Aquileo | Unsolicited ResponseWed, 27 May 2026 13:00:11 +0000Wed, 27 May 2026 13:00:11 +0000Libsyn RSSgen 1.0https://dale-peterson.com/ enhttps://dale-peterson.com/https://static.libsyn.com/p/assets/4/b/c/b/4bcb03c23363d8225f2e77a3093c12a1/Unsolicited_Response_Square.pngAquileo | Unsolicited ResponseDale Peterson: ICS Security Catalyst and S4 Conference ChairfalseDale Petersons4@digitalbond.comepisodicnoAquileo | Interview With Acting CISA Director Nick AndersenAquileo | Interview With Acting CISA Director Nick AndersenWed, 27 May 2026 12:52:00 +0000Dale Peterson interviews acting CISA Director Nick Andersen. They briefly begin with the impact of the personnel changes at CISA, both at the leadership level and widespread exodus of anyone involved in OT. What are the plans for the rebuild of OT capabilities.

The bulk of the discussion is on the need, implementation, and metrics related to CISA's ruthless prioritization of efforts and resources. What CISA and US critical infrastructure must do, and what they won't have the resources to do.

]]>Dale Peterson interviews acting CISA Director Nick Andersen. They briefly begin with the impact of the personnel changes at CISA, both at the leadership level and widespread exodus of anyone involved in OT. What are the plans for the rebuild of OT capabilities.

The bulk of the discussion is on the need, implementation, and metrics related to CISA's ruthless prioritization of efforts and resources. What CISA and US critical infrastructure must do, and what they won't have the resources to do.

]]>41:53false20262fullDale PetersonAquileo | Interview With Rob Lee On Dragos At 10, OT Threat & Incidents, Ransomware & MoreAquileo | Interview With Rob Lee On Dragos At 10, OT Threat & Incidents, Ransomware & MoreWed, 01 Apr 2026 12:45:00 +0000It's great to have my friend Rob Lee back on the podcast. Rob and I discuss:
 
4:00 Dragos at 10 years old, the OT detection market, and will there be another OT market segment valued at over $1B.
 
24:34 What's new in the 2026 Dragos Year In Review Report.
 
33:06 The dichotomy between the high level threat identified in reports by Dragos and others and the low level of publicly acknowledged impactful attacks (outside of ransomware).
 
45:30 Ransomware ... 3300 cases on industrial organizations and is any of it bypassing IT and going after OT?
 
49:48 Back to the level of incidents, what can Rob and Dale agree on?
 
1:01:22 Integration of products like Dragos with other OT and IT information sources.
]]>01:08:04false20261fullDale PetersonAquileo | Long Conversation: OT and IT - Convergence, Integration, and Separation?Aquileo | Long Conversation: OT and IT - Convergence, Integration, and Separation?Wed, 30 Jul 2025 12:45:00 +0000Few topics get as much heat as the current, future, and ideal relationship between OT and IT. One of the first posts someone just discovering OT makes is how OT is different than IT. As you dig deeper into OT you find an increasing case of the technology, processes, and even the people being similar to IT.

In this 90 minute long conversation format, we will try to bring some enlightenment to this question with a specially curated group of 9 S4x25 attendees.

 

About The Long Conversation Format 

Two people begin the discussion on stage. After 10 minutes a third person will tap one of the participants on the shoulder and replace them in the conversation. This continues for the 90 minutes. Participants are on stage for 20 minutes talking to two different people for 10 minutes each.

]]>Few topics get as much heat as the current, future, and ideal relationship between OT and IT. One of the first posts someone just discovering OT makes is how OT is different than IT. As you dig deeper into OT you find an increasing case of the technology, processes, and even the people being similar to IT.

In this 90 minute long conversation format, we will try to bring some enlightenment to this question with a specially curated group of 9 S4x25 attendees.

About The Long Conversation Format

Two people begin the discussion on stage. After 10 minutes a third person will tap one of the participants on the shoulder and replace them in the conversation. This continues for the 90 minutes. Participants are on stage for 20 minutes talking to two different people for 10 minutes each.

]]>01:32:33false20253fullDale PetersonAquileo | Unsolicited Response with Maggie MorgantiAquileo | Unsolicited Response with Maggie MorgantiThu, 13 Mar 2025 12:45:00 +0000Dale Peterson discusses with Maggie how she got into OT security, her recent move to the Financial Sector, women in ICS security, and more.]]>Dale Peterson discusses with Maggie how she got into OT security, her recent move to the Financial Sector, women in ICS security, and more.]]>49:09false20252fullDale PetersonAquileo | S4x25 Feedback & ReviewAquileo | S4x25 Feedback & ReviewThu, 06 Mar 2025 14:13:00 +0000If you're not interested in S4, skip this episode. Dale goes over the feedback from the survey and S4 Event's own thoughts on the event, Tampa, and more. ]]>If you're not interested in S4, skip this episode. Dale goes over the feedback from the survey and S4 Event's own thoughts on the event, Tampa, and more. ]]>23:14false20251fullDale PetersonAquileo | Joel Langill On His New OT Security Training Class And MoreAquileo | Joel Langill On His New OT Security Training Class And MoreWed, 13 Nov 2024 09:51:00 +0000Dale Peterson speaks with Joel Langill, the SCADAHacker, about his new training course entitled Conducting Threat, Vulnerability, and Risk Assessments For ICS. A two day version of this course will be offered prior to S4x25. 

Of course Dale and Joel jump around a bit on training, the workforce and other items. Take a listen.

]]>Dale Peterson speaks with Joel Langill, the SCADAHacker, about his new training course entitled Conducting Threat, Vulnerability, and Risk Assessments For ICS. A two day version of this course will be offered prior to S4x25.

Of course Dale and Joel jump around a bit on training, the workforce and other items. Take a listen.

]]>50:34false202410fullDale PetersonAquileo | S4x24 Main Stage Interview With Stewart BakerAquileo | S4x24 Main Stage Interview With Stewart BakerWed, 10 Jul 2024 12:45:00 +0000Stewart Baker is one of the preeminent lawyers on topics of cyber law with an impressive career in and out of government. Stewart also hosts the Cyberlaw podcast.

The Biden administration is contending that vendors should be held liable for security deficiencies in their products. 

Assuming this is turned into law and/or executive orders, what does it mean? What can we learn from other liability law to inform us what would be required for a vendor to be held liable for a security issue? How would the judgment / damages be determined. 

Dale's note: We talk about the SEC charges against SolarWinds in this interview.

]]>Stewart Baker is one of the preeminent lawyers on topics of cyber law with an impressive career in and out of government. Stewart also hosts the Cyberlaw podcast.

The Biden administration is contending that vendors should be held liable for security deficiencies in their products.

Assuming this is turned into law and/or executive orders, what does it mean? What can we learn from other liability law to inform us what would be required for a vendor to be held liable for a security issue? How would the judgment / damages be determined.

Dale's note: We talk about the SEC charges against SolarWinds in this interview.

]]>30:52false20249fullDale PetersonAquileo | S4x24 Main Stage Interview With Rob LeeAquileo | S4x24 Main Stage Interview With Rob LeeWed, 26 Jun 2024 12:45:00 +0000Dale Peterson interviews Rob Lee on the S4 Main Stage. They cover a lot of ground and Rob is never shy about sharing his opinions and analysis.
They discuss:
  • Rob's first S4
  • PIPEDREAM deployed v. employed distinction … and why 2 years later is it still the most dangerous ICS malware?
  • Are we really more homogenous?
  • What makes a group something that Rob/Dragos tracks as an ICS focused attacker?
  • If the answer to intel is do the basics, do I need intel?
  • What ICS specific data was VOLTZITE exfiltrating?
  • What countries are targeting critical infrastructure? Is it realistic to expect any country to not target its adversaries CI?
  • Threat actors focused on manufacturing
  • How should an asset owner measure the effectiveness of their detection solution?
]]>Dale Peterson interviews Rob Lee on the S4 Main Stage. They cover a lot of ground and Rob is never shy about sharing his opinions and analysis. They discuss:
  • Rob's first S4
  • PIPEDREAM deployed v. employed distinction … and why 2 years later is it still the most dangerous ICS malware?
  • Are we really more homogenous?
  • What makes a group something that Rob/Dragos tracks as an ICS focused attacker?
  • If the answer to intel is do the basics, do I need intel?
  • What ICS specific data was VOLTZITE exfiltrating?
  • What countries are targeting critical infrastructure? Is it realistic to expect any country to not target its adversaries CI?
  • Threat actors focused on manufacturing
  • How should an asset owner measure the effectiveness of their detection solution?
]]>33:31false20248fullDale PetersonAquileo | Chris Hughes, Author of Effective Vulnerability ManagementAquileo | Chris Hughes, Author of Effective Vulnerability ManagementWed, 15 May 2024 18:37:00 +0000Chris Hughes and Nikki Robinson recently wrote the book Effective Vulnerability Management. Dale and Chris discuss the topic and book including:

  • The definition and scope of vulnerabilities. It's much more than coding errors that need patches.

