on this page are from RedBelt Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: ICS Village Talks About ICS CTF At S4x23
Pub date: 2023-01-18

Tom VanNorman and Don Weber join Dale to describe the ICS Capture The Flag competition they will be running at S4x23, Feb 13 - 16 in Miami South Beach.

S4x23 web site

View Details

Podcast: New Cyber Frontier (LS 27 · TOP 10% what is this?)
Episode: NCF-314 Status of Cybersecurity for Critical Infrastructure
Pub date: 2023-01-18

In today’s Episode of New Cyber Frontier, we are going over the status of Critical Infrastructure. With thousands of new systems and devices all over the country in play over the last couple of decades, with little to no security, what does this mean for the future? These could include Air conditioning, heating systems, Control systems, HBAC Systems, and much more that are interconnected in some way. Join us In this week's post.

Visit our sponsors:

BlockFrame Inc.

IEEE Digital Privacy

Murray Security Services

The podcast and artwork embedded on this page are from Logic Central Online, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: RSA Conference
Episode: Critical Infrastructure at Risk: Uncovering the Danger of insecure-by-design Control System Software
Pub date: 2023-01-17

In this podcast, we will uncover the realities of insecure control systems software in critical infrastructure. From discovering zero-days to exposing vulnerabilities in built-in features, we'll explore the role of both vendors and operators in safeguarding our essential utilities. By the end, listeners will have a new perspective on the need to implement strong security practices into the foundation of the control systems that make modern life possible. Don't miss out on this crucial conversation about the current state and the future of our critical infrastructure!Speakers:Brian Foster, GMS Cybersecurity Lead, South California EdisonKacy Zurkus, Content Strategist, RSAC

The podcast and artwork embedded on this page are from RSA Conference, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: Become a Cybersecurity Entrepreneur with Michael Schroeder
Pub date: 2023-01-17

Today, Derek Harp interviews Michael Schroeder, the Founder, CEO, and Director of OT, FRCS, and ICS Security at 3 Territory Solutions.

Michael leads an organization that conceptualizes, develops, and implements cybersecurity standards and policies for Facility-Related Control Systems, Medical Devices, Industrial Control Systems, PIT and PIT Systems, Operational Technologies, and most generally, the Internet of Things. They are passionate, challenge the status quo, innovate, and fail forward.

Michael was born and raised in Pittsburgh, Pennsylvania. He is a long-time contributor to the cybersecurity space. In the early years, he was a Chapter Board Member in the Washington DC Chapter of the Control System Cyber Security Association International. He is also a father, husband, entrepreneur, engineer, project manager, traveler, and race-car driver. He joins Derek today to discuss his education and career path, talk about what he does today, and offer advice for anyone considering a career in cybersecurity.

Show highlights:

Michael explains what drew him toward the discipline of engineering and why he decided to study mechanical engineering.
Michael discusses what he did after graduating from Pennsylvania State University.
How Michael jumped from engineering and working in construction to cybersecurity in 2015.
Why should you leave jobs with professionalism and strive to keep the doors open?
Michael explains why his stint working at a large company was so short.
Michael shares his motivation for starting his own company and gets into the genesis process.
How Michael chose the name 3 Territory Solutions.
Michael shares some insight for entrepreneurs.
How Michael built his career by taking advantage of opportunities as they presented themselves.
Michael offers advice for people coming into the cybersecurity space.
The role mentorship has played in Michael’s career path.

Links and resources:

(CS)²AI

Michael Schroeder on LinkedIn

3 Territory Solutions

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Living at the Edge - Visibility into Edge Devices [The Industrial Security Podcast]
Pub date: 2023-01-16

Industrial network monitoring and intrusion detection tend to start at the highest level networks - the ones closest to the IT network. Ron Fabella, CTO and Co-Founder of Synsaber joins us to look at the problem the other way around - at how important and how useful it is to monitor our lowest level networks - the edge networks closest to the physical process.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS Cyber Talks Podcast
Episode: Hillel Kobrovski CAM @Fortinet, Cybersecurity Expert, Academic Lecturer about cyber and philosophy
Pub date: 2023-01-15

נחשון פינקו מארח את הלל קוברובסקי מומחה ומוביל דעה בקהילת הסייבר הישראלית, מרצה סייבר באקדמית אונו, חבר נשיאות בלשכה לטכנולוגיות המידע ומוביל מרכז המצוינות, פילוסוף ועתידן בשיחה על סייבר עבר ועתיד.

מה השינויים שחלו בנושא הסייבר ב 20 השנים האחרונות והאם זה יכול ללמד אותנו לגבי העתיד

מדוע נדרשת פרדיגמה שונה בהגנת הסייבר ושינוי מהותי בקו המחשבה של מנהלי אבטחת מידע ומיישמים

הפילוסופיה של הסייבר, לאן האנושות הולכת ומה היה רצוי שיקרה

האם התאוריה של נחשון שלמדינות אין אינטרס לחסל את נושא התקפות הסייבר נכונה

ועוד

Nachshon Pincu hosts Hillel Kobrovski, an expert and opinion leader in the Israeli cyber community, a cyber lecturer at the Ono Academic College, a presidential member of The Israeli camber of information technology

, and a leader of Excellence Center, a philosopher, and a futurist in a conversation about cyber past and future.

What changes have occurred in cyber in the last 20 years, and can this teach us about the future?

Why is a different paradigm required in cyber defense and a fundamental change in the way of thinking of information security managers and implementers?

The philosophy of the cyber, where humanity is going, and what would be desirable to happen?

Is Nachshon's theory that states have no interest in eliminating the issue of cyber-attacks correct?

and more

The podcast and artwork embedded on this page are from Nachshon Pincu, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast
Episode: Greg Valentine: You’re Compliant. Now Prove it.
Pub date: 2023-01-12

About Greg Valentine: He has over 30 years of experience in the software industry. The past 15 of which have been focused on cyber security. Greg currently holds two certifications including an ISC2 – CISSP, and GIAC – GRID. Greg is responsible for building technical solutions for Industrial Defender so that our clients receive the most effective, and most efficient implementations of the Industrial Defender software. Prior to working at Industrial Defender, Greg held cybersecurity roles at Lockheed Martin, Capgemini, CoreTrace Software and Winternals Software (a sister company to Sysinternals, now owned by Microsoft).

In this episode, Aaron and Greg Valentine discuss:

The challenge with proving compliance (e.g. NERC CIP)
Gathering quality data without manual walk-downs
Making the data useful, reportable and audit-friendly

Key Takeaways:

Proving compliance could be challenging. There’s a lot of manual work that goes into collecting data for the auditor. The data that you give has to be secure in a way where the data is unalterable, unmodifiable, or otherwise not possible to tamper with in order to ease the auditor’s peace of mind.
You need the right tool to gather the right data that you’ll need for your compliance report. When looking for a product, you need to find a company that’s credible. You need to minimize risk if you want to automate the process and have it run on a regular cadence to solve your compliance reporting problem.
The information that's collected for a PLC is very different from the information we collect from an HMI or firewall or switch but it's all critical. Once you have that data in a central repository. Now you can ask interesting questions to find that solution. There's a lot of benefit to aggregating all of this information into a single queryable location.

"[Compliance] is a good first step, you're kind of being forced. And that's not nice. But it's a minimal level of cybersecurity posture to be in. Hopefully, you take that and run with it, you extend and improve from there. But this is your foundation level for cybersecurity. it doesn't matter whatever it happens to be, that you're complying with, that should be your base standing from which you can grow." — Greg Valentine

Connect with Greg Valentine:

LinkedIn: https://www.linkedin.com/in/gvalentine/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: Women In ICS Security
Pub date: 2023-01-11

Donna Cusimano, Kim Legelis, and Saltanat Mashirov join Dale Peterson to talk about the Women In ICS Security Program at S4x23, Feb 13-16 in Miami South Beach. (see s4xevents.com/women).

These are three of a team of volunteers that have put together important career, education, and networking opportunities for the 100 free Women in ICS Security ticket holders and another ~150 women who will attend on a paid ticket. Really impressed and looking forward to seeing what this will accomplish.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Shifting into the OT space.
Pub date: 2023-01-11

A Canadian mining company shuts down its mill following a ransomware attack. The Port of Lisbon has sustained a cyberattack, with the LockBit ransomware gang claiming credit. Rail company Wabtec begins notifying victims of data breach following a ransomware attack. New York’s governor signs legislation seeking to secure power grids. And an upcoming NATO study will analyze hybrid warfare. Guest Kaleb Flem, Senior Cyber Threat Intel Analyst at Southern California Edison, returns for the second part of his interview to discuss the transition from the military and Intelligence Community to the OT space. The Learning Lab segment will return in our next episode.

Control Loop News Brief.Canadian mining company hit by ransomware.Copper Mountain Mining Subject to Ransomware Attack and Implements Risk Management Systems and Protocols (Canada NewsWire)

Canadian copper mine suffers ransomware attack, shuts down mills (The Record)

Port of Lisbon sustains cyberattack.LockBit claims an attack on the Port of Lisbon (CyberNews)

Rail company begins notifying victims of data breach.Data Security Incident Update – Personal Data Breach Public Communication (Wabtec Corporation)

Billion-dollar rail firm confirms data breach after suspected ransomware attack (The Record)

New York legislation seeks to secure power grids.tGovernor Hochul Signs Nation-leading Legislation to Protect Energy Grid from Cyber Threats (Governor Kathy Hochul)

NATO study will analyze hybrid warfare.How NATO can keep pace with hybrid threats in the Black Sea region and beyond (Atlantic Council)

Control Loop Interview.Kaleb Flem, Senior Cyber Threat Intel Analyst at Southern California Edison, returns for the second part of his interview to discuss the transition from the military and Intelligence Community to the OT space.

Control Loop Learning Lab.The Learning Lab will return in our next episode.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrie neu gedacht - ein Tech-Podcast von Bosch Rexroth
Episode: Programmiertipps für die sichere SPS
Pub date: 2023-01-03

Martin Scheu ist Security-Experte aus der Schweiz und erklärt uns die Schwachstellen und die besten Programmiertipps um die SPS sicherer zu machen.Wenn Sie Fragen haben, dann wenden Sie sich gerne an:vertrieb@boschrexroth.de

Produziert von Bosch Rexroth AG, Vertrieb Europa Mitte Susanne Noll

Die Gitlab Liste - keine Haftunghttps://gitlab.switch.ch/martin.scheu/sps-top20

Kontakt zu unserem Gesprächspartnerhttps://www.linkedin.com/in/martin-scheu/

The podcast and artwork embedded on this page are from Bosch Rexroth AG, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 64: Education That Alters Your Career Trajectory
Pub date: 2023-01-10

Today, Markus Braendle joins Derek Harp as his guest for today’s show. He is Head of Information and Automotive Security at the Volkswagen company, CARIAD.

Markus has been in the industry for a long time! He is a high-energy and result-driven professional offering extensive leadership and business experience. He has a proven track record of building, strengthening, and leading international teams, evolving organizations to meet future needs, as well as creating a customer-focused culture. He is confident and engaging with refined communication skills. He brings deep technical know-how to areas of information technology, cyber security, or industrial automation.

Markus was born in Iran and grew up in a small town near Zurich, Switzerland. In addition to being a technologist and an all-around geek, he is also a husband, father, hobby carpenter, mountain biker, and formally-trained software engineer. In this episode, he tells his story, discusses his education and career trajectory, and gets into what they are doing at CARIAD.

Stay tuned for more!

Show highlights:

His dad was into technology, and it became clear early on that Markus would also go into technology.
He studied for four years to get his Master’s in Computer Science and then did a P.h.D. in Theoretical Computer Science.
Markus talks about the value of the year he spent in the US as an exchange student.
He explains why he ended up in a corporate research lab after completing his studies.
Markus discusses his first intersections with control systems and cybersecurity.
How Markus learned to always ask about the most important thing a product does before trying to link security to it.
Markus discusses his approach to building a network to advance your career.
The qualities Markus looks for in candidates when interviewing them.
What diversity means to him, and why he feels it is essential when building teams.
How Markus discovered the benefits of working with people with autism.
Why he left ABB to join Airbus, and why he joined Cariad eight months ago.
Markus shares some advice for what people starting in their careers should study.

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The PrOTect OT Cybersecurity Podcast
Episode: Dennis Murphy: The Challenges With IT and OT Convergence
Pub date: 2023-01-05

About Dennis Murphy: Dennis is Lead OT Security Engineer at National Grid. He focuses on providing practical solutions to meet national critical infrastructure cyber security requirements. One of his main interests in OT cybersecurity is helping to bridge the gap between the information technology (IT) and operational technology (OT) domains.

Control systems engineer turned cybersecurity leader, Dennis has decades of experience implementing OT cybersecurity strategies across a wide variety of industrial environments. This experience allows him to apply state-of-the-art cyber security solutions to national critical infrastructure asset owners while maintaining the continued reliable operation of OT networks.

In this episode, Aaron and Dennis Murphy discuss:

The challenges with IT and OT convergence
Achieving an accurate asset inventory around OT
The importance of having the right endpoint data
The challenges of SBOM and scope

Key Takeaways:

In industrial security, there is still a need for IT and OT to collaborate more closely in order to standardize on effective programs. It is important to continue communication about OT-specific requirements and which IT practices should not be applied to operational environments and to drive agreement on standard practices and technologies across multiple sites.
Getting accurate and complete asset inventory and details is critical in making decisions for OT security and operations. While traditional IT approaches should not be used, there are effective ways now to get the visibility and endpoint data you need in OT environments. Giving analysts the complete picture of the device, its use, function, and configuration help to more quickly decide the course of action and remediations.
When it comes to SBOM, understanding the subcomponents is easier with new gear than it is with existing equipment. New systems can be pen tested as they come in. With existing systems, you need to consider when it makes sense to query, when that information might change, and what’s the scope of information needed.

Connect with Dennis Murphy:

LinkedIn: https://www.linkedin.com/in/dennis-murphy-ot-security/

Connect with Aaron:

LinkedIn: https://www.linkedin.com/in/aaronccrow

Learn more about Industrial Defender:

Website: https://www.industrialdefender.com/

LinkedIn: https://www.linkedin.com/company/industrial-defender-inc/

Twitter: https://twitter.com/iDefend_ICS

YouTube: https://www.youtube.com/@industrialdefender7120

Show notes by Podcastologist Melvin Romero

Audio production byTurnkey Podcast Productions. You're the expert. Your podcast will prove it.

The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 394: How to Get IT AND OT to work together with Bayron Lopez
Pub date: 2023-01-06

In this episode of the Smart Buildings Academy Podcast Bayron Lopez helps us to unpack the world of IT from a customer's point of view.

So often we are busy thinking "How can I respond to this spec?"

Or "How can I be compliant with XYZ requirement?"

But how often do we stop to think about the operational side of the systems we install?

In this episode Bayron helps us to understand the customer's point of view. Join us as Bayron gives us a behind the scenes look at how IT decisions are made and how we can avoid that dreaded not-qualified decision from IT.

View Details

Podcast: Government Information Security Podcast (LS 27 · TOP 10% what is this?)
Episode: Exclusive: FDA Leader on Impact of New Medical Device Law
Pub date: 2023-01-05

The $1.7 trillion omnibus spending bill signed into law last week by President Joe Biden contains new cybersecurity requirements for medical devices that make it a game changer for strengthening security within the healthcare ecosystem, says Dr. Suzanne Schwartz of the FDA.

The podcast and artwork embedded on this page are from GovInfoSecurity.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: What is Threat Detection? | Nozomi Networks
Pub date: 2022-12-28

Malware and ransomware are of course some of the biggest and most widely known threats that businesses face today. However, having a basic understanding of the bigger picture will enable you to prepare your business for a whole range of threats that you may come across, and secure your business further.

Learn more with Nozomi Networks Cybersecurity and Privacy Director Bruce Snell, and Security Research Evangelist Roya Gordon.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Secure Software Development and a Zero Trust Supply Chain [The Industrial Security Podcast]
Pub date: 2023-01-02

How does secure software development work for industrial products (SDLC) and what is a zero-trust supply chain? Gonda Lamberink of Fortress Information Security leads us on a deep dive of what's new in secure software development, and especially how supply chain security is impacting that lifecycle.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: What is Incident Response? | Nozomi Networks
Pub date: 2022-12-29

Incident response is something we hope you don’t have to deal with very often, but for those responsible for securing industrial and critical infrastructure, it’s a critical component of their cybersecurity strategy. In fact it’s key to ensuring that your business, systems and personnel are well prepared to act swiftly and efficiently when an incident does occur.

Learn more with Nozomi Networks Cybersecurity and Privacy Director Bruce Snell, and OT Cybersecurity Strategist Danielle Jablanski.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: What is Cyber Risk Management? | Nozomi Networks
Pub date: 2022-12-28

Cyber risk management involves identifying all the OT and IoT assets on your operational network, assessing their vulnerabilities, and outlining risk management processes to close security gaps.

Learn more with Nozomi Networks Cybersecurity and Privacy Director Bruce Snell, and Technical Sales Director Shan Zhou.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Interview Select: Maria Varmazis interviews Brandon Bailey about Space Attack Research and Tactic Analysis, or SPARTA matrix.
Pub date: 2022-12-28

This interview from December 2nd, 2022 originally aired as a shortened version on the CyberWire Daily Podcast. In this extended interview, Maria Varmazis sits down and interviews Brandon Bailey about Space Attack Research and Tactic Analysis, or SPARTA matrix.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast (LS 23 · TOP 10% what is this?)
Episode: What is Zero Trust Security? I Nozomi Networks
Pub date: 2022-12-28

The rise of remote working, hybrid cloud environments and use of mobile and IoT devices has casued the security perimeter approach to become obsolete. It’s quickly being replaced by the zero trust model which denies access to all applications and data by default. Zero trust is less a technology than it is a security policy objective and design approach.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 63: OT and Cybersecurity Updates from Rick Kahn of Verve Industrial Protection
Pub date: 2022-12-27

Today, Derek Harp shines the spotlight on Verve Industrial Protection. Verve has been around for some time and has been evolving over the last several years.

Rick Kaun is the VP of Solutions at Verve Industrial Protection. He joins Derek today to share his insights and talk about Verve, explain what sets them apart from the rest, and discuss where they are heading.

Rick is a CS2AI fellow and a former CS2AI Chapter President. He has been involved with CS2AI since the very early days.

You will not want to miss this episode if you are interested in learning about what goes on and what people are doing in the OT realm and cybersecurity space. Stay tuned to find out what Verve Industrial Protection does, the verticals they are in, who they help, and how they do it.

Show highlights:

Verve’s origin story.
How Verve differs from its competitors.
Rick discusses the various verticals Verve is in.
How and why Rick joined Verve.
Rick dives into what protection requires.
The main differences between Verve and traditional tools.
Why does Verve do managed services?
Rick unpacks what he finds exciting about where Verve is and the way they do things.
How do people get selected to do OT or ICS cybersecurity?

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Gate 15 Podcast Channel
Episode: The Gate 15 Interview EP30: Brian Harrell on Energy & Infrastructure Security, plus baseball, boating & burgers!
Pub date: 2022-12-26

In this episode of The Gate 15 Interview, Andy Jabbour visits with Brian Harrell, Vice President and Chief Security Officer (CSO) at AVANGRID. Brian currently serves as the Vice President and Chief Security Officer (CSO) at AVANGRID, an energy company with assets and operations in 24 states. He is responsible for the company’s cybersecurity, privacy, physical security, threat management, and business continuity. In 2018, Brian was appointed by the President of the United States to serve as the sixth Assistant Secretary for Infrastructure Protection at the U.S. Department of Homeland Security. He was also the first Assistant Director for Infrastructure Security at the Cybersecurity and Infrastructure Security Agency (CISA). He has spent time during his career in the US Marine Corps and various private sector agencies with the goal of protecting the United States from security threats. Brian is a Board Member and Strategic Advisor to many great companies. Brian on Twitter: @gridsecure In the discussion we address: Brian’s background and path from law enforcement to infrastructure, CISA to AVANGRID Information Sharing Preparedness and Best Practices Evolving threats to energy and infrastructure, including hostile events, insider threats, cyberattacks and nation state threats, 3rd party risk and more We talk baseball, burgers, and boating, plus shoutouts to some valued friends and partners! A few references mentioned in or relevant to our discussion include: AVANGRID. “AVANGRID is a leading sustainable energy company transitioning America toward a clean and connected future headquartered in Orange, CT, and has a footprint in 24 states with $40 billion in assets. Our primary businesses are Avangrid Networks, which serves 3.3 million electric and natural gas customers in the Northeast, and Avangrid Renewables, the third-largest renewable energy company in the U.S. with a diverse onshore and offshore renewable energy portfolio.” WSJ Pro Research Survey: Preparedness Results, 29 Nov 2022 The Cybersecurity and Infrastructure Security Agency (CISA) release of the Resilient Power Best Practices for Critical Facilities and Sites. This document supports emergency and continuity managers with guidelines, analysis, background material, and references to increase the resilience of backup and emergency power systems during all durations of power outages. Improving power resilience can help the nation withstand and recover rapidly from deliberate attacks, accidents, natural disasters, as well as unconventional stresses, shocks, and threats to our economy and democratic system. The Electricity Information Sharing and Analysis Center (E-ISAC) GridEx VII – November 14-15, 2023 Space ISAC DHS CISA on Cyber-Physical Convergence Gate 15: Blended Threats (update 1.1): Understanding an Evolving Threat Environment (and numerous other blog posts, papers and exercises)

The podcast and artwork embedded on this page are from Gate 15, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep 43 – ICS Vendor Management e The Human Element
Pub date: 2022-12-23

Os sistemas de controle industrial (ICS) são parte integrante das infraestruturas críticas, ajudando a facilitar as operações em indústrias vitais, como energia, petróleo e gás, água, transporte, fabricação, alimentos e bebidas e fabricação de produtos químicos.

Os últimos cinco anos trouxeram um aumento acentuado na preocupação com o potencial de ataques cibernéticos em infraestruturas críticas, e o número de incidentes cibernéticos em setores de infraestrutura crítica aumentou. A ameaça de uma invasão de agentes mal-intencionados na infraestrutura crítica usando explorações baseadas em computador também cresceu.

Vários incidentes recentes de alto perfil aumentaram a conscientização sobre essa ameaça e os indivíduos e grupos que a perseguem com intenção maliciosa. A disponibilidade de soluções de segurança específicas de ICS não acompanhou a ameaça crescente, portanto, as organizações devem implantar uma solução robusta de Defesa em Profundidade, tornando seus sistemas alvos pouco atraentes para possíveis invasores.

Vamos debater os elementos da estratégia de ICS Defense in Depth, sendo um episódio para cada elemento conforme agenda abaixo.

26/10/2022 – EP 38 – ICS Risk Management Program - Já realizado.

08/11/2022 – EP 39 - ICS Cybersecurity Standards e Physical Security - Já realizado.

23/11/2022 – EP 40 - ICS Network Architecture e ICS Network Perimeter Security - Já realizado.

30/11/2022 – EP 41 – ICS Host Security - Já realizado.

07/12/2022 – EP 42 – ICS Security Monitoring - Já realizado

14/12/2022 – EP 43 – ICS Vendor Management e The Human Element

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 62: Going from Gamer to Cybersecurity Expert with Donovan Tindill
Pub date: 2022-12-22

Derek Harp interviews Donovan Tindill today. Donovan is the Director of OT Cybersecurity at DeNexus.

Donovan Tindill is a control systems cybersecurity subject matter expert with the Honeywell Industrial Cybersecurity team. He spent over 17 years customer-facing as a control systems cybersecurity consultant in Canada, training/mentoring the technical team, and leading major projects across Consulting Services. Donovan supports global industrial cybersecurity by volunteering to teach, contributing to standards, supporting industry conferences, and sharing thought-provoking presentations.

He is a former ISA-99/62443 trainer, working group co-chair, and contributor. Donovan is an advisor to both the United States and Canadian government control systems cybersecurity conferences (i.e. US DHS ICSJWG Vice-Chair and Public Safety Canada ICS Symposium Vendor Seat) helping select speakers, drive awareness, and increase knowledge in North America. Donovan has an applied Bachelor’s Degree in Network Engineering and Management (NET:1999, BAIST-NM:-2003) from the Northern Alberta Institute of Technology (NAIT) and holds CISSP and GICSP certifications.

Donovan grew up in Canada, in rural Alberta, and currently lives in Edmonton. He is a long-time contributor to the cybersecurity space. He has been involved for much longer than most and is way more than just a cybersecurity enthusiast. He is also a professional speaker, husband, father, coach, outdoor enthusiast, camper, handyman, and tinkerer. He joins Derek in this episode to tell his story, unpack his career journey, share his experience, and offer advice.

You won’t want to miss this episode if you are considering a career in cybersecurity. Stay tuned to hear Donovan’s story and benefit from his experience in control systems and cybersecurity!

Show highlights:

How video games and networking computers together led Donovan to get into network engineering.
What the network engineering program is all about and what you can do with it.
Donovan discusses a roadblock to growth in the Honeywell cybersecurity business.
Donavan talks about the first project he worked on at the start of the integration between control systems and networks.
How has the cybersecurity journey evolved since the early 2000s?
Donovan talks about his decision to take a leave of absence from Matrikon to complete his degree program.
The different roles Donovan has been in throughout his career.
The benefits of volunteering.
Donovan discusses his motivation for doing what he does in the controls systems cyberspace.
What will you gain from giving and receiving mentorship?
Why Donovan decided to move to DeNexus.
Donovan shares his view of the future.

Links and resources:

(CS)²AI

Donovan Tindill on LinkedIn

DeNexus

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 32 · TOP 5% what is this?)
Episode: Ralph Langner on OT Asset Management
Pub date: 2022-12-21

Ralph Langner joins Dale on the Unsolicited Response Show to discuss Asset Management. They begin with the need for more exploration in OT, and more failures. After that they tackle:

Why Ralph decided to shift his company and focus from consulting / speaking to product
Is his OT Base, and asset management, a security product?
What are the elements of asset management? Do they all belong in one product?
OT, asset management and other, with ServiceNow and other enterprise solutions dealing with ticketing and human process management (this was Dale's favorite part of the show)
Power BI integration, dashboards what are they good for?
Other asset management integrations including OT detection solutions

As with any conversation with Ralph (and Dale) there are plenty of analysis and opinions that may be out of the mainstream.

Enjoy

Links

Langner's OT Base
Ralph's TED Talk on Stuxnet
Ralph's S4x12 Stuxnet Deep Dive
Robust Control System Networks
To Kill A Centrifuge
Art Manion, Dale and Ralph on Automating Patch Analysis
Dale's ICS-Patch Decision Tree (What to patch when in ICS)

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 61: Lessons from the Origins of Control Systems
Pub date: 2022-12-13

Joseph Weiss is an industry expert on control systems and electronic security of control systems, with more than 40 years of experience in the energy industry. Mr. Weiss spent more than 14 years at the Electric Power Research Institute (EPRI) where he led a variety of programs including the Nuclear Plant Instrumentation and Diagnostics Program, the Fossil Plant Instrumentation & Controls Program, the Y2K Embedded Systems Program and, the cyber security for digital control systems.

As Technical Manager of the Enterprise Infrastructure Security (EIS) Program, he provided technical and outreach leadership for the energy industry’s critical infrastructure protection (CIP) program. He was responsible for developing many utility industry security primers and implementation guidelines. He was also the EPRI Exploratory Research lead on instrumentation, controls, and communications.

Mr. Weiss serves as a member of numerous organizations related to control system security. These include the North American Electric Reliability Corporation (NERC) Control Systems Security Working Group (CSSWG), the International Electrotechnical Commission (IEC) Technical Committee (TC) 57 Working Group 15 – Data and Communication Security, the Process Controls Security Requirements Forum, CIGRÉ WG D2.22 – Treatment of Information Security for Electric Power Utilities (EPUs), and other industry working groups.

He served as the Task Force Lead for review of information security impacts on IEEE standards. He is also a Director on ISA’s Standards and Practices Board. He has provided oral and written testimony to three House subcommittees, one Senate Committee, and a formal statement for the record to another House Committee. He has also responded to numerous Government Accountability Office (GAO) information requests on cyber security and Smart Grid issues.

He is also an invited speaker at many industry and vendor user group security conferences, has chaired numerous panel sessions on control system security, and is often quoted throughout the industry.

He has published over 80 papers on instrumentation, controls, and diagnostics including chapters on cyber security for Electric Power Substations Engineering and Securing Water and Wastewater Systems. He coauthored Cyber Security Policy Guidebook and authored Protecting Industrial Control Systems from Electronic Threats. He supported MITRE and NIST in extending NIST SP800-53 to include control systems and the development of NIST SP800-82.

He was tasked to write the White Paper on Industrial Control Systems Security for the Center for Strategic and International Studies Blue Ribbon Panel preparing cyber security recommendations for the Obama administration.

In February 2016, Mr. Weiss gave the keynote to the National Academy of Science, Engineering, and Medicine on control system cyber security. Mr. Weiss has conducted SCADA, substation, plant control system, and water systems vulnerability and risk assessments and conducted short courses on control system security. He has amassed a database of more than 950 actual control system cyber incidents.

He is a member of Transportation Safety Board Committee on Cyber Security for Mass Transit. He was a subject matter expert to the International Atomic Energy Agency on nuclear plant control system cyber security. He also established the annual Industrial Control System (ICS) Cyber Security Conference. Mr. Weiss has received numerous industry awards, including the EPRI Presidents Award (2002) and is an ISA Fellow, Managing Director of ISA Fossil Plant Standards, ISA Nuclear Plant Standards, ISA Industrial Automation and Control System Security (ISA99), a Ponemon Institute Fellow, and an IEEE Senior Member. He has been identified as a Smart Grid Pioneer by Smart Grid Today.

He is a Voting Member of the TC65 TAG and a US Expert to TC65 WG10, Security for industrial process measurement and control – network and system security and IEC TC45A Nuclear Plant Cyber Security. Mr. Weiss was featured in Richard Clarke and RP Eddy’s book- Warning – Finding Cassandras to Stop Catastrophes. He has two patents on instrumentation and control systems, is a registered professional engineer in the State of California, a Certified Information Security Manager (CISM) and is certified in Risk and Information Systems Control (CRISC).

Mentioned in this episode:

Our Sponsors:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 32 · TOP 5% what is this?)
Episode: Dino on the DCOM Patch
Pub date: 2022-12-14

Dino Busalachi of Velta Technology talks to Dale about a 2021 security patch to DCOM that broke a number of ICS systems including Rockwell Automation and Siemens. Microsoft had a registry setting that disabled the patch and the incompatibility problem, but this ability to disable the patch goes away on 14 March 2023.

Of course this topic leads us down the patching in ICS rabbit hole, hopefully with some informed and helpful information.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Cyber threat intelligence in the OT space.
Pub date: 2022-12-14

Microsoft offers predictions for Russia’s war in Ukraine. A wiper targets the diamond industry. New version of Babuk ransomware hits manufacturing company. Cyberattacks against the manufacturing industry. Cybersecurity for farming equipment. CISA issues ICS advisories. Guest Kaleb Flem, Senior Cyber Threat Intel Analyst at Southern California Edison, discusses maximizing threat intelligence at a utility. And, in Part 2 of 2 on the Learning Lab, Mark Urban and Dragos’ CISO Steve Applegate talk about starting an OT cybersecurity program.

Control Loop News Brief.Predictions for Russia’s war in Ukraine.Preparing for a Russian cyber offensive against Ukraine this winter (Microsoft)

A wiper targets the diamond industry.Fantasy – a new Agrius wiper deployed through a supply‑chain attack (ESET)

New version of Babuk ransomware hits manufacturing company.Morphisec Discovers Brand New Babuk Ransomware Variant in Major Attack (Morphisec)

Cyberattacks against the manufacturing industry.BlackBerry/Make UK Research Reveals UK Manufacturing Sector Under Threat as Almost Half Suffer Cyberattack in the Last 12 Months (BlackBerry)

Cybersecurity for farms.Tractors vs. threat actors: How to hack a farm (ESET)

CISA’s ICS advisories.CISA Releases Three Industrial Control Systems Advisories (CISA)

Iguana triggers blackout.Rogue iguana causes widespread power outage in Lake Worth Beach (The Sun Sentinel)

Control Loop Interview.Guest Kaleb Flem, Senior Cyber Threat Intel Analyst at Southern California Edison, discusses maximizing threat intel at a utility.

Control Loop Learning Lab.Part 2 of 2 has Dragos CISO Steve Applegate talking with Dragos' Mark Urban about starting an OT cybersecurity program.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Joe Weiss: The Hard Truth About Industrial Cybersecurity
Pub date: 2022-12-14

Joe Weiss is what you would call a trailblazer in the realm of critical infrastructure cybersecurity. During his 40+ years in industrial instrumentation controls and cybersecurity, he has set many of the standards we now aspire to achieve and written multiple books on cybersecurity for power stations, water stations, and data centers. He is the managing partner at Applied Control Solutions consultancy and director of the International Society for Automation.

We sat down with him to discuss the frightening reality of industrial control systems. and the importance of including engineers in industrial product security.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Sharon Brizinov on Hacking IoT
Pub date: 2022-12-12

Claroty Team82 Director of Research Sharon Brizinov joins the podcast to discuss the recent Pwn2Own Toronto event. Brizinov was successful in three categories at the event, finding and exploiting zero day vulnerabilities in two network-attached storage devices and a popular router.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Consequences Matter [The Industrial Security Podcast]
Pub date: 2022-12-12

Worst-case consequences of compromise determine government and societal policies, so consequences matter, especially for critical infrastructure security. Danielle Jablanski, OT Cybersecurity Strategist at Nozomi Networks joins us to look at threats, consequences and policies for critical infrastructure security.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 42 - ICS Security Monitoring
Pub date: 2022-12-09

ICS SECURITY PODCAST - Ep. 42 - ICS Security Monitoring

Vamos debater os elementos da estratégia de ICS Defense in Depth, sendo um episódio para cada elemento conforme agenda abaixo.

26/10/2022 – EP 38 – ICS Risk Management Program - Já realizado.

08/11/2022 – EP 39 - ICS Cybersecurity Standards e Physical Security - Já realizado.

23/11/2022 – EP 40 - ICS Network Architecture e ICS Network Perimeter Security - Já realizado.

30/11/2022 – EP 41 – ICS Host Security - Já realizado.

07/12/2022 – EP 42 – ICS Security Monitoring

14/12/2022 – EP 43 – ICS Vendor Management e The Human Element

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: KBKAST (LS 25 · TOP 10% what is this?)
Episode: Episode 150: Edgard Capdevielle
Pub date: 2022-12-14

Edgard Capdevielle is President, CEO and co-founder of operational tech and IoT firm Nozomi Networks. Edgard brings an extensive background in successfully managing and expanding markets for both start-ups and established technology companies to his role as CEO. Previously he was Vice President of Product Management and Marketing for Imperva, where he led teams that made the company’s web and data security products leaders in their space. Prior to that he was a key executive at storage companies Data Domain and EMC.

The podcast and artwork embedded on this page are from KBI.Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cybercrime Magazine Podcast (LS 30 · TOP 5% what is this?)
Episode: GPS Hacking. Overcoming The Threat. Mizanur Rahman, Assistant Professor, University of Alabama.
Pub date: 2022-12-07

In this episode, host Hillarie McClure is joined by Dr. Mizanur Rahman, Assistant Professor at the University of Alabama. Together, they discuss his role at the University of Alabama, how he and his team developed a system that can overcome the threat of GPS hacking that can send a self-driving vehicle to the wrong destination, and more. • For more on cybersecurity, visit us at https://cybersecurityventures.com

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: UNSECURITY: Information Security Podcast (LS 30 · TOP 5% what is this?)
Episode: Unsecurity Episode 193: What the New CISA Reporting Rule Means for Critical Infrastructure
Pub date: 2022-12-08

Episode 193 of the Unsecurity Podcast is now live! This week, Oscar and Brad discuss the new CISA reporting rule and what it means for organizations in the critical infrastructure sector.

Links:
Critical Infrastructure Sectors
https://www.cisa.gov/critical-infrastructure-sectors

CISA - Reporting Rule
https://thehackernews.com/2022/12/what-cisa-reporting-rule-means-for-your.html
https://www.congress.gov/bill/117th-congress/house-bill/5440/text?format=txt
https://www.federalregister.gov/documents/2022/09/12/2022-19551/request-for-information-on-the-cyber-incident-reporting-for-critical-infrastructure-act-of-2022
https://www.cisa.gov/report
https://www.cisa.gov/sites/default/files/publications/Sharing_Cyber_Event_Information_Fact_Sheet_FINAL_v4.pdf

Give episode 193 a listen or watch and send any questions, comments, or feedback to unsecurity@protonmail.com.

The podcast and artwork embedded on this page are from InfoSec Missionaries, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Gate 15 Podcast Channel
Episode: The Risk Roundtable EP 36: Putting a bow on the year with Critical Infrastructure, Accelerationists, and Cyber Hygiene.
Pub date: 2022-12-06

In the latest episode of the Risk Roundtable, Dave, Jen, and Andy wrap up their third year together and talk through recent events and talk about ways to fight off those seeking to ruin the holiday spirit. Dave and Andy kicked things off talking about the incident at the North Carolina power substation and what it could mean given recent events (Walmart shooting, Colorado Springs) and how to look at it from a preparedness standpoint. Jen dropped down the chimney and spread holiday cheer with a double shot of cybersecurity tips talking about holiday scams (in only the way Jen can do), and passwords (don't be like Dave). Then Dave then took the group back through some of the 2022 predictions to see if they were right, needed more time, or were off base before Andy put a bow on the podcast with a holiday themed question.

Some of the topics discussed on the pod:

National Terrorism Advisory System & Bulletin 30 Nov 22
HS Today: ’Targeted’ N.C. Substation Gun Attack Comes Amid Escalating Critical Infrastructure Threats, 04 Dec 22
Washington Post: Walmart gunman showed troubling behavior before attack, ex-colleagues say, 04 Dec 22
CNN: Gunman kills 5 at LGBTQ nightclub in Colorado Springs before patrons confront and stop him, police say, 21 Nov 22
GridEx VII – November 14-15, 2023
Congratulations, Troy & Charlotte Hunt! @troyhunt & @Charlotte_Hunt_
And see Troy’s tweet: Happy birthday to @haveibeenpwned, born 9 years ago on 04 Dec
Catalin Cimpanu on Mastadon: ‘The only infosec predictions that need to be taken seriously are the ones in a meme format’: https://mastodon.social/@campuscodi/109427978223448015
Security Week: French Hospital Cancels Operations After Cyberattack, 05 Dec 22
https://www.sentinelone.com/blog/5-cyber-scams-to-watch-out-for-this-holiday-season/
https://www.bbb.org/article/news-releases/27843-bbb-study-update-reported-online-retail-fraud-losses-to-approach-$380m-in-2022
https://www.helpnetsecurity.com/2022/11/29/most-common-passwords-2022/
https://nordpass.com/most-common-passwords-list/
https://www.troyhunt.com/password-managers-dont-have-to-be-perfect-they-just-have-to-be-better-than-not-having-one/

The podcast and artwork embedded on this page are from Gate 15, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Senate Podcast
Episode: What is it about Operational Technology that makes overcoming the fundamentals so difficult to achieve?
Pub date: 2022-12-06

As defenders, how are we implementing controls and how do we do it better? Join Jamison Nesbitt and Stefan Liversage for this educational, thought provoking and controversial conversation.

The fundamentals are simple; patching, segmentation, malware controls, visibility – but what we are trying to achieve is no easy feat when you look to dismantle more than 20 years of ad hoc OT security measures as there is still risk during the implementation phase.

Key points to be discussed:

Technical controls / process and people
Poor visibility (automation)
Organisational structure to support OT
Manage risk faster
Contain threats quicker
Minimise impact
Green field vs brown field
Skills from the ground up
Managed services
Managing multiple streams of activity
Iterative, agile process, we learn, we move forward
Rapid threat containment

The podcast and artwork embedded on this page are from James Nesbitt / Cyber Senate, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Pipeliners Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 261: TSA Cybersecurity Directives and the Impact on Pipeline Contractors and Vendors with Mark Grant
Pub date: 2022-12-06

This week’s Pipeliners Podcast episode features Mark Grant discussing cybersecurity, where TSA is headed in the future with rulemaking, how cybersecurity has impacted the industry, and why it is necessary developers adapt to current threats.

In this episode, you will learn how malware has changed in recent years and ways to counteract them, the importance of isolating the incident while continuing to operate, and understanding what parts of the system are worth protecting.

Visit PipelinePodcastNetwork.com for detailed show notes, links, insider term definitions, and a full episode transcript.

The podcast and artwork embedded on this page are from Russel Treat, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 60: Coming Out of the Military to a Career in CyberSecurity with Charlie Givens
Pub date: 2022-12-06

Today, Derek Harp interviews Charlie Givens, the Project Manager at Bechtel.

Charlie is an experienced professional with a demonstrated history of working in Information Technology, Engineering Automation, and Cybersecurity. He is a Certified Software Quality Assurance Engineer, Global Industrial Cyber Security Professional, and Control System Cyber Security Association International Fellow. He has invested his career in database design, data analysis, software engineering, system management, software quality assurance, process improvement, procedure development, work process enhancement, digital transformation, and software and system integration. He has also focused on cybersecurity as it relates to industrial control systems.

Charlie hails from a small town in Georgia. As well as being an engineer, he is also a veteran, father, husband, fishing enthusiast, photographer, and a lifetime learner.

In this episode, he tells his backstory, discusses his career trajectory, and offers some valuable nuggets of advice for anyone looking to get into cybersecurity.

This episode is a must if you are considering a career in cybersecurity or the control systems space. Stay tuned to hear how Charlie got to where he is today and benefit from his insights and many years of experience in the field.

Show highlights:

Charlie talks about the time he spent in the Navy.
What Charlie studied after leaving the Navy.
How he encountered cybersecurity when he joined Bechtel as a software engineer.
What he learned over time from his perspective as a computer scientist in the engineering field.
Charlie’s recommendations for the first steps to get into the cybersecurity domain.
The process used for the ICS center program Charlie helped create.
The role mentorship has played in Charlie’s journey.
Some advice for people coming out of school or the military looking to break into cybersecurity.
Some of the challenges Charlie has faced in his career.

Links and resources:

(CS)²AI

Bechtel

Charlie Givens on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 32 · TOP 5% what is this?)
Episode: Resilience and Safety for Electric Co-Ops
Pub date: 2022-12-05

“One of my favorite topics is disaster resilience. We do quite a bit of work on what mutual assistance looks like and how to improve mutual assistance, how to rebuild systems once they've been hit by something terrible. My more recent interesting example was when a tornado had gone through a co-op and they were looking for what to do when their data server was just plain missing. It was Dorothy essentially over to somewhere else and they were asking us: Is it a data breach?”

Emma Stewart

For today's episode, I'm joined by Emma Stewart, Ph.D., Chief Scientist at the National Rural Electric Cooperative Association (NRECA). Electric coops are local, member-owned providers of affordable, reliable power. We discuss Dr. Stewart’s work supporting these co-ops in research, incident response, and managing the growing threat of ransomware attacks. What role do these electric co-ops play in our national energy supply? What core challenges do they have in staying resilient? Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 41 - ICS Host Security
Pub date: 2022-12-01

ICS SECURITY PODCAST - Ep. 41 – ICS Host Security

Vamos debater os elementos da estratégia de ICS Defense in Depth, sendo um episódio para cada elemento conforme agenda abaixo.

26/10/2022 – EP 38 – ICS Risk Management Program - Já realizado.

08/11/2022 – EP 39 - ICS Cybersecurity Standards e Physical Security - Já realizado.

23/11/2022 – EP 40 - ICS Network Architecture e ICS Network Perimeter Security - Já realizado.

30/11/2022 – EP 41 – ICS Host Security

07/12/2022 – EP 42 – ICS Security Monitoring

14/12/2022 – EP 43 – ICS Vendor Management e The Human Element

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Preparing for the electrical grid of the future.
Pub date: 2022-11-30

The US Government Accountability Office issues a report on offshore oil and gas cybersecurity. The Oak Ridge National Laboratory seeks to secure power grids. Boa web server vulnerabilities used to target energy organizations. CISA updates its Infrastructure Resilience Planning Framework. And CISA issues advisories for ICS vulnerabilities. Guests Mara Winn and Guohui Yuan join us from the Department of Energy to discuss their report, "Cybersecurity Considerations for Distributed Energy Resources on the U.S. Electric Grid.” In Part 1 of 2 on the Learning Lab, Mark Urban and Dragos’ CISO Steve Applegate talk about starting an OT cybersecurity program.

