S4x24 Closing Panel
Unsolicited Response Podcast
info_outline
Q1: ICS Security In Review
Unsolicited Response Podcast
Emma Stewart joins Dale to discuss the 3 big OT & ICS security stories from the first quarter. They end by giving their win, fail and prediction for Q1.
info_outline
S4x24 Preview
Unsolicited Response Podcast
info_outline
Predictions Analyzed
Unsolicited Response Podcast
In this solosode episode Dale reviews the status of his three predictions from the Q1, 2 and 3 quarter in review episodes and answers a listener question.
info_outline
Q4 ICS Security Quarter In Review
Unsolicited Response Podcast
info_outline
CISA Attack Surface Scanning Service
Unsolicited Response Podcast
Dale is joined by Steve Pozza, CISA Section Chief of Operational Resilience, and Tom Millar, CISA Branch Chief of Resilience, to discuss some of CISA's security services for asset owners. They discuss: The Internet accessible attack surface enumeration and vulnerability scanning surface. Asset owners can buy products or services to do this. Why is the government doing this? What CISA is doing with this attack surface data? How is CISA measuring the success of this service offering? Other broadly available services and tools, the cybersecurity performance goals (CPG assessment) ~500 done in...
info_outline
Engineering-Grade OT Security with Andrew Ginter
Unsolicited Response Podcast
Andrew Ginter published his third book this year: . Dale interviews Andrew on the book including: Who was the target reader that Andrew wrote the book for? Do (should) professional engineers lose their licenses for poor and dangerous cybersecurity design and deployments? The use of the term engineering grade, and how he defines it. Unhackable protection and safety controls as a major part of engineering grade. Unidirectional (one-way) network devices as the only security control listed as engineering grade. Is one-way from the enterprise network to the OT network engineering grade? Given the...
info_outline
Asset Inventory, Lawyers, and AI
Unsolicited Response Podcast
This week is a Dale Peterson solosode. Updates and Announcements Dale provides updates about S4x24 ticket sales and announces the Women In ICS Security program and sponsor package. Main Topics Asset Inventory in Cybersecurity: Dale challenges the common security mantra "You can't protect what you don't know," using examples from both physical and cyber domains. He notes many of the comments on this week's article missed the main point, and he gives hints on the next two asset inventory articles. Legal and Regulatory Issues in Cybersecurity: Dale emphasizes the importance of domain expertise...
info_outline
Is The Purdue Model Dead (E)
Unsolicited Response Podcast
info_outline
Kelly Shortridge - Security Chaos Engineering in ICS
Unsolicited Response Podcast
Kelly joins Dale to discuss her new book . Kelly points out the second part of the title is the most descriptive, and she is not a big fan of the Chaos term that has taken hold. They discuss: A quick description of Security Chaos Engineering Is there similarity or overlap with the CCE or CIE approach? The value of decision trees Her view of checklists of security controls like CISA's CPG Lesson 1 - "Start in Nonproduction environments" The experiment / scientific method approach and how it can start small The Danger Zone: tight coupling and complex interactions How should ICS use Chaos...
info_outlineI spoke with two Digital Bond alumni and Lord Remorin at the S4x20 Cabana Sessions about a wide ranging set of technical topics.
Reid Wightman, Principal Vulnerability Analyst at Dragos
- What he found interesting as an attendee, not running the CTF, at S4x20?
- Jake Brodsky's Session: Secure Coding Practices for PLCs
- The Pwn2Own competitors not being ICS regulars and future of Pwn2Own in ICS
- Reid's background at SEL and with Ed Schweitzer prior to Digital Bond
- How much gear Reid has in his basement?
- Will Reid run an ICS CTF in the future?
Stephen Hilt and Lord Remorin of Trend Micro (at 10:00)
- How they built the ICS Factory Honeynet to be highly realistic including the logic, public presence, employees and more
- Did they ever have an attacker who understood ICS?
- Was Mike an homage to Michael Toecker?
- Did Shodan find their honeynet? Did they label it a honeypot?
- What is the future of this or similar ICS honeynets at Trend Micro?