  • Are ICS protocols lacking authentication "vulnerabilities"

  • The reality that most organizations have 100's of thousands of unpatched vulnerabilities. Some statistics and will this change.

  • Ways to prioritize what vulnerabilities you address.

  • The SSVC decision tree approach that was introduced at S4 as Never, Next, Now

  • Tooling … vulnerability management, software configuration, ticketing, remediation.

  • And much more.

 

Links:

  • Effective Vulnerability Management, https://www.amazon.com/Effective-Vulnerability-Management-Vulnerable-Ecosystem/dp/1394221207/

  • Dale's ICS-Patch Decision Tree, https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

 

]]>Chris Hughes and Nikki Robinson recently wrote the book Effective Vulnerability Management. Dale and Chris discuss the topic and book including:

  • The definition and scope of vulnerabilities. It's much more than coding errors that need patches.

  • Are ICS protocols lacking authentication "vulnerabilities"

  • The reality that most organizations have 100's of thousands of unpatched vulnerabilities. Some statistics and will this change.

  • Ways to prioritize what vulnerabilities you address.

  • The SSVC decision tree approach that was introduced at S4 as Never, Next, Now

  • Tooling … vulnerability management, software configuration, ticketing, remediation.

  • And much more.

Links:

  • Effective Vulnerability Management, https://www.amazon.com/Effective-Vulnerability-Management-Vulnerable-Ecosystem/dp/1394221207/

  • Dale's ICS-Patch Decision Tree, https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

]]>43:55false20247fullDale PetersonAquileo | 2024 Threat Report – OT Cyber Attacks with Physical ConsequencesAquileo | 2024 Threat Report – OT Cyber Attacks with Physical ConsequencesFri, 03 May 2024 01:26:00 +0000Waterfall Security Solutions and ICSSTRIVE put out an annual threat report that Dale Peterson believes is the best in OT. Why? It only includes incidents that had physical consequences on systems monitored and controlled by OT. 

Dale and Andrew discuss:

  • What is in and out of scope for the report.

  • The breakdown of the 68 incidents that occurred in 2023 by industry sector, cause, threat actor and more.

  • The impact reporting requirements may have on these numbers in the future.

  • What percentage of OT cyber incidents with physical consequences are made public.

  • Ransomware on IT causing physical consequences, exfil v. encryption, and what asset owners should do given this represents 80% of the known incidents in the report.

  • And more.

Links:

]]>Waterfall Security Solutions and ICSSTRIVE put out an annual threat report that Dale Peterson believes is the best in OT. Why? It only includes incidents that had physical consequences on systems monitored and controlled by OT.

Dale and Andrew discuss:

  • What is in and out of scope for the report.

  • The breakdown of the 68 incidents that occurred in 2023 by industry sector, cause, threat actor and more.

  • The impact reporting requirements may have on these numbers in the future.

  • What percentage of OT cyber incidents with physical consequences are made public.

  • Ransomware on IT causing physical consequences, exfil v. encryption, and what asset owners should do given this represents 80% of the known incidents in the report.

  • And more.

Links:

]]>53:22false20246fullDale PetersonAquileo | State Of NERC CIP, European Update and OT Security CommunityAquileo | State Of NERC CIP, European Update and OT Security CommunityWed, 24 Apr 2024 12:45:00 +0000Patrick Miller has OT cybersecurity experience as an asset owner, PacificCorp. As a regulator and one of the first NERC CIP auditors with WECC. As a community organizer creating and leading EnergySec and the BeerISAC. And as an entrepreneur creating and leading a number of consulting practices. He is currently the Founder of Ampyx Cyber.

 

In this episode Patrick and Dale discuss:

  • Why Patrick changed the company name and selected Talinn as the location for the new European office.

  • The major differences in approaches to OT cybersecurity and risk management between Europe and the US. (more than just regulatory differences)

  • What has the EU learned or improved on regulation from NERC CIP.

  • What is the current state of NERC CIP regulatory risk? Are the regulated entities understanding and meeting the standards' requirements?

  • The challenge of slow NERC CIP modifications, eg virtualization and cloud.

  • Bad standard & good regulator v. good standard & bad regulator.

  • Should water follow the NERC CIP model as recommended by AWWA?

  • How Patrick is dealing with AI.

 

Links

 

]]>Patrick Miller has OT cybersecurity experience as an asset owner, PacificCorp. As a regulator and one of the first NERC CIP auditors with WECC. As a community organizer creating and leading EnergySec and the BeerISAC. And as an entrepreneur creating and leading a number of consulting practices. He is currently the Founder of Ampyx Cyber.

In this episode Patrick and Dale discuss:

  • Why Patrick changed the company name and selected Talinn as the location for the new European office.

  • The major differences in approaches to OT cybersecurity and risk management between Europe and the US. (more than just regulatory differences)

  • What has the EU learned or improved on regulation from NERC CIP.

  • What is the current state of NERC CIP regulatory risk? Are the regulated entities understanding and meeting the standards' requirements?

  • The challenge of slow NERC CIP modifications, eg virtualization and cloud.

  • Bad standard & good regulator v. good standard & bad regulator.

  • Should water follow the NERC CIP model as recommended by AWWA?

  • How Patrick is dealing with AI.

Links

]]>46:46false20245fullDale PetersonAquileo | Book Interview: Introduction To SBOM And VEXAquileo | Book Interview: Introduction To SBOM And VEXWed, 17 Apr 2024 12:45:00 +000059:20false20244fullDale PetersonAquileo | S4x24 Closing PanelAquileo | S4x24 Closing PanelWed, 10 Apr 2024 12:45:00 +000036:25false20243fullDALE PETERSONAquileo | Q1: ICS Security In ReviewAquileo | Q1: ICS Security In ReviewWed, 03 Apr 2024 22:15:00 +0000Emma Stewart joins Dale to discuss the 3 big OT & ICS security stories from the first quarter. They end by giving their win, fail and prediction for Q1.]]>Emma Stewart joins Dale to discuss the 3 big OT & ICS security stories from the first quarter. They end by giving their win, fail and prediction for Q1.]]>49:51false20242fullDale PetersonAquileo | S4x24 PreviewAquileo | S4x24 PreviewWed, 28 Feb 2024 21:51:00 +000047:35false241fullDale PetersonAquileo | Predictions AnalyzedAquileo | Predictions AnalyzedWed, 20 Dec 2023 13:16:00 +0000In this solosode episode Dale reviews the status of his three predictions from the Q1, 2 and 3 quarter in review episodes and answers a listener question.]]>In this solosode episode Dale reviews the status of his three predictions from the Q1, 2 and 3 quarter in review episodes and answers a listener question.]]>11:20false202339fullDale PetersonAquileo | Q4 ICS Security Quarter In ReviewAquileo | Q4 ICS Security Quarter In ReviewWed, 13 Dec 2023 22:03:00 +000056:34false202338fullDale PetersonAquileo | CISA Attack Surface Scanning ServiceAquileo | CISA Attack Surface Scanning ServiceWed, 06 Dec 2023 13:05:00 +0000Dale is joined by Steve Pozza, CISA Section Chief of Operational Resilience, and Tom Millar, CISA Branch Chief of Resilience, to discuss some of CISA's security services for asset owners. They discuss:
  • The Internet accessible attack surface enumeration and vulnerability scanning surface.
  • Asset owners can buy products or services to do this. Why is the government doing this?
  • What CISA is doing with this attack surface data?
  • How is CISA measuring the success of this service offering?
  • Other broadly available services and tools, the cybersecurity performance goals (CPG assessment) ~500 done in 2023 (and their thinking about self-assessments), Malcom traffic analysis tool, and a couple of other tools.

Links

]]>Dale is joined by Steve Pozza, CISA Section Chief of Operational Resilience, and Tom Millar, CISA Branch Chief of Resilience, to discuss some of CISA's security services for asset owners. They discuss:
  • The Internet accessible attack surface enumeration and vulnerability scanning surface.
  • Asset owners can buy products or services to do this. Why is the government doing this?
  • What CISA is doing with this attack surface data?
  • How is CISA measuring the success of this service offering?
  • Other broadly available services and tools, the cybersecurity performance goals (CPG assessment) ~500 done in 2023 (and their thinking about self-assessments), Malcom traffic analysis tool, and a couple of other tools.