Control Loop News Brief.GAO issues report on offshore oil and gas cybersecurity.Offshore Oil and Gas: Strategy Urgently Needed to Address Cybersecurity Risks to Infrastructure (US Government Accountability Office)

ORNL seeks to secure power grids.

DarkNet: Lighting up a secure grid communication network (ORNL)

Boa web server vulnerabilities.Vulnerable SDK components lead to supply chain risks in IoT and OT environments (Microsoft)

Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group (Recorded Future)

Sandworm renews ransomware activity against Ukrainian targets.

New ransomware attacks in Ukraine linked to Russian Sandworm hackers (BleepingComputer)

CISA updates its Infrastructure Resilience Planning Framework.Infrastructure Resilience Planning Framework (CISA)

CISA issues ICS advisories.CISA Releases Eight Industrial Control Systems Advisories (CISA)

CISA Releases Seven Industrial Control Systems Advisories (CISA)

Control Loop Interview.Guests Mara Winn and Guohui Yuan from the Department of Energy discuss their report, "Cybersecurity Considerations for Distributed Energy Resources on the U.S. Electric Grid.”

Control Loop Learning Lab.In Part 1 of 2 on the Learning Lab, Mark Urban and Dragos’ CISO Steve Applegate talk about starting an OT cybersecurity program.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 59: Staying Curious and Learning New Things is an Asset in Cyber Security with David Bacque
Pub date: 2022-11-29

Derek Harp interviews David Bacque today. David is currently the Vice President of Strategic Development and Director of OT/ICS Cybersecurity at RED Group.

RED Group is an Industrial Control Systems (ICS) technology development and integration firm specializing in Process Automation, IT/OT Consulting, and Industrial Cybersecurity. Dave is an experienced industrial cybersecurity and operational technology (OT) professional who has led, advised on, and delivered cybersecurity projects and initiatives with industrial clients around the world to help operators of critical infrastructure become more resilient to cyber threats. He has a B.S. in Information Systems and Decision Sciences from Louisiana State University and is a holder of the Global Industrial Cybersecurity Professional (GICSP) and Project Management Professional (PMP) certifications.

Dave grew up and went to school in a small town in South Louisiana. He has many years of experience in the OT space. As well as being an OT/ICS Cybersecurity leader, he is also a father, sailor, chef, barista, traveler, motorcyclist, and hiker. He joins Derek today to talk about his background, education, and career trajectory and discuss the importance of staying curious and being open to learning new things.

This episode is a must for anyone looking to get into the cybersecurity space! Tune in to hear Dave’s story, learn from his insights and experience, and benefit from his valuable nuggets of career advice!

Show highlights:

How his dad’s background in mechanical design led to David’s first interactions with technology.
The many interesting things that took place around the time Dave graduated from LSU in 2001.
What Dave did and learned when he started his career with Total in the early days of IT and OT convergence.
The value of getting to know your co-workers personally and building community within organizations.
Some changes in the OT security space that happened during the course of Dave’s career.
What does it take for engineers and IT people to become OT cybersecurity qualified and savvy?
Dave offers advice for leaders looking to get people together to build cross-functional teams.
What Dave did in his first career roles.
Dave dives into the power of building long-term relationships
Dave discusses the informal mentor/mentee relationships he has had in his career
The value of being able to tell people your story.

Links and resources:

(CS)²AI

RED Group

Dave Bacque on LinkedIn

Mentioned in this episode:

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 341 - Cyber threats and cyber-physical systems, and impacts for APAC
Pub date: 2022-11-27

Tim serves as the Technical Director - ICS and SCADA programs at SANS, and is responsible for developing, reviewing, and implementing technical components of the SANS ICS and SCADA product offerings. Additionally, performing contract and consulting work in the areas of ICS cybersecurity with a focus on energy environments.

A recognized leader in CIP operations, he formerly served as the Director of CIP (Critical Infrastructure Protection) Compliance and Operations Technology at Northern Indiana Public Service Company (NIPSCO) and was responsible for Operations Technology, NERC CIP Compliance, and the NERC training environments for the operations departments within NIPSCO Electric.

Recognizing the need for ICS-focused cyber security training throughout critical infrastructure environments and an increased need for NERC CIP hands-on training, Tim authored and instructs the ICS curriculum's newest course ICS456 - Essentials for NERC Critical Infrastructure Protection.

Outside of SANS, Tim continues to perform contract and consulting work in the areas of ICS cyber security with a focus on the energy sector.

Before accepting the opportunity to join SANS, Tim enjoyed a 15-year career with NIPSCO (Northern Indiana Public Service Company) - one of Indiana's largest natural gas and electric companies in the state, where he held management and leadership positions as well as EMS Computer Systems Engineer responsibilities over the control system servers and the supporting network infrastructure.

During his career, Tim has served as the Chair of the RFC CIPC, Chair of the NERC CIP Interpretation Drafting Team, Chair of the NERC CIPC GridEx Working Group, and Chair of the NBISE Smart Grid Cyber Security panel.

In this interview held on-site at the SANS ICS APAC Summit and Training 2022, Tim shares his insights on the developments in ICS (Industrial Control Systems).

He starts by explaining the evolution of the term “ICS” into “cyber-physical” – from “data-at-rest, data-in-use, data-in-motion” perspective to one where “data that does something, data that means something,” or in other words, data that has a “kinetic component,” a “physics component.”

Viewed this way, cyber-physical systems could be large scale, like SCADA covering multiple states, or could be on a plant floor distributed control system, could be individual PLCs, or the IIoT (Industrial Internet of Things) which are “using small edge devices to control parts of buildings, or SMART cities or transportation.”

Tim also gives an update on the threat landscape in cyber-physical systems and how intellectual property/data theft has evolved to process manipulation. The latest is the recently discovered malware – “Pipedream,” where the modularity of the malware framework is a “force multiplier.” By piecing different malicious components, he explains that threat actors can achieve their goals without knowing their specific environments – and also across multiple sectors.

Besides the evolving threat landscape, Tim also touches on varied levels of digital adoption in the cyber-physical environment across sectors means that the SANS courses are necessarily developed for professionals coming from a variety of experiences and cover legacy, existing, and new environments.

Depending on the complexities of the infrastructure specific to the country, Tim also shares his perspectives on differing priorities and approaches when it comes to cyber protection.

Recorded on 21st November 2022, 3pm, Grand Copthorne Hotel, Singapore.

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 40 - ICS Network Architecture e ICS Network Perimeter Security
Pub date: 2022-11-26

ICS SECURITY PODCAST - EP. 40 - ICS Network Architecture e ICS Network Perimeter Security

Vamos debater os elementos da estratégia de ICS Defense in Depth, sendo um episódio para cada elemento conforme agenda abaixo.

26/10/2022 – EP 38 – ICS Risk Management Program - Já realizado.

08/11/2022 – EP 39 - ICS Cybersecurity Standards e Physical Security - Já realizado.

23/11/2022 – EP 40 - ICS Network Architecture e ICS Network Perimeter Security - Já realizado.

30/11/2022 – EP 41 – ICS Host Security

07/12/2022 – EP 42 – ICS Security Monitoring

14/12/2022 – EP 43 – ICS Vendor Management e The Human Element

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: To The Point - Cybersecurity (LS 35 · TOP 2.5% what is this?)
Episode: OT and The Art of the Possible with Rob Lee
Pub date: 2022-11-22

In honor of November as Infrastructure Awareness Month, we wanted to bring back this episode from our 2021 archives with Rob Lee, CEO and Co-Founder of Dragos. In this episode, Rob breaks down the OT challenge that many businesses are facing today including a lack of clarity on who within the business owns OT and defining what acceptable OT risk means within the business. He also shares perspective on multi-factor authentication as one of the universal controls, the industry + geopolitical aspect of managing risk, and shifting the lens to think about the IP threat from the operator POV. And he shares insights on the Salt Water Project and what can happen when thinking through OT impact + the art of the possible.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e208

View Details

Podcast: Click Here (LS 48 · TOP 0.5% what is this?)
Episode: 41. Rounding up a cyber posse for Ukraine
Pub date: 2022-11-15

Washington and the tech world have been talking about public private partnerships in cyberspace for decades. The NSA and Cyber Command have intelligence about attacks; cybersecurity companies have the means to block them. It’s looks like they are finally working together — not in the U.S, but in Ukraine.

The podcast and artwork embedded on this page are from The Record by Recorded Future, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 58: Leveraging Your Military Career to Carve Out a Cyber Security Career with Dr. Michael Chipley
Pub date: 2022-11-22

Dr. Michael Chipley, the Founder and President of the PMC Group, is the guest for today’s podcast.

You will not want to miss this episode if you are leaving the military and considering a career in cybersecurity. Stay tuned to hear Dr. Chipley’s story and benefit from his breadth of experience!

Show highlights:

What Dr. Chipley did and studied during the 24 years he spent in the military.
Dr. Chipley talks about Shodan.io and what it can do.
Some advice about skills and opportunities in the control systems space.
How Dr. Chipley benefited from joining the military.
Why you can never stop learning in the control systems world.
Why women tend to excel in the cyber field.
How students can find opportunities to join internship programs.
Potential challenges that people in cybersecurity could face.
Some of the projects with which Dr. Chipley is currently involved.
What can young people do to add to their knowledge and education to increase their value five years from now?

Links and resources:

(CS)²AI

The PMC Group

Michael Chipley on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Dale Peterson: ICS Security Has a Way to Go
Pub date: 2022-11-23

Dale Peterson is the founder of the S4 conference and creator of many of today’s standard ICS security tools and techniques. We spoke with him about the biggest challenges in industrial control system cybersecurity today and learned from his fascinating personal story.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep, #39 - ICS Cybersecurity Standards e Physical Security
Pub date: 2022-11-17

O conceito de Defense in Depth não é novo — muitas organizações já empregam muitas das medidas de Defesa em Profundidade discutidas neste documento em suas infraestruturas de tecnologia da informação (TI); no entanto, eles não a aplicam necessariamente às suas operações de ICS. No passado, a maioria das organizações não via necessidade de fazê-lo. Os últimos cinco anos trouxeram um aumento acentuado na preocupação com o potencial de ataques cibernéticos em infraestruturas críticas, e o número de incidentes cibernéticos em setores de infraestrutura crítica aumentou. A ameaça de uma invasão de agentes mal-intencionados na infraestrutura crítica usando explorações baseadas em computador também cresceu.

Vamos debater os elementos da estratégia de ICS Defense in Depth, sendo um episódio para cada elemento conforme agenda abaixo.

26/10/2022 – EP 38 – ICS Risk Management Program - Já realizado.

08/11/2022 – EP 39 - ICS Cybersecurity Standards e Physical Security - Já realizado.

23/11/2022 - EP 40 - ICS Network Architecture e ICS Network Perimeter Security

30/11/2022 – EP 41 – ICS Host Security

07/12/2022 – EP 42 – ICS Security Monitoring

14/12/2022 – EP 43 – ICS Vendor Management e The Human Element

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: Moody's: Cyber Risk and Credit Ratings
Pub date: 2022-11-15

On the latest #unsolicitedresponse show I talk with Jim Hempstead, Managing Director of Moody's Global Project & Infrastructure Finance Group with Moody's Investor Services, about OT Cyber Risk and how this impacts Credit Ratings.

What Moody's does and what became of the cyber risk effort at Moody's owned Visible Risk
Moody's analysis of cyber insurance market including some cyber loss ratio numbers
Why Moody's believes USG disclosure and regulations are "Credit Positive"
Why Moody's has electric, gas and water utilities as "very high risk" in their heat map (despite minimal loss data)

And more. Several times in the show Dale asks Jim to explain some terms.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Looking to the future of the OT space.
Pub date: 2022-11-16

The US Department of Energy seeks to improve visibility into ICS environments. NIST has issued a proposal for upgrading cybersecurity at water plants in the US. A patch has been issued for a critical vulnerability that affects flow computers from ABB. Guest Ashif Samnani of Cenovus Energy shares insights from his nearly two decade career in the OT world. In the Learning Lab, hear the third in a series with Mike Hoffman, a Principal Industrial Consultant at Dragos, teaching infosec professionals how to think about OT security. This segment discusses looking at crown jewel analysis and understanding what really matters within your environment.

Control Loop News Brief.US Department of Energy seeks to improve visibility into ICS environments.“DOE Pivots Security Strategy as 'Smart' Tech Use Soars,” (GovCIO)

NIST proposal for upgrading cybersecurity at water plants.“NIST proposes project to improve cybersecurity at water utilities,” (FedScoop)

“[Project Description] Securing Water and Wastewater Utilities: Cybersecurity for the Water and Wastewater Systems Sector,” (NIST)

“Securing Water and Wastewater Utilities,” (National Cybersecurity Center of Excellence)

Critical vulnerability affects flow computers.ABB Oil and Gas Flow Computer Hack Can Prevent Utilities From Billing Customers (SecurityWeek)

CISA releases twenty ICS Security Advisories.CISA Releases Twenty Industrial Control Systems Advisories (CISA)

Control Loop Interview.Guest Ashif Samnani, Industrial Control System Cyber Security Leader at Cenovus Energy, shares some insights from his nearly two decade career across the OT world.

Control Loop Learning Lab.Our Learning Lab segment is the third in a series of three with Mike Hoffman, Principal Industrial Consultant at Dragos, teaching infosec professionals how to think about OT security. This segment discusses looking at crown jewel analysis and understanding what really matters within your environment.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Simplifying Cybersecurity Complexity
Pub date: 2022-11-15

No one will deny the complexity behind cybersecurity. It comprises an ever-growing and always-changing web of nuances to achieve a balance between ensuring systems are safe while keeping the business up and running. Find out how to see all your OT assets and understand how to protect them.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 2.5% what is this?)
Episode: Really Committing to Supply Chain Security [The Industrial Security Podcast]
Pub date: 2022-11-14

Supply chain security is bigger than one standard or one approach. Supply chain has fingers into remote access and cloud services and many other things beyond SBOMs and vendor questionnaires. Pedro Fernandes of Accenture joins us to look at the big picture and at what it takes to really commit to supply chain security.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Research Saturday
Episode: Over-the-air 0-day vulnerabilities.
Pub date: 2022-11-05

Roya Gordon from Nozomi Networks sits down with Dave to discuss their work "UWB Real Time Locating Systems: How Secure Radio Communications May Fail in Practice." Ultra-wideband (UWB) is a rapidly-growing radio technology that, according to the UWB Alliance, is forecasted to drive sales volumes exceeding one billion devices annually by 2025.

In an effort to strengthen the security of devices utilizing UWB, Nozomi Networks Labs conducted a security assessment of two popular UWB RTLS solutions available on the market. Their research reveals 0-day vulnerabilities and other weaknesses that, if exploited, could allow an attacker to gain full access to all sensitive location data exchanged over-the-air.

The research can be found here:

UWB Real Time Locating Systems: How Secure Radio Communications May Fail in Practice

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: David Bombal
Episode: #403: Are you safe from this?
Pub date: 2022-11-10

Are the hacks shown in Mr Robot fact or fiction? How real are they actually?

OTW discusses new vulnerabilities and issues with devices found in millions of companies around the world.

OTW loves the Mr Robot TV Series as a lot of them are actually realistic - unlike a lot of other shows.

Want to learn more from Occupy the Web? You can join his classes using these links: Hacker's Arise Pro Subscription for $32.99 a month: https://hackers-arise.com/online-stor...

Get 3 year's access to all live courses for $750: https://hackers-arise.com/online-stor...

// MENU // 00:00 - Coming up // Hacking Uninterruptible Power Supplies (UPS) 00:28 - Intro & Disclaimers 00:40 - Mr Robot episode recap // Hacking UPSs 02:57 - UPS breakdown 04:23 - UPS GUI examples 05:38 - Accessing the UPSs through a Femtocell 06:57 - UPS vulnerabilities // Embedding malware in firmware updates 14:30 - Intelligence agencies // Collecting data 17:45 - UPS vulnerability // Lead-acid battery corrosion 20:12 - "Hacking can kill" 21:57 - The Mr Robot series // Reality or fiction? 26:17 - Importance of Social Engineering 27:38 - Conclusion

// Mr Robot Playlist // https://www.youtube.com/playlist?list...

// David's SOCIAL // Discord: https://discord.com/invite/usKSyzb Twitter: https://www.twitter.com/davidbombal Instagram: https://www.instagram.com/davidbombal LinkedIn: https://www.linkedin.com/in/davidbombal Facebook: https://www.facebook.com/davidbombal.co TikTok: http://tiktok.com/@davidbombal YouTube: https://www.youtube.com/davidbombal

// Occupy The Web social // Twitter: https://twitter.com/three_cube

// OTW classes // Hacker's Arise Pro Subscription for $32.99 a month: https://hackers-arise.com/online-stor...

Get 3 year's access to all live courses for $750: https://hackers-arise.com/online-stor...

// Occupy The Web books // Linux Basics for Hackers: https://amzn.to/3JlAQXe Getting Started Becoming a Master Hacker: https://amzn.to/3qCQbvh

// Other books // The Linux Command Line: https://amzn.to/3ihGP3j How Linux Works: https://amzn.to/3qeCHoY The Car Hacker’s Handbook by Craig Smith: https://amzn.to/3pBESSM Hacking Connected Cars by Alissa Knight: https://amzn.to/3dDUZN8

// Occupy The Web Website / Hackers Arise Website // Website: https://www.hackers-arise.com/?afmc=1d OTW Mr Robot series: https://www.hackers-arise.com/mr-robot

kali linux linux parrot os kali hacker hacking hack cybersecurity ups apc nsa nsa hacker nsa hacking ethical hacking ceh oscp ine try hack me hack the box hacking ethical hacker oscp certification ctf for beginners

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

mrrobot #hacking #kalilinux

The podcast and artwork embedded on this page are from David Bombal, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Linux Basics for Hackers: Getting Started with Networking, Scripting, and Security in Kali

The Linux Command Line, 2nd Edition: A Complete Introduction

How Linux Works, 3rd Edition: What Every Superuser Should Know

Hacking Connected Cars: Tactics, Techniques, and Procedures

Getting Started Becoming a Master Hacker: Hacking is the Most Important Skill Set of the 21st Century!

View Details

Podcast: Cybercrime Magazine Podcast (LS 30 · TOP 5% what is this?)
Episode: Fireside Chats. Protecting Your OT & IT Environments. Steve Salinas, Stellar Cyber.
Pub date: 2022-11-08

Steve Salinas is the Head of Product Marketing at Stellar Cyber. In this episode, Steve joins host Hillarie McClure to discuss IT and OT environments, how security leaders can protect them, who might be facing this issue, and more. Stellar Cyber is the only security operations platform providing high-speed, high-fidelity threat detection and automated response across the entire attack surface. To learn more about our sponsor, visit https://stellarcyber.ai/

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CS2AI Control System Cyber Security Association International: (CS)²AI
Episode: 57: Using Mentorship to Help Advance Your Cybersecurity Career with Susan Peterson Sturm
Pub date: 2022-11-08

Today, Derek Harp interviews Susan Peterson Sturm, the Chief Information Security Officer at Cognite.

Susan is an incredible individual with vast experience! She’s an empath, DEI champion, mentor, board advisor, and volunteer focused on poverty alleviation.

In this episode, she discusses her background, talks to Derek about her professional journey, and offers helpful tips and advice.

Show highlights:

Susan talks about her studies.
Her motivation for pivoting into energy after graduating from college.
What she gained from her career in international affairs.
Some of Susan’s interesting roles early on in her career.
The benefits of getting in-the-field experience.
There are many different leadership paths to be chosen within the industry.
What you can gain from working abroad with distributed teams.
Where security first intersected with Susan’s career.
Why it’s worth investing your time in networks.
How being vulnerable can help you develop valuable relationships.
The role mentorship has played in Susan’s career.
How Susan ended up in her current role as a CISO.
Motherhood can be very challenging for women in senior roles.
The importance of moving on from any workplace where you don’t feel safe to express your needs.

Links and resources:

(CS)²AI

Cognite

Susan Peterson Sturm on LinkedIn

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 32 · TOP 5% what is this?)
Episode: Threats to Industrial Control Systems
Pub date: 2022-11-07

“What's been most concerning is the rise of wiper malware. Threat actors are no longer interested in hey we're going to lock up all of your data. We're going to encrypt everything and force you to pay a ransom and then maybe give you the decryption key. Now with wiper malware they're just completely wiping it. … This year there's been a total of 5 wiper malwares that has been targeting critical infrastructure. So I think everyone should be very aware of that.” -Roya Gordon

For today's episode, I'm joined by Roya Gordon and Danielle Jablanski of Nozomi Networks, a firm that does inventory and situational awareness for operational technology industrial control systems. We discuss Nozomi’s research, the key kinds of threat intelligence globally, and the kinds of regulation that are needed in today’s landscape of emerging threats to critical infrastructure. What emerging kinds of cyber attacks are the most troublesome? Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: Critical infrastructure in the crosshairs.
Pub date: 2022-11-02

CISA releases cross-sector cybersecurity performance goals. A look at the ransomware threat to industrial organizations. The TSA says it will issue new aviation cybersecurity requirements, and announces a railway cybersecurity directive. The White House focuses on cybersecurity in the chemical sector. Guest Jim Richberg of Fortinet addresses the evolving threat landscape and coming supply chain risks. In the Learning Lab, hear the second in a series with Mike Hoffman, a Principal Industrial Consultant at Dragos, teaching infosec professionals how to think about OT security. This segment discusses the critical aspects of OT systems that have to be considered before thinking about security.

Control Loop News Brief.CISA releases cross-sector cybersecurity performance goals. “Cross-sector Cybersecurity Performance Goals,” (CISA)

The ransomware threat to industrial organizations.“Dragos Industrial Ransomware Analysis: Q3 2022,” (Dragos)

Leading European metals producer hit with malware.“Aurubis says it was hit in wider cyberattack on metals industry” (Reuters)

Copper Giant Aurubis Shuts Down Systems Due to Cyberattack (SecurityWeek)

TSA says it will issue new aviation cybersecurity requirements.“U.S. to issue new cybersecurity requirements for critical aviation systems,” (Reuters)

TSA announces railway cybersecurity directive.“Rail Cybersecurity Mitigation Actions and Testing,” (TSA)

White House focuses on cybersecurity in the chemical sector.“FACT SHEET: Biden-⁠Harris Administration Expands Public-Private Cybersecurity Partnership to Chemical Sector,” (The White House)

“White House Adds Chemical Sector to ICS Cybersecurity Initiative,” (SecurityWeek)

Control Loop Interview.Guest Jim Richberg of Fortinet joins us to discuss the evolving threat landscape and coming supply chain risks.

Control Loop Learning Lab.Our Learning Lab segment is the first in a series of three with Mike Hoffman, Principal Industrial Consultant at Dragos, teaching infosec professionals how to think about OT security. IN this segment, he discusses the critical aspects of OT systems that have to be considered before thinking about security.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 2.5% what is this?)
Episode: ROI Mistakes for Cybersecurity Investments [The Industrial Security Podcast]
Pub date: 2022-10-31

Cybersecurity investments, like safety investments, involve ROI calculations. But unlike safety, security ROI is not baked into engineering practice. Wally Magda - a senior standards and security instructor, advisor and former NERC CIP auditor joins us to look at today's ROI problems and what to do about them.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 56: The Critical Role of Your Network in Developing Your Cybersecurity Career
Pub date: 2022-11-01

Today, Derek Harp interviews Anton Shipulin.

Anton is an Industrial Cybersecurity Evangelist at Nozomi Networks. His primary responsibilities in his current position include working with Nozomi teams and external stakeholders to understand current challenges and threats, enhance best practices, and mitigate risks. He evaluates the industrial environment's security posture, and future technologies and strategies, for protecting critical infrastructure. He works with industry and non-profit organizations to build and strengthen the OT/ICS cybersecurity community for industrial sectors. He researches global security topics and promotes OT and ICS cybersecurity awareness throughout the industry. He is also a husband, father, sports enthusiast, runner, cyclist, and public speaker

Anton grew up in Kazakhstan and Russia and currently lives in Dubai, UAE. He is passionate about industrial cybersecurity, critical infrastructure protection, knowledge, and information exchange. He joins Derek today to discuss his career journey, education, and career experiences and share his insights.

You will gain a lot from this episode if you are thinking of starting a career in cybersecurity or moving into the field from a different industry. Stay tuned to hear Anton’s story and get his valuable tips and advice!

Show highlights:

Anton discovered the power of programming when his parents bought him a PC when he was about nine years old.
Anton explains why he decided to make cybersecurity his university specialty and has continued working with it since then.
Anton gets into why he learned more working for Croc than in university.
There is currently a shortage of cybersecurity experts all over the world.
Anton gets into what he has learned about cybersecurity while working at Croc.
What he focused on while working for Kaspersky.
Anton talks about his experience co-founding the RUSCADASEC community.
Anton offers advice for entry-level individuals looking for resources to develop their professional careers.
Anton discusses his voluntary position at CCI.
The power of volunteering and helping others.
Why does he believe that networking is critical?
The benefits of both giving and receiving mentorship.
What excites Anton about the future?

Mentioned in this episode:

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 38– ICS Risk Management Program
Pub date: 2022-10-29

A ameaça de uma invasão de agentes mal-intencionados na infraestrutura crítica usando explorações baseadas em computador também cresceu. Vários incidentes recentes de alto perfil aumentaram a conscientização sobre essa ameaça e os indivíduos e grupos que a perseguem com intenção maliciosa. A disponibilidade de soluções de segurança específicas de ICS não acompanhou a ameaça crescente, portanto, as organizações devem implantar uma solução robusta de Defesa em Profundidade, tornando seus sistemas alvos pouco atraentes para possíveis invasores.

Vamos debater os elementos da estratégia de ICS Defense in Depth, sendo um episódio para cada elemento conforme agenda abaixo.

26/10/2022 – EP 38– ICS Risk Management Program

08/11/2022 – EP 39- ICS Cybersecurity Standards e Physical Security

23/11/2022 – EP 40- ICS Network Architecture e ICS Network Perimeter Security

30/11/2022 – EP 41– ICS Host Security

07/12/2022 – EP 42– ICS Security Monitoring

14/12/2022 – EP 43 – ICS Vendor Management e The Human Element

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Свежевыжатый подкаст (LS 24 · TOP 10% what is this?)
Episode: Промышленный SOC: перспективы роста и неочевидные вызовы — Д. Даренский, П. Луцик
Pub date: 2022-10-27

Как живёт мир промышленных SOC после 24 февраля и 21 сентября, сильно ли снизились расходы на кибербез на производствах и какие шаги к отраслевому регулированию делает Минпромторг — об этом в очередном выпуске «Свежевыжатого подкаста 2.0».

Руководитель практики промышленной безопасности Positive Technologies Дмитрий Даренский и ведущий подкаста Павел Луцик обсудили готовность «промышленников» к импортозамещению в ИТ- и ИБ-инфраструктуре — и почему многие для решения текущих проблем прибегают к сугубо ситуативному подходу.

Темы выпуска:

1:06 — Две точки зрения на ситуацию с кибербезопасностью в промышленности

2:22 — Будут ли «промышленники» «резать» бюджет на ИБ?

6:10 — Реакция промышленных предприятий на кадровый голод в ИТ- и ИБ-сферах

7:05 — Что такое «островизация» и как она связана с электроэнергетикой

8:42 — Рост спроса на кибербез в условиях сокращения бюджетов

11:15 — Как потенциал роста рынка кибербеза зависит от отрасли

14:08 — «Безопасники» и «АСУТПшники»: разница во взглядах

20:05 — Какое будущее у SOC в промышленности

27:47 — Неочевидные вызовы бизнесу, и как с ними работать

30:40 — Новые кейсы с участием вендоров систем промышленной автоматизации

34:50 — Как Минпромторг РФ идёт к реглуированию «кибербеза»

37:10 — Классический SOC непригоден для защиты целой отрасли

Медиа Группа «Авангард» продолжает серию подкастов с лучшими экспертами отрасли в преддверии SOC-Форума 2022, который пройдёт 15–16 ноября в Москве. Зарегистрироваться на самое знаковое в отрасли событие можно на сайте.

ИнформационнаяБезопасность #ibbank #socforum

Смотреть и слушать «Свежевыжатый подкаст 2.0»:

YouTube

ВКонтакте

Слушать выпуски первого и второго сезона:

Яндекс.Музыка

Podster

Apple Podcasts

Все доступные платформы на для прослушивания здесь

The podcast and artwork embedded on this page are from annavorobeva@avangardpro.ru, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Joe Slowik on TRITON Malware, XENOTIME Hacking Group
Pub date: 2022-10-28

Joe Slowik, threat intelligence and detections lead at Gigamon, joins the podcast to discuss the XENOTIME hacking group, the entity believed to be responsible for the 2017 Triton attack.
Triton was deployed within a petrochemical facility in Saudi Arabia and triggered a fault in the Schneider Electric Triconex Safety Instrumented Systems that initiated a shutdown of the plant. The Triton intrusion and malware deployment could have been much worse, resulting in harmful physical consequences and loss of life.
Slowik's recent Virus Bulletin paper and presentation describes the complex ecosystem behind XENOTIME, its connections to Russian intelligence, and the tooling it built enabling the Triton attack and deployment.
One question does linger: Who wrote Triton?

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 375: How Security Certificates Work
Pub date: 2022-10-28

Security Certificates can protect your communications, ensure that rogue devices are not on your network, and verify the authenticity of the devices that do connect to your network.

But do you know what certificates are, how they work, and how to deploy them?

In this episode of the Smart Buildings Academy Podcast we are going to do a deep dive on security certificates.

View Details

Podcast: Left to Our Own Devices
Episode: Rick Driggers: From the U.S. Air Force to Industrial Cybersecurity
Pub date: 2022-10-26

Rick Driggers is the critical infrastructure cyber lead at Accenture Federal Services. We chatted with him about his incredible journey from the U.S. Air Force to CISA, and uncovered the biggest challenges facing the industrial cybersecurity world today

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Left to Our Own Devices
Episode: Dr. Suzanne Schwartz, FDA: What's Next in Medical Device Cybersecurity
Pub date: 2022-09-28

Dr. Suzanne Schwartz is the Director of the Office of Strategic Partnerships & Technology Innovation, at the Center for Devices & Radiological Health of the US FDA. She is one of the most prominent policymakers and leaders in medical device cybersecurity, having spent the past 12 years at the FDA advancing medical device cybersecurity for the benefit of the entire world. We sat down with her to discuss where medical device cybersecurity regulations are headed and hear her advice for women wanting to advance their careers in cybersecurity.

The podcast and artwork embedded on this page are from Cybellum Technologies LTD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 55: The Benefits of Working in the Cybersecurity Industry with Dave Salwen
Pub date: 2022-10-25

Dave Salwen, the VP of Embedded Systems at RunSafe Security Inc., is the guest for today’s podcast.

Dave is a business leader who delivers emerging technologies to commercial and government markets. He achieves the above plan results with products and services for cyber defense, wireless communications, RF sensing, and electronic warfare areas. He has been successful in building highly effective teams. He has demonstrated his ability to drive the effectiveness of all aspects of the business, from strategic planning and concept development to financial results.

Dave’s career has always been about technology and people. He has spent his entire career supporting technologists and other super-smart people, helping them have more impact and realize their dreams. He is a father, husband, hiker, skier, tennis player, avid reader, and world traveler. He joins Derek today to discuss his education and career trajectory and share his experience. He gets into how he supports his fellow technologists and the benefits of working in cybersecurity and offers some valuable nuggets of advice.

This episode is for you if you are thinking of starting a career in cybersecurity or moving over from a different industry. Tune in to get Dave’s career advice and hear about his professional journey.

Show highlights:

What Dave has focused on throughout his career is to help technologists have more impact.
Dave grew up with technology, and it has always been part of his life.
The benefits of working as part of a team.
The different technological environments in which Dave has worked.
Dave gets into the different use cases for RunSafe.
Dave offers advice for anyone thinking about their career.
How electronic warfare ties up with cybersecurity.
People are crucial for developing and implementing security solutions, but electronic warfare still relies on the autonomous capabilities of automation.
Skills people may already have that they could adapt or extend to work in cybersecurity.
Dave defines embedded systems.
Some exciting areas of work within the cybersecurity space.
The benefits of risk-taking.

Links and resources:

(CS)²AI

RunSafe Security

Dave Salwen on LinkedIn

Mentioned in this episode:

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Inside Team82's EvilPLC Attack
Pub date: 2022-10-20

Team82's Noam Moshe, one of the researchers involved in developing the EvilPLC attack, discusses the technique of using a weaponized programmable logic controller to compromise an engineer's workstation and gain access to other PLCs on the OT network.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 28 · TOP 10% what is this?)
Episode: An IT security professional walks into an OT bar.
Pub date: 2022-10-19

An assessment of port and terminal cybersecurity in the US. Tata Power discloses a cyberattack. The White House issues statements on cybersecurity. India’s power company collaborates on energy sector cybersecurity. Guests Special Agent in Charge, Tom Sobocinski, and Supervisory Special Agent for Cyber, Tom Breeden, of the FBI Baltimore Field Office, discuss the FBI's collaborative approach to working with industry. In the Learning Lab, Mike Hoffman of Dragos kicks off the first of 3 segments on teaching infosec professionals how to think about OT security with the fundamental differences between IT security and OT security.

Control Loop News Brief.Port and terminal cybersecurity.“US Ports and Terminals Sustain Increased Cybersecurity Attacks,”(Jones Walker LLP)

Cyber attack against Tata Power.

“Indian energy company Tata Power announces cyberattack affecting IT infrastructure,” (The Record)

“Tata Power says hit by cyber attack, says critical system functioning,” (Mint)

“Tata Power says hit by cyber attack,” (The Economic Times)

Sabotage and terrorism directed against infrastructure.

“Russia’s MFA summons German, Danish, Swedish envoys over Nord Stream probe,” (TASS)

White House statement on cybersecurity.“FACT SHEET: Biden-⁠Harris Administration Delivers on Strengthening America’s Cybersecurity,” (The White House)

India collaborates on energy sector cybersecurity.

“New collaboration to tackle cybersecurity issues in power transmission systems,” (India Science Wire)

Control Loop Interview.Guests are FBI Baltimore Special Agent in Charge, Tom Sobocinski, and Supervisory Special Agent for Cyber, Tom Breeden, sharing the FBI's collaborative approach to working with industry.

Control Loop Learning Lab.Our Learning Lab segment is the first in a series of three with Mike Hoffman, Principal Industrial Consultant at Dragos, teaching infosec professionals how to think about OT security. This episode's segment is about the fundamental differences between IT security and OT security.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Government Information Security Podcast (LS 27 · TOP 10% what is this?)
Episode: Most Concerning Security Vulnerabilities in Medical Devices
Pub date: 2022-10-14

Security flaws in a vital signs monitoring device from a China-based manufacturer could allow hackers to launch an attack that spreads to all other devices connected to the same network. This is among the most serious security issues involving medical devices, says Jason Sinchak of Level Nine.

The podcast and artwork embedded on this page are from GovInfoSecurity.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 54: The Importance of Mentorship in Your Cybersecurity Career with Daniel Ehrenreich
Pub date: 2022-10-18

Derek Harp is delighted to have long-time expert thought leader, Daniel Ehrenreich, join him today for another episode in the series of interviews with control system-related cybersecurity leaders.

Daniel is from Secure Communications and Control Experts. He is an established industry contributor, educator, teacher, and speaker, known to be detail-oriented with some strongly-held opinions. He is an experienced world traveler who has lived in various parts of the world. He is also a writer, safety advocate, father, and grandfather

In this episode of the (CS)²AI Podcast, Daniel shares his backstory and discusses his education, career journey, and years of experience in the industry.

You will gain a lot from this episode if you are you are considering an occupation in the cybersecurity space. Stay tuned to get Dan’s advice and learn from his many years of experience in the field.

Show highlights:

In 1983, Daniel was selected by an Israeli component vendor to be a subject matter expert for lithium batteries in the USA.
While at university, Daniel earned an income fixing televisions.
How SCADA systems got developed by Motorola in Israel in the mid-1980s.
Why Daniel believes SCADA security should happen on the level of architecture and not on the PLC component level.
Cybersecurity came up for Daniel toward the end of the twenty years he spent with Motorola.
Daniel dives into his current areas of focus.
Daniel discusses the power of giving and receiving mentorship.
Daniel talks about his training classes and explains why he is detail-oriented.
Why Daniel believes IT and OT should never converge.
Some advice for engineers or others considering joining the cybersecurity industry.
The difference between IoT and IIOT.
Daniel talks about the ICS Cybersec conference he has coming up in Israel in November.

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 53: Career Advice for Women Pursuing Cybersecurity Positions
Pub date: 2022-10-11

Today’s guest is Danielle Jablanski. Danielle is an OT Cybersecurity Strategist for Nozomi Networks.

Danielle was born and raised in Upstate New York and moved to Southern Missouri when she was in high school. Since then, she has moved around a lot and lived and worked in many different places. For the first few years of her career, she got deeply involved in philanthropy and academia. She is a self-proclaimed nerd, researcher, volunteer, vagabond, idea lady, community builder, outdoor enthusiast, and big-time dog mom!

In this episode of the (CS)²AI Podcast, Danielle discusses her personal and professional journeys and experience and offers excellent advice for women considering a career in the cybersecurity or OT space.

You will not want to miss this show, particularly if you are a woman thinking of starting a career or shifting into technology, cybersecurity, or control systems! Stay tuned for more!

Show highlights:

Studying genocide in Rwanda sparked Danielle’s interest in international relations. She explains how that led her to the cybersecurity space.
Danielle talks about how she was poached out of grad school for her first job.
How national security and cybersecurity intersected with her career path.
Danielle explains why she got poached for a second time, to go to Stanford University.
Why she chose to pivot to energy before becoming a general OT cybersecurity strategist
Danielle goes into where the cybersecurity industry is today.
Where will the industry be twenty years from now?
What prompted her to get into cybersecurity?
What she focuses on, as a non-resident fellow at the Atlantic Council.
Danielle talks about mentorship and discusses her experience as a female expert in the industry.
Some gold nuggets of advice for women in the early stage of their careers.
The benefits of focusing on your strengths.

Links and resources:

(CS)²AI

Nozomi Networks

Books mentioned:

The Cuckoo’s Egg by Cliff Stoll

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: Sept 2022 - ICS Security Month In Review
Pub date: 2022-10-05

Dale Peterson gives his thoughts on the top 3 ICS security stories in Sept 2022, and he gives his wins, fails, and predictions for the month.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 52: Cybersecurity Careers, Educational Requirements and Resume Advice with Ron Brash
Pub date: 2022-10-04

Today, Ron Brash joins Derek Harp for another great episode in the series on security leaders! Ron is the VP of Technical Research and Integrations at aDolus Technology.

Ron Brash is a household name when it comes to ICS/OT cybersecurity and embedded vulnerability research. He was instrumental in creating the datasets for the S4 ICS Detection Challenges, received the Top 40 under 40 award for Engineering Leaders 2020 from Plant Engineering, was an embedded developer at Tofino Security, advised several large asset owners in a variety of industries for OT security, and brought several products to market, including consumer neuroscience devices and several industrial networking appliances.

Ron grew up in a rainforest on Vancouver Island, on the west coast of Canada. He is a problem-solver, a wake-boarder, a mini-Chihuahua-owner, a do-it-yourselfer, a geek, a sharer of information, and an all-around adventurous guy with water sports.

In this episode of the (CS)²AI Podcast, he shares his backstory, discusses his career path, and talks about what he is doing in the industry. He also offers some nuggets of advice around sequential education and degrees, sound resume advice, and some great career tips.

You will not want to miss this episode if you are considering starting a career in cybersecurity or breaking into that industry and want to know the best way to approach your education. Stay tuned for more!

Show highlights:

Ron talks about where he comes from and shares his backstory.
What he learned from his first paid job, working in a pizza shop.
Ron’s parents had computers for their business, so that was where his first intersection with technology happened.
He got into technology because he joined a tech program at his local university that put gifted high school students into certificate and diploma programs for free.
Ron knew he had to protect himself by planning and starting to save early on.
Ron’s ICS career started after a chance encounter with Eric Byres, one of the grandfathers of cybersecurity.
It is important to separate your personal life from your professional life.
Ron shares how he approached his education.
A resume tip to better your chances in interviews, and some great career tips.
Ron discusses the best way to approach university education and explains what your job is when you do a master’s degree.
What he gained from getting his master’s degree.
Some advice for people considering sequential education and degrees to further their careers.
The benefits of doing a SWOT analysis before embarking on a specific career path.
Ron dives into giving and receiving mentorship.
Some advice for anyone doing a startup.
How to set yourself up for a successful future.

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 2.5% what is this?)
Episode: 56 OT Vulnerabilities - do they matter? [The Industrial Security Podcast]
Pub date: 2022-10-03

Forescout's recent Icefall report documents 56 new OT vulnerabilities, many in certified "secure" industrial equipment. Daniel Dos Santos, Head of Security Research, joins us to look at the vulnerabilities and at what they mean for industrial security.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Sarah Fluchs Revisits the Top 20 Secure PLC Coding Practices List
Pub date: 2022-09-30

Sarah Fluchs, CTO at Admeritia, joins the Aperture podcast to discuss the Top 20 Secure PLC Coding Practices List. Written for engineers by engineers, the list provides recommendations that can be used to securely design and code programmable logic controllers (PLCs).
The first iteration of the list was published in 2021, and since then, its core group of maintainers has grown to 75 and more than 1,000 engineers and experts registered as contributors.
The list has been prominent referenced in training materials and other resources, including the NATO guide for protecting automation and control systems, and MITRE is considering integrating the list into its CWE database.
In this episode, Sarah discusses secure PLC programming, how the list was developed, and how it should be used by engineers and security practitioners.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: The Water Sector (Uniqueness, Cloud, Oldsmar, NERC CIP)
Pub date: 2022-09-28

On this episode of the Unsolicited Response show, Dale Peterson is joined by Kevin Morley of the American Water Works Association and Joel Cox of West Yost Associates to talk about ICS security and the Water Sector.

what makes the water sector unique?
does this uniqueness lead to early and better use of the cloud for operations?
how did the community deal with Oldsmar?
why in the world would the water sector want to follow the NERC CIP model?

View Details

Podcast: Aperture: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Vergle Gipson on Cyber-Informed Engineering
Pub date: 2022-09-28

Vergle Gipson, senior advisor, at Idaho National Lab's Cybercore Integration Center, joins the podcast to discuss cyber-informed engineering and the maturing discipline of operational technology (OT) cybersecurity.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 51: Learning the Discipline of Cybersecurity with Steve Mustard
Pub date: 2022-09-27

Derek Harp is happy to have Steve Mustard, President, and CEO of National Automation Inc., joining him on the show today! Steve has been a long-term contributor to the control systems cybersecurity space.

Steve Mustard is a Licensed Professional Engineer (Texas, Kansas) and UK Chartered Engineer with technical development and management experience in process automation and business process re-engineering across multiple sectors. He is also a volunteer and past president of the International Society of Automation (ISA), a home brewer, cyclist, guitarist, triathlete, husband, and father.

Steve grew up in Sunderland, an industrial region famous for coal mining and shipbuilding in the North East of England. Joseph Swan, the inventor of the incandescent light bulb, also came from Sunderland, and Lewis Carroll based much of the Alice in Wonderland story on the times he spent there.

In this episode of the (CS)²AI Podcast, Steve shares his backstory, discusses his education, gets into his career trajectory, and offers nuggets of career advice.

You will gain a lot from this show if you are thinking about making a career in cybersecurity or considering moving from a different field into the security space. Stay tuned for more!

Show highlights:

How and where Steve’s interest in technology, cybersecurity, and control systems engineering disciplines originated.
The event in 1999 that led to Steve’s first intersection with cybersecurity.
How the National Infrastructure Security Coordination Center (NICC), now called the Center for the Protection of National Infrastructure (CPNI), began in the UK.
Steve discusses the different areas he gets involved with.
Why he does not like the idea of cybersecurity always being its own discipline, separate from everything else.
Steve shares his concerns about digital transformation.
You don’t have to conform when selecting a career path. Rather think about what motivates you and what you enjoy doing, and forge your own direction.
Steve dives into his volunteer positions with IET and ISA.
People should be qualified to work in the cybersecurity or automation space. You can take courses and become certified through ISA.
There are many advantages to informing your career path with knowledge of safety and cybersecurity.
Steve offers career advice and tips for engineers looking for some additional knowledge.
Steve shares his concerns for the future of cybersecurity.

Links and resources:

(CS)²AI

National Automation Inc.

Steve Mustard on LinkedIn

Books mentioned:

Alice in Sunderland by Bryan Talbot

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CyberWire Daily (LS 59 · TOP 0.1% what is this?)
Episode: CISA Alert AA22-265A – Control system defense: know the opponent. [CISA Cybersecurity Alerts]
Pub date: 2022-09-22

This alert builds on previous NSA and CISA guidance to stop malicious ICS activity and reduce OT exposure. The alert documentation linked in the show notes describes TTPs that malicious actors use to compromise OT/ICS assets. It also recommends mitigations that owners and operators can use to defend their systems from each of the listed TTPs. NSA and CISA encourage OT and ICS owners and operators to apply the recommendations in this documentation.

AA22-265A Alert, Technical Details, and Mitigations

NSA and CISA guidance to stop malicious ICS activity and reduce OT exposure

For NSA client requirements or general cybersecurity inquiries, contact Cybersecurity_Requests@nsa.gov. To report incidents and anomalous activity or to request incident response resources or technical assistance related to these threats, contact CISA at report@cisa.gov.

To report incidents and anomalous activity or to request incident response resources or technical assistance related to these threats, contact CISA at report@cisa.gov, or call (888) 282-0870, or report incidents to your local FBI field office.

The podcast and artwork embedded on this page are from CyberWire, Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Defender's Advantage Podcast (LS 33 · TOP 3% what is this?)
Episode: Threat Trends: The Security Landscape Facing Manufacturing
Pub date: 2022-09-21

The latest episode in The Defender’s Advantage Podcast Threat Trends series features Todd Boppell, COO of the National Association of Manufacturers (NAM), who joined host Luke McNamara to discuss cyber security in the manufacturing landscape. During the conversation Todd shares the top concerns for NAM’s member organizations, how the industry approaches cyber security, and the challenges and opportunities he sees in the space.

Learn more about NAM at https://www.nam.org and follow at @ShopFloorNAM

Additional Resources

Watch Mandiant’s recent manufacturing focused webinar on-demand now: https://mndt.info/3C1jKN5

Learn how Mandiant helps manufacturing organizations monitor, detect and respond to threats: https://mndt.info/3eZwoD0

The podcast and artwork embedded on this page are from Mandiant, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: Providing a safe and secure OT infrastructure.
Pub date: 2022-09-21

The Palestinian hacktivist group GhostSec compromises Israeli PLCs. North Korea’s Lazarus Group targets the energy sector. The White House issues a memorandum on supply chain security. CISA issues advisories on ICS vulnerabilities. Guest Rachael Conrad of Rockwell Automation talks about how industrial automation organizations can achieve their connected enterprise by providing a safe and secure OT infrastructure. In the Learning Lab, Dragos' Mark Urban discusses the scale of the generation of electricity.

Control Loop News Brief.Palestinian threat actor compromises Israeli PLCs.“Pro-Palestinian Hacking Group Compromises Berghof PLCs in Israel,” (OTIRO)

Lazarus Group targets the energy sector.“Lazarus and the tale of three RATs,” (Cisco Talos)

White House issues memorandum on software supply chain security.“Enhancing the Security of the Software Supply Chain to Deliver a Secure Government Experience,” (The White House)

CISA issues ICS advisories.MZ Automation libIEC61850 (CISA)

PTC Kepware KEPServerEX (CISA)

Baxter Sigma Spectrum Infusion Pump (CISA)

Hillrom Medical Device Management (Update A) (CISA)

Hitachi Energy TXpert Hub CoreTec 4 Sudo Vulnerability (CISA)

Honeywell SoftMaster (CISA)

Delta Industrial Automation DIAEnergie (CISA)

Kingspan TMS300 CS (CISA)

Paradox IP150 (Update A) (CISA)

Siemens Mobility CoreShield OWG Software (CISA)

Siemens Simcenter Femap and Parasolid (CISA)

Siemens RUGGEDCOM ROS (CISA)

Siemens Mendix SAML Module (CISA)

Siemens SINEC INS (CISA)

Siemens RUGGEDCOM ROS (Update A) (CISA)

Simcenter Femap and Parasolid (CISA)

Siemens Industrial Products Intel CPUs (Update A) (CISA)

Siemens OpenSSL Affected Industrial Products (CISA)

Siemens OpenSSL Vulnerability in Industrial Products (Update E) (CISA)

Siemens SCALANCE (CISA)

Control Loop Interview.Rachael Conrad of Rockwell Automation joins Dave Bittner to talk about how industrial automation organizations can achieve their connected enterprise by providing a safe and secure OT infrastructure.

Control Loop Learning Lab.The Learning Lab has Mark Urban of Dragos, in part one of a two-part segment on electricity, explores the scale of the generation of electricity. For more detail, check out this blog post on Electricity by the Numbers.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Why and Who - Not Just How [The Industrial Security Podcast]
Pub date: 2022-09-20

The big picture of industrial security programs is why we do security, who does what, and to what standards or risk tolerances. Darren Conway of Capula joins us to look at documenting industrial security policies and programs, not just technology.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 50: Solution Spotlight: Waterfall Security
Pub date: 2022-09-20

We are excited to introduce The Solutions Spotlight, our new format for the (CS)²AI Podcast!

Today’s guests, Lior Frenkel and Andrew Ginter have both been on the show before to share their biographies and personal journeys in our series of interviews with various leaders across the industry in cybersecurity for control systems. Lior is the Co-founder of Waterfall Security, and Andrew is Waterfall’s VP of Industrial Security.

Lior and Andrew are long-time industry supporters and supporters of (CS)²AI. They join us today for today’s episode of The Solutions Spotlight to talk about Waterfall Security, what it does, and how the company got to where it is today.

Stay tuned to hear what Lior and Andrew have to say about how Waterfall originated and what they do!

Show highlights:

Why they do not like to use the term segmentation at Waterfall and prefer to think of it as safe connectivity.
How Waterfall provides all the benefits of connectivity without the risks.
How ransomware has changed the market.
What data diodes are, what they get used for, and how they differ from unidirectional gateways.
How Waterfall’s unidirectional security gateway connects and protects industrial and corporate networks.
How does Waterfall’s unidirectional security gateway work?
Where Waterfall’s technology gets applied today.
Lior shares Waterfall’s origin story.
Lior expected the industry to be more advanced than it is currently
What excites Lior for the future?
The changes Andrew foresees for the future.

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2% what is this?)
Episode: Episode 337 - Cyber-attacks resulting from the Russian – Ukraine conflict, critical infrastructure impact and response in Asia
Pub date: 2022-09-18

Bill Nelson is the Chair of Global Resilience Federation (GRF). GRF is a non-profit association dedicated to helping ensure the resilience and continuity of critical and essential infrastructure and organizations against threats, incidents and vulnerabilities.

Previously, Nelson was the President and CEO of the Financial Services Information Sharing and Analysis Center (FS-ISAC). In his 12 years, Nelson led FS-ISAC in its response to major cyber and physical threats and vulnerabilities that affected the financial services industry, including partnering with Microsoft to take down four major botnet infrastructures. He was also responsible for creating the Sector Services Division of FS-ISAC, which was established to assist other sectors and became the genesis for launching Global Resilience Federation.

Nelson was named the fifth most influential person in the field of financial-information security by the publication Bank Info Security and he also received the prestigious RSA Award for Excellence in Information Security.

Before joining FS-ISAC, Nelson was the Executive Vice President of NACHA, the electronic payments association, where he oversaw the development of the ACH Network into one of the largest electronic payment systems in the world, processing nearly 14 billion payments by the time he transitioned to FS-ISAC.

In this podcast, Bill introduces the audience to ISACs (Information Sharing and Analysis Centre), and the formation of OT-ISAC (“Operational Technology ISAC”), which was established under Pillar 2 of Singapore’s OT Cybersecurity Masterplan launched at Singapore International Cyber Week 2019.

He stresses how is trust is important in supporting effective information sharing, and how initiatives, such as the Traffic Light protocol is critical to facilitating sharing with the appropriate audience.

Bill also highlights the prevalence of wiper malware in the Russian-Ukrainian conflict in cyber space and the impacts in Asia. With the rising threat landscape, Bill advises organisations to adopt a “defence-in-depth” approach to withstand and recover from cybersecurity incidents.

To minimize service disruptions in the face of destructive attacks and events, he also points to the need for building resiliency. Referencing GRF’s “Operational Resilience Framework”, he explains how the multi-sector working group is developing rules and implementation aids that support the organisation’s recovery of immutable data.

Interview by Jane Lo, Singapore Correspondent. Recorded on-site at OT-ISAC Summit 2022 held at the VOCO Hotel, Orchard Road, Singapore on 7th September 2022 4.30pm.

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: SBOM ... Challenge & Thoughts
Pub date: 2022-09-14

Dale Peterson shares his thoughts on SBOMS in OT in three main areas:

1) The S4 SBOM Challenge ... it's three goals and what we hope to learn from it.

2) Near term, now and for the next 2 years, wins for asset owners and SBOMs.

3) What will determine the winners in the SBOM marketplace, early analysis.

Links:

S4x23 Tickets

S4x23 Hotel Info

SBOM Challenge

Dale's SBOM Content Page

View Details

Podcast: Hack the Plant (LS 32 · TOP 5% what is this?)
Episode: Cyber threats to agriculture and food production
Pub date: 2022-09-13

“Agriculture and cybersecurity has just run under the radar. We're talking about something that's one fifth of the us economy right? This is this is a huge deal here in the US, and globally as well … We can begin get the right expertise and collateral assembled so we're not the next ransomware victim or we have enough resiliency built into our operations that if we get we get hit and we get smoked our recovery will be easier and our our financial losses will be minimized.” - Joe Marshall

In this episode of Hack the Plant, I’m joined by Joe Marshall, a security researcher for the Outreach Team at Cisco Talos, one of the largest commercial threat intelligence teams in the world. We discuss his work on cyber threats to agriculture, an industry which doesn’t have much information or training on cyber threat levels - and the likely cascading effects of the war in Ukraine for agricultural supply and food security worldwide.

Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 49: Position Yourself to Win from the Cyber Security Job Explosion with David Hatchell
Pub date: 2022-09-13

Today, Derek Harp is excited to have David Hatchell, the Founder, and Principal of Industrial Cyber Secure, joining him for another episode in the interview series on security leaders. David will soon announce his CEO-ship of a new company dedicated to cybersecurity for the OT space.

David is recognized as one of the top leaders in the field of ICS/(IoT cybersecurity, leading multiple efforts over the past 10 years to develop new businesses in this emerging cybersecurity field. Leveraging a proven formula of partnerships, positioning, and product around vertical execution, he has worked in multiple roles in strategy development, product development, G2M development, and leading acquisition and integration efforts.

David comes from a small town in east Texas known for football, pub links, and good barbecue. He is a leader in the industry, a father, a singer, a frustrated runner, and a chef.

In this episode of the (CS)²AI Podcast, he talks to Derek about his background, discusses how he got to where he is today and shares his experience. He also gets into the various decisions he made along the way and offers valuable nuggets of advice.

There is an explosion in the cybersecurity industry right now! This show is a must for you if are considering a career in that space. Stay tuned for more!

Show highlights:

David shares his backstory and talks about his first introduction to work.
How the music industry featured and got him into the computer business.
David got to sell the first MP3 player that ever existed.
How his journey into the world of cybersecurity began and progressed.
How David learned about resiliency and safety.
Some advice for listeners from an IT background who would like to get into that area of cybersecurity.
How cross-discipline empathy can broaden your career perspective.
What did David learn from his tenure at Belden?
Why now is a great time to get into cybersecurity, regardless of your background.
The role mentorship has played in David’s career.

Links and resources:

(CS)²AI

David Hatchell on LinkedIn

Mentioned in this episode:

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Government Information Security Podcast (LS 27 · TOP 10% what is this?)
Episode: Protecting Industrial Security When Uptime Is Essential
Pub date: 2022-09-09

In this episode of "Cybersecurity Unplugged," Mark Cristiano of Rockwell Automation discusses Rockwell's cybersecurity journey, the particular challenges of deploying cybersecurity in an OT environment, and the minimum and proper industrial protections that organizations need to have in place.

The podcast and artwork embedded on this page are from GovInfoSecurity.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: EP. #37 - OT ZERO TRUST
Pub date: 2022-09-10

Nos siga no LinkedIn:https://bit.ly/3zXyz2h

Assista ao vivo a cada 15 dias, às 19h: https://bit.ly/3oMLKg0

Visite nosso site: https://www.muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 27 · TOP 10% what is this?)
Episode: The fundamentals of the control loop.
Pub date: 2022-09-07

Cybersecurity for the food industry. Montenegro works to recover from Russian cyber offensive. NSTAC recommends cataloging Federal OT assets. Chemical sector cybersecurity. Kinetic attacks affect Ukrainian nuclear power plant. CISA ICS alerts. Guest Dean Parsons from SANS joins us to discuss attacks against critical infrastructure. The Learning Lab finds Dragos' Mark Urban joined by Miriam Lorbert breaking down the fundamentals of the control loop.

Control Loop News Brief.Food industry cybersecurity.

Food Processing Special Report Reveals Increasing Concern of Cyber Attacks for Food & Beverage Industry (Dragos)

Montenegro works to recover from Russian cyber offensive.

FBI's team to investigate massive cyberattack in Montenegro (AP NEWS)

US issues rare security alert as Montenegro battles ransomware (TechCrunch)

Cuba ransomware group claims attack on Montenegro government (IT PRO)

Cuba Ransomware Team claims credit for attack on Montenegro (Databreaches.net)

Montenegro blames Cuba ransomware for cyberattack (Cybernews)

Montenegro Sent Back to Analog by Unprecedented Cyber Attacks (Balkan Insight)

Montenegro blames criminal gang for cyber attacks on government (EU Reporter)

Ransomware Attack Sends Montenegro Reaching Out to NATO Partners (Bloomberg)

NSTAC recommends cataloging Federal OT assets.

NSTAC Urges CISA Action to Boost Security of Feds’ OT Systems (MeriTalk)

Chemical sector cybersecurity.

Chemical Sector Next in Line for White House Plan to Incentivize Cybersecurity (Nextgov.com)

Kinetic attacks affect Ukrainian nuclear power plant.

Ukraine says nuclear plant offline after Russian shelling (AP NEWS)

Russia-Ukraine war: Ukraine accuses Russia of shelling town by Zaporizhzhia nuclear plant as inspectors arrive – live (the Guardian)

UN inspectors arrive at Ukraine nuclear plant amid fighting (AP NEWS)

U.N. Inspectors Gauge Risks at Nuclear Plant as Ukraine and Russia Trade Accusations (New York Times)

IAEA head ignores gunfire to visit Ukraine nuclear plant, says experts to stay (Reuters)

CISA ICS alerts.

Hitachi Energy FACTS Control Platform (FCP) Product (CISA)

Hitachi Energy Gateway Station (GWS) Product (CISA)

Hitachi Energy MSM Product (CISA)

Hitachi Energy RTU500 series (CISA)

Fuji Electric D300win (CISA)

Honeywell ControlEdge (CISA)

Honeywell Experion LX (CISA)

Honeywell Trend Controls Inter-Controller Protocol (CISA)

Omron CX-Programmer (CISA)

PTC Kepware KEPServerEX (CISA)

Sensormatic Electronics iSTAR (CISA)

Mitsubishi Electric GT SoftGOT2000 (CISA)

Contec Health CMS8000 (CISA)

Delta Electronics DOPSoft (CISA)

Dragos Industrial Security Conference 2022.Mark your calendar for Saturday, November 5, 2022, for the next Dragos Industrial Security Conference (DISC), 100% free as a thank you to the ICS asset owner and operator community. You’ll hear ICS research on threats, malware, incidents, and vulnerabilities conducted by our intelligence and threat operations teams. Visit http://dragos.com/disc-2022 to learn more and register.

Control Loop Interview.Dean Parsons from SANS talks about cyber attacks against critical infrastructure, the future of geopolitical conflict, active ICS defense using ICS-threat hunting techniques, and the difference between IT/OT incident response.

Control Loop Learning Lab.Do you want to know how a toilet became the very first industrial control system more than 2000 years ago? Hear about it in the Learning Lab where Mark Urban speaks with Miriam Lorbert, Senior Industrial Consultant at Dragos, about the fundamentals of the control loop.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: Moving Target Defence [The Industrial Security Podcast]
Pub date: 2022-09-07

Moving target defence is increasingly used for remote access systems and other high risk connections between and into systems. Ian Schmertzler, President and Co-Founder of Dispel joins us to dig into the technology.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 48: Engineering: The Perfect Transition to Cybersecurity with David Brearley
Pub date: 2022-09-06

Derek Harp is excited to have David Brearley joining him today! David is currently the Operational Technology Cybersecurity Director at HDR.

David Brearley (GICSP, PMP) is a senior professional associate and the operational technology cybersecurity director at HDR in Charlotte, North Carolina. David has nearly 20 years of international experience providing IT and OT (operational technologies/industrial controls) solutions, services, and consulting. In providing hands-on configuration, assessment, design, and consulting services, his experience covers the comprehensive control system life cycle. David is motivated by helping improve the security awareness and risk posture for HDR’s cross-sector clients.

David grew up in New Jersey, just off Long Beach Island, and went to school in South Carolina. He is a husband, sailor, chef, outdoorsman, programmer, controls, and cybersecurity enthusiast.

In this episode of the (CS)²AI Podcast, he talks to Derek about his professional journey, how his career has evolved, and his current role at HDR. He also offers some nuggets of advice for anyone considering a career in cybersecurity.

You are sure to gain a lot from this episode if you want to get into the cybersecurity space or are an engineer who would like to augment what you do. Stay tuned for more!

Show highlights:

David shares his modern-day superhero backstory.
He started looking at computer engineering after getting into programming in high school.
David discusses his experience as an intern with GE and talks about the benefits of doing an internship.
GE went through several transitions and eventually returned to being a privately-held company.
David talks about an opportunity that let him learn a lot more about networks and programming in an industrial environment.
He discusses the breadth of environments he has worked in his career.
How did David end up in his current role?
Where did cybersecurity first intersect with his career?
A book David recommends for getting one’s mindset geared for the cybersecurity space.
David discusses the mentorship and cybersecurity training programs he is involved in, both within and outside of HDR.
David describes how they are building a cybersecurity culture at HDR.
The benefits of having experience across diverse platforms.
What you should study to be on the cutting edge in the future.

Mentioned in this episode:

Join CS2AI

Join the largest organization for cybersecurity professionals. Membership has its benefits! We keep you up to date on the latest cybersecurity news and education.

Preroll Membership

Our Sponsors:

Network Perception Waterfall Security Tripwire KPMG Cyber

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Schweitzer Drive (LS 34 · TOP 3% what is this?)
Episode: Securing Industrial Control Systems Amid Increased Risk
Pub date: 2022-08-05

Industrial control systems (ICSs) across industries have experienced increased security risk in the last decade, and those within the electric power system are no exception. In this episode, Dave Whitehead talks with ICS cybersecurity expert Dale Peterson about today’s threat landscape and where ICS asset owners should focus their efforts to address this risk.

The podcast and artwork embedded on this page are from Schweitzer Engineering Laboratories, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 32 · TOP 5% what is this?)
Episode: Accelerating Innovation in Electric & Gas
Pub date: 2022-09-01

“Most industrial economies only consume about 20% our total end use energy in the form of electricity. The rest, we consume by basically combusting fossil fuel … You could get all of your electricity from wind and solar and you've still only solved 20% of your carbon problem. A lot of the investments we've made at Energy Impact Partners are actually in electrification. Basically electrifying all that stuff that today is fueled directly by fossil fuel but in the future could be fueled by electricity.” - Andy Lubershane

In this episode of Hack the Plant, I’m joined by Andy Lubershane, Director of Research for Energy Impact Partners (EIP), a venture investment firm founded by a coalition of electricity and gas utilities. We discuss how energy companies themselves accelerate investments in clean energy such as electric, wind, and solar technologies - and the threats and challenges to this innovation from a cybersecurity perspective.

Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: August - ICS Security Month In Review
Pub date: 2022-08-31

In this solosode, Dale Peterson gives his thoughts on three stories from August as well as a win and fail for the month. Stories this month:

South Staffs water hack and opportunity for water sector
Lloyds market bulletin overreaction vis-a-vis cyber war exclusions
QNX forensics tool

View Details

Podcast: Malicious Life (LS 58 · TOP 0.5% what is this?)
Episode: Software Bill of Materials (SBOM) [ML B-side]
Pub date: 2022-08-31

In May 2021, Following the Solarwinds and the Colonial Pipeline attacks, the Biden administration published a presidential Executive Order mandating the use of SBOMs – Software Bill of Materials – in all government agencies. What are SBOMs and how useful are they in cybersecurity? Nate Nelson talks to two experts: Allan Friedman (CISA) and Chris Blask (Cybeats).

The podcast and artwork embedded on this page are from Cybereason, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Click Here (LS 47 · TOP 1% what is this?)
Episode: 30. The scariest piece of malware since Stuxnet
Pub date: 2022-08-30

Back in April, cybersecurity officials discovered the notorious “Industroyer” malware in the Ukrainian electrical grid. It might have been the scariest infrastructure hack since malware destroyed centrifuges at an Iranian uranium enrichment plant in 2010 – were it not for a TGIF miracle. Plus, a visit with the IT Army of Ukraine and a different kind of information operation.

The podcast and artwork embedded on this page are from The Record by Recorded Future, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 35 · TOP 3% what is this?)
Episode: DNP3 Crypto - Harder Than It Looks [The Industrial Security Podcast]
Pub date: 2022-08-24

Many people ask "why can't we just encrypt all those industrial protocols?" It turns out it's harder than it looks. Andrew West of Subnet Solutions and the Technical Chair of the DNP User group looks at Secure DNP3 - take three.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Executive discussions and how to communicate your cyber risks to the Board.
Pub date: 2022-08-24

DOE invests in securing the US power grid. CISA’s recent ICS security advisories. Industroyer2 makes an appearance in Ukraine. DDoS attack against Energoatom’s website. Ransomware trends and the threat to OT systems. Ransomware gang attempts to extort the wrong water company.

Control Loop News Brief.DOE invests in securing the US power grid. DOE invests $45 million in cyber technology that protects power sector (The Hill)

CISA’s recent ICS security advisories.Cisco Releases Security Update for Multiple Products (CISA)

Siemens Simcenter STAR-CCM+ (CISA)

Siemens Teamcenter (CISA)

Schneider Electric EcoStruxure, EcoStruxure Process Expert, SCADAPack RemoteConnect for x70 (CISA)

Emerson ROC800, ROC800L and DL8000 (CISA)

Siemens SICAM A8000 Web Server Module (CISA)

Siemens SICAM TOOLBOX II (CISA)

Siemens SCALANCE (CISA)

Siemens SIMATIC S7-400 (CISA)

Siemens Industrial Products Intel CPUs (Update A) (CISA)

Siemens Industrial Products LLDP (Update B) (CISA)

Siemens Linux-based Products (Update G) (CISA)

Siemens Datalogics File Parsing Vulnerability (CISA)

Siemens S7-400 CPUs (Update A) (CISA)

Siemens SIMATIC Software Products (Update B) (CISA)

Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update B) (CISA)

Baxter Sigma Spectrum Infusion Pumps (Update B) (CISA)

Siemens Industrial Products with OPC UA (Update H) (CISA)

Siemens PROFINET Stack Integrated on Interniche Stack (CISA)

Siemens TIA Portal (Update C) (CISA)

Siemens Teamcenter (CISA)

Siemens Industrial Devices using libcurl (CISA)

Siemens SIMATIC WinCC and PCS (CISA)

Siemens Teamcenter (CISA)

Siemens Industrial Products (CISA)

Siemens OpenSSL Vulnerabilities in Industrial Products (CISA)

Siemens RUGGEDCOM ROS (CISA)

Simcenter Femap and Parasolid (CISA)

Siemens SRCS VPN Feature in SIMATIC CP Devices (CISA)

Yokogawa CENTUM Controller FCS (CISA)

LS ELECTRIC PLC and XG5000 (CISA)

Delta Industrial Automation DRAS (CISA)

Softing Secure Integration Server (CISA)

B&R Industrial Automation Automation Studio 4 (CISA)

Emerson Proficy Machine Edition (CISA)

Sequi PortBloque S (CISA)

Siemens Industrial Products with OPC UA (CISA)

Siemens Linux-based Products (Update J) (CISA)

Siemens Industrial Products LLDP (Update D) (CISA)

Siemens OpenSSL Affected Industrial Products (Update B) (CISA)

Mitsubishi Electric MELSEC iQ-R, Q, L Series and MELIPC Series (Update A) (CISA)

Mitsubishi Electric Multiple Factory Automation Products (Update A) (CISA)

Industroyer2 makes an appearance in Ukraine. Ukraine cyber chief pays surprise visit to 'Black Hat' hacker meeting in Las Vegas (Reuters)

Black Hat 2022‑ Cyberdefense in a global threats era (WeLiveSecurity)

DDoS attack against Energoatom’s website. Ukraine’s state-owned nuclear power operator said Russian hackers attacked website (The Record)

Ransomware trends and the threat to OT systems. Dragos Industrial Ransomware Analysis: Q2 2022 (Dragos)

Ransomware gang attempts to extort the wrong water company.Hackers attack UK water supplier but extort wrong company (BleepingComputer)

Control Loop Interview.Jason Christopher, Director of Cyber Risk at Dragos, Boards and threat-informed industrial risk management

Control Loop Learning Lab.David Foose, Senior Product Manager at Dragos, talking with Mark Urban of Dragos about SCADA.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ITSPmagazine (LS 36 · TOP 2.5% what is this?)
Episode: The Convergence Of Operational Technology (OT) Security With Information Technology (IT) Security | A Crucial Conversation With Rock Lambros
Pub date: 2022-08-23

Operational Technology (OT) and Information Technology (IT) have historically been managed by separate teams. But with cyberattacks targeting IoT devices on OT systems in recent years and opening the possibility of breaches spilling over to IT networks (and vice versa), OT and IT teams realize just how much they need each other. As a result, the cybersecurity industry is seeing a convergence between OT security and IT security.

In this episode, Rock Lambros, CEO and founder of RockCyber, discusses how CISOs are taking the lead by pushing for OT and IT teams to collaborate to understand each other’s challenges and how their knowledge can help improve the security postures of each other’s networks. Lambros also examines the different perspectives of IT and OT teams and how CISOs can collaborate with OT teams to achieve organizational success—where operational and information systems benefit from a strong security posture that allows the company to function at peak efficiency.

_______________________

Community Member Contributor: Rock Lambros
CEO and founder of RockCyber [@RockCyberLLC]
On Twitter | https://twitter.com/rocklambros
On LinkedIn | https://www.linkedin.com/in/rocklambros/

______________________

For more podcasts from Crucial Conversations with The Blue Lava Community, visit: https://www.itspmagazine.com/crucial-conversations-podcast

To access the full collection of Blue Lava Community resources, visit: https://itspm.ag/blclog22

To learn more about Blue Lava, visit: https://itspm.ag/blue-lava-w2qs

______________________

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

The podcast and artwork embedded on this page are from ITSPmagazine, Sean Martin, Marco Ciappelli, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CyberWire Daily (LS 59 · TOP 0.1% what is this?)
Episode: Roya Gordon: Becoming a trailblazer. [Research] [Career Notes]
Pub date: 2022-08-21

Roya Gordon, a Security Research Evangelist at ICS cybersecurity firm Nozomi Networks, started her career as an intelligence specialist in the U.S. Navy. After her time serving, Roya spent time as a Control Systems Cybersecurity Analyst at the Idaho National Laboratory and then took the role of Cyber Threat Intelligence Manager at Accenture. She shares her story after the NSA accepted her and then quickly diverted, creating a new path for Roya to follow. She shares the jobs she went after along the way, leading up to Nozomi Networks and how she wishes to be a trailblazer for young black women everywhere. She hopes to shape young women's minds on what the cybersecurity industry is actually like, in hopes that she can be a figure people look up to.

The podcast and artwork embedded on this page are from CyberWire, Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 47: From Academia to CyberSecurity Executive
Pub date: 2022-08-23

We have another interesting episode in our series of interviews with cybersecurity leaders and practitioners in the industrial controls systems or operating technology space.

Derek Harp is excited to have Ron Indeck, the CEO of Q-Net Security, and a Director, Founder, and Technology Advisor to Exegy and VelociData joining him on the show.

Ron grew up in Minneapolis, Minnesota, and got his degrees from the University of Minnesota. He is an inventor (he holds more than 100 patents), a distinguished professor at Washington University, a fellow at IEEE and several other professional organizations, an expert in all things magnetic, a serial entrepreneur, a scuba diver, and a father.

In this episode of the (CS)²AI Podcast, Ron discusses his career journey and shares his unique perspective on cybersecurity. He also offers some gold nuggets of career advice and gives insight into upcoming trends in the cybersecurity space.

You won’t want to miss this episode if you are looking for career inspiration or are interested in moving from the academic space into the world of cybersecurity. Stay tuned for more!

Show highlights:

Ron discusses his career path and his motivation for becoming an entrepreneur.
Ron’s approach to his work at Washington University.
Why did he transition across various engineering disciplines before ending up in research and patents?
Ron’s introduction to security came early on in his career while working with people from the FBI.
How security for industrial control systems evolved throughout Ron’s career.
How Ron built his patent portfolio.
Ron’s approach to solving the generational cybersecurity problem.
What made Ron decide to leave his successful academic career to become an entrepreneur?
Exciting and rewarding possibilities exist for academics in the industrial technology space.
How can you get into tech transfer?
Ron talks about his work at the Airforce Research Laboratory.
How to recognize an opportunity.
Teamwork and cooperation are vital for success.
Ron defines the term hardsec and compares it with a software approach to security solutions for the future.
Why does Ron believe that cybersecurity is an issue of human rights?
You can create exciting and rewarding career opportunities in cybersecurity.

Bio:

Ronald S. Indeck, Ph.D., received degrees from the University of Minnesota. He is CEO of Q-Net Security and a Director, Founder, and Technology Advisor to Exegy and VelociData.

He was a National Science Foundation Research Fellow at Tohoku University in Sendai, Japan. From 1988 to 2009 he was in the Department of Electrical Engineering at Washington University where he was the Das Family Distinguished Professor and Director of the Center for Security Technologies.

He has published more than 60 peer-reviewed technical papers and been awarded more than a hundred patents including MagnePrint. He has received many awards including the NSF Presidential Young Investigator Award from President Bush, the Missouri Bar Association Inventor of the Year, the IBM Faculty Development Award, the Washington University Distinguished Faculty Award, and the IEEE Centennial Key to the Future Award, and the IEEE Young Professional Award.

He is a Fellow of the IEEE, a member of the American Physical Society, and many other professional organizations. He has served on many local committees and group activities, was on the board of the FBI InfraGard, chaired sessions, and served at several international conferences including General Chairman for International Magnetics Conference, was an editor for the IEEE Transactions on Magnetics, President of the IEEE Magnetics Society, and IEEE Magnetics Society Distinguished Lecturer.

Specialties: Indeck is experienced in cybersecurity, heterogeneous computing, data mining in massive databases, magnetic measurements and modeling, physical security and authentication, recording physics, and magnetic devices.

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast (LS 23 · TOP 10% what is this?)
Episode: Noam Moshe on the Evil PLC Attack
Pub date: 2022-08-19

Claroty Team82 researcher Noam Moshe joins the podcast to discuss the Evil PLC Attack research published recently. Evil PLC is a technique whereby a weaponized PLC is used to compromise an engineering workstation in order to move deeper onto the OT network, the enterprise network, or other PLCs.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: RSA Conference
Episode: The Cyber Physical War: Does the Investment Match the Hype?
Pub date: 2022-08-19

While there seems to be a growing awareness of the threats to the cyber-physical world with cybercriminals increasingly targeting industrial organizations within critical infrastructure, are current investments, regulations, and actions enough to stop attackers. In this podcast, we’ll have a follow up Q&A to the RSAC 2022 session, “The Cyber Physical War—Lessons from the Digital Front Line,” to understand what more must be done to protect industrial organizations.

Speakers: Ian Bramson, Global Head of Industrial Cybersecurity, ABS Group Kacy Zurkus, Content Strategist, RSA Conference

The podcast and artwork embedded on this page are from RSA Conference, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: IoT For All Podcast (LS 38 · TOP 2% what is this?)
Episode: Using Physical Layer 1 for Ultimate Data Visibility | Sepio's Yossi Appleboum
Pub date: 2022-08-18

Yossi begins by introducing himself and his company before breaking down what is physical layer 1 and what makes it unique. Ryan and Yossi then move into higher-level conversations regarding identifying devices and misconceptions of abilities. They then wrap up the podcast by offering advice for companies and talking about the biggest risks in the industry. Yossi's passion is delivering simple solutions to complex problems. During the last 30 years, he has been involved in multiple engineering and leadership roles. He started his career in the Israeli intelligence corps (Unit 8200), where he participated in and then led large-scale R&D projects. In the late '90s, together with his two partners, he co-founded and led a couple of startups and developed cutting-edge technologies and solutions that addressed the evolving security and networking markets. After successfully exiting these (in 2012 and 2016), he co-founded Sepio (in 2016), where he served as CEO, focusing on leading the team and the growth path. Sepio was founded in 2016 by cybersecurity industry veterans. Sepio's HAC-1 is the first hardware access control platform that provides visibility, control, and mitigation to zero trust, insider threat, BYOD, IT, OT, and IoT security programs. Sepio's hardware fingerprinting technology discovers all managed, unmanaged, and hidden devices that are otherwise invisible to all other security tools.

The podcast and artwork embedded on this page are from IoT For All, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ITSPmagazine (LS 36 · TOP 2.5% what is this?)
Episode: SBOM FTW: But Keep The Humans Out | A Conversation With Eric Byers | The National Blast With Keenan Skelly
Pub date: 2022-08-17

SBOM is here, and here to stay. Join Eric and I as we chat about CISA and private sector efforts to make SBOM an easy day for everyone.

Bonus shoutouts to Allan Friedman [@allanfriedman] @CISAgov ✨

_______________________

Guest
Eric Byers
Founder & CTO aDolus [@aDolus_Inc]

______________________

Host
Keenan Skelly
On ITSPmagazine 👉https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/keenan-skelly

______________________

This Episode’s Sponsors
______________________

Resources

______________________

For more podcast stories from The National Blast Podcast with Keenan Skelly, visit: https://www.itspmagazine.com/the-national-blast-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

The podcast and artwork embedded on this page are from ITSPmagazine, Sean Martin, Marco Ciappelli, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: Rail Security With Miki Shifman
Pub date: 2022-08-17

Freight and passenger rail is another industry sector that relies on ICS for safety and services. It has its own language, consequences and standards.

In this episode, Dale Peterson speaks with Miki Shifman of Cylus. Most of the episode digs into how rail systems work and the key areas to secure. They cover the TS-50701 standard and TSA's regulations in the US, among other things.

The episode concludes with a discussion of the Cylus OT Detection product designed for rail. The big question is a sector specific focus a big enough moat to keep out the big 3 OT detection vendors.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 46: From Electrical Engineer to Cybersecurity Executive with Rob Garry
Pub date: 2022-08-16

Derek Harp is excited to have Rob Garry joining him on the show today! Rob is currently the Executive Chief Engineer and VP of Product Security at GE Power.

Rob is an experienced Chief Executive with a demonstrated history of working in the oil & energy industry. He is skilled in Power Plants, Root Cause Analysis, Power Systems, Renewable Energy, and Engineering. He is a strong finance professional with a BS focused in Electrical Engineering from Union College.

As well as being an engineer, Rob is also a father, husband, avid cyclist, master ski-racer, handy-around-the-house person, and an enthusiast in many different areas! In this episode of the (CS)²AI Podcast, he offers advice for people looking to enter the cybersecurity space and talks about his shift from control systems to cybersecurity, good leadership, inter-disciplinary team management, and why his job resonates so well with him.

Rob is passionate about discussing controls, how cyber plays into it, and the emerging role in the industry. You won’t want to miss this episode if you want to know more about cybersecurity from the perspective of a chief engineer. Stay tuned for more!

Show highlights:

Growing up, Rob was always working on things and fixing farm equipment.
As an engineer, Rob opted to go the electrical route. Throughout his career, he has developed and worked on control systems for heavy-duty gas, steam, and wind turbines for power generation.
How did cybersecurity intersect with Rob’s career?
Rob describes the work he did with networks in the years before anyone was speaking about security.
A lesson he learned from cybersecurity helped him where he is in his career today.
Why is risk in a power plant not binary?
Knowing how to describe risk in a way that layers into the equation has helped Rob in his current role more than his networking background.
Rob explains how a mature leader in his field enters discussions and makes judgment calls.
How does cybersecurity intersect with the monitoring and diagnostics of heavy industrial equipment?
The importance of inter-disciplinary team building and team management.
Rob talks about the career challenges people with technical minds sometimes face.
Rob’s approach to giving and getting mentorship.
Rob describes the best way to pass a chief engineer review.
Which area should you focus on learning that would make you invaluable as an employee in the next few years?

Links:

(CS)²AI

Rob Garry on LinkedIn

GE Power

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Paul's Security Weekly (Podcast-Only) (LS 28 · TOP 10% what is this?)
Episode: PSW #748 - Lesley Carhart
Pub date: 2022-07-22

This week in our first segment, we are thrilled to welcome Lesley (@hacks4pancakes) back to the show! In this segment, we'll dig into some ICS security topics including some recent threats, monitoring ICS networks for security, incident response for ICS, and more! Then, in the Security News for this week: heat waves and outages, GPS trackers are vulnerable, cracks in the Linux firewall, bas password crackers, microcode decryptors, SATA antennas, Okta vulnerabilities not vulnerabilities, updates on former CIA agent and Vault 7 leaks, decompiler explorer, and Tuxedo brings to market a liquid cooled laptop, & more!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

https://securityweekly.com/psw748

The podcast and artwork embedded on this page are from Paul Asadoorian, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Malicious Life (LS 58 · TOP 0.5% what is this?)
Episode: “A CISO’s Nightmare”: Israel Baron on Railway Secuirty
Pub date: 2022-08-15

Railway systems are a mess of old systems built on top of older systems, running ancient operating systems and exposing their most sensitive inner workings to commuters via Wifi. Why are railway systems so difficult to defend, and what are the most probable attack vectors against them? Nate Nelson, our Sr. producer, speaks with Israel Baron, Israel Railway’s first ever CISO.

The podcast and artwork embedded on this page are from Cybereason, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Work (LS 42 · TOP 1.5% what is this?)
Episode: Securing operational technology: ICS, IoT, AI and more | Guest Francis Cianfrocca
Pub date: 2022-08-15

If you want to learn more about working with operational technology (OT) and internet-connected devices, then don't miss today's episode with Francis Cianfrocca, CEO of Insight Cyber Group. He discusses security problems around OT and IoT systems and shares some surprising stories of intruders in the electrical grid. He also talks about why it’s so hard to secure a set of machines that often pre-date computer technology and the small changes in your community that can make huge differences in the entire security industry.

– Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
– View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Free cybersecurity training resources
0:56 - Overview of today's episode
1:48 - Who is Francis Cianfrocca and Insight Cyber?
2:15 - Getting into tech and cybersecurity
4:13 - Francis' job roles and companies
5:22 - Early days of ICS systems security
10:15 - CEO duties at a cybersecurity startup
12:19 - Why is infrastructure security so bad?
16:05 - Different approaches needed for ICS and IOT systems
20:23 - Catching intruders early on with industrial systems
22:45 - Using artificial intelligence in ICS security
24:50 - Bad actors are really good at reconnaissance
27:20 - ICS and IOT environments cannot have downtime
30:00 - Asset and behavioral inventory is difficult
31:42 - Real-world examples of rogue ICS software
36:30 - ICS vs. IOT security
42:57 - How to promote industrial security careers
46:07 - Impact of AI on cybersecurity careers
48:40 - Preparing for an ICS cybersecurity career
51:07 - What's Insight Cyber working on?
52:45 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It’s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

The podcast and artwork embedded on this page are from Infosec, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: ICS Security em Geral
Pub date: 2022-08-12

Na última quarta feira tivemos mais uma gravação do ICS SECURITY PODCAST. Nosso CEO Eduardo Honorato abordou o tema: ICS Security em Geral.

Nos siga no LinkedIn:https://bit.ly/3zXyz2h

Assista ao vivo a cada 15 dias, às 19h: https://bit.ly/3oMLKg0

Visite nosso site: https://www.muniosecurity.com

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industry 4.0 Podcast with Grantek
Episode: Jacob Chapman at Nozomi Networks - The Industry 4.0 Podcast with Grantek
Pub date: 2022-07-13

Jacob Chapman has a background in automation engineering, project management, account management, industrial networking, and ICS cybersecurity within the food and beverage, pharmaceutical, and energy generation sectors, among others. Jacob is currently a Solutions Architect within the BD and Alliances team at Nozomi Networks, the leader in OT & IoT security and visibility.

Jacob maintains involvement and leadership positions in international societies and standard bodies - including the Cybersecurity Committee Chair of ISA’s Smart Manufacturing & IIoT Division, a Registered U.S. Expert to TC65 of the IEC, member of Manufacturing Enterprise Solutions Association's Cybersecurity Workgroup, and a member of the ISA99 standards development committee.

The Industry 4.0 Podcast with Grantek delivers a look into the world of manufacturing, with a focus on stories and trends that lead to better solutions.

Our guests will share tips and outcomes that will help improve your productivity. You will hear from leading providers of Industrial Control System hardware and software, Grantek experts and leaders at best-in-class industry associations that serve Life Sciences and Food & Beverage manufactures.

The podcast and artwork embedded on this page are from Grantek, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ITSPmagazine (LS 36 · TOP 2.5% what is this?)
Episode: Car Hacking Village At DEF CON 30 | Chats On The Road | A Conversation With Justin | Black Hat 2022 And DEF CON 30 Las Vegas Event Coverage | Redefining CyberSecurity Podcast With Sean Martin And Marco Ciappelli
Pub date: 2022-08-11

The Car Hacking Village continues to evolve, bringing new systems and simulators into the village for hackers to get their hands on. There are also some talks taking place on the village YouTube channel for those interested in research and other engaging conversations and presentations.

About The Car Hacking Village
The primary goal of the Car Hacking Village is to build a community around discovering weaknesses and exposing vulnerabilities that could significantly impact the safety and security of all drivers and passengers on the road today. Educating security researchers on the functionality of vehicle systems coupled with providing them with the opportunity to gain hands-on experience working side by side with experts in this field is a plus for the attendees. Leveraging the vast amount of experience the security research community brings to the Village may increase the safety and security of vehicles on the road today and for generations to come.

Breaches of automotive systems have been in the forefront of the global media for more than a year. Wired and wireless exploitation of vehicle systems has become a critical safety concern for the automotive industry, the National Highway Traffic Safety Administration, Congress, the Department of Homeland Security, and consumers.

Car Hacking Village plays an important role for researchers interested in the safety and security of the more than one billion vehicles on the road worldwide. In 2015, over 16.5 million vehicles were sold in the United States. On average, motor vehicles are driven over 15,000 miles annually and consumers spend upwards of 730 hours per year in their cars.