Links

]]>30:01false202337fullDale PetersonAquileo | Engineering-Grade OT Security with Andrew GinterAquileo | Engineering-Grade OT Security with Andrew GinterWed, 29 Nov 2023 13:35:00 +0000Andrew Ginter published his third book this year: Engineering-Grade OT Security. Dale interviews Andrew on the book including:
  • Who was the target reader that Andrew wrote the book for?
  • Do (should) professional engineers lose their licenses for poor and dangerous cybersecurity design and deployments?
  • The use of the term engineering grade, and how he defines it.
  • Unhackable protection and safety controls as a major part of engineering grade.
  • Unidirectional (one-way) network devices as the only security control listed as engineering grade. Is one-way from the enterprise network to the OT network engineering grade?
  • Given the ICSSTRIVE/Waterfall report that 75% of all cyber incidents affecting operations are due to ransomware on IT, should asset owners prioritize address this issue or engineering grade security first?
  • What is keeping Andrew working rather than retiring

 Links

]]>Andrew Ginter published his third book this year: Engineering-Grade OT Security. Dale interviews Andrew on the book including:
  • Who was the target reader that Andrew wrote the book for?
  • Do (should) professional engineers lose their licenses for poor and dangerous cybersecurity design and deployments?
  • The use of the term engineering grade, and how he defines it.
  • Unhackable protection and safety controls as a major part of engineering grade.
  • Unidirectional (one-way) network devices as the only security control listed as engineering grade. Is one-way from the enterprise network to the OT network engineering grade?
  • Given the ICSSTRIVE/Waterfall report that 75% of all cyber incidents affecting operations are due to ransomware on IT, should asset owners prioritize address this issue or engineering grade security first?
  • What is keeping Andrew working rather than retiring

Links

]]>53:46false202336fullDale PetersonAquileo | Asset Inventory, Lawyers, and AIAquileo | Asset Inventory, Lawyers, and AIWed, 15 Nov 2023 20:59:00 +0000This week is a Dale Peterson solosode.

Updates and Announcements

Dale provides updates about S4x24 ticket sales and announces the Women In ICS Security program and sponsor package.

Main Topics

  1. Asset Inventory in Cybersecurity: Dale challenges the common security mantra "You can't protect what you don't know," using examples from both physical and cyber domains. He notes many of the comments on this week's article missed the main point, and he gives hints on the next two asset inventory articles.
  2. Legal and Regulatory Issues in Cybersecurity: Dale emphasizes the importance of domain expertise whether it be cybersecurity or the legal profession. He previews upcoming keynote interviews with legal experts and advises cybersecurity professionals against making legal analyses without proper expertise.

  3. Artificial Intelligence in Cybersecurity: Dale reveals that most AI submissions for S4 were broad and hand wavy. This isn't wrong, but most have heard this info by now. He then discusses the need for focusing on specific, real-world applications of AI and stresses the importance of measurable improvements in this age of experimentation.
]]>This week is a Dale Peterson solosode.

Updates and Announcements

Dale provides updates about S4x24 ticket sales and announces the Women In ICS Security program and sponsor package.

Main Topics

  1. Asset Inventory in Cybersecurity: Dale challenges the common security mantra "You can't protect what you don't know," using examples from both physical and cyber domains. He notes many of the comments on this week's article missed the main point, and he gives hints on the next two asset inventory articles.
  2. Legal and Regulatory Issues in Cybersecurity: Dale emphasizes the importance of domain expertise whether it be cybersecurity or the legal profession. He previews upcoming keynote interviews with legal experts and advises cybersecurity professionals against making legal analyses without proper expertise.
  3. Artificial Intelligence in Cybersecurity: Dale reveals that most AI submissions for S4 were broad and hand wavy. This isn't wrong, but most have heard this info by now. He then discusses the need for focusing on specific, real-world applications of AI and stresses the importance of measurable improvements in this age of experimentation.
]]>27:37false202335fullDale PetersonAquileo | Is The Purdue Model Dead (E)Aquileo | Is The Purdue Model Dead (E)Wed, 08 Nov 2023 13:30:00 +000032:26false202334fullDale PetersonAquileo | Kelly Shortridge - Security Chaos Engineering in ICSAquileo | Kelly Shortridge - Security Chaos Engineering in ICSWed, 01 Nov 2023 12:30:00 +0000Kelly joins Dale to discuss her new book Security Chaos Engineering: Sustaining Resilience in Software and Systems. Kelly points out the second part of the title is the most descriptive, and she is not a big fan of the Chaos term that has taken hold.

They discuss:

  • A quick description of Security Chaos Engineering
  • Is there similarity or overlap with the CCE or CIE approach?
  • The value of decision trees
  • Her view of checklists of security controls like CISA's CPG
  • Lesson 1 - "Start in Nonproduction environments"
  • The experiment / scientific method approach and how it can start small
  • The Danger Zone: tight coupling and complex interactions
  • How should ICS use Chaos Engineering
]]>Kelly joins Dale to discuss her new book Security Chaos Engineering: Sustaining Resilience in Software and Systems. Kelly points out the second part of the title is the most descriptive, and she is not a big fan of the Chaos term that has taken hold.

They discuss:

  • A quick description of Security Chaos Engineering
  • Is there similarity or overlap with the CCE or CIE approach?
  • The value of decision trees
  • Her view of checklists of security controls like CISA's CPG
  • Lesson 1 - "Start in Nonproduction environments"
  • The experiment / scientific method approach and how it can start small
  • The Danger Zone: tight coupling and complex interactions
  • How should ICS use Chaos Engineering
]]>47:15false202333fullDale PetersonAquileo | IACS System Testing and Assessment Rating (STAR) Methodology with Don WeberAquileo | IACS System Testing and Assessment Rating (STAR) Methodology with Don WeberWed, 25 Oct 2023 12:30:00 +0000Don Weber joins Dale Peterson to describe his IACS STAR Methodology to score the risk of a vulnerability to an ICS (or IACS in 62443-speak). It is a modification of the OWASP Risk Rating Methodology. Don has modified some of the 16-factors to create IACS STAR. The methodology and code is available on GitHub and a calculator is available on line.

Don and Dale discuss:

  • What Don likes about the OWASP Risk Rating
  • Potential issues with putting numbers to SME judgment
  • Differences between IACS STAR and the OWASP Risk Rating
  • The weighting of the 16 factors
  • The future of IACS STAR

Links

Slides Discussed In The Show: https://dale-peterson.com/wp-content/uploads/2023/10/IACS-STAR.pdf

IACS STAR GitHub Repo: https://github.com/cutaway-security/IACS_STAR_Methodology

IACS STAR Calculator: https://iacs-star-calculator.com/iacs_star_calculator.html

Cutaway Security Website: https://www.cutawaysecurity.com

ICS-Patch Decision Tree: https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

 

]]>Don Weber joins Dale Peterson to describe his IACS STAR Methodology to score the risk of a vulnerability to an ICS (or IACS in 62443-speak). It is a modification of the OWASP Risk Rating Methodology. Don has modified some of the 16-factors to create IACS STAR. The methodology and code is available on GitHub and a calculator is available on line.

Don and Dale discuss:

  • What Don likes about the OWASP Risk Rating
  • Potential issues with putting numbers to SME judgment
  • Differences between IACS STAR and the OWASP Risk Rating
  • The weighting of the 16 factors
  • The future of IACS STAR

Links

Slides Discussed In The Show: https://dale-peterson.com/wp-content/uploads/2023/10/IACS-STAR.pdf

IACS STAR GitHub Repo: https://github.com/cutaway-security/IACS_STAR_Methodology

IACS STAR Calculator: https://iacs-star-calculator.com/iacs_star_calculator.html

Cutaway Security Website: https://www.cutawaysecurity.com

ICS-Patch Decision Tree: https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

]]>39:28false202332fullDale PetersonAquileo | Dave Whitehead On SBOMs, Manufacturing in the US, and moreAquileo | Dave Whitehead On SBOMs, Manufacturing in the US, and moreWed, 18 Oct 2023 12:38:00 +0000Dave Whitehead, CEO of SEL, joins Dale on the show to talk about:
  • The new SEL printed circuit board (PCB) factory in Idaho. Why they bucked the trend and did this. The benefits, the ROI, and more.
  • SEL's position on providing SBOMs to customers and their internal use of SBOMs - Where leaders tend to go wrong.
  • Substation shootings
  • Market acceptance of SEL's Blueframe virtual platform

Links

]]>Dave Whitehead, CEO of SEL, joins Dale on the show to talk about:
  • The new SEL printed circuit board (PCB) factory in Idaho. Why they bucked the trend and did this. The benefits, the ROI, and more.
  • SEL's position on providing SBOMs to customers and their internal use of SBOMs - Where leaders tend to go wrong.
  • Substation shootings
  • Market acceptance of SEL's Blueframe virtual platform

Links

]]>40:38false202331fullDale PetersonAquileo | Cyber Risk Quantification (CRQ) with Nicole SundinAquileo | Cyber Risk Quantification (CRQ) with Nicole SundinWed, 11 Oct 2023 12:37:00 +0000Dale and Nicole Sundin of Axio discuss CRQ, how to deal with the precision challenge, Axio's prioritization of impact, ransomware on IT affecting operations as an example, and more.

They also discuss UX and the single pane of glass.

Links

Axio web site

]]>Dale and Nicole Sundin of Axio discuss CRQ, how to deal with the precision challenge, Axio's prioritization of impact, ransomware on IT affecting operations as an example, and more.

They also discuss UX and the single pane of glass.