Be sure to catch all of our conversations from Black Hat and DEF CON 2022 at https://www.itspm.ag/bhdc22

____________________________

Guest
Justin
Car Hacking Village Lead [@CarHackVillage]
____________________________

This Episode’s Sponsors

CrowdSec | https://itspm.ag/crowdsec-b1vp
Edgescan | https://itspm.ag/itspegweb
Pentera | https://itspm.ag/pentera-tyuw

____________________________

Resources

Car Hacking Village website: https://www.carhackingvillage.com/

Car Hacking Village Talks | https://www.carhackingvillage.com/talks

At DEF CON: https://forum.defcon.org/node/240928

____________________________

For more Black Hat and DEF CON Event Coverage podcast and video episodes visit: https://www.itspmagazine.com/black-hat-2022-and-def-con-hacker-summer-camp-las-vegas-usa-cybersecurity-event-and-conference-coverage

Are you interested in telling your story in connection with Black Hat and DEF CON by sponsoring our coverage?
👉 https://itspm.ag/bhdc22sp

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

The podcast and artwork embedded on this page are from ITSPmagazine, Sean Martin, Marco Ciappelli, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 33 · TOP 5% what is this?)
Episode: Mikko Hypponen: If It's Smart, It's Vulnerable
Pub date: 2022-08-10

Dale Peterson talks with Mikko Hypponen about his new book: If It's Smart, It's Vulnerable.

As with all books, Dale asks who Mikko wrote the book for, who is the intended reader. Then they dig into some of the interesting parts for the security professional including:

What security tasks should we expect users to do (and why security training fails)
Whose responsible for IoT/IIoT cybersecurity? How are we going to succeed in security IoT, and what regulation might work?
Hypponen's Law: If It's Smart, It's Vulnerable
Cyber Deterrence
Why have their been so few cyber attacks on critical infrastructure?

and more.

Links

If It's Smart, It's Vulnerable book
S4x23 Call For Presentations

View Details

Podcast: Data Breach Today Podcast (LS 32 · TOP 5% what is this?)
Episode: Medical Device SBOMs: Attention to Details Matter
Pub date: 2022-08-09

It's not enough for medical device makers to provide a software bill of materials - there also needs to be close attention paid to how vulnerabilities in components are communicated and managed, says medical device security expert Ken Hoyme.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Pipeline cybersecurity mitigation actions, contingency planning, and testing.
Pub date: 2022-08-10

BlackCat ransomware gang hits Luxembourg energy company. Predatory Sparrow's assault on Iran's steel industry. MOXA issues patches for two vulnerabilities. ICS security advisories. Two security bills pass the US House. Insider threat: Spain arrests nuclear plant employees. The human risk to OT systems.

Control Loop News Brief.BlackCat ransomware gang hits Luxembourg energy company.BlackCat ransomware gang hits Luxembourg energy supplier Creos (Computing)

Luxembourg energy provider Encevo Group battles ransomware attack by BlackCat (Tech Monitor)

BlackCat ransomware claims attack on European gas pipeline (BleepingComputer)

Luxembourg energy companies struggling with alleged ransomware attack, data breach (The Record by Recorded Future)

Predatory Sparrow's assault on Iran's steel industry.Predatory Sparrow: Who are the hackers who say they started a fire in Iran? (BBC News)

Hacktivists claiming attack on Iranian steel facilities dump tranche of 'top secret documents' (CyberScoop)

MOXA issues patches for two vulnerabilities.Moxa NPort Device Flaws Can Expose Critical Infrastructure to Disruptive Attacks (SecurityWeek)

Two Moxa Zerodays — ICSRange.com - Powered by En Garde Security (ICSRange.com - Powered by En Garde Security)

ICS security advisories.Inductive Automation Ignition (CISA)

Honeywell Safety Manager (CISA)

Honeywell Saia Burgess PG5 (CISA)

MOXA NPort 5110 (CISA)

Mitsubishi MELSEC and MELIPC Series (Update D) (CISA)

Rockwell Products Impacted by Chromium Type Confusion Vulnerability (CISA)

Mitsubishi FA Engineering Software (Update B) (CISA)

Mitsubishi Electric Factory Automation Engineering Software (Update C) (CISA)

Mitsubishi Electric Factory Automation Products Path Traversal (Update C) (CISA)

Mitsubishi Electric Factory Automation Engineering Products (Update H) (CISA)

Mitsubishi Electric FA Engineering Software Products (Update F) (CISA)

Delta Electronics DIAEnergie (Update C) (CISA)

Security bills pass the US House.House Passes Cybersecurity Bills Focusing on Energy Sector, Information Sharing (SecurityWeek)

Insider threat: Spain arrests nuclear plant employees.Spanish police arrest two accused of hacking radioactivity alert system (Record by Recorded Future)

The human risk to OT systems.The 2022 State of Operational Technology (SCADAfence)

Control Loop Interview.Bryson Bort from SCYTHE, on threat emulation for critical infrastructure, season 3 of Hack the Plant with the Atlantic Council, and the ICS Village at Def Con in collaboration with CISA.

Bryson Bort on LinkedIn

Control Loop Learning Lab.Jim Gilsinn, Technical Leader at Dragos Global Services Team, discusses Security Directive Pipeline-2021-02C, pipeline cybersecurity mitigation actions, contingency planning, and testing, with Mark Urban, VP of Product Market Strategy at Dragos.

Jim Gilsinn on LinkedIn

Mark Urban on LinkedIn

Subscribe to the Control Loop Newsletter here with new editions published every month.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: How Secure Are Air Gapped Systems?
Pub date: 2022-08-08

The goal of and air-gapped network is to remain free and clear of any outside malicious activity. In theory, no outside connections means no chance of attacks. In the digital era, how do you protect an air-gapped network?

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ITSPmagazine (LS 36 · TOP 3% what is this?)
Episode: Aerospace Village At DEF CON 30 | Chats On The Road | A Conversation With Kaylin Trychon | Black Hat 2022 And DEF CON 30 Las Vegas Event Coverage | Redefining CyberSecurity Podcast With Sean Martin And Marco Ciappelli
Pub date: 2022-08-08

"Striker, listen, and you listen close: flying a plane is no different than riding a bicycle, just a lot harder to put baseball cards in the spokes." - Rex Kramer [Airplane! the movie]

It's a lot harder to secure these giant flying computer systems as well. The same is true for pretty much every vessel and communications system represented in the Aerospace Village. Join us and our guest, Kaylin Trychon, as we take a journey into what visitors can expect at this year's village.

About the Aerospace Village
Aerospace is a cornerstone of our global infrastructure and economy. While passenger safety is at an all-time high, the increasing adoption of connected technologies exposes aircraft, airports, satellites, and the interdependent aerospace ecosystem to new types of risks. The consequences of cybersecurity failure in a ground, air, or space-based system can impact human life and public safety; a crisis of confidence in the trustworthiness of air travel can undermine economic and (inter)national security.

MISSION: Build, inspire, and promote an inclusive community of next-generation aerospace cybersecurity expertise and leaders.

VALUES: The aerospace industry, security researchers, and the public share a common goal: safe, reliable, and trustworthy aviation and space operations.

GOAL: The Aerospace Village is a diverse community of hackers, engineers, pilots, policy leaders and more from across both the public and private sectors. We believe the flying public deserves safe, reliable, and trustworthy air travel, which is highly dependent on secure aviation and space operations.

Be sure to catch all of our conversations from Black Hat and DEF CON 2022 at https://www.itspm.ag/bhdc22

____________________________

Guest
Kaylin Trychon
Communications Director at the Aerospace Village [@SecureAerospace]
On LinkedIn | https://www.linkedin.com/in/kaylintrychon/
On Twitter | https://twitter.com/KaylinTrychon
____________________________

This Episode’s Sponsors

CrowdSec | https://itspm.ag/crowdsec-b1vp
Edgescan | https://itspm.ag/itspegweb
Pentera | https://itspm.ag/pentera-tyuw

____________________________

Resources

IoT Village DEF CON Schedule: https://aerospacevillage.org/events/upcoming-events/def-con-30/

Aerospace Village website: https://aerospacevillage.org/

On LinkedIn | https://www.linkedin.com/company/aerospace-village/

At DEF CON: https://forum.defcon.org/node/240500

____________________________

Are you interested in telling your story in connection with Black Hat and DEF CON by sponsoring our coverage?
👉 https://itspm.ag/bhdc22sp

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

The podcast and artwork embedded on this page are from ITSPmagazine, Sean Martin, Marco Ciappelli, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Relationships, Not Creepiness - Marketing Industrial Security [The Industrial Security Podcast]
Pub date: 2022-08-08

Relationships, humour and a complete lack of creepiness - Laura Torres and Sarah Jennings of FoxGuard join us to look at the art of marketing industrial security solutions.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Matters, hosted by Dominic Vogel and Christian Redshaw
Episode: Ep. 137: Understanding Operational Technology (w/ Danielle Jablanski, Nozomi Networks)
Pub date: 2022-07-26

On today’s Cyber Security Matters episode, Dominic Vogel is joined by Danielle Jablanski, Operational Technology Strategist at Nozomi Networks.

Danielle Jablanski is an OT cyber security strategist at Nozomi Networks, responsible for researching global cybersecurity topics and promoting operational technology (OT) and industrial control systems (ICS) cybersecurity awareness throughout the industry. She is also a nonresident fellow at the Cyber Statecraft Initiative of the Atlantic Council’s Scowcroft Center for Strategy and Security.

Nozomi Networks accelerate digital transformation by protecting the world’s critical infrastructure, industrial and government organizations from cyber threats. Their solution delivers exceptional network and asset visibility, threat detection, and insights for OT and IoT environments. Customers rely on them to minimize risk and complexity, while maximizing operational resilience.

During our conversation, we will discuss: -What Operational Technology and Industrial Control Systems are -The importance of investing in Operational Technology Security -How vulnerable Operational Technologies are -What protecting your Operational Technology looks like

Want to connect with Danielle? Here are a couple of ways that you can do exactly that: -LinkedIn: @DanielleJablanski -Website: www.nozominetworks.com

The podcast and artwork embedded on this page are from Cyber.SC, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ITSPmagazine (LS 36 · TOP 3% what is this?)
Episode: ICS Village At DEF CON 30: Chats On The Road | A Conversation With Bryson Bort And Tom VanNorman | Black Hat 2022 And DEF CON 30 Las Vegas Event Coverage | Redefining CyberSecurity Podcast With Sean Martin And Marco Ciappelli
Pub date: 2022-08-03

The ICS Village is one of the first DEF CON villages we ever connected with. A lot has changed over the years, including the threats faced by critical infrastructure entities around the world. Let's find out what to expect at this year's village.

About the ICS Village
High profile industrial control system (ICS) security issues have grabbed headlines and sparked change throughout the global supply chain. The ICS Village allows defenders of any experience level to understand the unique failure modes of these systems and how to better prepare and respond to the changing threat landscape.

Interactive simulated ICS environments, such as Hack the Plan(e)t and Howdy Neighbor, provide safe yet realistic environments to preserve safe, secure, and reliable operations. The ICS Village brings a compelling experience for all experience levels and types, with IT and industrial equipment. Our interactive learning approach invites you to get hands on with the equipment to build your skills.

We bring you real components such as programmable logic controllers (PLC), human-machine interfaces (HMI), remote telemetry units (RTU), and actuators to simulate a realistic environment by using commonly used components throughout different industrial sectors. You will be able to connect your machine to the different industrial components and networks and try to assess these ICS devices with common security scanners to sniff the industrial traffic, and more!

Be sure to catch all of our conversations from Black Hat and DEF CON 2022 at https://www.itspm.ag/bhdc22

____________________________

Guests
Bryson Bort
Co-Founder of the ICS Village [@ICS_Village]
On LinkedIn | https://www.linkedin.com/brysonbort
On Twitter | https://mobile.twitter.com/brysonbort
On YouTube | https://youtube.com/c/ICSVillage

Tom VanNorman
Founding member of the ICS Village
On LinkedIn | https://www.linkedin.com/in/thomasvannorman/
On Twitter | https://twitter.com/Tom_VanNorman
____________________________

This Episode’s Sponsors

CrowdSec | https://itspm.ag/crowdsec-b1vp
Edgescan | https://itspm.ag/itspegweb

____________________________

Resources

ICS Village Website: https://www.icsvillage.com/

ICS Village at DEF CON 30 Schedule: https://www.icsvillage.com/schedule-def-con-30

ICS Village 360 Tour: https://www.exhibitstudiosmedia.com/tours/21396_ics_360_tour/

____________________________

Are you interested in telling your story in connection with Black Hat and DEF CON by sponsoring our coverage?
👉 https://itspm.ag/bhdc22sp

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

The podcast and artwork embedded on this page are from ITSPmagazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 34 - ICS Security em Geral
Pub date: 2022-08-01

Na última quarta-feira 27/07 teremos mais uma gravação do ICS SECURITY PODCAST. Nosso CEO Eduardo Honorato abordou o tema: ICS Security em Geral. Fique atento ao horário. A partir deste episódio, voltamos ao horário normal, 19h-GTM.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: teissPodcast - Cracking Cyber Security (LS 32 · TOP 5% what is this?)
Episode: teissTalk: Reducing the cyber risk to your operational technology
Pub date: 2022-07-29

Translating IT security awareness training and priorities to OT colleagues
Mitigating the risk of human threat or errors to your OT security
Securing legacy equipment and reducing the risk of compromise: should legacy OT be kept separate from IT?

The podcast and artwork embedded on this page are from TEISS, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: Demystifying the alphabet soup of OT, IT, IOT.
Pub date: 2022-07-27

More deniable DDoS attacks strike countries friendly to Ukraine. Russian intentions and capabilities in its hybrid war. Log4j is now “endemic.” CISA’s ICS security advisories. Operational technology and the C2C market. TSA issues revised pipeline cybersecurity guidelines. Zero-trust comes to OT.

Our guest is Puesh Kumar from the Department of Energy, discussing the DOE’s efforts to secure critical infrastructure, and to secure clean energy infrastructure.

In the Learning Lab, Kimberly Graham, senior director of product management at Dragos, talks with Mark Urban about the alphabet soup of OT.

Control Loop News Brief.Threats to infrastructure in a hybrid war.Ignitis Group hit by DDoS attack as Killnet continues Lithuania campaign (Tech Monitor) Ignitis services were knocked offline this weekend in a DDoS attack as Russian hackers Killnet target Ukraine's allies.

US seeking to understand Russia’s failure to project cyber power in Ukraine (Defense News) “With regard to the Russian use of cyber and our takeaways,” Anne Neuberger said, “there are any number of theories for what we saw and what, frankly, we didn’t see.”

Battling Moscow's hackers prior to invasion gave Kyiv 'full dress rehearsal' for today's cyber warfare (CyberScoop) Years of cyberattacks have helped prepare Ukraine to fight back against Russia's arsenal of digital weapons.

Log4j is now “endemic.”DHS Review Board Deems Log4j an 'Endemic' Cyber Threat (Dark Reading) Vulnerability will remain a "significant" threat for years to come and highlighted the need for more public and private sector support for open source software ecosystem, Cyber Safety Review Board says.

DHS board: No one used software inventories to find vulnerable Log4j deployment (FedScoop) Many in government and industry want SBOMs to be the secure software development compliance standard, but the technology remains limited.

Review of the December 2021 Log4j Event (Cyber Safety Review Board) We write this report at a transformational moment for the digital ecosystem. The infrastructure on which we rely daily has become deeply interconnected through the use of shared communications, software, and hardware, making it susceptible to vulnerabilities on a global scale.

Dragos and Emerson Expand Global Agreement to Secure Industrial Infrastructure for Process Industries (Dragos) Dragos Extends ICS/OT Cybersecurity to Emerson’s DeltaV Distributed Control System to Protect Process Industries.

CISA’s ICS security advisories.Hundreds of ICS Vulnerabilities Disclosed in First Half of 2022 (Security Week) More than 600 industrial control system (ICS) product vulnerabilities were disclosed in the first half of 2022 by the US Cybersecurity and Infrastructure Security Agency (CISA), according to an analysis conducted by industrial asset and network monitoring company SynSaber.

Operational technology and the criminal-to-criminal market. Hackers are targeting industrial systems with malware (Ars Technica) An entire ecosystem of sketchy software is targeting potentially critical infrastructure.

Hackers Distributing Password Cracking Tool for PLCs and HMIs to Target Industrial Systems (The Hacker News) Hackers Distributing Password Cracking Tool for PLCs and HMIs to Infect Industrial Systems with Sality Malware

The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators (Dragos) Learn more about Dragos's discovery of an exploit introduced through password "cracking" software that targets industrial engineers and operators.

TSA issues revised pipeline cybersecurity guidelines. TSA revises and reissues cybersecurity requirements for pipeline owners and operators (Transportation Security Administration) The Transportation Security Administration (TSA) announced the revision and reissuance of its Security Directive regarding oil and natural gas pipeline cybersecurity. This revised directive will continue the effort to build cybersecurity resiliency for the nation’s critical pipelines.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Industrie neu gedacht - ein Tech-Podcast von Bosch Rexroth
Episode: Die OT-Security-Sünden der Industrie
Pub date: 2022-03-31

Klaus Mochalski von Rhebo hat schon viele Security-Analysen gemacht. Im Podcast verrät er uns die Sünden der Industrie. Wenn Sie Fragen haben, dann wenden Sie sich bitte an: vertrieb@boschrexroth.de

Produziert von Bosch Rexroth AG, Vertrieb Europa Mitte Susanne Noll

The podcast and artwork embedded on this page are from Bosch Rexroth AG, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #33 - ICS Security em Geral
Pub date: 2022-07-18

Participe do nosso Webinar - https://us06web.zoom.us/webinar/register/WN_clWxKSqCQdmtjpByH-NcfA

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Dan Gunter on Threat Hunting in Industrial Control Systems
Pub date: 2022-07-18

Insane Forensics CEO and founder Dan Gunter joins the Aperture podcast to discuss threat hunting approaches inside industrial control systems (ICS) and operational technology (OT) networks. Gunter describes how Shodan can be used to understand exposures within an industrial network and threats posed by trust relationships to the OT network. Gunter explains what asset operators and owners need in place to begin threat hunting, what they should be looking for, and how to use tools such as Shodan to their greatest effect.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CyberWire Daily (LS 60 · TOP 0.5% what is this?)
Episode: A conversation with Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly. [Special Edition]
Pub date: 2022-07-15

In this extended interview, CyberWire Daily Podcast host Dave Bittner sits down with Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly to discuss her time at CISA and the work of her team. This interview from July 15, 2022 originally aired as a shortened version on the CyberWire Daily Podcast.

The podcast and artwork embedded on this page are from CyberWire, Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: CMMC and your industrial environment, plus the five most critical security controls.
Pub date: 2022-07-13

A cyberattack hits a Ukrainian energy provider. A Chinese-speaking threat actor targets building automation systems. An Iranian steel mill suspends production due to a cyberattack. The US US TSA issues relaxed pipeline cybersecurity directives. A US cybersecurity bill focuses on training.

Ian Frist from BlueVoyant joins us to discuss on what CMMC will mean for ICS environments.

And in the Learning Lab, Robert M Lee joins us to explain the five critical controls for ICS.

Control Loop News Brief.Russian hackers allegedly target Ukraine's biggest private energy firm (CNN) Russian hackers carried out a "cyberattack" on Ukraine's biggest private energy conglomerate in retaliation for its owner's opposition to Russia's war in Ukraine, the firm said Friday.

Attacks on industrial control systems using ShadowPad (Kaspersky) In mid-October 2021 Kaspersky ICS CERT researchers uncovered an active ShadowPad backdoor infection on industrial control systems (ICS) in Pakistan.

Cyberattack Forces Iran Steel Company to Halt Production (SecurityWeek) One of Iran’s major steel companies said Monday it was forced to halt production after being hit by a cyberattack that also targeted two other plants, apparently marking one of the biggest such assaults on the country’s strategic industrial sector in recent memory.

Iran’s steel industry halted by cyberattack (The Jerusalem Post) Predatory Sparrow, a hacktivist group that is little known, took credit for the hacking that halted Iran's steel industry.

Iranian steel facilities suffer apparent cyberattacks (CyberScoop) Three Iranian steel companies suffered apparent cyberattacks Monday, claimed a hacktivist group that previously took responsibility for a digital assault on the Iranian train system with wiper malware.

Smart Factories Need to Prioritize Cybersecurity (Capgemini) Smart factories are increasingly being utilized by industry as part of the transition toward digitization. Being connected to cloud or the internet, they bring a plethora of communicative advantages. However, this network connection also creates a larger surface area vulnerable to attack via digital means.

TSA Eases Pipeline Cybersecurity Rules Issued After Colonial Hack (Wall Street Journal) The Transportation Security Administration is loosening pipeline cybersecurity rules imposed after ...

House Passes ICS Cybersecurity Training Bill (SecurityWeek) The House of Representatives has passed the Industrial Control Systems Cybersecurity Training Act.

Cyber Yankee exercise hones New England Guard skills to fight digital threats (C4ISRNet) “Whether it’s a state or a federal effort, the importance of being prepared to respond to a cyber ...

Control Loop Interview.Ian Frist from BlueVoyant joins us to discuss the Cybersecurity Maturity Model Certification from the US Department of Defense and what it means for industrial environments.

Ian Frist on LinkedIn

Control Loop Learning Lab.Robert M. Lee teaches us about the five critical controls for OT cybersecurity.

5 Critical Controls for OT Cybersecurity

Subscribe to the Control Loop Newsletter here with new editions published every month.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: BLUEPRINT (LS 44 · TOP 1.5% what is this?)
Episode: Dean Parsons: Cyber Security for OT and ICS
Pub date: 2022-07-12

With ransomware and other highly disruptive attacks on the rise, there are few systems more important to defend than our critical infrastructure and ICS equipment. How should we think about defending these systems vs our typical IT network though? In this episode, Dean Parsons is here to give us that answer.

Resources mentioned in this episode:

OSINT / Site-visit Cheat Sheet
https://www.sans.org/posters/ics-site-visit-plan/

ICS Cyber Kill Chain Whitepaper:
https://www.sans.org/white-papers/36297/?msc=blog-ics-library

ICS specific Network Security Monitoring:
https://www.sans.org/posters/industrial-network-security-monitoring/

Top 5 ICS Incident Response Tabletops
https://www.sans.org/blog/top-5-ics-incident-response-tabletops-and-how-to-run-them/

My weekly ICS Defense Force LiveStream
https://www.youtube.com/playlist?list=PLjoUWqjR7qXhdZIcC8LgEBogrTyeoKqRT

The podcast and artwork embedded on this page are from John Hubbard, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: New Cyber Frontier (LS 27 · TOP 10% what is this?)
Episode: NCF 302 Industrial IOT Digital Transformation
Pub date: 2022-07-12

Out host Christopher Gorog keeps the discussion today's guest Sachin Shan, from ARMIS is one of the leading-edge technology trailblazers for industrial IoT digital transformation. This exciting conversation is about what's next for industrial controls cybersecurity. Our guest tells us the importance of applying security practices before they become security standards through knowing your technology. Sachin Shan talks about having the right visibility over your security systems. Thanks again Sachin Shan for the great discussion, we know you will enjoy this episode of New Cyber Frontier.

Visit our sponsors:

BlockFrame Inc.

SecureSet Academy

Murray Security Services

The podcast and artwork embedded on this page are from Logic Central Online, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Safety First
Episode: Episode #57: Industrial Cybersecurity on a global scale
Pub date: 2022-07-11

Ed Chandler The Industrial IoT (IIoT) is growing and so are the cyberthreads. On a global scale this is even more important, as cyberattacks don’t stop at national borders.

In this episode we take a closer look at Industrial Cybersecurity. Together with Ed Chandler from TÜV SÜD Americas we discuss: How can industry standards help establish resilient IIoT ecosystems? What standards are actually relevant for Industrial IoT on a global scale? And why are Risk Assessments and Trainings indispensable.

The podcast and artwork embedded on this page are from TÜV SÜD, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Energy Central Power Perspectives™ Podcast
Episode: 87. 'Protecting The Grid With Municipal-Level Cybersecurity' With Hong Sae Of City Of Roseville
Pub date: 2022-07-12

In the increasingly digital world in which we operate, cybersecurity has become a core focus for leaders across the economy. In the utility industry in particular, ensuring systems are secured against potential cyber attack is a top priority, and the state of cybersecurity protections must continue to evolve as new technologies continue to get introduced to the ecosystem. For any utility big or small, the prospect of a cyber vulnerability can put customer data at risk, cause financial damages, and can even bring the operation of the grid down.

No matter the size or makeup of the utility, these truths remain consistent, though for smaller municipal utilities the challenge can be greater as they have fewer resources than large investor-owned utilities. That said, municipal utilities are stepping up to the challenge, and the guest on this week's episode is one of those great leaders in utility cybersecurity at the city level. Hong Sae is the CIO at the City of Roseville, and he joins host Jason Price and producer Matt Chester the weigh in on the unique municipal challenges and offer tips and tricks from his over a decade in this role.

Key Links Link to Create Your Own Profile on Energy Central: energycentral.com/user/register

Did you know? The Energy Central Power Perspectives Podcast has been identified as one of the industry's 'Top 25 Energy Podcasts': blog.feedspot.com/energy_podcasts

The podcast and artwork embedded on this page are from Energy Central, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Like industrial security a decade ago [The Industrial Security Podcast]
Pub date: 2022-07-11

Building automation cybersecurity is starting to happen, but most buildings are way back of their industrial peers. Mirel Sehic, Cyber Practice GM for Honeywell Building Technology, joins us to look at security for building automation, smart cities, and the results of a recent survey re: state of the practice.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #32 - ICS IR Eradication
Pub date: 2022-07-08

Na última quarta-feira, tivemos mais uma gravação do ICS SECURITY PODCAST. Nosso CEO Eduardo Honorato abordou o tema: ICS IR Eradication.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Defender's Advantage Podcast (LS 34 · TOP 5% what is this?)
Episode: Bonus: Securing OT/ICS Systems with Nozomi Networks
Pub date: 2022-07-07

This special episode of The Defender’s Advantage Podcast features Mandiant CTO Marshall Heilman speaking with Edgard Capdevielle, CEO of Nozomi Networks. The conversation, recorded in-person at RSA Conference 2022, delves into the partnership between Mandiant and Nozomi, and how the organizations can take on escalating cyber risks to secure cyber-physical infrastructure. Marshall and Edgard discuss the trends they are seeing in the industrial and critical infrastructure space and the role of zero trust in how we secure modern day OT and ICS systems.

You can learn more about Nozomi Networks at their website: https://www.nozominetworks.com/

Follow Nozomi Networks at @nozominetworks

Additional Resources

Learn more about the Mandiant Cyber Alliance Program: https://mndt.info/3xnXw5r

The podcast and artwork embedded on this page are from Mandiant, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 31 · TOP 5% what is this?)
Episode: ICS Security Month In Review - June 2022
Pub date: 2022-07-06

Unsolicited Response Month In Review show for June 2022. This is a replay of the live episode.

This month's stories:

Dragos (Rob Lee/Bloomberg and Dragos OT-CERT)
OT:ICEFALL w/ Daniel Dos Santos
Dept of Energy's Cyber-Informed Engineering Strategy Document

Plus my win, fail & prediction for the month

Links:

S4x23 Call For Presentations
Bloomberg Article on Rob Lee
Rob Lee's Response to Bloomberg Article
OT:ICEFALL
Eric Byres' Comments on OT:ICEFALL
Dept of Energy CIE Strategy Document
Demystifying The Myth of the 85% paper
Google Project Zero Article
Dick Brooks / REA Patent

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Dan Ricci on the ICS Advisory Project
Pub date: 2022-07-06

Dan Ricci joins the podcast to discuss the ICS Advisory Project. Ricci founded the project in 2018, which provides vulnerability management teams with a searchable, intuitive dashboard that visualizes industrial control system security and vulnerability advisories and threat data.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 45: Changing Careers to the Cybersecurity Field
Pub date: 2022-07-05

Derek Harp is happy to have Ted Greene, the Chief Operating Officer at Network Perception, join him today!

Ted is a Visionary Leader with a strong customer focus. He has a proven record of creating high revenue growth businesses that create shareholder value through new product introduction, identifying new market opportunities, leveraging opportunities with existing customers, solution-oriented sales, acquisition, and strong relationship development.

Ted is an entrepreneur. He is also a husband, father of three, thinker, strategist, and workaholic.

In this episode of the (CS)²AI Podcast, he talks about his background, career journey, and various entrepreneurial ventures.

This episode will interest you if you are a leader in another industry and thinking of entering the field of cybersecurity. Stay tuned for more!

Show highlights:

When he was twelve years old, Ted got a job as a paper boy. He has been working ever since then. (3:37)
Ted explains why he went into banking and talks about the different banks where he has worked. (5:38)
He explains why he quit his job to start his first business with a friend who was an early technologist. (7:32)
They became one of the first internet technology companies in the Midwest in 1994. (9:28)
Why will people entering the ICS space have decades of job security in that space? (13:58)
At this point, people in our country expect the critical infrastructure to be there and work. So it’s often hard to get their attention around that. (17:21)
Ted talks about his experience of co-founding several different companies. (21:09)
How Ted’s early experiences led to him starting Network Perception. (25:40)
Ted shares the key to being a successful entrepreneur. (27:40)
Ted always focuses on staying relevant and strategies for growth in his businesses. (31:41)
Ted offers advice for people considering bringing their experience from senior levels in other sectors to the cybersecurity sector. (40:44)
There are many exciting opportunities for growth in the cybersecurity space. (46:55)

Links:

(CS)²AI

Ted Greene on LinkedIn

Network Perception

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Data Breach Today Podcast (LS 32 · TOP 5% what is this?)
Episode: OT Security: Has the Industry Made Progress?
Pub date: 2022-07-01

OT security has been at the center of the security conversation ever since the Colonial Pipeline attacks. Scott Flower, the founder of Pareto Cyber and a former global intelligence officer at FS-ISAC, discusses the challenges in OT security and where the industry needs to go.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cybercrime Magazine Podcast (LS 30 · TOP 10% what is this?)
Episode: In Plain Sight. Protect Critical Infrastructure. Gordon Lawson, Conceal & John Karabias, Jacobs.
Pub date: 2022-07-01

In Plain Sight is a Cybercrime Magazine podcast series brought to you by Conceal. In this episode, host Hillarie McClure is joined by Gordon Lawson, CEO at Conceal, and John Karabias, VP of Strategic Development at Jacobs. Together, they discuss why protecting our critical infrastructure is a top priority, where to start when it comes to securing industrial control system environments, and more. Conceal is a zero-trust network privacy and security company that disguises and protects your enterprise’s online presence and privacy. To learn more about our sponsor, visit https://conceal.io

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: World Economic Forum (LS 42 · TOP 1.5% what is this?)
Episode: Global Cybersecurity Outlook
Pub date: 2022-07-01

The World Economic Forum’s Global Cybersecurity Outlook report indicates that cyberattacks increased 125% globally in 2021, with evidence suggesting a continued uptick through 2022. In this fast-changing landscape it is vital for leaders to take a strategic approach to cyber risks.How can leaders better prepare for future cyber shocks? What individual and collective actions will foster a more secure and resilient digital ecosystem?This is the full audio from a panel discussion at the World Economic Forum’s Annual Meeting 2022 in Davos

Moderator: Karen Tso, CNBC InternationalSpeakers: Jürgen Stock, Secretary-General, International Criminal Police Organization (INTERPOL) Josephine Teo, Minister for Communications and Information of Singapore Chander Prakash Gurnani, Chief Executive Officer, Tech Mahindra Limited Robert M. Lee, Chief Executive Officer and Co-Founder, Dragos

Read the Global Cybersecurity Outlook 2022 here: https://www.weforum.org/reports/global-cybersecurity-outlook-2022/

Transcript: https://www.weforum.org/agenda/2022/07/global-cybersecurity-outlook-davos-2022

The podcast and artwork embedded on this page are from World Economic Forum, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 31 · TOP 5% what is this?)
Episode: Richard Seiersen - Author Of The Metrics Manifesto
Pub date: 2022-06-29

Dale Peterson interviewed Richard Seiersen, author of new book The Metrics Manifesto: Confronting Security With Data.

For security controls - what would I see that would show me it is working? How do I measure the effectiveness and efficiency of my security controls?
Why is so much of the book code, and can the book be valuable if you don't go through the code?
A lot of time spent on categories of metrics: burndown and survival, arrival and escapes, and wait time
Most of the examples in the book are vuln prevention and remediation ... how will the statistics deal with increases due to SBOMs? ... how to address vulnerabilities with very different related risk?
How to address the CISO wanting a single dashboard with OT and IT metrics with very different risk related to those metrics?
The concept of value of / return on control and how some CISOs are dealing with cyber risk
Using SME beliefs as data
and a lot more

Links

The Metrics Manifesto
The book's site with code and other info
Richard Seiersen's S4x18 video: How To Measure Anything In Cybersecurity Risk

The Metrics Manifesto: Confronting Security with Data

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast (LS 26 · TOP 10% what is this?)
Episode: The OT-CERT provides critical resources to the industrial community.
Pub date: 2022-06-29

ICEFALL affects OT devices. Thermal cameras and industrial processes. Sandworm spies on infrastructure. Ransomware hits auto parts manufacturer. Most electricity, oil & gas, manufacturing firms have seen cyberattacks. Nuclear facility cyber exercises. Connecticut Guard trains to defend utilities.

Dawn Cappelli joins us to discuss how the OT Cyber Emergency Readiness Team is planning to address cybersecurity resource gaps for industrial infrastructure.

And in the learning lab, Nick Shaw joins us for part two of OT fundamentals, where he explains the Purdue reference model for industrial cybersecurity.

Control Loop News Brief.ICEFALL vulnerabilities affect OT devices

OT:ICEFALL: 56 Vulnerabilities Caused by Insecure-by-Design Practices in OT (Forescout)

Thermal camera vulnerabilities.

Multiple Vulnerabilities in Infiray IRAY-A8Z3 thermal camera (SEC Consult)

Vulnerabilities in access control panels.

Trellix Threat Labs Uncovers Critical Flaws in Widely Used Building Access Control System (Trellix)

Sandworm exploits Follina in phishing campaign.

Russian hackers start targeting Ukraine with Follina exploits (BleepingComputer)

Ransomware hits automotive hose manufacturer.

US Subsidiary of Automotive Hose Maker Nichirin Hit by Ransomware (SecurityWeek)

Most ransomware victims are attacked a second time.

Ransomware: The True Cost to Businesses (Cybereason)

89% of electricity, oil & gas, and manufacturing firms have been hit by cyberattacks.

Cyber-Attacks on Industrial Assets Cost Firms Millions (Trend Micro)

Control Loop Interview.Dawn Cappelli on how the OT Cyber Emergency Readiness Team (OT-CERT) is addressing the cybersecurity resource gaps that exist in industrial infrastructure. Follow Dawn on LinkedIn.

OT-CERT is an Operational Technology – Cyber Emergency Readiness Team dedicated to addressing the OT resource gap that exists in industrial infrastructure. Designed to support asset owners and operators of industrial infrastructure, Dragos OT-CERT provides free cybersecurity resources for the Industrial Control System (ICS) /OT community. Learn more about OT-CERT here.

Control Loop Learning Lab.Mark Urban is joined by Nick Shaw for part two of an intro to OT.

A Collection of Resources for Getting Started in ICS/SCADA Cybersecurity.

Building security to achieve engineering and business requirements.

Subscribe to the Control Loop Newsletter here with new editions published every month.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 44: Communications Expertise Can Improve Cyber Security with Brian Foster
Pub date: 2022-06-28

Derek Harp is happy to have Brian Foster, the GMS Security Lead at Southern California Edison, joining him on the show today!

Brian Foster is a highly-skilled former Controls Engineer turned OT Cyber Security expert turned Security Leader. He has multiple degrees in engineering and years of experience in managing and leading within the OT Cyber Security field.

Brian is a well-rounded individual! He is a known speaker and contributor in the cybersecurity industry. He is an engineer, controls systems cybersecurity expert, pilot, brewmaster, outdoorsman, hunter, mentor, dog lover, and husband.

In this episode of the (CS)²AI Podcast, he talks about his backstory, discusses his career journey, and shares many nuggets of advice from his years of experience in the industry. He also highlights the importance of clear communication.

You won’t want to miss this episode if you want to learn more about cybersecurity or you’re looking for ways to get a foot in the door of the industry! Stay tuned for more!

Show highlights:

Brian’s journey was not a clean one. It was more a series of good mistakes. (2:14)
Brian has had computers and technology around him for as long as he can remember, and he loved playing games when he was growing up! (4:49)
He did not intend to go into controls engineering. (8:45)
Having an understanding of networking is fundamental for a successful career. (10:42)
Brian learned a lot about technology from the mistakes he made. (11:53)
Cybersecurity was always in the background, but it became a part of Brian’s life when he got bored with controls. (13:17)
One of his first professional forays into cybersecurity happened when he was an expert witness in a court case. (15:04)
There is often friction and distrust between OT people and those in IT cybersecurity. Brian shares his thoughts. (18:43)
Many people struggle to use spoken language to communicate their ideas to one another articulately. That leads to many challenges. (28:37)
Southern California Edison has much more of an eye on security than many other utilities Brian has worked with, either directly or indirectly. (32:23)
Brian views cybersecurity systems as no different from safety systems. (37:02)
The industry needs more people who know what they are doing. Brian struggles to find them, so he mentors people trying to get a foot in the door and learn about cybersecurity. (39:21)
Brian offers tactical advice for people entering the cybersecurity space. (43:34)
Brian sees a lot of promise for the future with containerization technology in the OT space. (48:20)

Links:

(CS)²AI

Brian Foster on LinkedIn

Southern California Edison (SCE)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Legislation demands state of the art [The Industrial Security Podcast]
Pub date: 2022-06-27

Jens Wiesner of the German BSI joins us - new German critical infrastructure laws demand immediate reporting and certified state-of-the-art attack detection.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Phil Venables - CISO at Google Cloud
Pub date: 2022-06-22

Phil Venables joins Dale to discuss OT's use, today and in the future, of cloud and edge services. They focus on reliability, security and use cases. The end of the episode focuses on how leadership views security. Phil writes some of the most interesting articles on security at philvenables.com.

Check out the links below for some of Dale's recent favorites.

Defense in Depth

Resilience is about Capabilities, Not Plans

If Accounting were like Cybersecurity

Organizational Politics

Also check out the S4x23 CFP

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #31 - Segurança em Redes de Automação Industrial
Pub date: 2022-06-24

Na última quarta feira tivemos mais um ep. do ICS SECURITY PODCAS, nosso CEO Eduardo Honorato abordou o tema Segurança em Redes de Automação Industrial.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: The Myth of 85% US Critical Infrastructure Being Privately Owned
Pub date: 2022-06-22

Dale's weekly article originally published on 21 June 2022.

View Details

Podcast: Pipeliners Podcast (LS 38 · TOP 2.5% what is this?)
Episode: Episode 237: What Every Pipeliner Should Know About Cyber Security with Russel Treat
Pub date: 2022-06-21

This week's Pipeliners Podcast episode features host Russel Treat walking through how each individual pipeliner should think about pipeline cyber security as it relates to supporting their operation. The conversation centers on three key areas of threats, understanding, and mitigation.

Access the show notes and full episode transcript at PipelinePodcastNetwork.com.

The podcast and artwork embedded on this page are from Russel Treat, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Don C. Weber on ICS Cybersecurity Training, Education
Pub date: 2022-06-15

Don C. Weber, founder of Cutaway Security, joins the podcast to discuss his extensive career in information security, his journey to industrial control system cybersecurity, and his desire to educate, train and mentor others in the community.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Emerson Automation Experts
Episode: Growing Cybersecurity Threats and Mitigation Approaches Podcast
Pub date: 2022-06-15

Cybersecurity was a big topic at the 2022 ARC Industry Forum in Orlando, Florida. While there, I had the opportunity to sit down and catch up with Emerson’s Director of Cybersecurity, Mike Lester. We discussed many of the issues and growing threats companies face, as they try to maintain strong cybersecurity postures.

Unfortunately, there is no silver bullet to becoming cyber-secure and maintaining strong defenses. Mike offers guidance on ways to develop a strong culture and address these challenges over time.

Visit the Cybersecurity section on Emerson.com and subscribe to our continuing series of Emerson Automation Experts podcasts.

Transcript Jim: Hi, everyone. This is Jim Cahill with another “Emerson Automation Experts” podcast. Today, I’m here at the 2022 ARC Forum in Orlando, and joined by Emerson’s director of cybersecurity, Mike Lester, to discuss some of the latest happenings in cybersecurity. Welcome, Mike.

Mike: Thanks, Jim.

Jim: Well, let’s get everyone grounded with a little bit of your background, and path to your current role here at Emerson.

Mike: Sure, Jim. So, I’ll start way back in the Air Force, I was an aircraft mechanic back from 1985. so I did that for 12 years and then moved into communications, which was networking, data center operations, cybersecurity, you name it, and we did it from a technology perspective. And then after doing that for 10 years, I moved into Emerson as the operations manager for IT in the Rosemount twin cities factories, and helped, you know, maintain the factories, and networks, and systems there. Then moving into information security role for the then Process group. And then in 2017, moving into the current role for product security in the technology arm of the organization today, where I get to interact with customers, and all the business units around cybersecurity strategy, as well as technologies and governance.

Jim: Well, that sounds like a really strong background, and I know cybersecurity is one of the key topic areas here at the conference this week. So why does cybersecurity remain such a large concern in the critical infrastructure space?

Mike: Jim, there’s some obvious reasons and responses here, like, ever-increasing threats and successful attacks against critical infrastructure targets. Cybersecurity remains a large concern because there’s been a clear shift from gang-related cyberattacks seeking financial gain, to cyber as a fifth element of war with all nature of attacks between different threat actors, nation-states to nation-state saboteurs, to nation-state to private industry and in critical infrastructure sectors.

A good example of this dynamic is Russia launching cyberattacks against Ukraine, days before the kinetic attacks began. Followed by that, was a global community of independent volunteer hackers that attacked and provided intelligence to the world about where oligarchs were docking their yachts, and much more direct, defensive, and offensive. Essentially crowdsourcing cyber warfare without anybody asking them to do it. Likewise, there’d been malicious threat actors like Anonymous, since most people are familiar with them, who chose sides in the cyber warfare effort. The threats are real, and we need to begin putting them into context in order to analyze risk with trained professionals in this space as opposed to some historically dismissive behavior or thinking that it can never happen.

Jim: Yeah. It sounds like the degree of difficulty for companies to deal with it has gone way up, so there’s more that needs to be done. So I guess, given the strategic importance of critical infrastructure like manufacturing, what are the key areas of concern?

Mike: Safety is always at the top of the list for concerns, but I would also couple this with the additional consequences of operational disruptions, leading to loss of revenue, supply chain disruption, all the way through to potential extreme or extended social and national capability disruptions, from lack of resiliency in cybersecurity and operations. Look, we depend on a Jenga stack of people, processes, and technology to live our daily lives with electronic everything. This includes our homes, our work, grocery stores, fuel, our national security, our entire way of life is really dependent on the continued and successful operation of critical infrastructure.

And if I extend that Jenga analogy, you know, if you take the wrong block out, the entire structure can fail. And we’ve seen this, some blocks have been taken out or partial collapses in many places. But when we look at the cases like Venezuela and Haiti, where power outages lasted for extended periods of time, there were significant disruptions across the spectrum of what we would consider normal society and livelihood capabilities. We need to be cognizant of the possible, and engineer capabilities in critical infrastructure to match the risk. This may seem a bit doom and gloom but, you know, in reality, they are possible in civilization. We need to manage the risk appropriately in a way that equals a holistic capability. We need to work collaboratively and recognize the role that we have.

Jim: I think that Jenga analogy is a real good one and gives people a picture of the challenges that we face in that. So what are some of the root causes of these points of concern?

Mike: You know, it might be a little unexpected, but, you know, and I’m not gonna go point to a particular control or get dived down into the real technical details, recognizing that in reality, we have imperfect systems, and devices operated by imperfect processes, and often undertrained, imperfect people, we must look across the spectrum to determine how we can prioritize efforts in the right place. I believe this confusion or varying opinions to achieve better levels of cybersecurity, coupled with an extreme shortage in appropriate talent in the workforce, have led the industry to focus on a silver bullet approach primarily with technology solutions, and a market that fuels this approach. And we are misaligned through focus on discrete objectives, rather than industry, regional, national, company-strategic objectives that achieve outcome-based risk management, as opposed to compliance-oriented risk management that’s failed us for decades.

A good example of this is antivirus or anti-malware, everybody’s familiar with that, being a mandatory compliance requirement for audits. When in reality, when it finds malware, it’s already in your environment, and likely active. Anti-malware is known as a reactive tool in the cybersecurity professional space, and what we should be focusing on is preventing that malware from getting into our environments in a proactive manner.

Jim: Well, I guess we all wish there was a silver bullet to handle it, but much like other things, safety, there is no single thing that just makes everything perfect for you. So what can be done to mitigate these cybersecurity risks and threats?

Mike: There’s a spectrum of thing, but it really equals work. Lots of work, with appropriate investment strategies, and dedicated budgeting. Threats can really only be addressed by more cyber-resilient and capable products, systems, services, supply chains, and operations. This requires cybersecurity skill and expertise across all business functional areas, similar to finance, or legal. Everyone in the company has a fiduciary expectation and responsibilities that they must meet. They don’t need to be a finance major, or certified public accountant, or a CFO.

More directly, I always like to start with an assessment for your operations to determine gaps and create a plan to remediate those in a prioritized manner. We need to expand this thought process to all aspects of our business and across all functions if we’re gonna get beyond compliance to higher levels of maturity and capability. It’s not gonna be easy, and it’ll likely stretch, or break most paradigms of how to approach holistic cybersecurity that can achieve cyber and operational resiliency to the levels needed in our industries, and for future opportunities in automation and control.

Jim: Well, yeah. It does sound like when you’re trying to tackle a very difficult problem, starting with the assessment and really prioritizing the things that need to be done, so it just doesn’t feel overwhelming. It seems like that’s a very logical approach to attack this very difficult problem. So what are your top recommendations to manufacturers and producers to strengthen their cyber defenses?

Mike: Often we’re gonna be looking for…customers may be looking for, or other business folks may be looking for a list, “Here’s my checklist of things to do.” But really what it comes down to is, work with industry experts and cybersecurity partners, get an outside perspective, or a gap analysis. Cybersecurity in general from a people, process, and technology perspective, has very fast-paced rate of change across a full landscape. So it’s likely what was known about your operations last year, or when it was implemented, they’re stale data points. You know, looking to…or working with partners to build cybersecurity and operation resiliency in business investments, processes, implementations, etc., you know, with a prioritized business risk-based approach, is a really good start.

Often, conversations around achieving cybersecurity devolve into technology and leverage, versus how to accomplish the right proactive or active defense against threats from the nation-state actors I spoke about earlier on, you know, an active cyber warfare landscape. I’m not saying this really to, you know, instill fear, uncertainty, or doubt, or what we commonly hear as FUD, but to really speak truth about what we face as an industry and as a society. Technology changes to improve cybersecurity capabilities will always be slow to implement and embed into systems and devices that control safety, operations, and the critical infrastructure segments. We’ve gotta understand the spectrum of cybersecurity architecture’s capabilities and operations that can enable resilient operations and fast recovery from what seems to be an inevitable incident that impacts manufacturers and producers.

Jim: Well, I think that’s some good guidance of how to think about it and approach it. So where can our listeners go to learn more about ways to build their cybersecurity posture and culture?

Mike: There’s a lot of good resources. I like to point folks, if they wanna be vendor-agnostic or they don’t…maybe they’re looking at vendors and asking whether we’re gonna sell them the silver bullet approach, you know, we can use resources like the national government’s U.S. Department of Homeland Security in the U.S., the Cyber and Infrastructure Security Agency (CISA), or the UK’s National Cybersecurity Centre, and others, you know. Most recently, Emerson’s partner Dragos, launched a program called OT-CERT. That provides free resources for companies who may not have the expertise available to help them understand the complex space of cybersecurity, and how to mature their programs, or even initialize their programs. Emerson also has a portfolio of cybersecurity capabilities like assessments, products, and services that focus on enabling secure customer operations. The bottom line is we really like to work with our customers and achieve their cybersecurity, and ultimately their business objectives.

Jim: Well, that’s a great summary of places to go for more information, and I’ll add a link to the cybersecurity section on emerson.com for more on the tools and solutions to help our listeners in their cybersecurity efforts. Well, Mike, I wanna thank you for joining us today. I hope our listeners got as much out of this as I did.

Mike: Thanks, Jim. Appreciate you having me.

The podcast and artwork embedded on this page are from Emerson Team, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Cyber Insurance Debate
Pub date: 2022-06-15

The Debate Question: Cyber Insurance Will Play A Major Role In OT Cyber Risk Management In The Next 3 To 5 Years Debating The Pro Case: Monica Tigleanu of MunichRe Speciality Insurance

Debating The Con Case: David White of Axio

(Note - The debaters were charged with making the most compelling case for their position. In some cases this doesn't represent their views).

Links

S4x23 Call For Presenations

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast
Episode: ICS training and education is a maturing domain.
Pub date: 2022-06-15

Subscribe to the Control Loop Newsletter here with new editions published every month.

UK Attorney General discusses hacking back in defense of critical infrastructure. Ethiopia says it stopped cyberattacks on its Nile dam. Recommended cybersecurity improvements for dams in the Southeastern US. Water system security. MITRE releases supply chain security framework. CISA and its partners issue guidelines for evaluating 5G implementation. Deloitte opens a Smart Factory at Wichita State University.

Tim Conway from SANS discusses his path to OT cybersecurity, workforce and cyber skills development for OT personnel, and new developments in cybersecurity education for industrial security.

And in the Learning Lab, Mark Urban is joined by Nick Shaw for part one of an intro to OT.

Control Loop News Brief.Hacking back in defense of critical infrastructure.Defensive Cyber Attacks Declared Legal by UK AG, Path Cleared to “Hack Back” When Critical Infrastructure & Services Attacked. (CPO Magazine)

TVA recommends cybersecurity improvements for dams in Southeastern US.Request for Final Action - Audit 2020-17340 Non-Power Dam Control Cybersecurity. (Office of the Inspector General, TVA)

INSA says cyber attack on GERD, financial institutions foiled. (Addis Standard)

Water system security.Cyberspace Solarium congressman, water officials decry EPA inaction on cybersecurity. (CyberScoop)

MITRE releases supply chain security framework.Mitre’s New “System Of Trust” Protects Vulnerable Supply Chains (MITRE)

CISA and its partners issue guidelines for evaluating 5G implementation.5G Security Evaluation Process Investigation Version 1 (CISA)

Ransomware attack on FOXCONN Mexico factory operations..Foxconn: Mexico factory operations ‘gradually returning to normal’ after ransomware attack. (The Record)

LockBit, Conti most active ransomware targeting industrial sector. (Bleeping Computer)

Deloitte opens US Smart Factory.Deloitte Opens New US Smart Factory in Wichita, Kansas, Convenes Ecosystem of Innovators to Make Industry 4.0 a Reality (PR Newswire)

Control Loop Interview.Tim Conway from SANS discusses his path to OT cybersecurity, workforce and cyber skills development for OT personnel, and new developments in cybersecurity education for industrial security.

His LinkedIn profile may be found here; follow him at the SANS Institute here.

Control Loop Learning Lab.Mark Urban is joined by Nick Shaw for part one of an intro to OT.

A Collection of Resources for Getting Started in ICS/SCADA Cybersecurity

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: OT Cyber insurance is changing fast [The Industrial Security Podcast]
Pub date: 2022-06-14

"Silent" cyber coverage has vanished in most insurance policies, and you can't get cyber insurance any more without cyber security. Georgina Williams, Senior Cyber Underwriter at Murich RE joins us to look at how insurers are digging deep into both engineering and security aspects of industrial cyber risk.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 42: How Skills Outside of the CyberSecurity Space Lay the Groundwork for a Great CyberSecurity Career with Art Conklin
Pub date: 2022-06-14

Derek Harp is happy to have Art Conklin, another legendary ICS control systems cybersecurity figure joining him on the show today!

Art is an experienced Information Systems Security professional. He has a background in software development, systems science, and information security.

He is qualified with CISSP, GICSP, GRID, GCIP, GCFA, GCIA, GCDA, CSSLP, CRISC, and Security+.

His specialties include information systems security management, network, and systems security, intrusion detection and intrusion detection monitoring, penetration testing, Incident Response, security policy and procedures, risk/threat assessments, Security training/awareness, user interface design and evaluation, FISMA, Secure code design/software engineering, cyber-physical systems security, and security metrics.

Art is a hacker at heart. Art was born in St. Louis, Missouri, in 1960. He has been a professor at the University of Houston for many years! He is also a well-known speaker, military veteran, technologist, author, sailor, rocket scientist, father, husband, and grandfather. In this episode of the (CS)²AI Podcast, he talks about his formative years, a life-changing Navy experience, taking advantage of learning situations outside of college, the application of knowledge, the benefits of getting an MBA, and the benefits of on the job training,

If you want to get into the cybersecurity space, you will not want to miss this episode - even if you have qualifications in a different area.

Show highlights:

There is a different level of thinking that gets taught and applied today. (5:49)
After doing courses at different universities and then starting med school, Art realized it was not where he wanted to go because it was science, not tech, and it was very theory-driven. (8:10)
Art wanted a career where he could do stuff, so he was advised to get an MBA from Harvard or join the military to learn how to lead men, manage a budget, and learn the difference between those things. Harvard was out of reach, so he joined the Navy. (9:07)
Art talks about the unique military experience that changed his perspective and made him who he is today. (11:05)
The cyber-world can benefit from people with no college degree who have problem-solving abilities, communication skills, and the ability to lead. (15:08)
Learning is about more than just knowledge because knowledge needs to be applied. (18:38)
Art wanted to leave the Navy to join IBM, but the Admiral did not want him to leave and offered him the opportunity to go to Navy Post Graduate School with no payback. So Art spent three years studying space system engineering, got a Ph.D. equivalent, and flew on a spacecraft. (20:40)
In some respects, transitioning out of the military is not easy, from a job perspective. (24:01)
Art explains why he did another degree after getting his doctorate. (27:44)
Art talks about the qualities of his various mentors and the importance of having connections with people with aspects that will broaden you and make you smarter. (29:14)
What he has done and is currently doing at the University of Houston. (32:32)
If you want to work in cybersecurity and you have a breadth of knowledge and experience, you are likely to succeed in the space. (39:16)
If you want to learn more about OT, many resources are available. Use and apply them. You can also email Art for local resources at waconklin@uh.edu.
Most people are willing to share their knowledge and become mentors, so reach out to those you look up to. (44:42)
How to invest in yourself. (46:20)

Links:

(CS)²AI

Art Conklin on LinkedIn

The University of Houston (Search for cybersecurity)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 30 - ISA/IEC 62443 - Entendendo e Aplicando.
Pub date: 2022-06-10

Chegamos ao episódio 30! Nosso CEO Eduardo Honorato irá abordar o tema: "ISA/IEC 62443 - Entendendo e Aplicando". Neste episódio você irá entender a norma 62443 e como aplicá-la em todas as fases. Para participar, basta clicar abaixo e adicionar ao seu calendário para receber a notificação. Nos vemos lá!

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast
Episode: A Day in the Life of an OT Responder
Pub date: 2022-06-09

Response time refers to the amount of time that takes place between when we perceive something to when we respond to it. It is the ability to detect, process, and respond to a situation. In this case, we look at what a typical day an Operational Technology (OT) responder must endure and why this role is crucial within critical infrastructure and industrial control networks.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: New Course ICS418: ICS Security Essentials For Managers
Pub date: 2022-06-08

Dale talks with Jason Christopher, a SANS Certified Instructor, who along with Dean Parsons created the new course SANS ICS418: ICS Security Essentials For Managers. They cover a lot of ground including:

What manager this course was designed for?
Why does a course for managers need a VM and course labs
The significant portion of the course addressing metrics. Why, what kind, for whom?
Does it address consequence reduction, working with engineers
What sort of team building and management advice is included
How is the course given? Live? Online?

Links

ICS418 Course Info

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 41: Writing a Book to Leverage Your Expertise and Improve Your Career with Pascal Ackerman
Pub date: 2022-06-07

Derek Harp is happy to welcome Pascal Ackerman as his guest for today’s podcast!

Pascal is a security professional, focused on industrial control systems and he's currently the Managing Director of Threat Services at ThreatGEN. He has a Master’s of Science degree in Electrical Engineering (MSEE/CE). He has had 18 years of experience in industrial Ethernet design and support, information and network security, risk assessments, pen-testing, forensics, and threat hunting, WAN/LAN/Internet and Wireless Technologies, Windows Environments, Unix, Linux, IIS, and Apache.

He specialized in the architecture, engineering, and securing of plant-wide Ethernet networks using Purdue-model design strategies, IDS/IPS sensors, network monitoring, Security Information, and Event Management (SIEM) solutions, next-gen firewalls, MS domain services, WSUS servers, MS SQL server clusters, etc.

Pascal was born and raised in the Netherlands. Right after leaving high school, he was put behind a POC by a company that sent him out across the world installing prototype machinery for filling machines. He is an engineer, programmer, gamer, hacker, traveler, tinkerer, pen-tester, and father.

In this episode of the (CS)²AI Podcast, he shares his superhero backstory and discusses his certifications, his education, and his career path. He also offers advice for those who would like to get into the field of cybersecurity and people thinking about writing a book.

If you are considering a career in cybersecurity or if you are an engineer and want to specialize in cyber security, you will gain a lot from this podcast! Stay tuned for more!

Show highlights:

After leaving college, Pascal stayed with the company where he did his internship. The company got him to set up a software simulation to test their POC programs and later put him on their commissioning team. (6:51)
Pascal talks about what he did while working as a controls engineer. (8:08)
How Pascal got invited to move to the US to continue with his work. (9:50)
Pascal explains how many doors opened for him after presenting his first report in 2005. (12:27)
Pascal talks about how security measures first intersected with his work in 2008-2009. (14:07)
Pascal pinpoints the moment when he decided to change his career path. (16:00)
Pascal offers advice for traditional engineers who want to improve what they do and join the cyber security workforce. (17:35)
A Network Plus certification will help controls engineers understand the fundamentals of networking. (18:19)
Pascal explains why he got hired as a commercial engineer in Network and Security at Rockwell. (21:16)
Pascal talks about his book, Industrial Cybersecurity. (23:39)
The book Hacking Exposed by Clint Bodungen inspired Pascal to write his first book. (27:50)
How Threat GEN became a company based around a game Pascal developed. (29:10)
Pascal offers advice on where people in IT who want to know more about safety, reliability, resiliency, and POCs can start. (32:36)
The most successful companies have a combined IT and OT team with knowledgeable people on both sides. (36:43)
Why do you need to figure out what you like the most and focus on that technology? (37:58)
Architecture will be the next big step for monitoring everything. (45:06)
Pascal discusses the process of writing his books and offers advice for those who would like to write a book. (45:49)

Links:

(CS)²AI

Pascal Ackerman on LinkedIn

Industrial Cybersecurity by Pascal Ackerman

Books mentioned:

Hacking Exposed by Clint Bodungen

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Idaho National Lab on the INL Control Environment Laboratory Resource (CELR)
Pub date: 2022-06-02

Tim Huddleston of Idaho National Laboratory joins the Aperture podcast to discuss the INL Control Environment Laboratory Resource (CELR). CELR is a simulated critical infrastructure environment where users may test their incident response capabilities against real-life attack scenarios. Users may also use the environment to conduct malware and vulnerability analysis of ICS and SCADA devices, and also test product capabilities against simulated cyber-physical attacks. Learn more about CELR here.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: May - ICS Security Month In The Review
Pub date: 2022-06-01

This is a solosode with Dale covering the two top stories from the month plus a win, fail and prediction.

Links

Schneider Electric SAAS on Azure for DERMS
Emerson ZEDI for water press release.
Dept of Transportion document on proposed fine for Colonial Pipeline.
ICS version of Backdoors & Breaches card deck.

View Details

Podcast: Data Breach Today Podcast (LS 31 · TOP 5% what is this?)
Episode: Developing Medical Device Cybersecurity Maturity Benchmarks
Pub date: 2022-05-25

An effort to establish industry benchmarks for medical device cybersecurity maturity aims to help advance overall cybersecurity in the healthcare sector, says Rob Suárez, CISO of medical device maker Becton, Dickinson and Co. He discusses how to improve the state of medical device cybersecurity.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast
Episode: Welcome to Control Loop: Giving back to the OT community.
Pub date: 2022-06-01

Every two weeks, get the latest in OT news in Control Loop News Brief, an interview featuring a thought leader in the OT space sharing current industry trends, and the Control Loop Learning Lab’s educational segment. A companion monthly newsletter is available through free subscription and on the CyberWire's website.

Headlines include: Russia’s hybrid war against Ukraine. Russian threat actors against industrial control systems. Exploits for Bluetooth Low Energy. Hacktivists claim attacks against Russian ground surveillance robots. New wiper loader. Turla threat actor reconnaissance in Estonian and Austrian networks. Robert M. Lee, CEO of Dragos, talks giving back to the OT community and shares insights on Pipedream malware. Learning Lab has Dragos' Mark Urban and Jackson Evans-Davies talking about the fundamentals of OT cybersecurity.

Control Loop News Brief.Continuing expectations of escalation in cyberspace.Microsoft President: Cyber Space Has Become the New Domain of Warfare - Infosecurity Magazine

Cyber Attacks on Ukraine: Not What You Think | PCMag

Warning: threat actor targets industrial systems.US warns energy firms of a rapidly advancing hacking threat - E&E News

PIPEDREAM: CHERNOVITE's Emerging Malware Targeting Industrial Environments | Dragos

Pipedream Malware: Feds Uncover 'Swiss Army Knife' for Industrial System Hacking | WIRED

Indestroyer2 and Ukraine's power grid. Twitter: @ESETresearch

Industroyer2: Industroyer reloaded | WeLiveSecurity

Russian hackers tried to bring down Ukraine's power grid to help the invasion | MIT Technology Review

Bluetooth vulnerabilities demonstrated in proof-of-concept.NCC Group uncovers Bluetooth Low Energy (BLE) vulnerability that puts millions of cars, mobile devices and locking systems at risk

Tesla Hacker Proves a Way of Unlocking Doors, Starting Engine - Bloomberg

CISA and its international partners urge following best practices to prevent threat actors from gaining initial access.Weak Security Controls and Practices Routinely Exploited for Initial Access | CISA

Hacktivists claim to have compromised Russian-manufactured ground surveillance robots.Did hackers commandeer surveillance robots at a Russian airport?

Twitter: @caucasnet

Politically motivated DDoS attack on Port of London Authority website.Twitter: @LondonPortAuth

Pro-Iran Group ALtahrea Hits Port of London Website by DDoS Attack

New loader identified in wiper campaigns.Sandworm uses a new version of ArguePatch to attack targets in Ukraine | WeLiveSecurity

Turla reconnaissance detected in Austrian and Estonian networks.Russian hackers perform reconnaissance against Austria, Estonia

TURLA's new phishing-based reconnaissance campaign in Eastern Europe

SANS ICS Summit is coming to Florida, June 1-9.ICS Security Summit & Training 2022

Colonial Pipeline’s ransomware attack, one year later.How the Colonial Pipeline attack instilled urgency in cybersecurity

OT vulnerabilities as credit risk.Operational Technology Cyberattacks Are a Credit Risk for Utilities

A Cyber Resilience Pledge. Global CEOs Commit to Collective Action on Cyber Resilience

Recent threat intelligence findings from Dragos.Dragos ICS/OT Ransomware Analysis: Q1 2022

Control Loop Interview.Robert M. Lee, CEO of Dragos, on giving back to the OT cybersecurity community, the idea behind the Control Loop podcast and newsletter, and his candid thoughts on the Pipedream malware and its creators.

Follow Rob on LinkedIn and Twitter.

Control Loop Learning Lab.Dragos’ Mark Urban and Jackson Evans-Davies on the fundamentals of OT cybersecurity and network architecture.

Dragos 2021 ICS Cybersecurity Year in Review

How to Build a Roadmap for ICS/OT Cybersecurity: 3 Steps to a Sustainable Program

Managing External Connections to Your Operational Technology Environment

Improving ICS/OT Security Perimeters with Network Segmentation

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 40: ICS Village and Why You Should Attend DefCon with Bryson Bort and Tom VanNorman
Pub date: 2022-05-31

Today, we got a special episode to highlight a really neat initiative that’s been in the works for awhile. My guests are Bryson Bort and Tom VanNorman.

Bryson is the Founder of SCYTHE, a start-up building a next generation attack emulation platform, and GRIMM, a cybersecurity consultancy, and Co-Founder of the ICS Village, a non-profit advancing awareness of industrial control system security. He is a Senior Fellow with the Atlantic Council’s Cyber Statecraft Initiative, the National Security Institute, and an Advisor to the Army Cyber Institute. As a U.S. Army Officer, he served as a Battle Captain and Brigade Engineering Officer in support of Operation Iraqi Freedom before leaving the Army as a Captain. He was recognized as one of the Top 50 in Cyber in 2020 by Business Insider.

Tom leads the CyPhy Product group at GRIMM, where his primary focus is securing Industrial Control Systems and the networking of such systems. Tom brings an unparalleled level of operational knowledge and experience, as he has been working in the Operational Technology (OT) field for almost three decades. He also has considerable knowledge in constructing Cyber Physical testing environments for OT systems.

Tom co-founded the ICS Village, a non-profit organization focused on Control System security and awareness. He is also retired from the Air National Guard, where he worked in Cyber Warfare Operations.

ICS Village is holding Def Con 29, a 100% virtual event that takes place Aug 6th-8th. There are sessions and workshops covering all aspects of ICS.

Show Highlights:

How ICS Village was started
The original 2 events - RSA and DefCon
GRIMM and their involvement in ICS Village
Why no one was thinking about Industrial control systems before ICS Village
The artwork that started it all
All of the events that ICS Village has throughout the year
How the pandemic changed DefCon and the other ICS Village events
The birth of Hack the Plant Podcast
Capture the Flag and what we can learn from it
Highlights of DefCon Table Talks and other sessions

Links:

CS2AI.org

ICS Village

DefCon Event happening Aug 6-8

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Loop: The OT Cybersecurity Podcast
Episode: Introducing Control Loop, the industrial cybersecurity podcast.
Pub date: 2022-05-26

Cybersecurity for Operational Technology and Industrial Control Systems.The Control Loop podcast, hosted by the CyberWire’s Dave Bittner, investigates the latest threat intelligence, security strategies, and technologies that industry professionals rely on to safeguard civilization. Every two weeks, Dave analyzes the biggest stories in OT security with commentary from key industry leaders and operators. Each episode includes new guests who provide the insider’s perspective on major threats and vulnerabilities, novel ideas and solutions, and critical training topics.

Control Loop Episode 1 premieres on June 1st, 2022.Listen and subscribe to thepodcast wherever you get your favorite shows and subscribe to thenewsletter on the CyberWire website.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Common mistakes in OT visibility deployments [The Industrial Security Podcast]
Pub date: 2022-05-30

A lot can go wrong - Enrique Martinez Technical Solutions Architect for OT Security at WWT joins us to look at common mistakes when deploying OT asset inventory, IDS and other visibility solutions - and how to avoid them.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 29 - ICS Zero Trust
Pub date: 2022-05-27

Na última quarta-feira tivemos mais uma gravação do ICS Security Podcast. Nosso CEO Eduardo Honorato convidou o Arnaldo H Omoto - Director of Alliances and Business para falar sobre ICS Zero Trust.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Defender's Advantage Podcast (LS 33 · TOP 5% what is this?)
Episode: Frontline Stories: OT/ICS Security
Pub date: 2022-05-26

In the inaugural episode of the Frontline Stories series, part of The Defender’s Advantage Podcast, host Kerry Matre is joined by Rob Caldwell, Director of OT/ICS Services at Mandiant. During the conversation, they discuss OT/ICS security and the impact an OT attack can have on an organization. They also dive specifically into the INCONTROLLER and INDUSTROYER2 attacks and how they targeted OT environments.

For more information on OT/ICS Security, visit https://mndt.info/3PF5JJD

You can follow Rob Caldwell at @robac3.

Don’t forget to rate, review, and subscribe where you listen to podcasts.

The podcast and artwork embedded on this page are from Mandiant, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control Amplified: The process automation podcast
Episode: Ethernet switching for the OT world
Pub date: 2022-05-27

Full featured managed switches from the IT world feature an impressive array of options and functionality—perhaps too many for operational technologists. Unmanaged switches, on the other hand, are relatively unsophisticated devices that cost less, but lack security and redundancy features. In this episode of Control Amplified: The Process Automation Podcast, Keith Larson talks to Charlie Norz, product manager for I/O systems, WAGO USA, about a network switch option designed specifically for the needs of OT applications—and the priorities and skillsets of the engineers and technicians that work with them.

Learn more about WAGO: https://www.wago.com/

Read the transcript: https://www.controlglobal.com/podcasts/control-amplified/ethernet-switching-for-the-ot-world

The podcast and artwork embedded on this page are from ControlGlobal, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Thomas Schmidt and Martin Scheu on the Common Security Advisory Framework
Pub date: 2022-05-26

Thomas Schmidt of the German Federal Office for Information Security and Martin Scheu, an OT Security Engineer at SWITCH-CERT, join the podcast to discuss the Common Security Advisory Framework (CSAF).

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Interview With Dave Lewis
Pub date: 2022-05-25

This is the audio from my interview with Dave Lewis, a Global Advisory CISO at Cisco, on the S4x22 Main Stage.

Dave has experience securing both IT and OT (he worked for electric utilities in Canada). Even more interesting is he talks every week with a wide variety of CISO's.

It's a wide ranging discussion that hits a lot of different areas on how to work and communicate best with CISO's and executive management on ICS security and cyber risk.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 39: From Mechanical Engineering to Database Mastery for Cyber Security
Pub date: 2022-05-24

Derek Harp is happy to have Wanda Lenkewich, the Founder and CEO of Chinook Systems joining him on the podcast today!

Wanda Lenkewich harnesses her subject matter expertise in engineering and construction, lifecycle commissioning, and facility management to advance the security and resiliency of critical infrastructure. She is the CEO of Chinook Systems Inc., leading an interdisciplinary team dedicated to commissioning, building systems and controls upgrades and replacements, and cybersecurity for facility-related control systems. Lenkewich has a passion for digital transformation and continues to innovate and advance technology that will protect and extend the life of buildings. That includes the full integration of cybersecurity into Chinook’s commissioning technology; Chinook's CyberCxTM program. Lenkewich is an industry advocate and founding fellow of the Control System Cyber Security Association International - CS2AI.

Wanda is an excellent example of a great set of career path choices! She is a well-rounded individual who brings a fresh perspective and experience to what she does today! She is an entrepreneur, a speaker, and a mechanical-minded engineer with a well-developed creative side! She is a painter, musician, horse enthusiast, and cook.

In this episode of the (CS)²AI Podcast, Wanda tells her story, talks about her career journey, and shares some great nuggets of information about opportunities within the cyber security space.

You will not want to miss this episode if you are thinking about embarking on a career in cyber security or considering starting a company of your own! Stay tuned for more!

Show highlights:

Technology first came into Wanda’s life at a trade show she attended while working at her first job. It fascinated her, and she fell in love with it immediately! (4:21)
Wanda talks about the first job she did after graduating as a Mechanical Engineer at the Northern Alberta Institute of Technology. (6:15)
Wanda talks about her satisfying experience when she first got into digital controls. (9:17)
Wanda started building commissioning in 1991. It was all about the validation of control systems, and it was where she fell in love with databases. (12:16)
Wanda discusses the catalyst that prompted her to leave the government and start her first company. (13:55)
Wanda experienced a lot of frustration with the industry because it was slow to adopt new practices. She believes that things are changing, however. (17:45)
Wanda talks about what happened in the period between the first and the second companies she founded. (18:36)
The impact that Y2K had on her career path. (23:09)
Wanda talks about being invited to the Pentagon to help launch their renovation project. She has had a constant and consistent relationship with the Pentagon via Chinook ever since. (29:14)
Wanda talks about the challenges she faced while moving her business operation from Canada to the US. (32:09)
When cyber security first intersected with Chinook. (35:33)
The challenges with new construction and with existing buildings. (39:01)
Wanda shares some advice based on her years of experience for people entering the field of cyber security. (45:14)
It takes a lot of skill sets to build a strong cyber team in the OT world. (53:29)

Links:

(CS)²AI

Wanda Lenkewich on LinkedIn

Chinook Systems

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Living With Dirty Cyber Assets
Pub date: 2022-05-24

My weekly article. Originally published on 24 May 2022.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 38: Cyber Security for Manufacturing with Collin Dunn and Isiah Jones
Pub date: 2022-05-22

Derek Harp would like to invite you, the listener, to next week’s (CS)²AI Online Symposium on Secure Control Systems for Smart Manufacturing. Manufacturing is a critical sector that forms a large portion of the American economy. It has over twelve-million workers and currently has 2.3 trillion dollars of output in the US alone!

The symposium will be in two parts: Part 1 will take place on Wednesday, May the 25th, 2022, at 1 pm EST. Some great prizes will be given to the participants in the question process, including some valuable industry books! Part 2 will happen in August 2022. More topics on manufacturing will be covered in the second part by some additional speakers.

As a society, we take much of what gets produced within the manufacturing sector for granted, yet cyber threat actors take advantage of every vertical within that sector. Today, Colin Dunn, one of the (CS)²AI sponsors and the CEO of Fend Incorporated, and Isiah Jones, a (CS)²AI Founding Fellow and a well-known cyber security researcher and practitioner, join Derek to share their thoughts on the importance of cyber security for manufacturing. Stay tuned for more!

Show highlights:

Isiah saw the kind of problems that happen under normal circumstances with manufacturing baby food years ago when he was with Jacobs Engineering.
Messing with manufacturing and the supply chain is sure to disrupt any society.
Supply chains have many vulnerable parts and do not need any additional stress like cyber-attacks right now.
There are ways to keep cyber attackers out. The symposium is a way to explore some of those options.
All sectors, especially manufacturing, need to start spending more money on employing trained safety staff.
One of the assets the manufacturing sector has is the safety culture.
Thinking about cyber security as key to safety will help it get taken more seriously within the manufacturing sector.
More attention needs to be paid to problems like ransom threats, the manipulation of logic, and intellectual property theft within the manufacturing sector.
Much more action needs to be taken around security issues in the manufacturing sector.

Links:

(CS)²AI

(CS)²AI Online Symposium Secure Control Systems for Smart Manufacturing

Colin Dunn on LinkedIn

Fend Incorporated

Isiah Jones on LinkedIn

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: S4x22 Closing Panel
Pub date: 2022-05-18

Zach Tudor of INL and Megan Samford of Schneider Electric join Dale Peterson on stage to close out S4x22. They discuss:

What the ICS security community isn't talking about that we need to pay more attention to.
OT cyber workforce issues.
What should we draw from the OT malware that came out in early 2022 and the response?
The SBOM market.
And more

View Details

Podcast: Cybercrime Magazine Podcast (LS 30 · TOP 10% what is this?)
Episode: Who's Hacked. German Wind Farm Operator. Steve Morgan, Cybercrime Magazine.
Pub date: 2022-05-19

The Cybercrime Magazine Podcast brings you our daily alert, which provides boardroom and C-suite executives, CIOs, CSOs, CISOs, IT executives and cybersecurity professionals with a breaking news story we’re following. If there’s a cyberattack, hack, or data breach you should know about, then we’re on it. Airs every day on WCYB and our podcast. For more on the latest cyberattacks, hacks, and breaches, visit https://cybercrimewire.com

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: (CS)²AI
Episode: 37: Engineers Should Consider a Cyber Security Career with Vivek Ponnada
Pub date: 2022-05-17

Derek Harp is excited to have Vivek Ponnada, the Regional Sales Director for Nozomi Networks, joining him for another episode in the series on security leaders! Vivek was also a long-time contributor at GE.

Vivek Ponnada has over 23 years of experience in Industrial Control Systems. He currently serves customers in Western Canada for Nozomi Networks with market-leading OT and IoT Security & Visibility solutions.

He started his career in ICS as an Instrumentation Technician and then became a Controls Engineer and commissioned Gas Turbine Controls systems in Europe, Middle-East, Africa, and South-East Asia. During his career, Vivek has held multiple roles including Sales, Marketing & Business Development, and Services covering Control systems & Cybersecurity solutions for Critical Infrastructure (Power, Oil & Gas, Water, and Mining) industries at GE and ICI Electrical Engineering in North America. He is a co-lead for the Top 20 Secure PLC Coding Practices Project and his recent talks and contributions include ICS Village (DefCon 29), Industrial Security Conference in Copenhagen & several BSides.

Vivek has a bachelor's degree in Electrical Engineering from I.E. India, an MBA from The University of Texas at Austin, and GICSP certification from GIAC. He is an active member of the Infosec community in Vancouver, BC as a Board Member for Mainland Advanced Research Society, Volunteers for ISACA, and is a member of the ISA.

Vivek is a thoughtful and fun individual! He is an engineer, analyst, and finance guy! He is also a motorcycle enthusiast, an intermediate skier, and a husband!

In this episode of the (CS)²AI Podcast, Vivek shares his backstory, discusses his education, and talks about his career trajectory. He also offers gold nuggets of advice for engineers with an interest in cyber security.

This is one show you will not want to miss- particularly if you are an engineer considering moving into the field of cyber security. Stay tuned for more!

Show highlights:

Vivek grew up in South India. He became an engineer and developed skills in control systems long before he became a cybersecurity guy. (1:50)
The first job Vivek remembers doing was helping someone with gardening when he was seven or eight years old. (2:98)
When Vivek graduated from high school, he was in a technical program. So he was already in an electronics and communication phase. (4:10)
Vivek studied his engineering undergrad part-time because he was also working full-time. It all worked out well because the work he was doing and his studies were all connected. (4:43)
He enjoyed learning how to connect his work-life with his education organically. (6:25)
Vivek discusses his twenty-year history with GE. (7:10)
Security is a discipline that is a constant learning process. (12:26)
Some helpful advice for engineers who have an interest in cyber security, but don’t know where to start or how to break into the field. (14:52)
Vivek talks about the career challenges he faced at GE and how he navigated them. (19:00)
Two things that most engineers tend to struggle with. (21:01)
Vivek jumped around in his career path, so he never had a mentor. He had some excellent coaches and managers, however. (23:17)
People in the cybersecurity community are always open to advising and helping one another. (25:14)
How sales came into Vivek’s career journey. (27:09)
Vivek talks about the Top 20 Secure PLC Coding Practices Project to which he is contributing. (30:40)
It is always good to have a plan for the next few years. (32:57)
Vivek shares his recommendations for career choices in the field of cyber security. (39:13)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Can We Share Information? (Log4j and CODESYS)
Pub date: 2022-05-17

My weekly article, originally published on 17 May 2022.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Just the tricky bits [The Industrial Security Podcast]
Pub date: 2022-05-16

Industrial security programs have to touch all the bases. Alexandru Suditu of the Enevo Group joins us to look at - not everything - just the tricky bits.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Gate 15 Podcast Channel
Episode: The Cybersecurity Evangelist: Ep 18 – Space Systems are Critical Infrastructure for Critical Infrastructure
Pub date: 2022-04-10

A chat with Erin Miller, Executive Director of Space ISAC, from the 37th Space Symposium

Have you ever thought about just how much reliance there is on space systems and how satellites – tons of them – are actually flying computers with IP addresses? In an episode that is out of this world, the Gate 15 Podcast Channel welcomes back a very special guest – Erin Miller, Executive Director of Space ISAC on the 18th episode of The Cybersecurity Evangelist – to talk about all that and more from the 37th Space Symposium at The Broadmoor in Colorado Springs. From an event that Erin called, “bigger than Disneyland,” we talked about the importance of securing space systems, the pivotal role that Space ISAC is playing to increase the cybersecurity posture for the global space community, and the general passion for cybersecurity among attendees and speakers at the symposium.

Resources mentioned in this episode:

Space ISAC
37th Space Symposium
Dr. Stacey Dixon (LinkedIn) – Principal Deputy Director of National Intelligence, ODNI
CISA Director, Jen Easterly (Twitter)
Women in Cybersecurity (WiCyS)
Alert (AA22-076A) Strengthening Cybersecurity of SATCOM Network Providers and Customers
Purdue University
University of Colorado Colorado Springs
Colorado Springs Chamber & EDC
United States Space Force
United States Space Command
United States Air Force Academy
The Gate 15 Interview Ep. 16: Erin Miller, Executive Director, Space ISAC. Securing Space Infrastructure (and terrestrial critical infrastructure too!)

The podcast and artwork embedded on this page are from Gate 15, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 28 - ICS Security em Geral
Pub date: 2022-05-13

Nesta ultima quinta-feira, tivemos mais uma gravação do ICS SECURITY PODCAST. Acompanhe agora nosso CEO Eduardo Honorato falando sobre o tema: ICS SECURITY EM GERAL.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The OT and IoT Security Podcast
Episode: OT Network Security Challenges in Enterprise Environments
Pub date: 2022-05-12

Learn how the Ukraine Russia conflict has enlivened nation sponsored and cyber terrorism events and what defines their motivation.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Gate 15 Podcast Channel
Episode: The Cybersecurity Evangelist: Episode 19 - TCE Evangelizes a Few ICS Security Thingz
Pub date: 2022-05-13

This month, Jen tries to put the “evangelize” in The Cybersecurity Evangelist by spreading the word on some great work in the ICS cybersecurity community.

Resources evangelized in this episode:

@BEERISAC OT/ICS Security Podcast Playlist https://podcasts.apple.com/us/podcast/beerisac-ot-ics-security-podcast-playlist/id1459741251
Consequence-driven Cyber-informed Engineering (CCE) https://inl.gov/cce/
ICS4ICS https://gca.isa.org/ics4ics
Top 20 Secure PLC Coding Practices https://www.plc-security.com/index.html

The podcast and artwork embedded on this page are from Gate 15, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Ilan Gendelman of SIGA
Pub date: 2022-05-11

Unsolicited Response host Dale Peterson has been skeptical of the cost/benefit of accessing the electrical signals between Level 0 and Level 1 and creating a separate network to send that data to a platform for comparison to data at higher levels and analysis. This is a core part of SIGA's offering.

Dale and Ilan discuss what it actually does and doesn't do. What percentage of the Level 0 device communication needs to be monitored to get this information? The cost per sensor. And more. In the end they don't reach the same conclusion, but the decision points are clearer.

They finish discussing the back end processing for process variable anomaly detection, and how SIGA plans to compete with large vendors (GE, Siemens, ...), Azure and AWS, PI and specialized system vendors who have developed models.

Links

SIGA OT Security Site

Dale's Pivot To Process Variable Anomaly Detection article

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: The ICS Dichotomy of Surface Area
Pub date: 2022-05-10

Dale's weekly article points out the conflict in thinking and posture in miminizing and maximizing surface area. A minimization strategy can help security and hurt creativity. Seems about right with what we see.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 36: The S4 Conference: Why You Should Attend Every Year
Pub date: 2022-05-10

The S4 Conference is one of the pinnacle events of the year for anyone interested in hearing deep subject matter experts speak. It is definitely worth attending if you are not formally part of the CS2AI community.

Today, Derek Harp shares a short podcast he created after attending the 22nd S4 Conference, held from the 19th to the 21st of April this year.

Dale Peterson is the Founder, Creator, and MC of the S4 Conference. He was on a recent CS2AI Podcast episode, talking about how S4 came about. Patrick Miller was also a recent guest on the CS2AI Podcast. He “accidentally” founded the informal yet powerful and informative after-hours Dear ISAC part of the S4 event.

The recent S4 Conference was a great opportunity for everyone to get back together, in person after Covid! This year, 800 people attended the event. The speaker line-up was just as amazing as it has always been in the past! Many women were present, and there was also a well-attended Women in ICS social pre-event that took place on the Monday before the main event.

In this episode, we share some comments on the recent S4 event made by Andrew Ginter from Waterfall Security Solutions and Isiah Jones, a CS2AI Founding Fellow and Principal Security Engineer for ICS Security Integration. Stay tuned for more!

Show highlights:

Andrew’s biggest takeaway from the event was finding out that the industry wants cyber security regulations.
The shipping industry is price sensitive. They should spend some money and effort on cyber security but won’t spend a penny unless their competition does the same.
Andrew explains why he was surprised to learn that the industry wants cyber security regulations.
Isiah enjoyed the diversity at the event! He was happy to see so many female technical engineers and black people attending the event.
Isiah enjoyed seeing many new people interested in the more technical topics.
Isiah explains why he was happy to see Jen Easterly show up at the event to address the community directly.
Isiah enjoyed listening to new topics on PLCs, containers, and the latest attackers living off the land.
Seeing and interacting with everyone at the latest S4 event, and seeing new people get their coins, was good for Isiah’s mental health!

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Work (LS 43 · TOP 1.5% what is this?)
Episode: What does an ICS security practitioner do? | Cybersecurity Career Series
Pub date: 2022-05-09

Industrial control system (ICS) security practitioners are responsible for securing mission-critical SCADA and ICS information systems. They are responsible for restricting digital and physical access to ICS devices, such as PLCs and RTUs, to maximize system uptime and availability. Extensive knowledge of OT and IT protocols, incident response, Linux and Windows OS, configuration management, air-gapped or closed networks, insider threats and physical security controls are important competencies for any ICS security practitioner.

Learn more: https://www.infosecinstitute.com/skills/train-for-your-role/ics-security/

O:00 - ICS security practitioners
0:25 - What is an industrial control system practitioner?
2:22 - How to become an ICS practitioner
4:00 - Education required for an ICS practitioner
5:00 - Soft skills ICS practitioners need
6:05 - Common tools ICS practitioners use
7:59 - Where do ICS practitioners work?
10:05 - Can I move to another role after ICS practitioner?
12:18 - Getting started as an ICS practitioner

The podcast and artwork embedded on this page are from Infosec, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: ICS Security - April Month In Review
Pub date: 2022-05-05

Daniel Kapellmann Zafra of Mandiant joins Dale to talk about April's three big stories:

INCONTOLLER / PIPEDREAM
INDUSTROYER2
JCDC ICS

Then they give wins, fails and predictions with a first appearance of conspiracy Dale.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Daniel Kapellmann Zafra on Incontroller/Pipedream ICS Attack Tools
Pub date: 2022-05-04

Mandiant senior technical analysis manager Daniel Kapellmann Zafra joins the Claroty Aperture podcast to discuss the Incontroller/Pipedream attack tool. Incontroller is alleged to be a state-sponsored tool specifically designed to target industrial control systems. Incontroller was discovered before it was employed on a victim's network, yet nonetheless it remains one of the most sophisticated, dangerous ICS attack platforms ever developed.

Kapellman Zafra discusses Incontroller's three components—Tagrun, Codecall, and OmShell—that give it extreme flexibility in targeting different ICS equipment and communication protocols. You'll also learn about how resilient potential victims may be, as well as some of the mitigations and defensive strategies that organizations should consider.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Will CISA Recommend Securing ICS?
Pub date: 2022-05-03

Dale's weekly article also read on this podcast feed.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Exploding demand [The Industrial Security Podcast]
Pub date: 2022-05-02

Demand for skilled industrial / OT security people has increased dramatically over the last couple of years. Join Meg Duba, Senior Technical Recruiter at Idaho National Labs for an update on the market.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: EP. 27 - ICS Security em Geral
Pub date: 2022-04-28

Na última quarta-feira, 27/04 tivemos a gravação do 27 episódio do ICS SECURITY PODCAST. Nosso CEO Eduardo Honorato e nosso CTO Fabiano Paixão abordaram o tema: ICS Security em Geral

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: CISA Director Jen Easterly at S4x22
Pub date: 2022-04-27

S4 Founder Dale Peterson interviews CISA Director Jen Easterly on the S4x22 Main Stage, 20 April 2022. Start: What are CISA's major goals in ICS Security for 2022/23 and how will they measure progress? Jen goes over people, process and partnerships goals, and highlights the hiring they are doing in the ICS security area. Also, Jen announces the new JCDC ICS.

17:38 When will the Shields Up come down? Since Shields Up is mostly basic cyber hygiene will there be a Shields Way Up?

23:30 Does Jen believe regulation is required to secure private industry owned critical infrastructure? And of course a lot of other things came up in the course of this half hour interview.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Hope In ICS Security Workforce
Pub date: 2022-04-25

Some quick info on the release of S4x22 content and then my weekly article published on 24 April 2022.