Links

Axio web site

]]>40:30false202330fullDale PetersonAquileo | Presidential Candidate Will HurdAquileo | Presidential Candidate Will HurdWed, 04 Oct 2023 12:35:00 +0000Former Congressman and Presidential candidate Will Hurd is a rarity with a tech background in someone who was elected to the US Congress, and even rarer in someone running for President. Will graduated Texas A&M with Computer Science degree. Worked as a Senior Adviser to the cybersecurity company FusionX, which was acquired by Accenture. More recently he was on the board of OpenAI.

This is probably one of the most technical interviews with a Presidential candidate you will hear. Dale asks Will:

  • How he would rate CISA's performance (he co-sponsored the bill to create CISA)?
  • Does the Executive Branch have the authority required to secure critical infrastructure?
  • His views on Cyber Command / DoD policy of "defend forward"?
  • The current level of Congress's technical literacy?
  • What type of cybersecurity legislation, if any, Congress should pass?
]]>Former Congressman and Presidential candidate Will Hurd is a rarity with a tech background in someone who was elected to the US Congress, and even rarer in someone running for President. Will graduated Texas A&M with Computer Science degree. Worked as a Senior Adviser to the cybersecurity company FusionX, which was acquired by Accenture. More recently he was on the board of OpenAI.

This is probably one of the most technical interviews with a Presidential candidate you will hear. Dale asks Will:

  • How he would rate CISA's performance (he co-sponsored the bill to create CISA)?
  • Does the Executive Branch have the authority required to secure critical infrastructure?
  • His views on Cyber Command / DoD policy of "defend forward"?
  • The current level of Congress's technical literacy?
  • What type of cybersecurity legislation, if any, Congress should pass?
]]>27:12false202329fullDale PetersonAquileo | ICS Security - Q3 In ReviewAquileo | ICS Security - Q3 In ReviewWed, 27 Sep 2023 19:16:00 +0000Patrick Miller of Ampere Industrial Security joins Dale to discuss the three big stories of the quarter and give their win, fail and prediction.

Stories

  1. US National Cybersecurity Strategy Implementation Plan + CISA 2024-2026 Strategic Plan
  2. The cybersecurity / OT cybersecurity vendor market news. We just had Cisco buy Splunk, plus the Dragos "extension", and SCADAfence selling to Honeywell. Seems like some tough times.
  3. Ransomware again … Port of Nagoya, Clorox, hospitals, CISA Ransomware Vulnerability Notification Service

Links

 

]]>Patrick Miller of Ampere Industrial Security joins Dale to discuss the three big stories of the quarter and give their win, fail and prediction.

Stories

  1. US National Cybersecurity Strategy Implementation Plan + CISA 2024-2026 Strategic Plan
  2. The cybersecurity / OT cybersecurity vendor market news. We just had Cisco buy Splunk, plus the Dragos "extension", and SCADAfence selling to Honeywell. Seems like some tough times.
  3. Ransomware again … Port of Nagoya, Clorox, hospitals, CISA Ransomware Vulnerability Notification Service

Links

]]>01:03:43false202328fullDale PetersonAquileo | Dale Peterson On The Sunspace Alliance WebinarAquileo | Dale Peterson On The Sunspace Alliance WebinarWed, 20 Sep 2023 13:01:00 +0000Dale Peterson was recently interviewed by Jay Johnson of Sandia and Tom Tansy of the Sunspec Alliance as part of their distributed energy resources (DER) Sunspec webinar series. We covered a lot of issues and Dale was not shy in throwing out some analysis and opinions. After 5 minutes discussing the S4x24 ticket process, the topics discussed:
 
  • How DER will deal with the complex, large number of users and stakeholders PKI environment.
  • The Sunspec device security specification and the benefits of a limited, key set of security controls.
  • What is the role of government regulation to solve DER security issues?
  • The potential power of the utility companies to levy requirements and be a choke point for access.
  • The Patch Act, FDA and DER.
  • shift left and product liability due to security flaws
  • and more
]]>Sunspec Alliance as part of their distributed energy resources (DER) Sunspec webinar series. We covered a lot of issues and Dale was not shy in throwing out some analysis and opinions. After 5 minutes discussing the S4x24 ticket process, the topics discussed:
  • How DER will deal with the complex, large number of users and stakeholders PKI environment.
  • The Sunspec device security specification and the benefits of a limited, key set of security controls.
  • What is the role of government regulation to solve DER security issues?
  • The potential power of the utility companies to levy requirements and be a choke point for access.
  • The Patch Act, FDA and DER.
  • shift left and product liability due to security flaws
  • and more
]]>01:01:15false202327fullDale PetersonAquileo | Cyber-Physical Attacks with Marina KrotofilAquileo | Cyber-Physical Attacks with Marina KrotofilWed, 06 Sep 2023 12:47:00 +0000Marina Krotofil recently published the paper Industrial Control Systems: Engineering Foundations and Cyber-Physical Attack Lifecycle which is a detailed paper on cyber attacks that cause a physical impact on the system being monitored and controlled. It took Marina 1.5 years to write this paper, which is more accurately described as a short book. We discuss:
  • the work she is doing to help Ukrainian critical infrastructure security during wartime
  • what got Marina interested in cyber-physical security 10+ years ago
  • the current understanding of cyber-physical in the OT security community
  • Chapter 2: Engineering Foundations as a great intro for those in IT to understand basic automation principles
  • Chapter 3: Very detailed explanation of a specific process (we don't spend much time on this)
  • The Cyber-Physical Attack Lifecycle with emphasis on the Damage Loop. "Plant shutdown is risky for the attacker as it may instigate an investigation"
  • Chapter 4.6 is a great conclusion

 

]]>Marina Krotofil recently published the paper Industrial Control Systems: Engineering Foundations and Cyber-Physical Attack Lifecycle which is a detailed paper on cyber attacks that cause a physical impact on the system being monitored and controlled. It took Marina 1.5 years to write this paper, which is more accurately described as a short book. We discuss:
  • the work she is doing to help Ukrainian critical infrastructure security during wartime
  • what got Marina interested in cyber-physical security 10+ years ago
  • the current understanding of cyber-physical in the OT security community
  • Chapter 2: Engineering Foundations as a great intro for those in IT to understand basic automation principles
  • Chapter 3: Very detailed explanation of a specific process (we don't spend much time on this)
  • The Cyber-Physical Attack Lifecycle with emphasis on the Damage Loop. "Plant shutdown is risky for the attacker as it may instigate an investigation"
  • Chapter 4.6 is a great conclusion
]]>57:36false202326fullDale PetersonAquileo | SBOMs & CycloneDX with Steve SpringettAquileo | SBOMs & CycloneDX with Steve SpringettWed, 23 Aug 2023 09:17:00 +0000Steve Springett is the Chair of the OWASP CycloneDX Core Working Group. CycloneDX is one of the two main machine readable formats that SBOMs are being created in, although CycloneDX can capture all sorts of BOMs.

In this episode we assume listeners know what a SBOM is and why it might be desired by a vendor and asset owner. The beginning of the show we cover some basics of CycloneDX

If you know the basics, skip to 14:24 where we get into the details

  • Statistics on who is generating and using CycloneDX SBOMs, and the impact of governement regulations on the use.
  • Steve's view of the NTIA Minimum Elements for SBOM v. CycloneDX elements.
  • How CycloneDX tries to capture the completeness of and confidence in the SBOM.
  • The naming problem. CPE, CVE, NVD, SWID, PURL and more. Steve describes the problem and what he thinks is the way forward.
  • Vulnerabilities ... and why Steve thinks VEX is a missed opportunity.
  • Outdated component analysis (this could be very useful in a procurement decision)
  • and more

Links

CycloneDX document: Authoritative Guide To SBOM

ICS-Patch (what to patch when in ICS / risk based decision tree)

S4x24 CFP

]]>Steve Springett is the Chair of the OWASP CycloneDX Core Working Group. CycloneDX is one of the two main machine readable formats that SBOMs are being created in, although CycloneDX can capture all sorts of BOMs.

In this episode we assume listeners know what a SBOM is and why it might be desired by a vendor and asset owner. The beginning of the show we cover some basics of CycloneDX

If you know the basics, skip to 14:24 where we get into the details

  • Statistics on who is generating and using CycloneDX SBOMs, and the impact of governement regulations on the use.
  • Steve's view of the NTIA Minimum Elements for SBOM v. CycloneDX elements.
  • How CycloneDX tries to capture the completeness of and confidence in the SBOM.
  • The naming problem. CPE, CVE, NVD, SWID, PURL and more. Steve describes the problem and what he thinks is the way forward.
  • Vulnerabilities ... and why Steve thinks VEX is a missed opportunity.
  • Outdated component analysis (this could be very useful in a procurement decision)
  • and more

Links

CycloneDX document: Authoritative Guide To SBOM

ICS-Patch (what to patch when in ICS / risk based decision tree)

S4x24 CFP

]]>01:01:30false202325fullDale PetersonAquileo | The OT Cybersecurity / Climate Nexus with Andy BochmanAquileo | The OT Cybersecurity / Climate Nexus with Andy BochmanWed, 16 Aug 2023 12:19:00 +0000At S4x23 Andy Bochman gave a Main Stage performance on the OT Cybersecurity / Climate Nexus. It's a new idea and Dale wanted to dig into it and understand it better. The discussion looks at where there is a nexus/connection/overlap and where there may be parallel efforts where each side might learn from the other.

Links

Andy Bochman S4x23 Video

Slide used in this episode

Earlier episode with Dale and Andy discussing CCE

S4x24 Call For Presentations

]]>At S4x23 Andy Bochman gave a Main Stage performance on the OT Cybersecurity / Climate Nexus. It's a new idea and Dale wanted to dig into it and understand it better. The discussion looks at where there is a nexus/connection/overlap and where there may be parallel efforts where each side might learn from the other.

Links

Andy Bochman S4x23 Video

Slide used in this episode

Earlier episode with Dale and Andy discussing CCE

S4x24 Call For Presentations

]]>53:51false202324fullDale PetersonAquileo | Water Sector Cyber Risk with Gus SerinoAquileo | Water Sector Cyber Risk with Gus SerinoWed, 09 Aug 2023 12:34:00 +0000Gus Serino worked at a large water utility before joining Dragos in 2019. We're talking water sector so it's obligatory to start with Oldsmar (2:20), but we don't talk cyber. Instead we go through the physical portion of the water system assuming the attacker is able to issue the command to the pump to dump a lot of sodium hydroxide into the water system and what would likely happen. Importantly Gus identifies the simple, unhackable solution to this threat. A hard wired PH sensor that will shut off the pump regardless of the commands from the ICS.

After Oldsmar Dale and Gus discuss:

  • how small and medium water systems should approach cyber risk
  • the greater challenge to large water systems
  • the EPA's early steps on cybersecurity and future regulation - surprises in moving from a water utility to Dragos
  • what Gus's new I&C Secure company is doing 
]]>Gus Serino worked at a large water utility before joining Dragos in 2019. We're talking water sector so it's obligatory to start with Oldsmar (2:20), but we don't talk cyber. Instead we go through the physical portion of the water system assuming the attacker is able to issue the command to the pump to dump a lot of sodium hydroxide into the water system and what would likely happen. Importantly Gus identifies the simple, unhackable solution to this threat. A hard wired PH sensor that will shut off the pump regardless of the commands from the ICS.

After Oldsmar Dale and Gus discuss:

  • how small and medium water systems should approach cyber risk
  • the greater challenge to large water systems
  • the EPA's early steps on cybersecurity and future regulation - surprises in moving from a water utility to Dragos
  • what Gus's new I&C Secure company is doing
]]>50:34false202323fullDale PetersonAquileo | One-Way, SAIDI & S4x24 CFPAquileo | One-Way, SAIDI & S4x24 CFPWed, 02 Aug 2023 12:30:00 +0000This is a solo-sode where Dale reviews two articles from July with comments on comments and additional thoughts. The final section is a must listen if you are going to submit to speak on the S4x24 Stage. The times below are so you can skip to what you are interested in.

1:29 One-Way Data Diodes and School Zones

10:15 SAIDI: What Cyber Incidents Should Be Excluded From Metrics

16:05 Do's and Don'ts For Your S4x24 CFP Submission

Links

Subscribe to Dale's Friday ICS Security News & Notes

Info and Links for the S4x24 CFP

]]>This is a solo-sode where Dale reviews two articles from July with comments on comments and additional thoughts. The final section is a must listen if you are going to submit to speak on the S4x24 Stage. The times below are so you can skip to what you are interested in.

1:29 One-Way Data Diodes and School Zones

10:15 SAIDI: What Cyber Incidents Should Be Excluded From Metrics

16:05 Do's and Don'ts For Your S4x24 CFP Submission

Links

Subscribe to Dale's Friday ICS Security News & Notes

Info and Links for the S4x24 CFP

]]>24:33false202322fullDale PetersonAquileo | Interview with HD MooreAquileo | Interview with HD MooreWed, 26 Jul 2023 12:17:00 +0000HD Moore is most famous for his creation of the Metasploit penetration testing framework. It began in 2003 and hit the OT world in 2011. HD is now the Founder and CTO of RunZero, another cybersecurity startup that is starting to play in the OT Space.
 
In this episode we spend the first third of the show talking about Metasploit ... early reaction, OT modules, is Metasploit still necessary and useful today.
 
We then shift to creating asset inventories in IT and OT, which is what RunZero does.
  • Why HD decided to run back into the cybersecurity startup world?
  • How it started as a solo shop with HD writing all the code.
  • How HD things Shodan and RunZero are different.
  • What technique does RunZero use to 'scan'. A term that many fear in OT. Check out their approach to 'fragile devices'.
  • The OT reaction to this type of scanning.
  • What role uses the RunZero product?
 
Links
RunZero website
S4x24 Call For Presentations
]]>
  • Why HD decided to run back into the cybersecurity startup world?
  • How it started as a solo shop with HD writing all the code.
  • How HD things Shodan and RunZero are different.
  • What technique does RunZero use to 'scan'. A term that many fear in OT. Check out their approach to 'fragile devices'.
  • The OT reaction to this type of scanning.
  • What role uses the RunZero product?
    • Links RunZero website S4x24 Call For Presentations]]>    35:23false202321fullDale Peterson    Aquileo | US Dept of Energy's OT Defender Fellowship ProgramAquileo | US Dept of Energy's OT Defender Fellowship ProgramWed, 19 Jul 2023 12:30:00 +0000Dale is often critical of the US Government's efforts and programs to address OT cyber risk. So it's a pleasure to highlight a program that is working.

    Samantha Ravich, Chair of the Center on Cyber and Technology Innovation at the Foundation for the Defense of Democracies, joins Dale to discuss the US Department of Energy's OT Defender Fellowship Program.

    They begin by describing the program, its goals, what are ideal candidates for the program, and the early results from the first few cohorts. Then Timothy Pospisil of Nebraska Public Power District and part of the 2022 OT Defender Fellowship cohort joins the show to discuss his experience in the program.

    At the end we discuss how this could be expanded to address water, critical manufacturing and other sectors.

    Link

    OT Defender Fellowship Program

    ]]>    Dale is often critical of the US Government's efforts and programs to address OT cyber risk. So it's a pleasure to highlight a program that is working.

    Samantha Ravich, Chair of the Center on Cyber and Technology Innovation at the Foundation for the Defense of Democracies, joins Dale to discuss the US Department of Energy's OT Defender Fellowship Program.

    They begin by describing the program, its goals, what are ideal candidates for the program, and the early results from the first few cohorts. Then Timothy Pospisil of Nebraska Public Power District and part of the 2022 OT Defender Fellowship cohort joins the show to discuss his experience in the program.

    At the end we discuss how this could be expanded to address water, critical manufacturing and other sectors.

    Link

    OT Defender Fellowship Program

    ]]>    37:06false202320fullDale Peterson    Aquileo | Eric Cosman On Dow, Open Automation, 62443 & MoreAquileo | Eric Cosman On Dow, Open Automation, 62443 & MoreWed, 12 Jul 2023 12:30:00 +0000Eric Cosman had a 38 year career at Dow Chemical, was on the ISA 99 committee its inception, and then he retired. After retirement Eric joined ARC Advisory Group as a Contributing Consultant and got even more active with ISA. He is a long time co-chair of ISA99 and was President of ISA in 2020. Eric and Dale discuss:
    • Dow's in house developed DCS and SIS: MOD
    • Eric's top trend from 2022: The value of open automation and the Open Process Automation Forum
    • ISA/IEC 62433
      • Eric's view they are "primarily engineering standards"
      • What Eric thinks about the safety / security analogies
      • His experience in being ISA President in the first year of COVID
      • ISA as "the home of automation"
      • Has ISA lost mindshare on ICS security standards to the US Government and training to SANS
    ]]>
  • Dow's in house developed DCS and SIS: MOD
  • Eric's top trend from 2022: The value of open automation and the Open Process Automation Forum
  • ISA/IEC 62433
    • Eric's view they are "primarily engineering standards"
    • What Eric thinks about the safety / security analogies
    • His experience in being ISA President in the first year of COVID
    • ISA as "the home of automation"
    • Has ISA lost mindshare on ICS security standards to the US Government and training to SANS
    ]]>    55:26false202319fullDale Peterson    Aquileo | ICS Security Quarter In Review Q2-2023Aquileo | ICS Security Quarter In Review Q2-2023Wed, 05 Jul 2023 19:58:00 +0000Mark Hyman of Verge Management Group joins Dale to discuss the big 3 stories of Q2 along with their win, fail and predication.

    Big Stories

    1. The OT Security Layoffs (Mark is a recruiter specialized in ICS/OT security)
    2. Still No US National Cyber Director?
    3. The Merck NotPetya Insurance Claim Ruling

    Plus they both have a win, fail and prediction at the end.

    ]]>    Mark Hyman of Verge Management Group joins Dale to discuss the big 3 stories of Q2 along with their win, fail and predication.