Links:

S4x22 Video Release Schedule

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Sharon Brizinov on Hacking and Securing PLCs
Pub date: 2022-04-20

In this episode of the Aperture podcast, Claroty Team82 vulnerability research lead Sharon Brizinov covers a presentation he’s giving at the S4x22 conference in Miami that explains a unique attack against Siemens SIMATIC 1200 and 1500 PLCs that enabled native code execution on the device.
Also, Brizinov explains his participation in the Pwn2Own contest. S4 hosts the only ICS-focused version of Pwn2Own, and this year there are four categories of targets in scope: control servers, OPC UA servers, data gateways, and HMIs.
“The goal in most cases is to achieve remote code execution, not only to find a vulnerability but achieve exploitation,” Brizinov said. “Usually we are able to find at least one vulnerability, but the real challenge is to exploit those vulnerabilities. Usually the difficulty around this is to bypass the different security mitigations that both the software, hardware, or operating system present.”

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 35: Building a Consulting Career in the Cyber Security Industry with Patrick C. Miller
Pub date: 2022-04-19

Derek Harp is happy to have Patrick Miller joining him today for another episode in the Security Leaders series! Patrick is a well-known legend in the ICS cyber security space. He is currently the Chief Executive Officer of Ampere Industrial Security.

Patrick Miller has dedicated his career to the protection and defense of critical infrastructures. As President and CEO of Ampere Industrial Security, he is a trusted independent security and regulatory advisor for industrial control systems worldwide. In addition to his role at Ampere, Mr. Miller is also the founder, director, and president emeritus of EnergySec and US. Coordinator for the Industrial Cybersecurity Center. Patrick's diverse background spans the Energy, Telecommunications, Water, Wastewater, Manufacturing, and Financial Services verticals, including key positions with regulatory agencies, private consulting firms, utility asset owners, and commercial organizations. Patrick was instrumental in the establishment of the NERC CIP standards in the US as a drafting team member and the first CIP auditor in the nation. He currently serves on or contributes to multiple NERC CIP guidance and standards drafting teams. Patrick is also an instructor for the ICS456 NERC CIP course with the SANS Institute.

Patrick loves tech and the outdoors! As well as being a technologist, he is also a chef, a keen kayaker, a father, and a builder of communities! In this episode of the (CS)²AI Podcast, he tells his modern-day superhero origin story, talks about the various milestones in his professional journey, and shares valuable nuggets of advice for people from different backgrounds who would like to get into the cyber security industry.

You won’t want to miss this episode if you would like to make a career in cyber security, become a better security professional, or start a cybersecurity business of your own. Stay tuned for more!

Show highlights:

Entrepreneurship is in Patrick’s blood. (3:05)
Growing up in the early days of technology, Patrick was lucky enough to get the new tech as it came out. (4:15)
Patrick was using cutting-edge technology to do a senior capstone biology project just before he dropped out of school to do tech. (6:32)
Any kind of background can be helpful for you as a security professional. (9:00)
How phone systems have advanced and transformed over the last few decades. (10:30)
Patrick’s first “hacking job”. (11:29)
Patrick talks about when he decided to specialize in security and the point when industrial security first intersected with his journey. (13:23)
Patrick discusses his stint as a regulator for WECC (Western Electricity Coordinating Council.) (17:54)
Joining standards bodies in the early stage can help people break into the cyber security industry. (24:26)
What motivated Patrick to start a consulting firm? (26:14)
The Dawn of Energy Sec (Energy Sector Security Consortium). (32:24)
Patrick shares his vision for Ampere. (35:15)
Why good communication skills are essential. (38:40)
What is ISAC all about, and how did Patrick instigate it? (41:40)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: David Bombal
Episode: #371: Hacking Power Plants and Industrial Control Systems (Scada) // Ukraine Russia Cyberwar
Pub date: 2022-04-19

This is my second interview with the professional hacker Occupy The Web. In this video we discuss OSINT and hacking industrial control systems (ICS) using SCADA (supervisory control and data acquisition). Jump to 33:40 for scada discussions.

Disclaimer: The opinions expressed by Occupy The Web in this interview are his own.

// Previous video // OTW video 1: https://youtu.be/GudY7XYouRk

// Occupy The Web social // Twitter: https://twitter.com/three_cube

// Occupy The Web books // Linux Basics for Hackers: https://amzn.to/3JlAQXe Getting Started Becoming a Master Hacker: https://amzn.to/3qCQbvh

// Occupy The Web Website / Hackers Arise Website // Website: https://www.hackers-arise.com/

Using OSINT to find Yachts: https://davidbombal.wiki/osintyachts

Can the CIA or other Intelligence Agencies Track My Every Move: https://davidbombal.wiki/ciaphonestra...

SCADA Hacking: The Key Differences between Security of SCADA and Traditional IT systems https://davidbombal.wiki/scada1

SCADA Hacking: Finding SCADA Systems using Shodan https://davidbombal.wiki/scada2

Shodan: Using Shodan to Find Vulnerable Russian SCADA/ICS Sites https://davidbombal.wiki/shodan

SCADA Hacking: The Most Important SCADA/ICS Attacks in History https://www.hackers-arise.com/post/sc...

SCADA Hacking: SCADA/ICS Protocols (Profinet/Profibus) https://www.hackers-arise.com/post/20...

Lots of Scada content: https://www.hackers-arise.com/scada-h...

// In the News // Feds Uncover a ‘Swiss Army Knife’ for Hacking Industrial Control Systems: https://www.wired.com/story/pipedream...

Ukrainian power grid 'lucky' to withstand Russian cyber-attack: https://www.bbc.co.uk/news/technology...

An Unprecedented Look at Stuxnet, the World's First Digital Weapon https://www.wired.com/2014/11/countdo...

// Other books // The Linux Command Line: https://amzn.to/3ihGP3j How Linux Works: https://amzn.to/3qeCHoY

// MY STUFF // https://www.amazon.com/shop/davidbombal

// SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com

The podcast and artwork embedded on this page are from David Bombal, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Industrial cyber attacks, consequences & trends [The Industrial Security Podcast]
Pub date: 2022-04-19

Greg Hale - Editor and Founder of ISSSource and ICSStrive joins us to look at his new OT / industrial incident repository, and a new report using the data in the repository, analyzing industrial cyber incidents with physical consequences.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CyberWire Daily (LS 60 · TOP 0.5% what is this?)
Episode: CyberWire Live: Hack the Port 2022 Fireside chat. [Special Edition]
Pub date: 2022-04-17

At the Hack the Port 2022 event, the CyberWire held a CyberWire Live event. CyberWire Daily Podcast host Dave Bittner was joined by Roya Gordon, OT/IoT Security Research Evangelist at Nozomi Networks, and Christian Lees, CTO at Resecurity. During this fireside chat format session, Dave and our guests discussed ICS, OT cybersecurity, the role of security research and demos, supply chain compromise, and IT/OT security trends among other things. Thanks to the team at MISI/DreamPort for this opportunity.

The podcast and artwork embedded on this page are from CyberWire, Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. 26 - ICS Detection and Response
Pub date: 2022-04-15

Nesse novo episódio do ICS SECURITY PODCAST. Nosso CEO Eduardo Honorato dessa vez contou com a presença do OT Cybersecurity Specialist da Cervejaria Ambev - Thaian de Moraes. Juntos abordaram o tema: ICS Detection and Response.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 34: Foundations for Starting Your Own Cyber Security Business with Dale Peterson
Pub date: 2022-04-12

Derek Harp is thrilled to have Dale Peterson of Digital Bond joining him for another great episode in the series on security leaders! Dale is a legend and leader in the cyber security industry!

For over 15 years, Dale Peterson has been on the leading/bleeding edge helping security-conscious asset owners effectively and efficiently manage risk to their critical assets. He has pioneered numerous ICS security tools and techniques, such as the first intrusion detection signatures for ICS that are now in every commercial product. In 2007 Dale created the S4 Events to showcase the best offensive and defensive work in ICS security and build a community. S4 is now the largest and most advanced ICS event in the world. Dale is constantly pushing and prodding the ICS community to move faster and get better.

Dale is a catalyst in the ICS cyber security space. He is most famous for his S4 Events. (The latest S4 Event will be coming up between the 19th and 21st of April 2022.) He is also an author, former cryptologist, skier, hiker, outdoorsman, well-known speaker, husband, and father.

In this episode of the (CS)²AI Podcast, Dale shares his origin story and discusses his career trajectory. He explains what led him to start Digital Bond, he talks about how the S4 Events came about, and he also offers some valuable nuggets of advice for people looking to start a business.

You won’t want to miss this episode if you are looking for ways to get into the cyber security industry or if you want to know which moves to make to become a leader within the industry or start a company of your own. Stay tuned for more!

Show highlights:

The most interesting and influential work that Dale did early on. (3:10)
What it takes to produce S4 Events. (4:46)
Dale first worked on computers when he was in junior high school. (6:06)
After getting a degree in finance, Dale worked for the NSA as a cryptologist and then went on to work for a company selling military encryption equipment before starting his own company. (8:10)
Starting a company is not for everyone. (12:48)
What led to Dale starting Digital Bond? (13:13)
Dale shares his biggest failure so that others need not make the same mistake. He also offers advice for anyone wanting to start a business. (16:13)
How the S4 events came about in 2007. (12:53)
The highlights and the worst moments Dale remembers from doing S4 events. (30:15)
You need never be afraid to try something new in your business or career. (32:05)
Dale talks about where he has helped the most as a mentor. (36:54)
If you are very good at something, you can quickly make yourself known and become the best in the world at it in new sectors. (38:06)
Where you can start reading and researching to augment your professional knowledge. (42:39)
You need to understand your mission when you start a conference or an event. (48:42)

Links:

(CS)²AI

Dale Peterson’s website

Dale Peterson on LinkedIn

Books mentioned:

The Brand You 50 by Tom Peters

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

The Brand You 50 : Or : Fifty Ways to Transform Yourself from an 'Employee' into a Brand That Shouts Distinction, Commitment, and Passion!

View Details

Podcast: Click Here (LS 47 · TOP 1% what is this?)
Episode: 10. Are America’s nuclear systems so old they’re un-hackable?
Pub date: 2022-04-12

In its latest defense budget, the Biden Administration has asked Congress to fund the modernization of America’s nuclear weapons systems.The current system – that until recently was still using eight inch floppies – is seen as so old that it’s virtually un-hackable. So if you modernize, now what? Plus, cyber hits from Nigeria’s music scene.

SHOW NOTES:

At The Brink podcast

Herb Lin's book Cyber Threats and Nuclear Weapons

How cybercrime remixed the Nigerian Music scene

The podcast and artwork embedded on this page are from The Record by Recorded Future, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: New Cyber Frontier (LS 27 · TOP 10% what is this?)
Episode: NCF-294 Imaginary vs Real Threats to The Electric Grid
Pub date: 2022-04-11

Tom Alrich is a consultant in Cybersecurity for the Electric Power Industry. Today’s show talks about the possible worst-case cyber attack on the electric grid. Tom talks about imaginary vs. real threats and what these mean to the industry. In addition, our guest spends some time explaining what the presidential orders on the electric grid mean for cybersecurity practitioners. Listen today to find out about a great blog to follow and some insight about critical infrastructure security.

Visit our sponsors:

BlockFrame Inc.

SecureSet Academy

Murray Security Services

The podcast and artwork embedded on this page are from Logic Central Online, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2.5% what is this?)
Episode: Episode 319 - OT Cybersecurity - In conversation with Robert Lee, CEO & Founder of Dragos
Pub date: 2022-04-10

We attended the opening of the Dragos office in Melbourne, Australia and met with CEO and Founder, Robert Lee.

Robert Lee is a recognized pioneer in the industrial security incident response and threat intelligence community. He gained his start in security as a U.S. Air Force Cyber Warfare Operations Officer tasked to the National Security Agency where he built a first-of-its-kind mission identifying and analyzing national threats to industrial infrastructure. He went on to build the industrial community’s first dedicated monitoring and incident response class at the SANS Institute (ICS515) and the industry recognized cyber threat intelligence course (FOR578).

Forbes named Robert to its 30 under 30 (2016) list as one of the “brightest entrepreneurs, breakout talents, and change agents” in Enterprise Technology. He is a business leader but also technical practitioner. Robert helped lead the investigation into the 2015 cyber attack on Ukraine’s power grid, he and his team at Dragos helped identify and analyze the CRASHOVERRIDE malware that attacked Ukraine’s grid in 2016 and the TRISIS malware deployed against an industrial safety system in the Middle East in 2017.

Robert is routinely sought after for his advice and input into industrial threat detection and response. He has presented at major security conferences such as SANS, BlackHat, DefCon, and RSA and has testified to the Senate’s Energy and National Resources Committee. As a non-resident national security fellow at New America, Robert works to inform policy related to critical infrastructure cyber security and is regularly asked by various governments to brief to national level leaders.

Recorded April 7, 2022

Video version available at https://youtu.be/i2H3YndP8gs

For more information visit www.dragos.com

otcybersecurity #cybersecurity #dragos #ukraine #cyberattack #crashoverride

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Value of Cybersecurity for Buildings
Pub date: 2022-04-06

No one can deny we are seeing unprecedented levels of cyberattacks across all industries and sectors. From IT enterprises, to operational technology and healthcare, there is no reason why building automation should be left out of the discussion. With such a fragmented sector with so many vendors and contractors working within one environment and with connectivity increasing, it only makes sense buildings are potential low hanging fruit for would be attackers. While almost everybody in the world is aware of cybersecurity issues, the lack of a solid and robust building automation security program can result in damage to a facility and its occupants and/or act as a pivot point for attackers to go after the building’s tenants.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Malicious Life (LS 59 · TOP 0.5% what is this?)
Episode: Chris Roberts: Hackers on a Plane
Pub date: 2022-04-05

When Chris Roberts landed at Syracuse, NY – two FBI agents were waiting to escort him off the airplane. Apparently, this wasn’t the first time that the Gray Hat hacker was suspected of hacking into an aircraft’s control system – WHILE IN FLIGHT. Is risking the lives of hundreds of passengers a price worth paying for uncovering major vulnerabilities in an aircraft’s network?

The podcast and artwork embedded on this page are from Cybereason, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 33: Certifications and Instructional Careers in Cybersecurity with Justin Searle
Pub date: 2022-04-05

Derek Harp is excited to welcome Justin Searle as his guest for another episode in the series on security leaders!

Justin is the Director of ICS Security at InGuardians, specializing in ICS security architecture design and penetration testing. He has taught courses in hacking techniques, forensics, networking, and intrusion detection for multiple universities, corporations, and security conferences. He is currently a Senior Instructor for the SANS Institute and a faculty member at IANS. In addition to electric power industry conferences, he frequently presents at top international security conferences such as Black Hat, DEFCON, OWASP, Nullcon, and AusCERT.

Justin is well-balanced and versatile and a super fascinating person! He was born in Utah and has lived there for most of his life. He has a Bachelor’s Degree in Technology Education with minors in computer science and electrical engineering, and a Master’s Degree in International Business and Information Systems. He is an entrepreneur, researcher, security practitioner, open-source advocate, instructor, teacher, and author. He is an outdoor enthusiast and has some cool hobbies, like scuba diving and rock climbing. He is also a falconer, a helicopter pilot, and a globetrotter.

In this episode of the (CS)²AI Podcast, he shares his modern-day superhero backstory, and he talks to Derek about how his career journey led to him becoming immersed neck-deep in cyber security for control systems. He also talks about the value of certifications and becoming an instructor. You will gain a lot from this show if you would like to make a career in cyber security or become an instructor in the field. Stay tuned for more!

Show highlights:

Justin started doing basic programming when he was in elementary school and almost earned an Associate’s Degree in Electronics Engineering in high school. (4:58)
Justin talks about the certifications he obtained to build credibility and advance his career. (9:40)
Justin shares his thoughts about certifications. (11:50)
Getting a certification will help students stand out trying to find an internship. (Justin recommends the CompTIA Security+ Certification because it is an inexpensive option.) (13:22)
Graduates should consider getting a CISSP Certification. (13:48)
Justin explains why he shifted to focus on networking technologies, IT technologies, and cyber security in 2000-2001. (18:10)
Getting into his niche area- penetration testing in industrial control systems. (19:50)
How can listeners break into becoming teachers or instructors? ( 22:38)
The pros and cons of joining communities and collaborative groups. (27:08)
Justin enjoys being an informal mentor to others and providing feedback when people ask questions. (31:04)
Justin offers advice for maximizing your benefit when you change jobs or your positions within a company. (33:22)
You will be valued in the field if you get into any area of cyber security. (40:10)

Links:

(CS)²AI

Justin Searle on LinkedIn

In Guardians

CISSP Certification

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Cyberlaw Podcast (LS 47 · TOP 1% what is this?)
Episode: Episode 401: All at Sea: Maritime Cybersecurity
Pub date: 2022-04-04

Spurred by a Cyberspace Solarium op-ed, Nate Jones gives an overview of cybersecurity worries in the maritime sector, where there is plenty to worry about. I critique the U.S. government’s December 2020 National Maritime Cybersecurity Strategy, a 36-page tome that, when the intro and summary and appendices and blank pages are subtracted, offers only eight pages of substance. Luckily, the Atlantic Council has filled the void with its own report on the topic.; Of course, the maritime sector isn't the only one we should be concerned about. Sultan Meghji points to the deeply troubling state of industrial control security, as illustrated by at "10 out of 10" vulnerability recently identified in a Rockwell Automation ICS.; Still, sometimes software rot serves a good purpose. Maury Shenk tells us about decay in Russia's SORM – a site-blocking system that may be buckling under the weight of the Ukraine invasion. Talking about SORM allows me to trash a nothingburger story perpetrated by three New York Times reporters who ought to know better. Adam Satariano, Paul Mozur and Aaron Krolik should be ashamed of themselves for writing a long story suggesting that Nokia did something wrong by selling Russian telecom gear that enables wiretaps. Since the same wiretap features are required by Western governments as a matter of law, Nokia could hardly do anything else. SORM and its abuses were all carried out by Russian companies. I suspect that, after wading through a boatload of leaked documents, these three (three!) reporters just couldn't admit there was no there, there.; Nate and I note the emergence of a new set of secondary sanctions targets as Treasury begins sanctioning companies that it concludes are part of a sanctions evasion network. We also puzzle over the surprising pushback on proposals to impose sanctions on If the WSJ is correct, and the reason is fear of cyberattacks if the Russian firm is sanctioned, isn't that a reason to sanction them out of Western networks?; Sultan and Maury remind us that regulating cryptocurrency is wildly popular with some, including Sen. Elizabeth Warren and the EU Parliament. Sultan remains skeptical that sweeping regulation is in the cards. He is much more bullish on Apple's ability to upend the entire fintech field by plunging into financial services with enthusiasm. I point out that it’s almost impossible for a financial services company to maintain a standoffish relationship with government, so Apple may have to change the tune it’s been playing in the U.S. for the last decade.; Maury and I explore fears that the DMA will break WhatsApp encryption, while Nate and I plumb some of the complexities of a story Brian Krebs broke about hackers exploiting the system by which online services provide subscriber information to law enforcement in an emergency.; Speaking of Krebs, we dig into Ubiquiti's defamation suit against him. The gist of the complaint is that Krebs relied on a "whistleblower" who turned out to be the perp, and that Krebs didn't quickly correct his scoop when that became apparent. My sympathies are with Krebs on this one, at least until Ubiquiti fills in a serious gap in its complaint – the lack of any allegation that the company told Krebs that he’d been misled and asked for a retraction. Without that, it's hard to say that Krebs was negligent (let alone malicious) in reporting allegations by an apparently well-informed insider.; Maury brings us up to speed on the (still half-formed) K. online harms bill and explains why the U.K. government was willing to let the subsidiary of a Chinese company buy the U.K.'s biggest chip foundry. Sultan finds several insights in an excellent CNN story about the Great Conti Leak.; And, finally, I express my personal qualms about the indictment (for disclosing classified information) of Mark Unkenholz, a highly competent man whom I know from my time in government. To my mind, the prosecutors are going to have to establish that Unkenholz was doing something different from the kind of disclosures that are an essential part of working with tech companies that have no security clearances but plenty of tools needed by the intelligence community. This is going to be a story to watch.; Download the 401st Episode (mp3).; Subscribe to The Cyberlaw Podcast:; As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!; The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

The podcast and artwork embedded on this page are from Steptoe & Johnson LLP, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 31 · TOP 5% what is this?)
Episode: Training the Cyber Workforce of the Future
Pub date: 2022-04-04

“You can only cover about 65% of the cybersecurity workforce demand with the existing workforce today. So we need to do something to address that gap. We need to either build that workforce or re-skill existing individuals that are looking to get into new fields. That's the approach that we're taking. So the need is there. We know that cyber risk is there. We know that adversaries are constantly re-skilling and skilling up as well. And we need to build a protective workforce around that.” - John Ellis

In this episode of Hack the Plant, we feature John Ellis, who heads up the Industrial Cyber Alliances at Siemens Energy. We discuss a new, industry-lead apprenticeship program he runs which focuses on critical infrastructure protection called CIISAp (short for: Cybersecurity & Industrial Infrastructure Security Apprenticeship Program).

ICS village is one of the partners of this program, which is tackling the gap between shortage of skilled employees and the workforce

How is the cohort designed? How can we encourage collaboration tech companies, service companies, academia, and government to train the cyber workforce of the future?

Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 32: Creating a Cyber Security Career in Production Environments with Rick Kaun
Pub date: 2022-03-29

Today, Derek Harp is excited to interview Rick Kaun for another episode in the security leaders series. Rick is the VP of Solutions at Verve Industrial Protection.

Rick is a well-versed OT cyber security thought leader, evangelist, advocate, and solution provider with more than 20 years in the identification, development, and provision of all sizes and shapes of security programs. Regardless of the industry, security maturity level, or standard (corporate, regulatory, or best practice) Rick has focused on helping clients to find solutions that are effective, affordable, and manageable. With a special experience in production environments, he has had the pleasure of working around the world with multiple organizations ranging from Power to Oil and Gas, Refining, Mining, Pulp and Paper, discrete manufacturing to corporate and regulatory projects.

Rick is an honest and authentic person. He is a straight talker, known for getting right to the heart of the matter. He is a husband and father and a keen outdoorsman. He is also an ice hockey fan, traveler, boater, and dog lover.

In this episode of the (CS)²AI Podcast, he tells his story and shares his wisdom. He talks about his career, discusses the decisions he made that led him to where he is today and shares some gold nuggets of career advice.

You won’t want to miss this episode if you are looking for career direction, considering a career in cyber security, or already in the security field and would like to move forward in your career. Stay tuned for more!

Show highlights:

Rick shares his superhero origin story. (5:28)
In grade four, Rick became the computer lab administrator for his class. (8:34)
Rick did not start his career in cyber security with a technical degree. He explains how he went from studying sociology to learning about technology. (11:26)
Technology is such a complex field, and it has so many opportunities that you can have an entire career and a specialty within it. (12:04)
There are various technical studies courses that you can do at the Northern Alberta Institute of Technology (NAIT). (13:04)
Rick believes that security basics should underpin every course that anyone ever does. He would love to have a panel discussion on safety culture! (16:58)
Rick explains how he jumped into security for control systems at Honeywell twenty-one years ago. (18:53)
Rick joined Verve about five years ago, and since then, they have doubled twice. (24:23)
We need meaningful and sustainable risk reduction for the future. (25:19)
People you know now could become important in the future. That’s why you need to invest in as many quality relationships as possible within the cyber security industry. (25:51)
Some of the challenges Rick has faced while navigating his career journey. (28:28)
Rick discusses the importance of collaboration. (34:21)
With trainees, it is way better to be humble and honest about things you don’t know than to make something up. (41:49)
Rick feels that mentorship is the key component for anybody to get anywhere. (44:27)
You need to enjoy the work you do. (47:28)

Links:

(CS)²AI

Rick Kaun on LinkedIn

Verve Industrial Protection

Northern Alberta Institute of Technology (NAIT)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Standardization and other risks - experience using CCE [The Industrial Security Podcast]
Pub date: 2022-03-29

Standardization and consolidation increase the consequences of cyber attacks - these are unexpected insights from applying the CCE methodology. Jodi Jensen, President of Secure SCADA Solutions joins us to look the experience of using Consequence-Driven, Cyber-Informed Engineering

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 31 · TOP 5% what is this?)
Episode: Diversity in Power Systems Distribution
Pub date: 2022-03-28

“How do we talk about all the great things we're doing in our communities, in optimizing and trying to reduce carbon, and looking at new solutions and coming up with different technologies that can help advance to help keep prices down and keep reliability up. We're really spoiled at times in the US with how often we have our power. I've had to travel on all seven continents and had times where I didn't have power because the grid was down in other countries.” Dr. Noel Schulz

In this episode of Hack the Plant, Dr. Noel Schulz of Washington State University joins us to talk about innovations within the power industry. We discuss how our power systems (which we often take for granted) work, how to keep them secure, and innovations around the world in power supply. We also tackle the challenges of creating more diversity in harnessing carbon-neutral power sources…and the analogous issues of diversity and inclusion in industry.

How can we increase access to reliable power while reducing our carbon footprint? Who

Join us as we discuss these questions, and more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #25 - ICS DETECTION AND RESPONSE
Pub date: 2022-03-25

Na última quarta-feira, 23/03, tivemos a primeira gravação do ICS Security Podcast no ano de 2022. Nosso CEO Eduardo Honorato abordou o tema: ICS Detection and Response e contou com a participação do Cleber da Paz - Sales Director na Munio Security para falar sobre a trajetória da Munio até aqui e planos para o futuro.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Risk Quantification
Pub date: 2022-03-23

David White, Co-Founder and CEO of Axio, joins Dale on the Unsolicited Response show to discuss cyber risk quantification. Axio makes the bold statement, "Quick time to value: quantify risk in hours not months; board reports readily available in minutes".

Dale digs in on their approach do to this, how they deal with the likelihood challenge, and how the process differs for OT as opposed to IT. The issue of deciding where to put the next dollar is a thread through the entire conversation.

They finish talking about how risk questionnaires and other methods will be used by the cyber insurance industry today and in the next 3 - 5 years.

View Details

Podcast: Automation Chat (LS 26 · TOP 10% what is this?)
Episode: Successful Strategies for Mitigating Manufacturing Supply Chain Disruptions
Pub date: 2022-03-22

In this episode from The Journal From Rockwell Automation and Our PartnerNetwork magazine, Executive Editor Theresa Houck details the steps some manufacturers are taking to successfully build resilience and agility into their supply chain so they can recover from a shortage of people, products or capacity. Our hope is that some of these can help you. You’ll learn the common thread in all of them is the use of digital solutions, data analytics and IT/OT convergence.

Agility allows you to make faster changes, and will help verify the right cost, service and quality given external market factors. Resilience will mitigate the impact of disruption where there are potential points of failure.

It’s useful to understand how and why the supply chain disruptions happen so you can evaluate your processes and technologies to minimize the impact. Theresa reviews the domino effect that started when COVID-19 hit in 2020, then examines ongoing factors that continue to resonate — including the China lockdown due to a COVID resurgence, labor shortages, a recent earthquake in Japan, the truck driver shortage, and particularly, the Russia/Ukraine war.

She examines catastrophic effects on the food and beverage industry, including the price and availability of bread, meat and eggs, and how food security is threatened in many parts of the world. Also learn about the semiconductor chip & other electronics and automobile industries, with reduced production in China, Europe and the United States that delay production and increase supplier and OEM costs.

Learn the real reasons behind The Great Resignation cited by MIT data and other research. And see how some manufacturers are successfully using cross-training, upskilling, labor-supporting technology like robotics or AGVs, and other strategies to streamline work and improve productivity and worker satisfaction.

And of course, get your family-friendly, silly Joke of the Day.

To learn more about how to build resiliency into your supply chain, download our newly released 2022 Supply Chain Reliability eBook.

If you like “Automation Chat,” please leave us a 5-star rating, and subscribe so you don’t miss a single episode.

Access more resources from today’s episode:

2022 Supply Chain Reliability eBook, from The Journal From Rockwell Automation and Our PartnerNetwork.
Sign up for the e-newsletter from The Journal From Rockwell Automation and Our PartnerNetwork.

The podcast and artwork embedded on this page are from rokthejournal, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 31: Cyber Security Start Ups and Product Creation with Eric J. Byres
Pub date: 2022-03-22

Today, Derek Harp is excited to interview Eric J. Byres, the Founder of and Chief Technology Officer of aDolus Technology Inc., in another episode of the Security Leaders series. Eric is a pioneer in industrial cyber security. He is a technologist, entrepreneur, author, inventor, outdoor enthusiast, and sailor.

Eric grew up in North Vancouver and later graduated with a Bachelor of Applied Science Degree from The University of British Columbia, focusing on geological engineering and mining operations. He is widely recognized as one of the world’s top experts in the SCADA security field. As the inventor of the Tofino Security technology, Eric and his partner Joann guided the product through its evolution from an academic research project and startup to a successful acquisition by Belden Inc (NYSE: BDC). Tofino received numerous industry awards and was licensed by industry giants such as Honeywell, Schneider Electric, and Caterpillar. Today it is probably the most widely deployed ICS-specific firewall in the world.

In this episode of the (CS)²AI Podcast, Eric shares his background and discusses his career trajectory. He also offers many gold nuggets of advice for listeners who would like to do a startup, launch a product, be useful for the industry later on, or use what they already have to add value to the cyber security industry.

This episode is one you will not want to miss if you are looking to start your career in cyber security or considering starting a company in the cyber security space.

Show highlights:

Eric started his first business, making and selling root beer when he was about eight years old. He gained some valuable entrepreneurial experience doing that! (2:35)
His dad bought him a Digi-Comp 1 mechanical digital computer with three bits of memory when he was about eight years old. (5:31)
Eric's first job after graduating was with a small but prestigious consulting firm that designed mines. They shipped him off to Australia, South Africa, and Columbia. (7:09)
After three or four years, Eric got out of mining and imbedded himself into the data communications and industrial computer markets. (8:01)
Eric explains what went on in his early days in control systems. (10:36)
Writing a peer-reviewed paper for the IEEE on cyber security for control systems while he was at DCIT was a turning point in Eric’s career. (16:30)
Eric discusses the birth of Tofino Security. (20:35)
Eric talks about the challenges he faced and offers advice for listeners who would like to follow a similar career path. (22:35)
Why does he feel that startups have an advantage? (25:48)
Eric describes the Tofino firewall and explains what is. (26:39)
Eric talks about his mentors and the advisory roles he has been in. (33:50)
Eric explains how aDolus came into existence and discusses the complicated software supply chain. (36:40)
What is an S-bom? How does it differ from a D-bom? (46:02)
Some advice for listeners who want to start laying the tracks to be on the cutting edge of something or be of value to the cyber security industry. (52:17)

Links:

(CS)²AI

Eric Byres on LinkedIn

aDolus Technology Inc.

Books mentioned:

The Cuckoo’s Egg by Cliff Stoll

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: CyberWire Daily (LS 60 · TOP 0.5% what is this?)
Episode: Implications of data leaks of sensitive OT information. [Research Saturday]
Pub date: 2022-03-19

Guest Nathan Brubaker from Mandiant joins Dave Bittner on this episode to discuss Mandiant Threat Intelligence's research: "1 in 7 Ransomware Extortion Attacks Leak Critical Operational Technology Information." Data leaks have always been a concern for organizations. The exposure of sensitive information can result in damage to reputation, legal penalties, loss of intellectual property, and even impact the privacy of employees and customers. However, there is little research about the challenges posed to industrial organizations when threat actors disclose sensitive details about their OT security, production, operations, or technology.

In 2021, Mandiant Threat Intelligence continued observing ransomware operators attempting to extort thousands of victims by disclosing terabytes of stolen information on shaming sites. This trend, which Mandiant Threat Intelligence refers to as “Multifaceted Extortion,” impacted over 1,300 organizations from critical infrastructure and industrial production sectors in just one year. Nathan walks us through their research and findings.

The research can be found here:

1 in 7 Ransomware Extortion Attacks Leak Critical Operational Technology Information

The podcast and artwork embedded on this page are from CyberWire, Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Threat Intelligence with Sergio Caltagirone
Pub date: 2022-03-16

Dale Peterson's guest on the Unsolicited Response show is Sergio Caltagirone, VP of Threat Intel at Dragos.

What is good threat intel?
How does threat intel "reduce harm by reducing operational meantime to recovery"?
Should an asset owner care about the various threat actors named by Dragos, Mandiant and others?
Does it matter if it was Petrovite or Erythracite?
Why are the top recommendations in Dragos and other threat intel annual reports the typical, same as they always are, recommendations? What is the value if this is the case?
What does an asset owner need to have in place to make use of threat intel?
How does threat intel deal with the fact we are very bad at calculating or predicting likelihood?
Why did you feel the new Journal of Threat Intelligence and Incident Response was needed?

Links:

Dragos 2021 Year In Review
Webinar with Sergio on 2021 Year In Review
Sergio's Threat Intel Class at the Threat Intelligence Academy
S4x22, April 19-21 in Miami South Beach

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 30: Engineers Should Consider a Cybersecurity Career with Graham Speake
Pub date: 2022-03-15

Today, Derek Harp is excited to have Graham Speake, the Director of Industrial Security at Waterfall Security Solutions, joining him on the show! Graham started very early on as an engineer in control systems. He is an interesting and well-rounded individual with a long history in engineering.

Graham was born in Wales and moved to London when he started working. He has been living in America for the past twenty years. He is a senior Cyber Security professional with broad experience leading global Operational Technology (OT) and Information Technology (IT) cybersecurity programs for protecting mission-critical systems and infrastructure. He is an expert in developing and delivering security training courses and security awareness. He has subject-matter expertise in Industrial Control Systems (ICS) and SCADA cybersecurity, particularly in oil and gas majors, and for risk managing large capital value projects and architecting global solutions for Oil and Gas and Industrial Automation customers. He is a music lover, photographer, and world traveler who has recently become an RV traveler. He is also a husband, father, grandfather, and raspberry pie enthusiast!

In this episode of the (CS)²AI Podcast, Graham talks about his background and career journey and discusses what led him to where he is today. He also offers valuable nuggets of advice for listeners who would like to make a career in or transition into cyber security.

This is one episode you will not want to miss if you are looking to make a career in the cyber security space or are an engineer and would like to add cyber security to your career path. Stay tuned for more!

Show highlights:

Graham's early experiences inspired him to do electrical/ electronic engineering at college and then move into working with electronics and electricity in an industrial setting. (3:13)
The benefits of having an engineering background. (8:05)
Graham shares his recommendations for engineers who would like to add cyber security to their professional path. (9:08)
The US government offers free security training through the Idaho National Laboratory (INL). (10:22)
Graham talks about the mentorship he received and offers advice for finding a mentor and doing a mentorship exchange. (12:07)
Security only intersected with his journey much later in his career. (17:16)
9/11 was a pivot- point in his career. (20:08)
Graham talks about various types of industrial proprietary communication protocols. (26:04)
Graham talks about how he got into his interesting role at Yokogawa and how it differed from what he did at BP. (29:58)
Graham discusses what happened in the security space after being invited to be part of a training course and certification program in 2011. (36:58)
Learning the basic working vocabulary and terminology is a way to build bridges and get teams from different industries to work together. (42:22)
Graham explains why he could not say no to working for Waterfall. (54:00)
Relationships you form early in your career in the security space end up being very powerful later on. (57:40)

Links:

(CS)²AI

Waterfall Security Solutions

Graham Speake on LinkedIn

INL Critical Infrastructure Protection Training

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Risk-based Security Levels - updating ISA/IEC 62443-3-3 [The Industrial Security Podcast]
Pub date: 2022-03-15

The widely-used 62443-3-3 standard is being updated. One big change is making security levels risk-based. Join Alex Nicoll, co-chair of the ISA committee updating the standard, to look at what this means and how it will work.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Critical Mass
Pub date: 2022-03-15

My weekly article originally published on 15 March 2022.

View Details

Podcast: The OT and IoT Security Podcast
Episode: Monitoring & Protecting Assets in Critical Infrastructure
Pub date: 2022-03-08

Join our esteemed panel of experts who cover ways to advance cyber security strategies for critical infrastructure by monitoring and protecting your assets.

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Cyber Nationalism
Pub date: 2022-03-09

Dan Geer and Olav Lysne join Dale Peterson to discuss Cyber Nationalism and how this will affect ICS asset owners and ICS vendors should and will deal with increased pressure by nation states to insert back doors and other weaknesses in ICS.

Why would a vendor even consider cooperating with a government asking for a special favor?
What are some of the different levels of cooperation?
The benefits of deniability, and what is the likely business impact if the vendor is caught.
How is a global vendor to deal with multiple knocks on the door from competing 'teams'. Does the vendor need to pick a side?
How should asset owners view a solution from a vendor coming from a different 'team'? Should they assume there is a way the team could compromise their system?

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Shields Up For ICS
Pub date: 2022-03-08

Dale Peterson's weekly article suggests we develop a list of actions to take when the threat has a significant increase. He provides some examples of what should and should not be on that list.

Subscribe to Dale's ICS Security Friday News & Notes

View Details

Podcast: Pipeliners Podcast (LS 38 · TOP 2.5% what is this?)
Episode: Episode 222: The Evolving Cyber Threat Landscape with Annie McIntyre
Pub date: 2022-03-08

This week’s Pipeliners Podcast episode features Annie McIntyre of EverLine discussing the evolving cyber threat landscape in the oil and gas pipeline industry.

In this episode, you will learn about the importance of cybersecurity in the oil and gas industry. The conversation will cover lessons learned from various cyber security attacks, such as the recent high-profile Colonial Pipeline Incident, and how these attacks have pushed for more proactive compliance.

Russel and Annie also discuss what pipeline operators can do to protect themselves during the current Russian/Ukrainian war. Finally, Annie provides a glimpse into the future of cybersecurity technology.

Access the show notes and full episode transcript at PipelinePodcastNetwork.com.

The podcast and artwork embedded on this page are from Russel Treat, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 29: How to Be a Good CISO Even in the Face of Challenges with Mark Weatherford
Pub date: 2022-03-08

Derek Harp is happy to have Mark Weatherford, the CSO at AlertEnterprise, and the Chief Strategy Officer at the National Cybersecurity Center, joining him today for another episode in the series of security leader interviews!

Mark grew up on a farm in an agricultural community in Northern California and left the farming life to embark on a career in the Navy and travel the world as a technologist, helping companies in cyberspace. Throughout his career, he always planned to get back into ranching. Apart from being a well-known security leader, Mark is a military veteran, technologist, beekeeper, hunter, pilot, and a soon-to-be rancher and gardener. He is also a husband and father.

Mark has had various executive-level cybersecurity roles, including Global Information Security Strategist at Booking Holdings, Chief Cybersecurity Strategist at vArmour, a Principal at The Chertoff Group, Chief Security Officer at the North American Electric Reliability Corporation, and Chief Information Security Officer for the state of Colorado. He was appointed in 2008 by Governor Arnold Schwarzenegger to serve as California’s first Chief Information Security Officer. In 2011, he got appointed by the Obama Administration as the Deputy Under Secretary for Cybersecurity at the U.S. Department of Homeland Security.

Mark is a well-rounded individual who does a variety of interesting things. In this episode of the (CS)²AI Podcast, he shares his backstory and describes his career journey. He talks about the challenge CISOs face today, explains why relationships are vital, and discusses what it takes to be a good CISO today. He also offers some valuable nuggets of career advice for listeners.

You will not want to miss this episode if you are in a first-time CISO role or considering making a career in cybersecurity. Stay tuned for more!

Show highlights:

Growing up, Mark was always playing around with electricity, wiring up motors and lights, and often overloading circuits and blowing breakers. (3:20)
Mark became a cryptologic technician in the Navy and focused on signals intelligence. (4:50)
In 1994, Mark wrote his grad school thesis on information security. That changed his life and set the stage for his future. (7:59)
Mark created the Navy’s first operational red team. (10:14)
Mark explains why a CISO cannot be an expert today. (12:20)
Mark got hired as the first CISO for the state of Colorado. It was a great learning experience! (15:06)
Why is becoming a CISO is all about developing relationships? (19:47)
Mentoring others is one of the most satisfying things Mark has ever done. (25:28)
Mark had a lot of influence in his role at DHS. (32:01)
Some advice for people thinking of taking on CISO roles. (35:34)
What do you need to focus on and learn if you are aiming for a senior CISO position? (38:24)
What do people in advisory board roles do? (46:08)

Links:

(CS)²AI

Mark Weatherford on LinkedIn

AlertEnterprise

National Cybersecurity Center

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cybercrime Magazine Podcast (LS 30 · TOP 10% what is this?)
Episode: The Cyber Threat. Are Nuclear Power Plants At Risk? Hany Abdel-Khalik, Purdue University.
Pub date: 2022-03-03

Hany Abdel-Khalik is an Associate Professor of Nuclear Engineering and Researcher with Purdue University’s Center for Education and Research in Information Assurance and Security (CERIAS) who, along with his students, created an algorithm to protect electric grids, manufacturing facilities, and nuclear power plants from cyber attacks. In this episode of Cybercrime Radio, Hany joins host Paul John Spaulding to discuss whether nuclear power plants are actually at risk for a cyber attack, how vulnerable electrical grids and manufacturing systems may be, and more. To learn more about Hany’s work, visit https://cerias.purdue.edu • For more on cybersecurity, visit us at https://cybersecurityventures.com

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: ICS Security - February Month In Review
Pub date: 2022-03-03

Chris Sistrunk joins Dale Peterson to discuss the month's big 3 stories.

Urkraine from an ICS preparation standpoint.
DHS's new Cyber Safety Review Board
What to take from ICSsec vendor annual / semi-annual activity reports

Plus wins, fails and predictions.

View Details

Podcast: Government Accountability Office (GAO) Podcast: Watchdog Report (LS 41 · TOP 1.5% what is this?)
Episode: Federal Efforts to Improve Protection of Critical Infrastructure After the Colonial Pipeline Attack
Pub date: 2022-03-01

The 2021 cyberattack on the Colonial Pipeline disrupted fuel supplies in the Southeast United States and showed us just how vulnerable our nation's infrastructure is to these kinds of threats. The Cybersecurity and Infrastructure Security…

The podcast and artwork embedded on this page are from Government Accountability Office, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Senate Podcast
Episode: Safe Available Secure: Five Essentials to Keep the Rail Sector on Track
Pub date: 2022-03-01

Cyber Senate recently had the opportunity to catch up with Rick Peters, CISO, Operational Technology North America with Fortinet, to discuss their involvement in the rail sector, how they are helping and to elaborate further on their planned presentation for the May 12/13th conference Rail Cybersecurity USA in Arlington VA. www.railcybersecurityusa.com

Mr Peters will be discussing "Safe Available Secure: Five Essentials to Keep the Rail Sector on Track."
Like many industrial environments, rail systems have been in operation for decades. Keeping services on time and available, along with providing safety to passengers and cargo have been a staple. As rail systems add digital or cyber connectivity to their environment, they introduce efficiency gains but also take on risk.

In late 2021, new cybersecurity guidelines for rail transit were introduced to shore up critical infrastructure following a year of headlines regarding ransomware attacks. There are five cybersecurity essentials important for keeping rail systems on track to maintain safe, available and secure services. During this session, we will explore how you can innovate securely by incorporating these principles into your cybersecurity strategy including:

· Balancing modernization priorities such as Safety and Reliability, Ease and Comfort, Smart Transportation, and Customer Experience

· Understanding known and unknown vulnerabilities worthy of immediate attention

· Integrating and controlling access to the digitally connected IT and OT systems

· Investing in a cybersecurity framework to support a distributed architecture

· Recognizing cybersecurity is a team sport and partnerships matter

Rick brings the Fortinet OT-CI team more than 37 years of cybersecurity and global partnering experience working across foreign, domestic, and commercial industry sectors at the National Security Agency (NSA). As Fortinet’s Operational Technology North American CISO, he delivers cybersecurity defense solutions and insights for the OT/ICS/SCADA critical infrastructure environments. Prior to Fortinet, Rick led development of cyber capability across Endpoint, Infrastructure, and Industrial Control System technologies at the agency. Previously, Rick also served as an executive leader supporting the Information Assurance Directorate at the NSA. Earlier in his career, he served in a broad range of leadership and Engineering roles including Chief of Staff for the NSA Cyber Task Force and a 5-year forward liaison charged with directing integration of cyber and cryptologic solutions for U.S. Air Force Europe, Ramstein AFB, Germany.