    Big Stories

    1. The OT Security Layoffs (Mark is a recruiter specialized in ICS/OT security)
    2. Still No US National Cyber Director?
    3. The Merck NotPetya Insurance Claim Ruling

    Plus they both have a win, fail and prediction at the end.

    ]]>    01:00:24false202318fullDale Peterson    Aquileo | Josh Corman - Healthcare Security, SBOMs & MoreAquileo | Josh Corman - Healthcare Security, SBOMs & MoreWed, 28 Jun 2023 12:45:00 +0000Josh Corman is the VP of Cyber Safety Strategy at Claroty, was the Chief Strategist of the CISA COVID Task Force, and founder of I Am The Cavalry. Josh and I dive into Healthcare Security, SBOMs and other topics. 
    • Can OT in healthcare be treated in a similar way as the factory, power plant, water treatment plant, ... ? 
    • The first fatality due to a cyber attack on a hospital.
    • Should we be focusing our efforts on reducing the impact if ransomware hits a healthcare facility? What is the equivalent to a steel reinforced cockpit door?
    • The PATCH Act (included in the Omnibus bill passed in Dec 2022) requiring medical device manufactures to provide a SBOM and a patching program. What is it? What will be the impact of this? (BTW, Josh changed my mind on this as a start to a long term impact)
    • Will the PATCH Act provisions delay approval of medical devices?
    • How accurate and complete are vendor generated SBOMs today? How will this be solved?
    • What will be the impact of SBOM mandates?
    • Differing views on the importance to society of attacks and outages in the agriculture / food industry
    • I Am The Cavalry turns 10.

    We will need to have Josh back for a Part 2.

     

    ]]>    Josh Corman is the VP of Cyber Safety Strategy at Claroty, was the Chief Strategist of the CISA COVID Task Force, and founder of I Am The Cavalry. Josh and I dive into Healthcare Security, SBOMs and other topics.
    • Can OT in healthcare be treated in a similar way as the factory, power plant, water treatment plant, ... ?
    • The first fatality due to a cyber attack on a hospital.
    • Should we be focusing our efforts on reducing the impact if ransomware hits a healthcare facility? What is the equivalent to a steel reinforced cockpit door?
    • The PATCH Act (included in the Omnibus bill passed in Dec 2022) requiring medical device manufactures to provide a SBOM and a patching program. What is it? What will be the impact of this? (BTW, Josh changed my mind on this as a start to a long term impact)
    • Will the PATCH Act provisions delay approval of medical devices?
    • How accurate and complete are vendor generated SBOMs today? How will this be solved?
    • What will be the impact of SBOM mandates?
    • Differing views on the importance to society of attacks and outages in the agriculture / food industry
    • I Am The Cavalry turns 10.

    We will need to have Josh back for a Part 2.

    ]]>    01:04:49false202317fullDale Peterson    Aquileo | OTCEP Panel - Secure PLC Coding PracticesAquileo | OTCEP Panel - Secure PLC Coding PracticesWed, 21 Jun 2023 12:20:00 +0000This episode is a replay of a lively panel from the Cyber Security Agency of Singapore's OT Cybersecurity Expert Panel (OTCEP) last year. It begins with a great introduction to the Top 20 Secure PLC Coding Practices by Sarah Fluchs. At the 35 minute mark the panel discussion begins. There was a lot more disagreement and back and forth than the typical panel. This gives you a variety of points of view and positions to consider.

    Paul Griswold moderated the panel of Dr. Ong Chen Hui, Joel Langill, Sarah Fluchs and Dale Peterson.

    Links

    ]]>    This episode is a replay of a lively panel from the Cyber Security Agency of Singapore's OT Cybersecurity Expert Panel (OTCEP) last year. It begins with a great introduction to the Top 20 Secure PLC Coding Practices by Sarah Fluchs. At the 35 minute mark the panel discussion begins. There was a lot more disagreement and back and forth than the typical panel. This gives you a variety of points of view and positions to consider.

    Paul Griswold moderated the panel of Dr. Ong Chen Hui, Joel Langill, Sarah Fluchs and Dale Peterson.

    Links

    ]]>    01:24:36false202316fullDale Peterson    Aquileo | Metrics: How Effective Is A Security Control?Aquileo | Metrics: How Effective Is A Security Control?Wed, 17 May 2023 17:41:00 +0000How much does a security control reduce cyber risk? What control or mix of controls provides the most efficient cyber risk reduction? Tough questions that a team of researchers at INL and Sandia tried to answer in a project.

    Two of the researchers, Jay Johnson of Sandia and Jake Gentle of INL, join Dale on the show to talk about the metrics and results. The project was Cyber Resilience for Wind Installations, but the metrics and results are applicable to every sector. We get into the weeds on this episode and discuss:

    • how they created the test environment
    • the two attack scenarios (and why only two and how easy it would be to expand)
    • the physical resilience score
    • the cyber resilience score
    • the results from four different mixes of security controls
    • areas for further testing and improvement
    • and a tiny bit about trying to calculate an Expected Benefit from Cybersecurity Investment, which is a bit like ROI and how much money to spend.

    Links

    • Video: https://www.youtube.com/watch?v=bBLbLUFKzIc

    • IEEE Access Journal Paper: https://ieeexplore.ieee.org/document/10043706

    • POWER magazine article: https://www.powermag.com/cyber-resilience-for-wind-power-installations/

    • 2-page flyer: https://www.researchgate.net/publication/367074443_Cyber_Resilience_for_Wind_Installations_A_Cyber_Resilient_Reference_Architecture

    • Final project report: https://www.researchgate.net/publication/368599508_Hardening_Wind_Energy_Systems_from_Cyber_Threats-Final_Project_Report

    ]]>    How much does a security control reduce cyber risk? What control or mix of controls provides the most efficient cyber risk reduction? Tough questions that a team of researchers at INL and Sandia tried to answer in a project.

    Two of the researchers, Jay Johnson of Sandia and Jake Gentle of INL, join Dale on the show to talk about the metrics and results. The project was Cyber Resilience for Wind Installations, but the metrics and results are applicable to every sector. We get into the weeds on this episode and discuss:

    • how they created the test environment
    • the two attack scenarios (and why only two and how easy it would be to expand)
    • the physical resilience score
    • the cyber resilience score
    • the results from four different mixes of security controls
    • areas for further testing and improvement
    • and a tiny bit about trying to calculate an Expected Benefit from Cybersecurity Investment, which is a bit like ROI and how much money to spend.

    Links

    • Video: https://www.youtube.com/watch?v=bBLbLUFKzIc

    • IEEE Access Journal Paper: https://ieeexplore.ieee.org/document/10043706

    • POWER magazine article: https://www.powermag.com/cyber-resilience-for-wind-power-installations/

    • 2-page flyer: https://www.researchgate.net/publication/367074443_Cyber_Resilience_for_Wind_Installations_A_Cyber_Resilient_Reference_Architecture

    • Final project report: https://www.researchgate.net/publication/368599508_Hardening_Wind_Energy_Systems_from_Cyber_Threats-Final_Project_Report

    ]]>    49:56false202315fullDale Peterson    Aquileo | S4x23 Closing PanelAquileo | S4x23 Closing PanelWed, 10 May 2023 13:00:00 +0000Ralph Langner, Megan Samford and Zach Tudor join Dale Peterson on the S4 Main Stage to close out S4x23. This Closing Panel is always an attendee favorite as none of these four are afraid to take a strong and even unconventional stance on at OT security topic or issue.]]>Ralph Langner, Megan Samford and Zach Tudor join Dale Peterson on the S4 Main Stage to close out S4x23. This Closing Panel is always an attendee favorite as none of these four are afraid to take a strong and even unconventional stance on at OT security topic or issue.]]>40:09false202314fullDale PetersonAquileo | Puesh Kumar, Director of CESER at US Dept of EnergyAquileo | Puesh Kumar, Director of CESER at US Dept of EnergyWed, 03 May 2023 13:13:00 +0000Dale Peterson interview CESER Director Puesh Kumar on the S4x23 Main Stage. We discuss a number of CESER programs how they are measuring success, what has not worked, why they are doing some things industry is already doing and more.

    5:30 Where is the CESER CRISP program (detection and information sharing) today? Has it stopped or reduced the impact (outages and others) of cyber attacks on the electric sector? How will they measure the success of this program?

    10:40 What has CESER tried, thought it would work, and ended up failing? 

    14:05 CESER's CyTRICS program is testing vendor equipment? Why, does GE and Hitachi need help? And the results have been trivial vulnerabilities that could be found in hours. Why is CESER spending millions on this?

    19:25 Cyber Informed Engineering (CIE) is it the same as Secure By Design? This is a long process, what will the early wins look like? Two years from now how will we know if we are succeeding? Maintaining a manual capability dominated the examples in the document, why hasn't this been highlighted in the program? How can we accelerate this?

    25:20 Clean Energy Cyber Accelerator is looking at solutions (OT detection and MFA remote access to OT) that are well established with vendor offerings and asset owner deployments. Why is CECA doing this and trying to accomplish?

     

    ]]>    Dale Peterson interview CESER Director Puesh Kumar on the S4x23 Main Stage. We discuss a number of CESER programs how they are measuring success, what has not worked, why they are doing some things industry is already doing and more.

    5:30 Where is the CESER CRISP program (detection and information sharing) today? Has it stopped or reduced the impact (outages and others) of cyber attacks on the electric sector? How will they measure the success of this program?

    10:40 What has CESER tried, thought it would work, and ended up failing?

    14:05 CESER's CyTRICS program is testing vendor equipment? Why, does GE and Hitachi need help? And the results have been trivial vulnerabilities that could be found in hours. Why is CESER spending millions on this?

    19:25 Cyber Informed Engineering (CIE) is it the same as Secure By Design? This is a long process, what will the early wins look like? Two years from now how will we know if we are succeeding? Maintaining a manual capability dominated the examples in the document, why hasn't this been highlighted in the program? How can we accelerate this?

    25:20 Clean Energy Cyber Accelerator is looking at solutions (OT detection and MFA remote access to OT) that are well established with vendor offerings and asset owner deployments. Why is CECA doing this and trying to accomplish?

    ]]>    32:37false202313fullDale Peterson    Aquileo | Chris Blask: Cybersecurity Pioneer and Idea ManAquileo | Chris Blask: Cybersecurity Pioneer and Idea ManWed, 26 Apr 2023 12:15:00 +0000Chris Blask has a long career bringing new ideas to reality. He currently is Vice President of Strategy at Cybeats, who has a SBOM Studio product.

    Cybeats is different in that SBOM Studio does not create SBOMs. This requires SBOMs to be available from somewhere, and Dale & Chris spend a lot of the podcast talking about the SBOM market today and in the future.

    • What percentage of the OT software solutions have SBOMs today? What will that number be in three years, five years, seven years?
    • When will the top 10% asset owners be able to be get value worth the effort from SBOMs and related tools and information?
    • What will the SBOM marketplace look like?
    • the DBOM.io project

    Of course being Dale and Chris, they deviate into a lot of other topics. Such as Chris's quotes:

    • "Security comes through transparency and automation"
    • "2020, this is the last decade of cybersecurity" "the last decade when entirely new fields will be discovered" I think we have covered the field.
    ]]>    Chris Blask has a long career bringing new ideas to reality. He currently is Vice President of Strategy at Cybeats, who has a SBOM Studio product.

    Cybeats is different in that SBOM Studio does not create SBOMs. This requires SBOMs to be available from somewhere, and Dale & Chris spend a lot of the podcast talking about the SBOM market today and in the future.

    • What percentage of the OT software solutions have SBOMs today? What will that number be in three years, five years, seven years?
    • When will the top 10% asset owners be able to be get value worth the effort from SBOMs and related tools and information?
    • What will the SBOM marketplace look like?
    • the DBOM.io project

    Of course being Dale and Chris, they deviate into a lot of other topics. Such as Chris's quotes:

    • "Security comes through transparency and automation"
    • "2020, this is the last decade of cybersecurity" "the last decade when entirely new fields will be discovered" I think we have covered the field.
    ]]>    46:39false202312fullDale Peterson    Aquileo | Edgard from Nozomi (Part 2)Aquileo | Edgard from Nozomi (Part 2)Wed, 19 Apr 2023 12:30:00 +0000The August 2021 Unsolicited Response episode with Edgard Capdevielle, CEO of Nozomi Networks, was a fan favorite. So Dale invited Edgard back, like the first time it was a wide ranging and fun conversation. His budget analogy of OT security and a new child in the family was Dale's favorite part.

    They cover a lot of ground including:

    • the OT visibility and detection market growth in the last two years
    • whether he stands by his 2021 view that a company that does "X, Y, Z and OT security" doesn't really do OT security
    • how much of the back end (non-sensor) part of the market is moving to the cloud now and what will it be in three years. Plus some disagreements / discussion on architecture
    • budget muscle and momentum
    • what sort of metrics should an asset owner use to determine the value of these OT visibility and detection solutions
    • how is the US Government affecting the market Enjoy!
    ]]>    The August 2021 Unsolicited Response episode with Edgard Capdevielle, CEO of Nozomi Networks, was a fan favorite. So Dale invited Edgard back, like the first time it was a wide ranging and fun conversation. His budget analogy of OT security and a new child in the family was Dale's favorite part.

    They cover a lot of ground including:

    • the OT visibility and detection market growth in the last two years
    • whether he stands by his 2021 view that a company that does "X, Y, Z and OT security" doesn't really do OT security
    • how much of the back end (non-sensor) part of the market is moving to the cloud now and what will it be in three years. Plus some disagreements / discussion on architecture
    • budget muscle and momentum
    • what sort of metrics should an asset owner use to determine the value of these OT visibility and detection solutions
    • how is the US Government affecting the market Enjoy!
    ]]>    45:51false202311fullDale Peterson    Aquileo | Interview with Gene SpaffordAquileo | Interview with Gene SpaffordWed, 12 Apr 2023 12:30:00 +0000Dale Peterson interviews cybersecurity legend Gene Spafford on the S4x23 Main Stage. Some of what they cover is:
    • how to deal with securing legacy systems
    • the incredibly productive 3 years of firsts including host IDS, network IDS, honeypot, network vulnerability scanner, and more. What led to this amazing production?
    • The upcoming 25th year of CERIAS
    • His new book Cybersecurity Myths and Misconceptions ... Avoiding the Hazards and Pitfalls that Derail Us and digging into some of those myths (Cyber Offense is Easier than Defense, Sharing More Threat Intel Will Make Things Better, Everyone Should Solve A Given Cybersecurity Problem In The Same Way)
    ]]>    Dale Peterson interviews cybersecurity legend Gene Spafford on the S4x23 Main Stage. Some of what they cover is:
    • how to deal with securing legacy systems
    • the incredibly productive 3 years of firsts including host IDS, network IDS, honeypot, network vulnerability scanner, and more. What led to this amazing production?
    • The upcoming 25th year of CERIAS
    • His new book Cybersecurity Myths and Misconceptions ... Avoiding the Hazards and Pitfalls that Derail Us and digging into some of those myths (Cyber Offense is Easier than Defense, Sharing More Threat Intel Will Make Things Better, Everyone Should Solve A Given Cybersecurity Problem In The Same Way)
    ]]>    30:39false202310fullDale Peterson    Aquileo | ICS Security: Q1 in ReviewAquileo | ICS Security: Q1 in ReviewWed, 05 Apr 2023 19:48:00 +0000Marty Edwards joins Dale Peterson to discuss the big stories of the first quarter of 2023.
    • The US National Cybersecurity Strategy
    • ISA / ISASecure starting an OT Site Assessment Certification
    • Ransomware Affecting Operations (indirectly)

    Marty and Dale then give their win and fail for Q1 and a prediction.

    ]]>    Marty Edwards joins Dale Peterson to discuss the big stories of the first quarter of 2023.
    • The US National Cybersecurity Strategy
    • ISA / ISASecure starting an OT Site Assessment Certification
    • Ransomware Affecting Operations (indirectly)

    Marty and Dale then give their win and fail for Q1 and a prediction.

    ]]>    58:48false20239fullDale Peterson    Aquileo | The OT SBOM MarketAquileo | The OT SBOM MarketWed, 29 Mar 2023 12:52:00 +0000Dale Peterson talks with Matt Wyckhouse, Founder and CEO, of Finite State about where the SBOM products and market is today and where it will go in the future. This discussion was informed by the SBOM Challenge at S4x23.
    • Who is the primary buyer of SBOM products and services today? (Hint: Matt thinks that 80% of the code in a product is third party)
    • How accurate are the products, and the Finite State product in particular, in creating a SBOM?
    • How much is the value of a SBOM degraded if it is not perfect? If it is missing software or has inaccuracies?
    • Are the offerings now a product? A semi-custom service that uses a developed product? (with an apt comparison to the detection market)
    • What will the US Government do with all these SBOMs if they actually get them? If they get an exponential increase in software inventory and the patching and cyber maintenance burden.
    • Will there be a separate/distinct OT SBOM market? Will there be a SBOM market in the long run or will it get subsumed in some sort of asset management market?
    • Early thoughts on the SBOM marketplace (a place to collect and distribute and respond to queries on SBOMs)
    • Where is the industry / products now on VEX?
    • Do configuration files belong in a SBOM?
    • Surprise data points from the SBOM Challenge
    ]]>    Dale Peterson talks with Matt Wyckhouse, Founder and CEO, of Finite State about where the SBOM products and market is today and where it will go in the future. This discussion was informed by the SBOM Challenge at S4x23.
    • Who is the primary buyer of SBOM products and services today? (Hint: Matt thinks that 80% of the code in a product is third party)
    • How accurate are the products, and the Finite State product in particular, in creating a SBOM?
    • How much is the value of a SBOM degraded if it is not perfect? If it is missing software or has inaccuracies?
    • Are the offerings now a product? A semi-custom service that uses a developed product? (with an apt comparison to the detection market)
    • What will the US Government do with all these SBOMs if they actually get them? If they get an exponential increase in software inventory and the patching and cyber maintenance burden.
    • Will there be a separate/distinct OT SBOM market? Will there be a SBOM market in the long run or will it get subsumed in some sort of asset management market?
    • Early thoughts on the SBOM marketplace (a place to collect and distribute and respond to queries on SBOMs)
    • Where is the industry / products now on VEX?
    • Do configuration files belong in a SBOM?
    • Surprise data points from the SBOM Challenge
    ]]>    50:05false20238fullDale Peterson    Aquileo | Puesh Kumar - Director of Dept of Energy's CESERAquileo | Puesh Kumar - Director of Dept of Energy's CESERWed, 22 Mar 2023 12:55:00 +0000Dale Peterson interviewed Puesh Kumar on the S4x23 Main Stage. Puesh is the Director of the US Dept of Energy's Cybersecurity, Energy Security, & Emergency Response (CESER). The lead US Government OT cybersecurity agency in the energy sector.