The podcast and artwork embedded on this page are from James Nesbitt / Cyber Senate, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 28: Threat Hunting and Other Headline Making Cyber Security Careers with Mark Bristow
Pub date: 2022-03-01

Today, Derek Harp is excited to have Mark Bristow joining him for another episode in the interview series on security leaders! Mark is well-known in the cyber security industry. He is the Branch Chief for Cyber Defense Coordination and Operations for threat hunting at the Department of Homeland Security.

Mark found his first bug in an ISV system when he was ten years old. As a teenager, he was passionate about technology and spent much of his time discovering what he could do with his computer and the nascent internet. He later earned a Computer Engineering degree from Penn State.

Mark has been at the forefront of headline-making incident response efforts like the attack on the Ukrainian power grid, intrusions into U.S. election infrastructure, and Russian attempts to gain access to the U.S. power grid. He often does talks on worldwide industrial control systems security issues. He enjoys sharing his knowledge about the protection of critical infrastructure and using his real-life experience to help students relate the information to scenarios in the field. He is also a pilot-in-training and a scuba diver!

Mark had access to control systems as a young child, and as a result, he developed a breaker mindset quite early on. In this episode, he tells his story, talks about his background and career, and shares his unique perspective on cyber security. He talks about working for the government and offers some nuggets of career advice for people thinking of making a career in cyber security or those currently doing development in systems design and would like to specialize in cyber security.

If you are thinking of making a career in cyber security, you will learn a lot from today’s interview with Mark Bristow! Stay tuned for more!

Show highlights:

The role Mark’s father played in him becoming an early adopter of technology (3:11)
How he found a bug in an ISV system at the age of ten. (5:14)
Mark figured out how to bypass the safety controls and make the computer drop the space shuttle's engines before they were supposed to. (8:14)
How Mark transitioned from doing programming to doing cyber security professionally. (11:25)
Mark explains how programming mattered and helped him in his career journey. (13:23)
Some nuggets of advice for programmers who want to add something to their career path by specializing in cyber security. (16:02)
A nugget of advice for what you should do when you receive a job offer. (19:48)
The mentors and people who opened doors for Mark along his career path. (23:21)
What is it like working for the government? (24:37)
Mark explains why he pivoted to become a federal employee. (30:40)
Everyone in the cyber security industry is open to helping each other and offering advice. (35:51)
What you can do right now to become sought-after and successful in five to ten years. (37:29)
Mark explains his job title and talks about what he does. (45:29)

Links:

(CS)²AI

Mark Bristow on LinkedIn

CISA

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 321: How to Secure Your BAS Part 3
Pub date: 2022-03-07

In this episode, we discuss common attack methods that can be used to attack a BAS, we look at how attacks progress, and we discuss cyber security controls that can be put in place using existing frameworks.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 320: How to Secure Your BAS Part 2
Pub date: 2022-03-02

In this episode, we continue our discussion on securing your BAS against cyber threats. We will discuss how to explore the cybersecurity capabilities of a BAS, discuss the limitations of cyber security controls, and will look at the human aspects of cyber security.

View Details

Podcast: The Smart Buildings Academy Podcast | Teaching You Building Automation, Systems Integration, and Information Technology (LS 42 · TOP 1.5% what is this?)
Episode: SBA 319: How to Secure Your BAS Part 1
Pub date: 2022-02-28

In this episode, we begin our discussion on how to secure your building automation. We will explore, potential threats to a building automation system, how to assess risk, and common cyber security controls

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Sean Tufts on OT Security Culture, Technology
Pub date: 2022-02-24

Sean Tufts, ICS and OT security practice director at Optiv, joins the Claroty Aperture podcast to discuss some of the security technology and cultural challenges facing industrial enterprises as they deal with digital transformation and convergence.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Importance, Risk Reduction, and Level 0
Pub date: 2022-02-22

My weekly article originally published on 2/22/22.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Complete Rewrite - API 1164 Rev 3 [The Industrial Security Podcast]
Pub date: 2022-02-22

Functional vs operational safety, profiles, deep connections to IEC 62443 and more. Tom Aubuchon, Principal Consultant at Ethosecure Consulting and Suzanne Lemieux, Director Operations Security and Emergency Response Policy at the American Petroleum Institute join us to look at API 1164 Rev 3 - a complete rewrite of a pioneering cybersecurity standard.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Pipeliners Podcast (LS 38 · TOP 2.5% what is this?)
Episode: Episode 220: Gamification for Conducting Exercises with Clint Bodungen
Pub date: 2022-02-22

This week’s Pipeliners Podcast episode features IT and cybersecurity subject matter expert Clint Bodungen discussing the use of gamification for conducting exercises in pipeline operations.

In this episode, you will learn about how ThreatGEN is being used to support cybersecurity efforts in industrial settings, including oil and gas pipelines, how pipeline operators can benefit from implementing this tool in their team training, and how this tool can be used to support PHMSA Control Room Management requirements.

Access the show notes and full episode transcript at PipelinePodcastNetwork.com.

The podcast and artwork embedded on this page are from Russel Treat, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 27: The Fundamentals of Building a Cyber Security Business with Jeff Hussey
Pub date: 2022-02-22

Today, Jeff Hussey joins Derek Harp for another podcast in the Security Leader interview series.

Jeff is the Co-Founder, President, and CEO of Tempered. He is a serial entrepreneur who has accomplished a lot throughout his career. He founded and co-founded several companies, including the well-known F5 Networks. He is a professional board member of various businesses- both for-profit and not-for-profit. He has worked hard to make the internet more resilient, hardened, and secure, bring clean water to underprivileged countries, and enrich his community through the arts. He has also been funding and broadening technology innovation and cultivating better living standards for coffee growers in Latin America. Jeff is also a speaker, mountain climber, wine-maker, father, and lover of all things tech!

Starting from a very young age, Jeff has always been passionate about technology and communications! In this episode of the (CS)²AI Podcast, he talks about his background, his love of tech, the various businesses he started, and founding Tempered. He shares nuggets of advice around getting down to the fundamentals of what you are studying, dealing with customers, and networking, and offers some valuable tips for moving forward in the cyber security industry.

You won’t want to miss this episode if you are starting a career in cyber security or if you are in a similar field and considering a career change! Stay tuned for more!

Show highlights:

Jeff explains why he creates his own jobs. (3:53)
Jeff talks about his passion for tech and communications. (4:33)
How the first company Jeff started became the first internet service provider in Honolulu. (9:28)
The increasing internet traffic inspired Jeff to start his next business in 1996. (10:29)
Jeff discusses his initial foray into security and explains how the security paradigm changed after that. (12:25)
How his dad used to advise and help him early in his career. (16:30)
What he did to deepen his knowledge and become more effective in his career role. (18:01)
Jeff offers some excellent advice for dealing efficiently and effectively with customers. (22:05)
Jeff talks about his company, Tempered. (25:53)
Jeff explains what the host identity protocol does and how his company, Tempered, approaches it to create a hyper-secure network. (30:42)
Jeff shares his views on corporate culture. (34:16)
Jeff explains what excites him about the Airwall Solution that Tempered brought to market. (42:50)

Links:

(CS)²AI

Jeff Hussey on LinkedIn

Tempered

Books mentioned in the show:

Steven’s TCP/IP Illustrated Volumes 1 and 2

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Patrick Miller on Securing Critical Infrastructure in a Time of Conflict
Pub date: 2022-02-17

Veteran ICS cybersecurity expert Patrick Miller joins Claroty's Aperture podcast to discuss the proactive measures ICS cybersecurity managers and OT asset owners and operators should be taking right now in light of geopolitical tensions around the world.
Miller recently wrote a blog explaining what and how electric utilities and other CI organizations should be communicating and sharing in the event of conflict between Russia and Ukraine spilling over onto the internet. He elaborates on that piece in this discussion, as well as his experience in helping to get the NERC CIP standards off the ground, how the standard may be ready to "collapse under its own weight," 20 years later.
-
Join Claroty Team82's Slack channel and connect with our research team to discuss the latest in ICS and OT cybersecurity threat and vulnerability research.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Cyber Insurance Exclusions and Rates
Pub date: 2022-02-16

Two cyber insurance underwriters, Monica Tigleanu of Munich Re and Paul Gooch of Tokio Marine Kiln, join Dale Peterson on the Unsolicited Response show to talk cyber insurance.

Most of the episode discusses exclusions. Recently we had the high profile ruling that Merck's property policy in fact covered NotPetya losses because there was not a cyber exclusion statement.

The more interesting and important discussion is around the four recommended exclusions related to cyber war for cyber insurance policies that Lloyd's Market Association issued. These will likely by used by many in the Lloyd's syndicate and will affect other insurers. We look at the language around cyber operations, attribution, and other key terms.

Then the last part of the podcast talks about how insurers will be looking to set cyber insurance rates. How do they determine the cyber security posture of a potential insured.

It's an area that cybersecurity pro's in OT, and IT, need to understand better if they are part of cyber risk discussions.

Links

Merck's NotPetya Insurance Claim

Lloyd's Market Association Cyber War Exclusions

Dale's ICS Security: Friday News & Notes

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Pivot To Process Variable Anomaly Detection
Pub date: 2022-02-15

My weekly article suggests that Level 0 / 1 monitoring and detection vendors should pivot to process variable anomaly detection.

Subscribe to my ICS Security - Friday News & Notes

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 26: Starting Your Own Cyber Security Business with Albert Rooyakkers
Pub date: 2022-02-15

Albert Rooyakkers, the CEO and Founder of Bedrock Automation, joins Derek Harp today for another episode in the Security Leaders series. Albert is a well-known technologist in the cyber security industry. He is also an inventor, a motorhead, and a keen outdoorsman.

Albert was born and raised in Canada. After finishing high school, he went to the Southern Alberta Institute of Technology to learn about instrumentation and process control. After completing his studies, he spent sixteen years working at Foxboro, where he went from Sales to Applications to Projects and eventually into management. Foxboro later became Invensys and sent Albert to the Middle East. He loved that because the Middle East is a fascinating place!

Albert once described himself as a future enthusiast because the future excites him so much! In this episode of the (CS)²AI Podcast, he discusses his background, education, and career path. He talks about his early work experiences, dives into the founding of Bedrock Automation, and discusses the exciting transition to run Bedrock. He also shares some nuggets of advice for getting ahead in your career and talks about the exciting changes we can look forward to seeing in the future.

If you have spent most of your career working for one or two companies and are thinking about starting a business of your own, you are sure to gain a lot from today’s inspiring conversation with Albert Rooyakkers. Listen in to hear more!

Show highlights:

Albert worked on big projects while at Foxboro and often traveled internationally. (3:01)
Albert grew up with family businesses, so he knew starting a business would involve a lot of hard work. (4:10)
Why did he become a young workaholic while working in their family businesses in Canada? (5:29)
Albert talks about the best and most rewarding years of his life while starting Bedrock. (7:35)
What Albert believes is the most comprehensive learning experience imaginable. (8:55)
Jumping from Invensys to Maxim and then jumping from Maxim to Bedrock. (9:28)
Some advice for actualizing an idea or design that relates to the company you are in. (13:18)
Cyber violates the premise of automation. Albert explains how we can solve that right here in the USA. (18:29)
Building and maintaining relationships is vital. (25:14)
Great technology moves beyond technology and becomes art. When presented in the right way, that inspires people to use it. (28:31)
Some advice for overcoming challenges, growing, and evolving along your career journey. (32:57)
What excites Albert about the future? (38:51)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Tom Alrich On All Things SBOM
Pub date: 2022-02-09

Tom Alrich dives deep on the items he works and writes about. For a long time it was NERC CIP, and he recently added SBOMs to his repertoire. We go deep and I think the business model portion may be the best and most accessible part of the episode.

1:21 The 2 main SBOM formats. There differences and what will win.

12:30 VEX ... identifying what vulnerabilities in the SBOM are exploitable

24:00 What EO 14028 will require the USG to do with SBOMs in August

34:00 Who and how SBOMs will be provided and used. Business models.

Links

Tom Alrich's Blog

Tom's Who Should Be Responsible article

Subscribe to Dale's ICS Security - Friday News & Notes

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: OT Security Product Segment Winners = No Change
Pub date: 2022-02-09

My article from 8 Feb 2022 looks at what the two most successful OT security product segments have in common.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 25: Exploring Careers in the Cybersecurity Controls Niche with Fred Gordy
Pub date: 2022-02-08

Today, Derek Harp interviews Fred Gordy in another episode in the Security Leaders series. Fred is the Director of Cyber Security at Intelligent Buildings.

Fred hails from Atlanta, Georgia. He is an author, musician, woodworker, technologist, travel enthusiast, and grandfather. He is also well-known as an evangelist around cyber security for building control systems and building management.

Fred has worked with electronics, computers, IT, and even robotics along his career path. He had his first computer experience back in the days of basic programming in the mid-1980s when he did electronic engineering technology at college. Although his direction as an electronic engineer in technology should have been to get in on a board level, he was always more fascinated with the computer part.

In this episode of the (CS)²AI Podcast, Fred tells his story, discusses his career trajectory, and talks about the highlights of his career. He shares his insights and experience and offers some helpful nuggets of advice for listeners considering a career in the controls space. If you are at the entry-level of our industry and wondering where to go next, you will not want to miss this episode! Stay tuned for more!

Show highlights:

Fred had the opportunity to experience control systems when doing an internship while in college. (5:01)
How Fred inadvertently got exposed to computer control systems early on in his career. (6:27)
Having had a computer background before moving into the world of control systems allowed him to speak both languages. It helped him a lot in his career. (8:15)
Fred sees a career role emerging that will require individuals to know the full range of IT and OT. They need to understand computers and control systems. (9:01)
Fred discusses the work that Intelligent Buildings does in the commercial real estate industry. (13:03)
How buildings intersected with his career path. (14:22)
For Fred, there is nothing quite as exhilarating as having the power, capability, and know-how to make a massive piece of equipment work in concert with hundreds of other devices. (15:55)
Everything Fred has done in his life has in some way built upon itself. It's why he encourages listeners to draw on all their experiences, no matter how small they might seem. (17:40)
Fred talks about overcoming challenges. (21:40)
When he started his career, he knew little about what he was doing. He attributes his success to the mentors who helped him, encouraged him, and ignited his inner fire. (28:00)
Fred discusses ways to get people in different areas of the building-control space to work better together. (36:18)
Fred believes that the path for people in the controls industry will become easier now, since the advent of the MSI (Master System Integrator). (44:38)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Security vs Compliance & other NERC CIP insights [The Industrial Security Podcast]
Pub date: 2022-02-07

Which is better - security or compliance? Suzanne Black of Network Security Technologies brings a new perspective to this old question and covers a lot of other ground in the latest NERC CIP standards.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Tom Pace On Firmware Security Testing
Pub date: 2022-02-02

Tom Pace, who co-founded Netrise.io with Michael Scott, joins Dale Peterson to discuss Firmware Security Testing. There is a lot of firmware in ICS -- PLC's and other controllers, instruments, network infrastructure, etc. They spend some time discussing the elements that are tested and then dive into how a product vendor and asset owner might use this type of testing. And the key question is whether there will be enduring and important product differentiation. Check out S4x21, April 19-21 in Miami South Beach

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: OPC UA In Pwn2Own
Pub date: 2022-02-01

Dale's weekly article covers the importance of some serious security testing of four popular OPC UA stacks that will take place at Pwn2Own Miami at S4x22.

The last Pwn2Own Miami awarded $280K for 0days in ICS targets.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 24: Cybersecurity Careers in Real Estate and Other Niches with Bayron Lopez
Pub date: 2022-02-01

Bayron Lopez joins Derek Harp today for another podcast episode in the Security Leader series. Bayron is the Manager of Operational Technology at Kilroy Realty Corporation, a real estate investment trust company specializing in developing, acquiring, and managing real estate assets, primarily in Seattle, San Francisco, LA, and San Diego. Those four strategic areas encompass about fourteen million Class A commercial real estates. Bayron is responsible for the operational technology and security of those estates.

Bayron was born in El Salvador and grew up in South Central Los Angeles. While in high school, he had an excellent teacher and mentors who were designing aircraft and large buildings. They exposed him to multiple areas of engineering, including electrical, mechanical, civil, and aerospace. Bayron was very lucky to have that exposure because it was unusual for kids from the South Central Los Angeles neighborhood to get introduced to the world of engineering.

Bayron likes to see an objective outlined and then get things done. He has a degree in engineering and is a keen technologist. He is also a soccer fan and dreamer who likes to look ahead at what is coming up just beyond the horizon. In this episode of the (CS)²AI Podcast, he talks about his background and discusses his educational journey. He explains why he chose to work for a real estate company after graduating and talks about his current position at Kilroy. He also shares some valuable nuggets for people starting in cyber security or those who would like to get involved in the space.

Cyber security is going to become a cornerstone for buildings in the future. If you are thinking about getting into the field, you will gain a lot from this episode! Stay tuned for more!

Show highlights:

When he was in high school, Bayron decided to become an engineer and find something in that space that worked for him. He talks about the study program he chose. (3:58)
Bayron explains why he went to work for a real estate company after he graduated. (6:41)
How the idea of having an Operational Technology Manager came in at Kilroy. (8:45)
Bayron talks about the challenges he has faced since becoming Kilroy’s Operational Technology Manager. (10:28)
A strategy for creating a valuable security solution. (13:04)
Bayron discusses the day-to-day operations in his current position at Kilroy. (15:50)
The luxury of new builds versus retrofitting onto existing buildings. (19:44)
Some advice from Bayron for his younger self. (21:23)
A way in and some words of wisdom for individuals wanting to get into the security of building control systems. ( 22:38)
There are currently many different opportunities for specializing in the cyber security industry as it pertains to building systems. (26:38)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 31 · TOP 5% what is this?)
Episode: The future of cybersecurity education?
Pub date: 2022-02-01

“I've been educating now for about eight years within the college system and that hands-on experiential learning is critical. When I have students do something that's like a scenario based off of different security assessments I've done or just weaving in some real world stuff, they thrive. They really get excited. They walk away from it energized.” - Dennis Skarr

In this episode of Hack the Plant, Dennis Skarr of Everett Community College joins us to talk about an industrial cybersecurity program for students he has recently built. He describes the interactive element that helps students get excited about cybersecurity - in turn inspiring the next generation of cybersecurity professionals.

What success has this program had - and how, and why, should it be replicated across the country?

Join us as we discuss these questions, and more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: OT-ISAC on Information-Sharing, Incident Recovery
Pub date: 2022-01-30

Bill Nelson, director and officer of the OT-ISAC, joins the podcast to discuss the growing need for adequate sharing of threat intelligence and incident information among operational technology professionals, including asset owners and security practitioners.
Nelson explains some of the information-sharing challenges that continue to shadow ISACs, and why member organizations may be hesitant to share incident details. He also discusses a new operational resilience framework in development that will soon be released for public comment and feedback, and how that ties into the need for more discussions on incident response and recovery.
--
Claroty's research arm, Team82, invites you to join its new Slack channel where you can join other OT, ICS, and IoT cybersecurity experts to discuss the team's research, vulnerability disclosures, and best practices. Click here to join.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Ralph Langner, Dale Peterson & Zach Tudor
Pub date: 2022-01-26

We've been busy with the date change for S4x22, so here is a great replay of the S4x20 closing panel. Ralph and Zach have a ton of experience and make it a lot of fun.

View Details

Podcast: Digital Transformation Viewpoints
Episode: Larry O'Brien Talks OPC Cybersecurity with Randy Armstrong of the OPC Foundation
Pub date: 2022-01-18

Welcome back to another cybersecurity-focused episode of the ARC Digital Transformation Podcast. In this episode, we speak to Randy Armstrong, director of IT operations at the OPC Foundation. OPC has a very solid cybersecurity foundation and Randy has been at the center of this for some time, giving us an excellent summary of the many different layers of cybersecurity within OPC UA.

Security isn't something that was bolted on to OPC. From the beginning, security has been a primary concern. According to Randy,

"We wanted to have a standard that incorporated security as a first-class concept. From the beginning, every aspect of the specification is analyzed in terms of its impact on security, and, and has to be able to follow the conventions and the requirements that we've laid out for the overall framework. So by doing this, we've developed a standard that has a very cohesive, holistic view of security that shows up at different levels in the implementations."Many of the concepts behind what's known today as "zero trust" already exist in OPC, such as advanced authentication schemes, including the use of PKI, application authentication, and more. According to Randy,

"What we built into the OPC UA infrastructure is this concept of application authentication. So every application that's installed on a particular node has a unique identifier and has a certificate assigned to it. And it will be configured to only allow communication with a finite number of other applications. And it's up to the administrators to decide who's allowed to trust who, and you have very fine-grained control. So you can have a cell on a factory floor with 10 machines, and those 10 machines would all be I'll be configured to talk to each other but nobody else. And this is going to be independent of the user credentials, which may determine what access somebody has when they're accessing the machine. So it's really two layers of authentication."

The podcast and artwork embedded on this page are from ARC Advisory Group, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 23: Transitioning from IT to OT to Cybersecurity with Bryan Singer
Pub date: 2022-01-25

Derek Harp is excited to have Bryan Singer join him today for an episode in the Security Leader interview series!

Bryan is a true pioneer in the cyber security space! He has an extensive background in several industries, including manufacturing, DoD, and healthcare. His proven professional skills include system architecture and design, software project management, application development, system administration, network administration, database design and administration, and multi-tier support. Currently, he is Principal Director of Security Innovation at Accenture.

Bryan was born in Mountain Home, Idaho. His father was a pilot in the air force, so they lived in many different places across the country while he was growing up. He spent most of his childhood in Alabama, and he remembers being the coolest kid on the street because he had an Apple 2 Plus computer with two five-and-a-quarter-inch floppy drives. Watching WarGames inspired him to become a hacker, but he soon realized that hacking was not quite what it appeared to be on television!

In this episode of the (CS)²AI Podcast, Bryan shares his superhero backstory, talks about his career journey, and discusses the valuable lessons he learned early on that he could apply later in his career. He also shares some helpful nuggets for people either considering a career in cyber security or crossing over from other areas in IT or OT. If you are interested in cyber security, stay tuned. You will not want to miss this informative episode!

Show highlights:

Bryan talks about when he first got an itch for hacking. (1:23)
Immediately after high school, he joined the army. He worked in Intelligence and got exposed to computer and network security, now known as cyber security. (3:40)
Bryan started his career doing software development. (4:58)
Bryan describes his first experience of dealing with a compromise. (7:00)
Having a deep systems background has been helpful when diagnosing other problems later in his career. (8:43)
What Bryan tells people when they ask him how he got involved in cyber security. (9:34)
How he ended up being Chairman of the ISA-99 Security Committee. (12:34)
Bryan discusses mentorship and explains how he managed to connect with mentors in the world of industrial safety. (17:12)
How to get involved in the standards bodies early on in your career. (21:51)
The advice Bryan would give to his younger self. (29:34)
Some helpful advice for facing challenges. (33:14)
The impact of the pandemic on the cyber security industry. (34:01)
Bryan discusses the things he chose to do in his career, outside of what his job required. (35:52)
Bryan co-authored two books. (36:14)

Links:

(CS)²AI

Accenture

Bryan L Singer on LinkedIn

Resources:

The books Bryan co-authored:

Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SIS

Hacking Exposed Industrial Control Systems: ICS and SCADA Security Secrets & Solutions

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SIS

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Insurance Exclusions
Pub date: 2022-01-25

Dale's weekly article dives into the Merck / Ace American case on NotPetya damages covereage.

Check out S4x22, April 19-21 in Miami South Beach

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Architecting Next Gen OT Security [The Industrial Security Podcast]
Pub date: 2022-01-24

Safety, insiders, external attacks, remote access, zero trust and more. Serkan Yusuf at Applied Risk explores a new report based on a survey of over 1000 industrial security practitioners.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2.5% what is this?)
Episode: Episode 306 - Assessing Risk in ICS Environments
Pub date: 2022-01-23

Ransomware has captured the attention of many due to its far-reaching impacts on industrial control systems (ICS). Once a problem that only affected IT infrastructure, ransomware that now targets ICS / OT can significantly impact or even shut-down control processing, logistics, distribution, and delivery of critical goods.

We speak with Dr. Tom Winston, Director of Intelligence with Dragos Inc, based in Virginia. Dr. Winston is a Cyber Security subject matter expert focused on threats to critical infrastructure (ICS/SCADA) systems, as well as foreign cyber threat intelligence and threat analysis. Tom has extensive public and private sector experience in IT/OT threat environments to include hunting, detection engineering and reverse engineering. Tom has extensive experience in mobile devices, removable/fixed media digital forensics. Tom is also a seasoned manager of people, technology, projects, and programs. Multilingual, and with extensive experience in international relations, intelligence, and foreign policy analysis. Dr Winston has extensive private and public sector experience in IT/OT threat environments to include hunting, detection engineering and reverse engineering.

Formerly, a highly sought after and award-winning professor Dr Winston was an undergraduate and graduate student advocate and champion; student success is critical - not just in school, but after graduation as well. He built cyber security engineers one student at a time and continues to assist them even well past their graduation by providing career and other professional guidance.

Recorded 18 January 2022 courtesy of Dragos.

To view the video version visit https://mysecuritymarketplace.com/av-media/assessing-risk-in-ics-environments/

ICS #OTcybersecurity #cybersecurity #insiderthreat

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Interview With Andy Greenberg On Sandworm
Pub date: 2022-01-19

With the recent cyber activities and near hostilities in Ukraine I thought it would be a good time to replay my S4x20 Main Stage interview with Andy Greenberg, author of Sandworm: A New Era of Cyberwar and the Hunt for the Kremin's Most Dangerous Hackers.

Check Out S4x22: April 19-21 in Miami South Beach

Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Per Endpoint Risk Calculation
Pub date: 2022-01-18

Dale's weekly article looks at a new feature in Industrial Defender that measures risk per endpoint. Right direction, and the calculation needs to be more than a cyber hygiene measure.

Subscribe to Dale's ICS Security - Friday News & Notes

View Details

Podcast: Automation World Gets Your Questions Answered
Episode: Is SCADA IoT Control Too Risky?
Pub date: 2022-01-18

In this episode of the "Automation World Gets Your Questions Answered" podcast, we connect with Ben Manlongat of system integrator Outbound Technologies to learn about the risks of remote access and read-only SCADA data and how to secure this critical automation system component.

The podcast and artwork embedded on this page are from Automation World, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 22: Niching Down Within the CyberSecurity Industry with Daryl Haegley
Pub date: 2022-01-18

Today, Daryl Haegley joins Derek Harp for another episode in the Security Leader interview series! Daryl was a military officer and then became a civilian in DOD (Department of Defense) operations. He is now the Director of Mission Assurance and Cyber Deterrence for the DOD.

Daryl has always been fascinated with technology. He links his fascination to the intrigue he felt when watching Star Trek episodes with his father and brothers as a child and seeing how much simpler technology can make people’s lives.

Even though Daryl became one of the early cyber security pioneers, technology did not lead him to where he finds himself today.

In this episode of the (CS)²AI Podcast, Daryl tells his story, talks about his journey, discusses his choices, and explains how his career path led him to where he is today. He discusses some of the practices he employed along his career path that could be valuable when selecting a specific line of work. He also talks about how individuals in the military can increase their value to the outside world and explains where people can get formal or informal security training.

You will not want to miss this episode if you are leaning toward a career in the cyber security field, so stay tuned for more!

Show highlights:

The path leading Daryl to where he is today did not proceed through technology. (4:42)
After completing his RTC in the Navy, Daryl thought he was done with school, but he went on to get three master’s degrees. (6:36)
Daryl talks about crossing over from college RTC to become a cryptologist. (7:45)
An important lesson he learned from history is about defense. (9:01)
Today, Daryl still references some of the lessons he learned from his early experiences in his naval career. (11:44)
Some advice for how individuals who are still in military service can strengthen their resumes and increase their value to the outside world. (14:24)
Daryl discusses some areas where individuals can get either formal or informal security training. (15:53)
Daryl talks about control systems and explains how they first intersected with his career. (16:55)
Daryl shares some highlights of his career and discusses some of the things he would do differently today. (20:19)
How mentorship has played out on his career path. (24:01)
Daryl talks about the sharing of information between government entities and non-government entities. (28:32)
Daryl discusses his involvement in the cyber security certification model being rolled out. (29:43)
There are engineering classes at Georgetown University and George Mason University that include courses for individuals who want to study cyber security. (33:22)
The career areas within cyber security that Daryl believes will be in demand five years from now. (35:17)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Interview with Pascal Ackerman - Author of Industrial Cybersecurity Volumes 1 and 2
Pub date: 2022-01-12

Industrial Cybersecurity, listed as 2nd Edition but actually a completely new Volume 2 is 1027 pages on Security Monitoring, Threat Hunting and Security Assessments and Intel. In this episode, Dale Peterson talks with its author Pascal Ackerman.

Links

Industrial Cybersecurity Volume 1

Industrial Cybersecurity Volume 2

Industrial Cybersecurity: Efficiently secure critical infrastructure systems

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 21: A Non-Linear But Rewarding Career Path In Cybersecurity with Chris Blask
Pub date: 2022-01-12

Today, we have another podcast in the Security Leaders interview series. In this episode, Derek Harp talks to Chris Blask, the Global Director of Industrial and IoT Security at Unisys. Chris is a man of many talents! He is an entrepreneur, an inventor, an evangelist, and a visionary. He has been involved in many different projects for work, for fun, and sometimes a mix of both.

Chris was the inventor of one of the first firewall products. In addition, he built a multibillion-dollar firewall business at Cisco System, co-founded an early SIEM vendor, wrote the first book on SIEM, founded an information-sharing center for critical infrastructures, and advised both public and private organizations across the world in every sector. In his role at Unisys, Chris created the Operational Technology and IoT security practices, which he also leads. He also invented the Digital Bill of Materials (DBoM) structure and established the Unisys Marine Living Research Center. He currently chairs a range of non-profit cybersecurity organizations and contributes to a wide range of global security efforts.

Chris is very well known, and his resume is outstanding! He has been involved in many different projects and initiatives. In this episode of the (CS)²AI Podcast, he shares some valuable nuggets from his vast experience! He tells his superhero origin story, talks about the non-linear way he got to where he is today, sheds light on his current role as a leader in the cybersecurity industry, and discusses his philosophy around problem-solving.

Chris frequently changed course throughout his career journey. If you are in the early part of your career and thinking of making some changes down the line, you really won’t want to miss this episode! Be sure to stay tuned for more!

Show highlights:

Technology was a thread that ran all along Chris’s career path. (5:51)
While growing up, Chris always loved taking things apart to figure out how they worked. (8:16)
Moving on after every change he made in his life and education. (10:57)
The history and appreciation of art have had as much to do with Chris’s success as learning to program in Cobol. (12:46)
Chris explains how he started teaching people about different aspects of technology and how that led to his first job in OT with General Electric. (13:16)
Chris enabled himself to do mobile video conferencing to save his company millions of dollars. (15:28)
Chris explains how the security aspect of his career came into play. (21:00)
Creating and releasing the BorderWare Firewall Server. (25:46)
History has proved that there will always be a point in the future when every problem will get solved. (27:24)
Chris has been into cybersecurity for the last 28 years. He talks about all the companies with which he was involved. (31:56)
Chris talks about the genesis of firewalls. (34:05)
Learning to talk the right language, to move up in the world of technology. (39:17)
How mentorship has played out in Chris’s career. (43:20)
Chris shares a strategy for anyone currently in OT or cybersecurity. (51:34)
Chris talks about the changes he sees happening with OT and cybersecurity in the future. (58:37)

Links:

(CS)²AI

Unisys

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Tom VanNorman on OT Cybersecurity Skills Gap
Pub date: 2022-01-12

ICS Village cofounder Tom VanNorman joins the Aperture podcast to discuss the recently announced Cybersecurity & Industrial Infrastructure Security Apprenticeship Program that aims to improve cybersecurity knowledge within operational technology. ICS Village is part of a consortium behind this apprenticeship program along with Siemens Energy, SANS Institute, and a number of academic institutions. The aim is to integrate academic classes, training, and real-world job rotations at leading industrial companies.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: How Much Will It Reduce Fragility
Pub date: 2022-01-11

Dale's weekly article looks back at the dichotomy of must never go down and don't touch it or it might go down. And how a reduction of fragility can be a good metric of your next cyber risk reduction expenditure in ICS.

View Details

Podcast: Digital Transformation Viewpoints
Episode: ARC Cybersecurity Podcast: Sid Snitkin Interviews Radiflow and ServiceNow
Pub date: 2022-01-08

In the latest cybersecurity podcast, Sid Snitkin, leader of the cybersecurity practice at ARC, interviews Radiflow Chief Information Security Officer Rani Kehat and ServiceNow head of product James Destro. This was a wide-ranging discussion covering the convergence of IT and OT cybersecurity, the skills gap, incident response, and more. It's also a good introduction to Radiflow and ServiceNow.

Radiflow was one of the pioneers to develop OT-specific security solutions, and today they have greatly expanded their role to be a proactive cybersecurity provider focused on managing risk and getting the right threat intelligence to measure cybersecurity posture. You can also hear about ServiceNow's expanding role in OT cybersecurity and its partnership with Radiflow. According to James Destro, "ServiceNow has now extended into workflows for the operational technology space, specifically around Incident management, vulnerability response, security, incident response, just to name a few. "

Rani Kehat's thoughts on the Convergence of IT and OT Cybersecurity are also worth noting:

“The term IT and OT I think is slowly dissolving. Basically, we're talking about processes, we're talking about production. They span across multiple silos of technology. Some of them could be in the cloud, some could be something physical, and they are all joined to the same production process. So, these boundaries are currently dissolving and not really describing correctly the threat landscape or the client's system. Today, when we look at any production environment, it will start from anywhere from the enterprise, for example, SAP, and it will go down into the production flow commands, sent via data channels. Controllers today are working on TCP IP networks, some of the production environments, are even service-oriented. So, the convergence is here. The thing that hasn't converged are people, we haven't converged our mentality between engineers and cyber people. “

The podcast and artwork embedded on this page are from ARC Advisory Group, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: 2021 Attacks & Predictions for 2022 [The Industrial Security Podcast]
Pub date: 2022-01-10

A special episode where Nate and Andrew look back at what we can learn from cyber attacks on industrial sites in 2021 and what we should expect to come at us in 2022 and 2023.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: What I'm Watching In ICS Security In 2022
Pub date: 2022-01-05

The first live episode of the year covered the top three things Dale Peterson will be watching in 2022. Not predictions. More areas that could go in many different directions. The three are:

CISA Activities and Metrics
SW/FW/SBOM Product & Service Business Models
Cyber Insurance

The episode included two guests who talked about what they will be watching in 2022.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: 2022 ... The Year Of
Pub date: 2022-01-04

The Year Of descriptors are done retrospectively and looking forward. This episode looks at three ideas of what 2021 was the year of, and six ideas of what 2022 might be the year of. Related to OT and ICS Security, of course.

Subscribe to Dale's ICS Security: Friday News & Notes

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: OT Security 2021: Perspective & Progress
Pub date: 2021-12-28

The final podcast episode of 2021 includes two articles that summarize the year. The first is on Perspective and the second is Progress.

Enjoy the holidays and thanks for your support of the show.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 19: Internships and Specialties In the Cybersecurity Industry
Pub date: 2021-12-28

Today, Derek Harp is happy to welcome John Cusimano, Vice President of Industrial Security at Deloitte (The industrial cybersecurity division of aeSolutions’ was acquired by Deloitte in Aug. of 2021), as his guest for another episode in the Security Leader series.

John leads their industrial cybersecurity practice team, comprised of about twenty dedicated subject matter experts who mostly came from automation, IT security, or a blend of the two in the earlier parts of their careers.

John hails from Upstate, New York. While in high school, he played guitar in a band and loved using guitar effects. He wanted to become an audio engineer, so he was motivated to go into the engineering field. After graduating from high school, he went to Clarkson University in Upstate New York and did a combined electrical and computer engineering degree. John picked Clarkson specifically because it was the first school in the entire country to give every new freshman a computer.

In this episode of the (CS)²AI Podcast, John joins Derek to share his superhero origin story, talk about how he became a leader in the cybersecurity industry, and share the valuable lessons he learned along the way. He talks about the benefits of gaining practical experience from doing internships and specializing in your career. He also offers some gold nuggets of advice for people thinking of starting a career in the world of cybersecurity.

If you are entering the workforce or in the mid-level part of your career and want to move up within your corporation or step out and start a business of your own, you will learn a lot from today’s episode, so be sure to stay tuned for more!

Show highlights:

John talks about how he got to where he is at AE Solutions. (1:15)
John’s first encounter with technology happened before he was even in high school. (2:18)
John discusses how his practical experience from summer internships helped him land his first job. (6:09)
John shares an excellent way to bolster your career. (8:32)
How John found the niche of safety, and then later in his career, saw the connection between safety and cybersecurity, and started digging into cybersecurity. (11:23)
John talks about the people who mentored him and influenced his career path. (13:51)
John shares some nuggets to help engineers dive deeper into the world of cybersecurity. (17:39)
Overcoming the challenges in his career. (20:29)
There is value in being obsessive and eventually becoming an expert on a particular topic. (22:36)
John took a huge risk in starting an industrial cybersecurity practice before the technology got known to be a real thing. (24:33)
John talks about the areas within the cybersecurity industry that could start exploding with new opportunities over the next few years. (27:23)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #24 - ICS Security em Geral
Pub date: 2021-12-24

Nesta quarta-feira tivemos a gravação do último ICS Security Podcast de 2021! Nosso Fouder e ICS Security Expert @Eduardo Honorato junto do nosso CTO @Fabiano, falaram sobre ICS Security em geral.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Predictions Analyzed
Pub date: 2021-12-22

At the end of the ICS Security Month In Reviews episodes my guest and I give a win, fail and prediction. In this episode we replay those predictions and assess if we were right, wrong or the answer is still pending.

Subscribe to Dale's ICS Security: Friday News & Notes

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 18: Changing Careers to Leverage Cybersecurity Opportunities with Jaco Benadie
Pub date: 2021-12-21

Today, Derek Harp is excited to have Jaco Benadie, the Executive Director of KPMG Malaysia, joining him on the show for another episode in the series on Security Leaders.

Jaco is a well-known leader and problem-solver in the world of cybersecurity. He has a great attitude and is always willing to do whatever he can to make things happen. He is a barbeque and sports fanatic who loves watching the Rugby World Cup!

With over fifteen years of experience in the cybersecurity field, in both Information Technology and Operational Technology, Jaco leverages his IT and engineering skills and experiences to design, develop and implement controls to support the protection of critical computing systems from cyber threats.

Jaco has become an expert in dealing with every level of customer management in OT, IT, and cyber security. He has often worked as a subject matter specialist for complex remediation activities. He has also acted as a mediator to resolve tensions between IT and OT.

In this episode, Jaco tells his superhero story. He peels back the layers to let us in on the personal side of his life and career. He talks about his different work experiences after graduating from university and explains how hard he had to study to move into cybersecurity. He also talks about guidance and mentorship and explains what motivated him to leave KPMG to do rigorous safety training with Shell.

Jaco encourages anyone considering a career change to go ahead and do it, regardless of how old you are! You will not want to miss this episode if you are thinking about breaking into the field of cybersecurity!

Show highlights:

As a young boy, Jaco spent the best years of his life in Namibia with his grandfather, who was a farmer. (2:40)
Although he graduated with a B.Com degree in marketing, Jaco has never worked in that field. (4:52)
Jaco shares one of the most valuable career lessons he learned while working as a door-to-door salesman. (7:55)
While on a working holiday in the UK, Jaco was offered a permanent position as a Physical Security Manager. That was where he got introduced to the world of cybersecurity for the first time. (10:14)
Jaco did not have a technical background, so starting his journey into cybersecurity involved a steep learning curve. (14:09)
Jaco talks about how hard he had to study to break into the cybersecurity industry. (17:48)
The kind of guidance, mentorship, and exposure Jaco would have liked to have while breaking into the cybersecurity industry. (21:18)
What he does to encourage the junior associates in his team to engage with him and ask questions. (24:22)
Jaco explains why you don’t have to be a technical expert to have a key role in cybersecurity programs. (26:33)
How he got introduced to KPMG, took a side-step, and started working there as an assistant manager. (30:58)
Jaco talks about what he learned from the rigorous safety training he did with Shell before returning to KPMG. (36:05)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: We Were Always Connected [The Industrial Security Podcast]
Pub date: 2021-12-20

Graham Speake (semi-retired) reflects on a career in industrial security. He points out industrial networks were always connected and observes that we should all get more credit for material improvements in industrial security and security technologies in the last 2-3 decades.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Today with ISSSource
Episode: Managing the Supply Chain
Pub date: 2021-12-14

There are plenty of attacks making the news these days and while ransomware seems to be on the tips of everyone’s tongue, there is another type of attack just simmering slightly below the surface, and while it may seem hard to believe, is more dangerous. That is a supply chain attack.

The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Two Articles
Pub date: 2021-12-15

Dale Peterson's articles from Dec 7th and 14th.

Failing Business (Home) Continuity Plans
VC's, OT Security and Criticality

View Details

Podcast: Data Breach Today Podcast (LS 31 · TOP 5% what is this?)
Episode: The Ransomware Files, Episode 3: Critical Infrastructure
Pub date: 2021-12-09

Cybersecurity experts worry about attacks and ransomware directed at the 70,000 water and wastewater facilities in the U.S. In November 2020, the Hampton Roads Sanitation District was infected with Ryuk ransomware. Fortunately, its operational technology systems were unaffected, and it recovered.

The podcast and artwork embedded on this page are from DataBreachToday.com, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Click Here (LS 47 · TOP 1% what is this?)
Episode: 238 Shielding the Nuclear Arsenal From Cyber Attacks
Pub date: 2021-12-13

Joining us this week is Herbert Lin, Senior Research Scholar at the Center for International Security and Cooperation and Hank J. Holland Fellow at Stanford University. He’s author of the book, Cyber Threats and Nuclear Weapons, in which he outlines the challenges the U.S. faces in modernizing the control systems for our nuclear weapons arsenal, the dangers of connecting these systems to the internet, and the peril of feature-creep and increased complexity in the nuclear age.

The podcast and artwork embedded on this page are from The Record by Recorded Future, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #23 - Formação e Carreira em ICS Security
Pub date: 2021-12-10

Na última quarta-feira, tivemos mais uma gravação do ICS Security Podcast! Nosso CEO Eduardo Honorato, nosso CTO Fabiano Paixão, Rafael Pinho - ICS Security Specialist e o Professor Cesar - Professor do Senai, abordaram o tema: Formação e Carreira em ICS Security.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Dale on OT Exposed - Raw
Pub date: 2021-12-08

Dale Peterson joined Clint Bodungen and Pascal Ackerman on the OT Exposed - Raw show on YouTube. They broadcast this live on Friday afternoons, and it has the Friday afternoon vibe.

The first ~12 minutes are a bit on Dale's entry into the field and S4. Then they discuss maturity models, what to do when, and future technologies that will make a difference in the next 2 - 5 years.

View Details

Podcast: The Smart City Podcast (LS 27 · TOP 10% what is this?)
Episode: Smart City Podcast - Larry O'Brien Interviews Andre Ristaino of ISA on Cybersecurity Issues in 2022
Pub date: 2021-12-07

The ARC Smart City Podcast is back and this time we interview Andre Ristaino who is managing director at ISA, the International Society of Automation. Those in the world of smart cities may not be familiar with ISA, but most of those in the power and energy industry probably are. ISA creates and administers industrial and OT level standards that apply to critical infrastructure and manufacturing. Their standards are very widely adopted in these sectors not just in North America but around the world.