    After Puesh gives a 3 minute overview on CESER, they dig into it.

    • How are they measuring CRISP's detection and analysis progress? Has it stopped or limited the impact of any attacks?
    • What is one of the CESER programs that didn't work and what did they learn from it?
    • Why is the US Government testing products for GE, Hitachi and other large companies and questioning the results.
    • The push for Cyber Informed Engineering and what success looks like
    • Competing with industy
    • and more ... CESER is tackling a lot so there was much to squeeze into 30 minutes
    ]]>    Dale Peterson interviewed Puesh Kumar on the S4x23 Main Stage. Puesh is the Director of the US Dept of Energy's Cybersecurity, Energy Security, & Emergency Response (CESER). The lead US Government OT cybersecurity agency in the energy sector.

    After Puesh gives a 3 minute overview on CESER, they dig into it.

    • How are they measuring CRISP's detection and analysis progress? Has it stopped or limited the impact of any attacks?
    • What is one of the CESER programs that didn't work and what did they learn from it?
    • Why is the US Government testing products for GE, Hitachi and other large companies and questioning the results.
    • The push for Cyber Informed Engineering and what success looks like
    • Competing with industy
    • and more ... CESER is tackling a lot so there was much to squeeze into 30 minutes
    ]]>    32:48false20237fullDale Peterson    Aquileo | Book Interview: Industrial Cybersecurity with Steve MustardAquileo | Book Interview: Industrial Cybersecurity with Steve MustardWed, 15 Mar 2023 13:36:00 +0000Steve Mustard took his 30 years of experience and wrote Industrial Cybersecurity: Case Studies and Best Practices, published by ISA. After talking about who the book is for and the writing process, Dale and Steve dig into the details. 

    Given Steve's longtime involvement and leadership with ISA, it's not surprising the book leans heavily on ISA/IEC 62443. They talk chapters on architecture, certification, optimism / pessimism, risk management and a fundamental misunderstanding of IT by OT. Some agreement, some disagreement, and always a civil discourse.

    ]]>    Steve Mustard took his 30 years of experience and wrote Industrial Cybersecurity: Case Studies and Best Practices, published by ISA. After talking about who the book is for and the writing process, Dale and Steve dig into the details.

    Given Steve's longtime involvement and leadership with ISA, it's not surprising the book leans heavily on ISA/IEC 62443. They talk chapters on architecture, certification, optimism / pessimism, risk management and a fundamental misunderstanding of IT by OT. Some agreement, some disagreement, and always a civil discourse.

    ]]>    42:43false20236fullDale Peterson    Aquileo | Cyber Persistence TheoryAquileo | Cyber Persistence TheoryTue, 07 Mar 2023 13:58:00 +0000Dale's interview with Michael Fischerkeller, co-author of the bood Cyber Persistence Theory. The first half of the interview digs into Cyber Persistence Theory.
    • Why Michael believes cyber is a new and third strategic environment (in addition to conventional and nuclear)
    • What is meant by cyber being an environment of exploitation and not coercion
    • The theory's different use of initiative and why the theory believes it is the important element to winning ("initiative rather than restraint is necessitated")
    • How a series of smaller, fait accompli, actions that are not responded to can have a strategic-level cumulative effect

    The second half of the interview looks at what the world will look like and what asset owners should do if multiple nations believe in and act on this Cyber Persistence Theory. 

    • Michael argues it already is in place and the US is late to the game
    • Persistence presence in critical infrastructure would not "cross the threshold"
    • How organizations will reach a cyber agreed competition
    • Will this be escalatory (Michael says no)

    Dale believes this is an incredibly important theory to understand because it is taking hold in the world's major powers.

    Links

    Cyber Persistence Theory book

    ]]>    Dale's interview with Michael Fischerkeller, co-author of the bood Cyber Persistence Theory. The first half of the interview digs into Cyber Persistence Theory.
    • Why Michael believes cyber is a new and third strategic environment (in addition to conventional and nuclear)
    • What is meant by cyber being an environment of exploitation and not coercion
    • The theory's different use of initiative and why the theory believes it is the important element to winning ("initiative rather than restraint is necessitated")
    • How a series of smaller, fait accompli, actions that are not responded to can have a strategic-level cumulative effect

    The second half of the interview looks at what the world will look like and what asset owners should do if multiple nations believe in and act on this Cyber Persistence Theory.

    • Michael argues it already is in place and the US is late to the game
    • Persistence presence in critical infrastructure would not "cross the threshold"
    • How organizations will reach a cyber agreed competition
    • Will this be escalatory (Michael says no)

    Dale believes this is an incredibly important theory to understand because it is taking hold in the world's major powers.

    Links

    Cyber Persistence Theory book

    ]]>    31:03false20235fullDale Peterson    Aquileo | OT Managed Security Services - 1898 & Co.Aquileo | OT Managed Security Services - 1898 & Co.Wed, 01 Mar 2023 13:05:00 +0000Matt Morris and Mark Mattei of 1898 & Co. joined Dale to talk OT Managed Security Services as 1898 recently introduced an OT Managed Threat Protection and Response service. The discussion included:
    • what they are monitoring in the OT environment
    • the OT MSP competitive landscape (OT detection vendors, ICS vendors, large consulting vendors, ...)
    • can you / should you monitor OT separate from IT
    • how 1898 deals with competing partners (such as Claroty, Dragos and Nozomi) that they resell and install and competing against them for MSP
    • the active response and threat hunting services and how that is accepted in the generally conservative
    • and more
    ]]>    Matt Morris and Mark Mattei of 1898 & Co. joined Dale to talk OT Managed Security Services as 1898 recently introduced an OT Managed Threat Protection and Response service. The discussion included:
    • what they are monitoring in the OT environment
    • the OT MSP competitive landscape (OT detection vendors, ICS vendors, large consulting vendors, ...)
    • can you / should you monitor OT separate from IT
    • how 1898 deals with competing partners (such as Claroty, Dragos and Nozomi) that they resell and install and competing against them for MSP
    • the active response and threat hunting services and how that is accepted in the generally conservative
    • and more
    ]]>    38:41false20234fullDale Peterson    Aquileo | Interview with Bill Fehrman of Berkshire Hathaway EnergyAquileo | Interview with Bill Fehrman of Berkshire Hathaway EnergyThu, 23 Feb 2023 13:17:00 +0000Bill Fehrman is the CEO of Berkshire Hathaway Energy, co-chair of the Electricity Subsector Coordinating Council, and chair of the E-ISAC.

    The major topics Dale and Bill discuss include:

    • The US Government / Electric Sector information sharing program around detection information and threat intel. Have they stopped or reduced the impact of attacks? What are the metrics they are using to determine if these resources are worth it?

    • How is the industry and BHE positioned to recovery from a major outage due to a cyber attack? The mutual assistance agreements in the electric sector … the transformer and critical sparing programs. BHE has drills that take away technology and see if they can still deliver power. 

    • Who will pay for all this cyber risk reduction? Will there be rate increases due to these efforts? Does customer demand for climate change actions or security actions drive investment? Be required for investment? What does he think of the FERC incentives to get utilities to invest in security?

    • Is the single point person representing the electric sector, now Bill, by design and a good idea?
    ]]>    Bill Fehrman is the CEO of Berkshire Hathaway Energy, co-chair of the Electricity Subsector Coordinating Council, and chair of the E-ISAC.

    The major topics Dale and Bill discuss include:

    • The US Government / Electric Sector information sharing program around detection information and threat intel. Have they stopped or reduced the impact of attacks? What are the metrics they are using to determine if these resources are worth it?
    • How is the industry and BHE positioned to recovery from a major outage due to a cyber attack? The mutual assistance agreements in the electric sector … the transformer and critical sparing programs. BHE has drills that take away technology and see if they can still deliver power.
    • Who will pay for all this cyber risk reduction? Will there be rate increases due to these efforts? Does customer demand for climate change actions or security actions drive investment? Be required for investment? What does he think of the FERC incentives to get utilities to invest in security?
    • Is the single point person representing the electric sector, now Bill, by design and a good idea?
    ]]>    30:45false20233fullDale Peterson