ISA has put a huge amount of effort into developing cybersecurity standards used at the OT level. The ISA 99 standards committee first began its work on a comprehensive industrial and OT level cybersecurity standard back in 2002. The standard has since been adopted internationally by the International Electrotechnical Commission (IEC) as the IEC 62443 Standard. ISA also supports a huge range of other cybersecurity-related efforts such as ISA Secure product certification, the ISA Global Cybersecurity Alliance, training programs, and liaisons with other standards bodies like NIST and NERC.

ISA's cybersecurity standards and other related efforts like ISA Secure have huge potential for smart cities and critical infrastructure. They're already being adopted in the electric power, water and wastewater, and building automation sectors. This podcast gives a great overview of what ISA can do for you in the realm of cybersecurity, what the standards are, and some key resources for end-users and owner/operators of OT-level technologies and assets.

The podcast and artwork embedded on this page are from The Smart Cities Team at ARC Advisory Group , which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: To The Point - Cybersecurity (LS 35 · TOP 3% what is this?)
Episode: OT and The Art of the Possible with Rob Lee
Pub date: 2021-12-07

This week Dragos CEO and co-founder Rob Lee joins the podcast and breaks down the OT challenge that many businesses are facing today including a lack of clarity on who within the business owns OT and defining what acceptable OT risk means within the business. He also shares perspective on multi-factor authentication as one of the universal controls, the industry + geopolitical aspect of managing risk, and shifting the lens to think about the IP threat from the operator POV. And he shares insights on the Salt Water Project and what can happen when thinking through OT impact + the art of the possible.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e161

The podcast and artwork embedded on this page are from Forcepoint | Global Cybersecurity Leader | Protecting the Human Point, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 31 · TOP 5% what is this?)
Episode: INL - Wind energy and cybersecurity challenges
Pub date: 2021-12-07

Wind energy is one of the most rapidly growing energy generation sources in the US - how can these renewable systems stay resilient in the face of cyber attacks as the industry grows?

In this episode, we hear from Megan Culler and Keith Mecham of Idaho National Labs (or INL). Megan Culler is a Power Engineer and Researcher; Keith Mecham is a Critical Infrastructure Cybersecurity Engineer.

INL is a Federally funded research and development center (FFRDC): public-private partnerships which conduct research and development for the United States Government. They operate large infrastructure security programs that include wind, power, and telecommunication, as well as provide engineering and development support to the federal government.

How does wind fit into our broader energy infrastructure? What threats does cybersecurity present to renewable energy? How can industry work tougher for policymakers to keep our systems secure?

Join us as we discuss these questions, and more.

“A big risk is people just don't understand the risks with these types of systems. I think that's starting to change, as we have larger and larger energy companies that already understand cybersecurity jumping into wind. We have projects from Royal Dutch Shell and BP and other energy companies. They're setting up huge wind farms, especially offshore. They understand cybersecurity because of their refineries and pipeline systems, better than a startup does. And we hope we see more of that bring some maturity to the industry.”

-Keith Mecham

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: New Cyber Frontier (LS 27 · TOP 10% what is this?)
Episode: NCF-281 Miniature Sensors Control Cybersecurity
Pub date: 2021-12-06

Today's podcast, our Control Systems Cybersecurity Expert, Joseph M. Weiss, an international authority on cybersecurity, control systems, and system security, will be talking about Control system cyber security is about keeping lights on, water flowing, etc. It is more than a matter of preserving network accessibility. We get in-depth about how a cyber incident impacts control systems, critical infrastructure reliability, availability, and safety. Our expert explores how industrial, manufacturing, transportation, and others rely on Operational Technology (OT) Internet protocol-based (IP) networks to bring significant productivity improvements but with such progress gains new threats to the given system. Enjoy today's show!

Visit our sponsors:

BlockFrame Inc.

SecureSet Academy

Murray Security Services

The podcast and artwork embedded on this page are from Logic Central Online, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Emerson Automation Experts
Episode: Episodio 33: Protección Cibernética en Sistemas Instrumentados de Seguridad
Pub date: 2021-12-03

En este episodio el experto en Sistemas de Control y Sistemas Instrumentados de Seguridad, Sergio Díaz, nos comenta sobre las consideraciones más importantes en términos de ciberseguridad en los sistemas de las plantas.

Hablamos sobre arquitecturas recomendables, tendencias actuales y mejores prácticas para proteger los sistemas de control y sistemas instrumentados de seguridad de ataques cibernéticos.

Escucha el episodio completo y suscríbete a nuestro canal para conocer más sobre las diferentes innovaciones en automatización industrial.

https://media.blubrry.com/emersonprocessxperts/content.blubrry.com/emersonprocessxperts/EPISOD_2.mp3

The podcast and artwork embedded on this page are from Emerson Team, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: November - ICS Security Month In Review
Pub date: 2021-12-02

Patrick Miller of Ampere joins Dale to discuss the months top 3 stories plus give their wins, fails and predictions. Stories:

The water sector proposing a NERC/FERC CIP approach to cybersecurity regulation.
GridEx VI
INL adding another large engineering firm to their CCE program.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Stronger & Faster - ISA/IEC 62443 [The Industrial Security Podcast]
Pub date: 2021-12-01

The IEC 62443 security standards are evolving. Eric Cosman, co-chair of the ISA SP-99 committee that creates the 62443 standards joins us in this episode. Eric looks at how experience using the 62443 standards is driving change in a number of key areas.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: OT Visibility & Detection Market - Q4 2021 Update
Pub date: 2021-11-30

My market update identifies the biggest challenge for the Big 3 pure plays, the enterprise acquirers, and the niche pure plays in the OT Visibility & Detection Market.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 15: Running a Successful CyberSecurity Company with Clint Bodungen
Pub date: 2021-11-30

Today, Derek Harp is excited to have Clint Bodungen, the Founder and CEO of ThreatGEN, joining him for an episode of the Security Leader interview series. Clint is an inspiring and creative individual who has been working in the cybersecurity industry for more than 25 years. He is a founder, entrepreneur, gamer, game designer, teacher, researcher, professor, martial artist, and father.

Clint Bodungen is the lead author of Hacking Exposed: Industrial Control Systems and creator of the ThreatGEN® Red vs. Blue cybersecurity gamification platform. He is a United States Air Force veteran and an active part of the cybersecurity community. Since 2003, his focus has been exclusively on ICS/OT cybersecurity, and he has helped many of the world's largest energy companies. Clint has worked for Symantec, Kaspersky Lab, and Industrial Defender and has published many technical papers and training courses on ICS/OT cybersecurity vulnerability assessment, penetration testing, and risk management.

While growing up, Clint was both technically inclined and artistic. He wanted to study commercial art and graphic design but started studying theatre and movie special effects instead. After a while, he switched to studying art, and soon after that, he quit his studies to join the Air Force. While in the military, he was allowed to learn about computers and computer security.

In today’s episode of the (CS)²AI Podcast, Clint tells his inspiring story and shares some great nuggets of advice for getting ahead in your career, finding opportunities, and running a successful company! He talks about his love of gaming and other interests while growing up. He discusses his studies, joining the Air Force, mentorship, the turning point in his career when he learned about industrial systems for the first time, and the process of writing his book, Hacking Exposed: Industrial Control Systems.

Stay tuned! You won't want to miss this nugget-filled and inspiring episode!

Show highlights:

Clint’s love of games and technology started when his family got an Atari in the early 1980s. (5:28)
His mom introduced him to one of her co-workers, a programmer. That got him interested in programming. (6:54)
Deciding to quit studying art and join the Air Force. (10:23)
What made Clint decide to join the military? (12:13)
Clint got the opportunity to start working on internet networks and learn about computers and computer security in 1995, while in the military. (15:26)
Clint and his colleague became interested in hacking in the mid-1990s. (16:27)
Clint talks about what prompted him to leave the military and discusses what he would have done differently today. (18:38)
Clint shares some nuggets of advice for anyone considering a career in computer security or technology. (22:45)
Much of what we learn comes from experience rather than books or classrooms. (25:40)
Clint talks about mentorship and how he got mentored by a hacker. (29:05)
The turning point in Clint’s career was when he got the opportunity to cross-train and write intrusion detection system codes with some of the developers at Symantec. (38:34)
When Clint learned about industrial systems for the first time. (42:00)
Writing papers and sharing his knowledge gave Clint a lot of exposure and the opportunity to give something back to his community. (47:53)
Clint talks about the process of writing his book, Hacking Exposed: Industrial Control Systems. (52:02)
Clint shares some of the nuggets he learned along the way in his career. (1:03:38)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Claroty, JFrog on Fuzzing BusyBox
Pub date: 2021-11-28

Claroty researcher Vera Mens and JFrog researcher Shachar Menashe join the podcast to discuss a recent research collaboration between the two companies that looked at the security of BusyBox.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #22 - Detecção e Resposta à Eventos e Incidentes de Segurança Cibernética
Pub date: 2021-11-26

Nesta quarta-feira tivemos mais uma gravação do ICS Security Podcast! Nosso CEO Eduardo Honorato, nosso CTO Fabiano Paixao e o Especialista OT/ICS Security Rafael Pinho Campos abordaram o tema: Detecção e Resposta à Eventos e Incidentes de Segurança Cibernética!

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hacking Humans (LS 51 · TOP 0.5% what is this?)
Episode: software bill of materials (SBOM) (noun) [Word Notes]
Pub date: 2021-11-23

A formal record containing the details and supply chain relationships of various components used in building software.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 14: Consequence-Driven, Cyber-Informed Engineering (CCE) with Sara Freeman and Andy Bochman
Pub date: 2021-11-23

Today, Derek Harp, the host of (CS)²AI Podcast, shares an episode of the Author Spotlight that features practitioners and contributors who do great work and write books about new modalities, new systems of organization, and new thought processes.

In this episode, Andy Bochman and Sarah Freeman, authors of Countering Cyber Sabotage- Introducing Consequence-Driven Cyber-Informed Engineering, join Derek to talk about their book.

Sarah has been an Industrial Control Systems Cyber Security Analyst at The Idaho National Laboratory (The Lab) for the past eight years. She did not get there through the traditional computer or cyber security background, however. Sarah studied Intelligence and Security Studies, focusing on terrorism in Graduate School, and came into cyber security through Language Services by assisting with certain investigations and operations on the language side. That eventually transitioned into industrial control systems when she joined The Lab.

Sarah has a unique understanding of different kinds of threat actors from some of the work she has done in the past. The Lab focuses on bringing in people with different backgrounds, like cyber security researchers, malware reverse engineers, and engineers. That is invaluable when talking about attacks specifically leveled against industrial control systems because some things translate well between traditional IT attacks while others are completely different. Bringing in different groups helps with much of their work.

One of the first companies Andy ever worked for was an applications security company that eventually got bought by IBM. He was also involved in some startups and some consulting. At IBM, Andy matched his cyber security day job with his night job, moonlighting as a blogger on the DOD Energy Blog and the Smart Grid Security Blog. While at IBM, he asked if he could cover energy from a cyber point of view, and they agreed. From that point, it became clear that he would eventually end up at the Idaho National Laboratory, where he has been for the last seven years.

Show highlights:

Sarah is valuable to the community because of her knowledge of the spoken and written languages used in certain parts of the world. (4:28)
The genesis of their book and the philosophy behind it. (7:51)
From about 2003-2004, Idaho National Laboratory has focused on electric grid security. (16:16)
Whatever first hits the people on the street and then ripples up to the people on The Hill brings about a new level of awareness. (19:37)
Critical infrastructure is sure to be targeted, and once something has been targeted it will be compromised. (20:40)
Putting security into the design stage is a different approach that is now evolving out of The Lab. (24:23)
Many opportunities exist for adversaries to get in and turn things to their advantage after a new software product has been deployed and begins to interact with other networks. (29:49)
What initially prompted Andy to write the book before Sarah came on board. (30:35)
How Andy came up with the title of the book. (36:43)
When espionage turns into sabotage. (39:04)
How you can use the book. (40:25)
A partner program and another version of the book, known as “Bootcamp” or “Partner Training” are also available. (41:13)
People are tired of the status quo and would be willing to explore a new way. (44:43)

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: ICS Security Maturity Levels (What To Do In What Order)
Pub date: 2021-11-16

This is from a two-part article originally published on Nov 9th and Nov 16th. It addresses the first six levels.

Many, if not most, asset owners bypass at least four of the first six levels.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: How Lenses Blind Us [The Industrial Security Podcast]
Pub date: 2021-11-17

"Lenses" are preconceived notions that limit our ability to evaluate and accept solutions. Dr. Art Conklin from the University of Houston joins us to look at lenses in industrial security and what to do about them.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: S4x12 Great Debate: Anti-Virus & Security Patching Should Be Abandoned In ICS
Pub date: 2021-11-17

This is from back when S4 was in a case study room that sat 60 and everyone could see and talk to everyone. Michael Toecker took the pro, Billy Rios the con. They had five minutes each and then you'll hear from many of the attendees who are the pioneers in ICSsec.

And in some quarters this debate still rages on.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: ZDI's Dustin Childs on Pwn2Own Miami
Pub date: 2021-11-15

Dustin Childs of the Zero Day Initiative (ZDI) joins Claroty's Aperture podcast to discuss the upcoming Pwn2Own Miami hacking contest. This is the only hacking contest focused on finding zero-day vulnerabilities in industrial control systems (ICS) and operational technology (OT), and it will be held during the S4 conference in January.

Childs is a veteran of the security industry and Pwn2Own, which is 16 years old. Pwn2Own Miami will be the second such event with an ICS focus. Researchers will compete for a prize pool over more than $300,000; four technology categories are in scope at this year's event: control servers, OPC servers, data gateways, and HMIs.

Childs explains Pwn2Own Miami's hybrid approach that will allow competitors to enter either virtually or on-site, how Pwn2Own works, and what the disclosure process is like with affected vendors once a zero-day is demonstrated.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #21 - ICS Security em geral
Pub date: 2021-11-12

Nesta quarta-feira tivemos mais uma gravação do ICS Security Podcast! Nosso CEO Eduardo Honorato, nosso CTO Fabiano Paixão, falaram de ICS em Geral.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Fortinet Keynote: Operational Resilience
Pub date: 2021-11-10

A recording of Dale Peterson's 30-minute Keynote at the Fortinet OT Symposium - Manufacturing Day.

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Exploring and Navigating OT for CISOs
Pub date: 2021-11-10

Splunk OT security strategist Chris Duffey and Global Advisory CISO Doug Brush join Claroty's Aperture podcast to discuss how CISOs can and must navigate the world of industrial control system (ICS) and operational technology cybersecurity.

Digital transformation and convergence have forced IT and OT under the same umbrella for many industrial enterprises and critical infrastructure. For many CISOs, managing OT cybersecurity is a whole new world of risk management strategies, technologies, and vendors.

Duffey and Brush explain some of the success stories they've experienced with CISOs who have had to close knowledge, technology, and experience gaps in order to meet OT security challenges head-on. There are numerous considerations from both an operational and strategic point of view, and Duffey and Brush share their experiences.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Manufacturing Happy Hour (LS 42 · TOP 1.5% what is this?)
Episode: Common Cybersecurity Threats and What to Do about Them with Dana Mantilia
Pub date: 2021-11-09

Dana Mantilia is a cybersecurity expert specializing in security and employee training, as well as identity theft protection. She’s the Founder of Identity Protection Planning, where she assists small to medium-sized businesses through her security products and services. Plus, she’s built a great name for herself in the security space through her viral videos that simplify some of the most important topics in cybersecurity.

In this episode, Dana takes us through some of the simple steps that all businesses need to take to ensure they’re better protected from cyber-attacks. She explains why businesses shouldn’t just relegate cybersecurity to the IT department. It should be something that everyone gets involved in.

Dana shares the two simplest ways everyone can better protect themselves and the company they work for and why cybersecurity practices start at home.

Make sure to visit ManufacturingHappyHour.com for detailed show notes and a full list of resources mentioned in this episode. Stay Innovative, Stay Thirsty.

In this episode, find out:

Why most cybersecurity issues stem from non-technical employees
Why education on cybersecurity is essential
How to start with the basics of cybersecurity
Why cybersecurity isn’t just about firewalls
Why being a small company doesn’t mean you’re safe from hackers
The starting steps that companies can take to become more secure
How Dana’s company meets CMMC requirements
Why you should probably change your Google account password

Enjoying the show? Please leave us a review here. Even one sentence helps. It’s feedback from Manufacturing All-Stars like you that keeps us going!

Tweetable Quotes:

“From a hacker’s point of view, it's 100 times easier to trick somebody into giving something away versus trying to learn how to hack all this stuff and get into the system.”

“Let's start with some basic cyber hygiene, some basic policies, and get the culture within the organization to start paying a little bit more attention to what we're clicking on.”

“85% of the problems are being caused by the non-technical people either clicking on something or giving away credentials accidentally.”

Links & mentions:

Identity Protection Planning, offering a range of cybersecurity trainings, products, and services; helping to protect Americans, their families, and their businesses from ID theft and cyber crimes

Cyber Security with Dana Mantilia, click here to subscribe to Dana’s YouTube channel

CMMC Accreditation Body, Dana’s company makes the process for meeting the needs and requirements of CMMC simple; if you are a manufacturer working with the DoD, learn more about CMMC (Cybersecurity Maturity Module Certification) here

Make sure to visit http://manufacturinghappyhour.com for detailed show notes and a full list of resources mentioned in this episode. Stay Innovative, Stay Thirsty.

The podcast and artwork embedded on this page are from Chris Luecke, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 12: Using Writing Skills to Unlock Careers in Cybersecurity with Andrew Ginter
Pub date: 2021-11-09

Today, Andrew Ginter, a pioneer in the cyber security space, joins Derek Harp. Andrew is the VP of Industrial Security at Waterfall Solutions. He is an author, a podcast host, and a well-known cyber security expert with multiple credentials in the industry.

Andrew was raised on a farm outside of Calgary and has remained there ever since. Where ever he worked early on in his career, Andrew would always step up and volunteer to do anything important that needed to get done. So he often wound up doing the things no one else wanted to do. That mostly involved doing maintenance because everyone else in the computer field wanted to do development. Andrew found that going with whatever was important and executing it well got him promoted and afforded him better opportunities.

In this episode of (CS)²AI Podcast, Andrew discusses his journey into cyber security. He shares his insights and offers advice for those who want to use their writing skills to open up new opportunities. This is an episode you won’t want to miss if you are interested in starting a career in the industrial security space!

Show highlights:

Andrew shares his background. (2:00)
How Andrew got pulled into doing SCADA security. (5:06)
Where technology first intersected with Andrew’s life. (7:05)
How Andrew wound up doing maintenance on 100,000 lines of assembly code. (10:15)
The helpful role mentorship played in Andrew’s career. (12:24)
Andrew talks about the control system product he developed. (17:54)
How Andrew’s writing skills opened up opportunities for him. (19:55)
What got highlighted for Andrew as a result of him writing a controversial book. (28:02)
Some practical advice for where writing skills could get developed and applied to the cyber security industry. (34:36)
Andrew shares some great advice about researching while working on a Master’s Degree to get a Ph.D. (37:46)
What you need to know if you are starting in the industrial security space. (43:26)

Resources:

Practical Cryptography by Bruce Schneier

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Cybercrime Magazine Podcast (LS 30 · TOP 10% what is this?)
Episode: Protecting A Nation. Building A More Secure Infrastructure. Nitin Natarajan, Deputy Director, CISA.
Pub date: 2021-11-08

Nitin Natarajan, Deputy Director at the Cybersecurity and Infrastructure Security Agency (CISA) joins host Hillarie McClure in this episode of Cybercrime Radio. Nitin shares a bit about his unconventional path into cybersecurity and his current role, tells us about the great work that CISA is doing to defend the U.S. and help us become more resilient, and more. To learn more about CISA, visit https://cisa.gov • For more on cybersecurity, visit us at https://cybersecurityventures.com

The podcast and artwork embedded on this page are from Cybercrime Magazine, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hacking Humans (LS 51 · TOP 0.5% what is this?)
Episode: OT security (noun) [Word Notes]
Pub date: 2021-11-09

Hardware and software designed to detect and prevent cyber adversary campaigns that target industrial operations.

The podcast and artwork embedded on this page are from CyberWire Inc., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Advanced Manufacturing Now (LS 32 · TOP 5% what is this?)
Episode: The Growing Importance of Cybersecurity in Manufacturing
Pub date: 2021-11-05

In this podcast, Bruce Morey, Senior Technical Editor for Manufacturing Engineering Magazine discusses with guests Jush Danielson and Bindu Sundaresan of AT&T how manufacturers are investing in digital technologies like IoT and 5G to gain visibility into their operations, improve efficiencies in their processes and enable new revenue opportunities. However, these digital transformation initiatives expand the attack surface and risk for a breach in their network. A sound cybersecurity strategy is important to help protect critical infrastructure.

The podcast and artwork embedded on this page are from Advanced Manufacturing Now, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: October ICS Security Month In Review
Pub date: 2021-11-03

Clay Carter, VP and Head of Product Security at Xylem, joins Dale Peterson to discuss the top 3 stories of the month and give their win, fail and prediction. The stories:

what did CISA's Water & Wastewater Alert mean to those sectors and a broader discussion on what would be helpful to those sectors.
Drago's raising $200M at a post money valuation of $1.7B.
Shodan Trends and how it could be used by asset owners and potentially .gov.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Weekly Article: Hidden Value In Creating Cybersecurity Audit Programs
Pub date: 2021-11-02

This article was originally published on the Tripwire Guest Author page. It highlights an early fail of mine and what I learned.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 11: Career Advancement in Information Security Services with Bill Malik
Pub date: 2021-11-02

Today, Bill Malik, the Vice President for Infrastructure Strategies at Trend Micro, joins Derek Harp. Bill is a well-rounded individual who has been involved in the security industry for quite some time. He has tons of experience in many different areas and has a long list of career milestones. Bill is a well-known writer, analyst, and speaker. He is a former programmer who still enjoys dabbling for fun! He is also a father and grandfather, an explorer of ideas, a chef, a wine connoisseur- and was even once a DJ!

In this episode of the (CS)²AI Podcast, Bill gives an inside view into his career journey. He discusses his interesting career and explains how he got involved in developing an information security service. He also shares some gold nuggets of advice for those individuals who would like to get to the next level in their organization by bettering their communication skills and offers excellent advice for those starting in their careers.

This is a great conversation full of nuggets that you won’t want to miss! Stay tuned for more!

Show highlights:

Bill talks about his background. (10:15)
When technology first came into play in Bill’s life. (13:08)
Bill discusses MIT’s involvement in developing a secure system for time-sharing, which led to his first intersection with cookies and security. (14:12)
Bill talks about the event that led to his first information security moment as an app developer. (19:39)
One of the biggest bits of programming Bill has ever done. (21:03)
Leaving IBM to join Gartner. (24:42)
How Bill got into developing an information security service during his time at Gartner. (26:05)
Bill shares some nuggets for those who want to better their communication skills and get to the next level in any organization. (29:39)
How Bill transitioned to KPMG. (33:12)
Where Bill first encountered industrial control systems. (36:03)
Why we are fortunate to be living in this age, in human history. (38:45)
Bill talks about mentorship and shares some valuable advice for people starting in training positions. (39:35)
The advice Bill would give to his younger self. (45:56)
Bill shares his advice regarding potential future careers. (47:40)
Why Bill sees no significant productive application in the future of blockchain. (51:12)

Links and resources:

Recommended video: The Last Lecture by Randy Pausch

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Hack the Plant (LS 31 · TOP 5% what is this?)
Episode: Cyber Challenges to Securing Our Electric System - California and Beyond
Pub date: 2021-11-01

“Initially it was looking at specific types of attacks and thinking how those could be utilized against our systems, but then it became more sophisticated in thinking of how these attacks could be coordinated together by larger actors? …. I think that regulation's role is more to draw attention and provide you with a base minimum, and then from there, it's the responsibility of those industries of those actors to step up and design the systems and implement true security.” - David Coher

How can our electrical grid system anticipate cybersecurity attacks? What is the nature of its vulnerability to attack, and what role can regulation play in securing our future?

In this episode, we hear from David Coher, leader of Southern California Edison’s (SCE) Energy Contract Management team, which manages their long-term energy procurement contracts (approximately $4 billion, annually). David is an attorney, who moved from real estate litigation to SCE where he established programs for cybersecurity, participation in California’s Greenhouse Gas emissions Cap & Trade market, and Dodd-Frank compliance.

We discussed how the power grid works and the changing landscape of keeping our energy grids safe from cyber attacks. We also explored the challenges of establishing a regulatory compliance program - in particular how to anticipate cybersecurity threats.

What is next for SCE? What are some potential opportunities and threats on the horizon for the safety of our electric grid? Join us to learn more.

The podcast and artwork embedded on this page are from Bryson Bort, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Mergers & Acquisitions - Rapid Change [The Industrial Security Podcast]
Pub date: 2021-10-31

Change is a risk in industrial operations, but at least on the security side of things, rapid change is the order of the day when connecting an acquisition to a new owner's infrastructures. Anthony Morrone and Marianne Swarter of Level5Cyber join us to look at issues and solutions for mergers, acquisitions and divestitures of industrial operations.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #20 - ICS Security em geral
Pub date: 2021-10-30

Na última quarta tivemos mais uma gravação do ICS Security Podcast! Nosso CEO Eduardo Honorato, nosso CTO Fabiano Paixão, falaram de ICS em Geral.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: SOAR In ICS
Pub date: 2021-10-27

Peter Lund of Industrial Defender joins Dale to discuss SOAR in ICS.

Examples of early big wins for SOAR in ICS
Can you mix and match your SIEM and SOAR from different vendors?
Partial v Full Automation ... will there always be a person in the loop? - Does SOAR need to be customized for OT to be of real use in OT?

They finish the conversation with a bit on Industrial Defender's recently announced OT Machine Learning Language.

Check Out The S4x22 Agenda

View Details

Podcast: Aperture: A Claroty Podcast
Episode: Gary E. Miller on the GPSD Bug
Pub date: 2021-10-27

Gary E. Miller, principle maintainer of GPSD, joins the Aperture Podcast to discuss a bug in this service that potentially could have caused some disruptions on devices that rely on global positioning systems for precise time-keeping.
GPSD is a service daemon that extracts time information from GPS appliances. GPSD can be found in anything from mobile phones, to submarine navigation systems, and satellites. There are also industrial applications that reply on GPS for timing, including flow meters in pipelines, for example.
A bug was discovered earlier this year in the GPSD code that could have rolled back time on GPS-reliant devices starting Oct. 24 to March 2002. Such an event could have affected data integrity with systems dependent on timestamps, for example. Some sensors transmit data regularly and part part of larger systems that take actions based on sensor readings.
Miller explains how GPSD works, the intricacies of the bug, and why there haven't been incidents related to the bug since Oct. 24.

The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Свежевыжатый подкаст (LS 25 · TOP 10% what is this?)
Episode: Выпуск 7. Практика мониторинга ИБ в энергосистеме — Алексей Лукацкий, Лев Палей
Pub date: 2021-10-26

Новый выпуск «Свежевыжатого подкаста» — про актуальные для энергетической отрасли киберугрозы, про устройство и зону охвата SOC в системном операторе, а также про то, как наладить обмен срочной ИБ-информацией между энергетическими компаниями. Об отраслевой специфике и практике мониторинга рассказывает Лев Палей, начальник службы информационной безопасности СО «ЕЭС», а расспрашивает его ведущий подкаста — Алексей Лукацкий.

Медиа Группа «Авангард» публикует серию бесед с лучшими экспертами отрасли в преддверие SOC-Форума 2021, который пройдёт 7–8 декабря в Москве. Успейте зарегистрироваться на сайте: soc-forum.ru. Слушайте выпуски на любой из платформ — Anchor.fm, SoundCloud, Яндекс.Музыке или YouTube.

00:00 Выпуск 7. Мониторинг инцидентов в энергетике

01:15 Кто такой «системный оператор» и кому он нужен

04:35 Обмен информацией между участниками отрасли

06:36 Как закалялся SOC в СО ЕЭС

07:44 Процесс-майнинг: идёт апробация, но пока всё сложно

10:27 Основа для use case — стратегия компании

14:48 Строение SOC в системном операторе

18:10 Функционирование Центра мониторинга и разные часовые пояса

23:19 Можно ли в энергоотрасли обойтись без SOAR

27:29 Технологический стек

31:40 Как строить SOC в идеальном мире

34:52 Аутсорсинг мониторинга инцидентов

38:17 Удержать специалистов — любой ценой?

45:42 CERT и собственный Центр информационной безопасности

54:17 Как обосновать необходимость SOC. Советы и лайфхаки

59:05 «Заставить считаться с собой»: внутренний маркетинг службы ИБ

The podcast and artwork embedded on this page are from Медиа Группа «Авангард», which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 10: A Non-Traditional Path of Curiosity & Cybersecurity with Jim McGlone
Pub date: 2021-10-26

In today’s episode of (CS)²AI Podcast, Derek Harp is joined by Jim McGlone. Jim is from Kenexis. He is an industry veteran working on control systems, safety, and security. Jim was born in Baltimore, Maryland. His dad worked for government contractors, so Jim was taken all over the world as a child. He remembers living in Germany, where his dad was responsible for all the control systems, and targeting mechanisms on cold war nuclear missiles pointed at Russia. His life was a little stressful and strange back then because his family took some weird vacations to places in Switzerland which Jim, only in his fifties, learned were safe houses. Later, when he was in grade school, their family moved back to a small town in Ohio where Jim grew up amongst some interesting people living on the edge of Amish country.

After graduating from high school, Jim went to the University of Akron intending to get a double E Degree. He did not do well, unfortunately, and dropped out after three years. He later graduated from the University of New York, with honors, with degrees in computer technology, nuclear technologies, and physics. Then, ten years later, he earned his MBA.

Jim is a multi-talented individual! What really sets him apart from others is his insatiable curiosity. He is constantly changing and evolving. In this episode, he talks about his career and how the unusual education choices he made early on later influenced his career path. He did not follow the expected order of things, preferring to do it in his own time. Later in his career, he went back and completed much of what had earlier been expected of him. You will not want to miss this episode if you’re curious, like Jim, and always striving to grow and develop.

Show highlights:

Jim’s children get upset with him because he is unable to tell his grandchildren what he does in his career because it is too complicated. (13:45)
Jim just did several safety courses and is preparing to get some certifications for process safety, like risk analysis. (14:46)
How education in the military differs from other education. (15:15)
Where industrial controls and systems intersected with Jim’s journey. (16:00)
Jim’s career journey just after he got out of the navy. (17:59)
The point at which Jim’s life became all about computers and software. (21:58)
Meeting Bryan Singer and traveling with him, doing sustainability and security summits. (25:31)
Jim went to work for Honeywell. (28:00)
When Jim got ahead of the curve with the software he created. (31:10)
Some circuits are so critical that we need to rethink what they get hooked up to. (35:05)
Jim is coming up with standard language around cyber security. (45:35)
Some of the challenges Jim has faced in his career: Good advice for anyone who’s looking to get into cybersecurity as a career (47:00)
How mentorship has played a part in Jim’s life. (57:24)

This podcast is brought to you by: Waterfall Security Solutions, Fortinet, Network Perceptions, Industrial Defender, Tripwire and Q-Net Security.

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Who Manages The Edge?
Pub date: 2021-10-26

My weekly article looks at the work and risk related to cyber maintenance of the ICS edge devices (when they get the needed DPI)

Check out the S4x22 Agenda

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2.5% what is this?)
Episode: Episode 292 - Critical Info Infrastructure Protection in Singapore with Cyber Security Agency of Singapore
Pub date: 2021-10-24

Interview by Jane Lo, Singapore Correspondent with Lim Thian Chin (Director, Critical Info Infrastructure Division, Cyber Security Agency of Singapore)

Thian Chin is leading the Critical Information Infrastructure (CII) Division at the Cyber Security Agency of Singapore (CSA). The division is responsible for building the cyber resilience of the Nation’s essential services across 11 CII sectors covering government, utilities, transport and services clusters. His team works with sectoral regulators to strengthen the cyber resilience of CII owners, to promote confidence-building measures and to deepen the public-private partnership between the government and CII stakeholders. Thian Chin also represents Singapore in International and regional cybersecurity forums where he shares his knowledge on cybersecurity resiliency and capability building.

Thian Chin has over 19 years of experience in Information & Technology governance, risk management, resilience and compliance, and Operational Technology cybersecurity. Prior to joining CSA in August 2015, he was responsible for the regional Technology Governance function in United Overseas Bank. He also led the Technology Risk function in GIC from 2008 – 2013. In his earlier years, he was a Manager and had led a team of auditors in Information Technology in Ernst & Young. Thian Chin holds an Executive Masters (Cybersecurity) with Brown University, a bachelor’s degree in Computer Engineering from Nanyang Technological University and is an alumnus of the George C Marshall European Center for Security Studies. He is certified as a GICSP, CGEIT, CDPSE, CRISC, CISM, CISSP, CISA, and SABSA practitioner.

In this podcast, Thian Chin shared some highlights* on cybersecurity and operational technology (OT) at the Singapore International Cyber Week (SICW 2021), and the OT Cybersecurity Expert Panel (OTCEP), organized by the Cyber Security Agency of Singapore.

Touching on cybersecurity incidents highlighted in the “Singapore Cyber Landscape 2020” such as ransomware and supply chain, he noted the increasing complexity of the threat landscape.

He discussed some common perceptions of the cybersecurity professionals and the engineers running the operating infrastructure, including infrastructure “air gap” and cultural differences such as skills and language, and security goals (“CIA” - versus “SRP”).

Referring to one of Singapore’s largest cyber incidents in the CII sector, and the recent threats, he shared perspectives on how government policies such as the OT-ISAC, the OT Cybersecurity Code of Practice (updated in 2019) and the Cybersecurity Competency Framework (2021) help to boost cyber defenses.

With the recent release of the “Singapore Cyber Security Strategy 2021”, he also several areas of focus for the CII cybersecurity ecosystem, including structuring an approach to managing supply chain risks and building cyber resiliency profiles.

*also included highlights from OT-ISAC (Operational Technology Information Sharing and Analysis Centre) and ISACA Singapore Chapter

Recorded: 15th October 2021 (SGT 8.30am)

The podcast and artwork embedded on this page are from MySecurity Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: The Future of ICS Security with Susan Peterson Sturm
Pub date: 2021-10-20

Susan Peterson Sturm and Dale Peterson talked about the future at Cognite's Ignite event. They discussed:
what changes can we expect when architectures base on the Purdue mode are dying
trust and restricted capabilities between service providers and assets owners
how data ops coming online now can help secure OT and leverage IT / OT convergence
cultural convergence - the promise of process variable anomaly detection

Check Out S4x22

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Try Different Roles & Companies In Your First Two Decades
Pub date: 2021-10-19

Dale's weekly article published on 19 October 2021.

Subscribe to Dale's ICS Security: Friday News & Notes

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 09: Mentorship for Cyber Security Career Development with Rick Peters
Pub date: 2021-10-19

Today, Rick Peters joins Derek Harp. Rick has a long history in the world of cyber security. He is currently the CISO for Operational Technology, North America for Fortinet.

Rick was born and raised on the east coast and was always involved with the community there. That involvement afforded him some wonderful opportunities, both before and after he graduated from college with a Double E degree.

In high school, Rick never thought he would end up with a career in math and the sciences. He dabbled in architecture for a while but soon realized he was not cut out for it. Then, he looked into engineering and found he had an aptitude for it and was a natural fit for that world. He found his niche specifically in the digital aspect of engineering.

In this episode of (CS)²AI Podcast, Rick tells his story. He talks about the awesome opportunities he had for growth while working as an engineer at the NSA and discusses the time he spent overseas with US Air Force Europe, working with industrial control systems and SCADA technology. He also explains why mentorship is vital and shares some sterling advice for getting ahead in your career and for those thinking about moving from working for the government to working in the private sector. Tune in to hear more!

Show highlights:

How Rick found his niche. (3:01)
The fantastic opportunities Rick had for growth while working as an engineer at the NSA. (6:35)
The questions you need to ask yourself as a career professional. (6:50)
Spending five years with the US Air Force in Europe as NSA’s Liaison. (8:45)
Raising the bar for security in the US Air Force. (12:37)
Working with operational technology- or industrial control systems and SCADA technology. (14:35)
Thinking about security from the inside out. (20:00)
Rick talks about his career path. (24:35)
Some advice for those considering moving from working for the government to working in the private sector. (26:52)
The career advice Rick would give to his younger self. (34:02)

Resources:

Fortinet Website

CS2AI Website

This podcast is brought to you by: Waterfall Security Solutions, Fortinet, Network Perceptions, Industrial Defender, Tripwire and Q-Net Security.

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: ICS SECURITY PODCAST
Episode: Ep. #19 - Energy Sec: Detalhando a Rotina Operacional do ONS
Pub date: 2021-10-15

Nesta tivemos mais uma gravação do ICS Security Podcast! Nosso CEO Eduardo Honorato, nosso CTO Fabiano Paixão, abordaram o tema Energy Sec: Detalhando a Rotina Operacional do ONS.

The podcast and artwork embedded on this page are from Munio Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Calculating OT Cyber Risk With Ilan Barda of Radiflow
Pub date: 2021-10-13

This episode dives deep into the risk score methodology of Radiflow's Ciara product. It attempts to use interview, asset inventory, and simulation to identify a risk score for a zone or site. It also then uses simulation to determine what security controls would most improve the risk score / reduce risk. Obviously this is a detailed talk on a specific vendor approach, so if that sort of thing bothers you this episode might not be for you. We also talk about whether the visibility / detection product segment will be separate from the OT cyber risk product, and we end with a discussion of how a company the size of Radiflow competes with the Claroty/Dragos/Nozomi of the world that have raised $100M+.

View Details

Podcast: Control Amplified: The process automation podcast
Episode: The forces reshaping tomorrow’s distributed control system
Pub date: 2021-10-12

Since its introduction more than four decades ago, the distributed control system, or DCS, has made enormous contributions to the safe, efficient and reliable operation of innumerable industrial processes around the world. In this episode of Control Amplified, editor in chief Keith Larson talks about the forces reshaping the distributed control system (DCS) landscape and how ABB is responding to them is Mark Taft, ABB group vice president responsible for the company's process control systems offerings worldwide.

Read the transcript: https://www.controlglobal.com/podcasts/control-amplified/the-forces-reshaping-tomorrows-distributed-control-system

The podcast and artwork embedded on this page are from ControlGlobal, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: Supply Chain Cybersecurity: Calamity or Shoulder Shrug II
Pub date: 2021-10-12

My weekly article. The cybersecurity team needs to be careful about overselling the supply chain cybersecurity risk in an environment where real, large supply chain disruptions are occurring.

My article originally published on 12 October 2021.

View Details

Podcast: The Industrial Security Podcast (LS 33 · TOP 5% what is this?)
Episode: Automating Vulnerability Handling - a Promising New Standard: CSAF [The Industrial Security Podcast]
Pub date: 2021-10-12

Vulnerability handling costs a lot of time and effort - finding the announcements, evaluating them, comparing to our systems, planning & managing deployment and more. Jens Wiesner of the German BSI joins us to explore a new standard that promises to automate much of this task - the Common Security Advisory Framework.

The podcast and artwork embedded on this page are from PI Media, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Control System Cyber Security Association International: CS2AI
Episode: 08: Creating a Business Around a Great Idea That Solves Problems with Lior Frenkel
Pub date: 2021-10-12

Today, Derek Harp is joined by Lior Frenkel, the CEO, and Founder of Waterfall Security Solutions. Lior is a man of many talents! He is an entrepreneur and a business executive. He is also a problem-solver, father, off-road adventurer, competitive shooter, and cooking enthusiast! He has created multiple companies, and he was involved in developing many different products, both commercially and for the military.

Lior was born and raised in Israel. He had his first encounter with technology at eight years old when his parents bought a computer for his brother. He got hooked immediately, and since then, he has never left the keyboard! It has always excited Lior to see something tangible happen after writing a few lines of code, and he loves to see people using his technology to solve something meaningful!

In this episode of (CS)²AI Podcast, Lior shares his captivating story. He talks about how he taught himself to code at a very young age, the software he developed while in high school, his capacity for solving problems, and why he chose to make a career in the field of cyber security. Stay tuned today to hear about Lior’s journey, and find out how to create a successful business around a great idea or solution.

Show highlights:

Lior shares his background and origin story. (20:48)
Learning through his real-life experience and from others with more knowledge. (25:55)
Finding ways to solve problems has always been most important for Lior. (29:02)
How Lior started his career while still in high school, selling the educational software he developed. (35:15)
Lior talks about his incredible experience in the Israeli Air Force and starting his first business as an adult. (37:29)
He knew nothing about business when he started focusing on building technologies for computer/information warfare. (42:19)
What Lior started to worry about when he never failed to get in through the perimeter security or firewalls of his targets. (46:13)
Lior explains why security became the focus of his life. (50:25)
How to start a successful business around a great idea for a new solution. (55:48)
Lior shares his vision for the future. (1:06:54)

Resources:

Waterfall Security Solutions

CS2AI.org

This podcast is brought to you by: Waterfall Security Solutions, Fortinet, Network Perceptions, Industrial Defender, Tripwire and Q-Net Security.

The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: To The Point - Cybersecurity (LS 35 · TOP 3% what is this?)
Episode: Today’s Ransomware Relationship Status: It’s Complicated, With Danny Jenkins
Pub date: 2021-10-05

Joining us this week is Danny Jenkins, CEO and Co-founder of ThreatLocker, an Orlando-based cybersecurity firm providing zero-trust endpoint security. Danny shares insights on the challenges facing critical infrastructure, particularly water systems that continue to be targeted with today’s latest headline grabbing financial + idealogical threat of ransomware. And he poses the question, “Will we get to a point where we have to stop drinking tap water?” He also provides perspective around the nuances of compliance (note: listen for the motorcyclist example!) versus regulation and getting on a path to proactive versus reactive security while moving to a collective mindset of ‘what can I do to improve security this week’? And you don’t want to miss ThreatLocker’s must read report on protecting water infrastructure from cyber attacks available here on our show notes at https://www.forcepoint.com/govpodcast/e153

View Details

Podcast: The OT and IoT Security Podcast
Episode: Understanding the Risks to Operational Technology (OT)
Pub date: 2021-10-09

Operational technology (OT) and Information Technology (IT) have traditionally been managed separately. With the emergence of Internet of Things (IoT) and the changing threat and risk landscape, industrial, manufacturing and critical infrastructure companies are bringing together their OT, IT and IoT networks to achieve a combined cyber and risk plan to prevent future cyberattacks. The incoming Critical Infrastructure Bill is aimed at driving action in this direction and organizations must start to prepare now to secure their IT as well their OT / IoT infrastructure.

These combined capabilities not only achieve significant improvements in cybersecurity but bring remarkable improvements in the efficiency of managing and securing your diverse assets.

In this episode, learn more about:

Threats to OT
Unified visibility and security
Eliminating OT and IT silos
Reducing risks to OT, IT and IoT

The podcast and artwork embedded on this page are from Nozomi Networks, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

View Details

Podcast: Unsolicited Response Podcast (LS 30 · TOP 5% what is this?)
Episode: September: ICS Security Month In Review
Pub date: 2021-10-06

Joel Langill joins Dale in this Live episode. The stories:

CISA's Performance Goals and Objectives for Critical Infrastructure ICS (and a bit on TSA's 2nd Security Directive)
Moody's moving from Visible Risk to Bitsight for Cyber Security Ratings, and the difficulty to create and possible use of Cyber Security Ratings
Who performs what tasks in "OT"

Plus Wins, Fails and Predictions.

Links:

S4x22: https://s4xevents.com

Joel's Training: https://icscsi.org

View Details

Podcast: Cyber Security Weekly Podcast (LS 38 · TOP 2.5% what is this?)
Episode: Episode 287 - Let’s get Critical: The new security imperative for Australian Critical Infrastructure
Pub date: 2021-10-07

2021 is shaping up to be a seminal year for Critical Infrastructure organisations when it comes to both physical and cybersecurity.

The twin imperatives of COVID-19 (and its contingent lockdowns and impact on international travel to and from Australia) and the amendments to the Critical Infrastructure Act mean that its more important than ever for the sector to get their security in order.

In this interview we talk to Genetec’s ANZ Country Manager George Moawad about how has risk management at Critical Infrastructure organisations has changed over the last 12-18 months and what are the biggest security concerns of current and prospective critical infrastructure clients.