BROADCASTS.com

Pwn2Own Miami

Listed in: Technology

Are Your ICS Security Patching Plans Realistic?

Listed in: Technology

Is The Normalized, Taxonomized Approach In A SIEM Doomed To Fail

Listed in: Technology

How To Be An OT Visionary

Listed in: Technology

ICS Breaches Will Happen

Listed in: Technology

December: ICS Security Month In Review

Topics:

1. The Solarwinds hack
2. Dragos raising $110M in venture funding
3. The minimal number and damage from cyber attacks on ICS in 2020

Tweet Me! @digitalbond
Friday Newsletter: https://mailchi.mp/f53b1c8c2da0/friday

Listed in: Technology

2020 Predictions: Right, Wrong and Pending

Listed in: Technology

Good News

Listed in: Technology

ICS Detection Market Analysis - Part 2

Listed in: Technology

Weekly Article: ICS Detection Market Analysis - Part 1

Listed in: Technology

November: ICS Security Month In Review

Listed in: Technology

Impact to ICS Security Effort with Dir. Krebs Firing

Listed in: Technology

October: ICS Security Month In Review

Top Stories

1. Six Sandworm attackers from Russia charged. Why was this done now and what does it accomplish?

2. More ICS vendors announced security services (ABB and Siemens). Will this be a good business? Is it good for asset owners?

3. ICS security vendors are creating risk metrics for cyber assets and zones (Claroty and ID announced). How should asset owners view these metrics?

Plus Jason has a Win and Prediction, and I give my Win, Fail and Prediction for October.

Links

Jason Nations / Selena Larson S4x20 video - Understanding Our Adversaries

Thomas Rid's Active Measures book

ICS-Patch Decision Tree ... What To Patch When?

Finite State web page and Unsolicited Response episode

Listed in: Technology

September: ICS Security Month In Review

This month's stories include:

• S4x21's cancellation and S4x22 dates
• (7:01) Ransomware in ICS
• (12:30) SCIDMark and other ICS cyber incident databases
• (16:50) Is the Airgap myth still believed by asset owners?
• (21:51) Wins, Fails and Predication

This is a solosode, as my planned guest got sick (not Covid). And I also start the podcast with some information on S4x21's cancellation and S4x22.

Links

S4x21 Is Cancelled

German death due to ransomware article

UHS ransomware incident

SCIDMark

Sanjay Chhillar ICS Security Myth Presentation

Shodan ICS Page

DoE program to create and evaluate Schneider Electric SBOM (CyTRICS)

DoE funding NRECA ICS Detection Tool

Listed in: Technology

ATT&CK for ICS Evaluations

In this episode I talk with Otis Alexander of MITRE about ATT&CK for ICS Evaluations. We begin with a discussion on ATT&CK and the ICS version of ATT&CK. If you are familiar with this, skip to 17:09 where we begin our discussion on the upcoming evaluations.

MITRE has created a Triton type attack and will test companies abilities to detect the various elements of this created attack. Five companies have signed up to be tested, and hopefully more will step up to this challenge.

Otis and I get into the details on how the testing takes place, the scope of the testing, how the results will be reported out, the value of the results to asset owners, and more.

Links

ATT&CK for ICS

ATT&CK for ICS Evaluations

Listed in: Technology

Splunk OT Security Add-On

In this episode of the Unsolicited Response podcast I talk with Ed Albanese, the VP Internet of Things at Splunk about the OT Security Add-On.

This is a more detailed, technical episode as I try to dig into the features and benefits of the integration today and where it can be improved in the future. This includes:

• The additional OT fields in the Splunk Asset Framework
• The OT_Asset and OT_SW_Asset data models
• How the 29 OT search queries will work with integrations likely using different terms (such as different names for asset types) and the types of search queries currently supported.
• The value of having standardizations for some OT alerts/events sent to Splunk, such as "modify control logic". This support for standardized notables, as Splunk calls them, is not in the released Add-On but can be configured.
• How Splunk is tracking vulnerability management (currently no OT integration)
• And how Splunk is calculating the Risk Scores in the OT Security Posture Tab

Links

Splunk OT Security Add-On Announcement

Splunk OT Security Add-On Software Download Page

Listed in: Technology

What OT Can Learn From IT

1. OT doesn't really understand IT, and the similar, but not identical, requirements that mission critical IT has with OT.
2. OT can actually learn a lot from IT.

So I wanted to discuss this with someone with significant experience in both OT and IT security. Lesley Carhart of Dragos was a great choice. Before Dragos she worked for Motorola and was involved with incident response for both OT and mission critical IT.

I talk and opine a bit more than normal in this episode because I have strong feelings on this topic.

Send any comments or suggestions to s4@digitalbond.com, and subscribe if you haven't already.

Links

Lesley Carhart on Twitter: @hacksforpancakes

Lesley Carhart personal website

Lesley's DerbyCon session: Confessions of an IT / OT Marriage Counselor

Dragos

Listed in: Technology

DHS CISA's New Strategy

Listed in: Technology

July - ICS Security Month In Review

Listed in: Technology

Peter Singer - Author of Burn In: A Novel About The Real Robotic Revolution

Listed in: Technology

June - ICS Security Month In Review

Listed in: Technology

Building & Using Digital Twins

Listed in: Technology

Matt Wyckhouse: Testing ICS Firmware Security & Supply Chains

Listed in: Technology

May: ICS Security Month In Review

Listed in: Technology

COVID-19 Impact In ICS Security

Listed in: Technology

S4x20 Closing Panel

Listed in: Technology

Interview with Inventor & Legend Ed Schweitzer

Listed in: Technology

Interview with Bryan Owen of OSIsoft

Listed in: Technology

Tenable's OT Strategy with Marty Edwards

Listed in: Technology

Board of Directors Role in ICS Security with Thomas Parenty

Listed in: Technology

ICS Threat Intel with Sergio Caltagirone

Listed in: Technology

An Interview with Andy Greenberg - Author of Sandworm

Listed in: Technology

Kelly Jackson Higgins Interviews Dale

Listed in: Technology

The Cabana Sessions

Listed in: Technology

Megan Samford on ICS4ICS

Listed in: Technology

Interview with DHS CISA Director Chris Krebs

Listed in: Technology

An Interview with Marina Krotofil

Listed in: Technology

Sean McBride on ICS Security Education and Degree Programs

Listed in: Technology

An Interview with Patrick Miller

Listed in: Technology

S4x19 Closing Panel

The S4 Closing Panel is always a candid discussion on where the community is in securing ICS, where we are succeeding and where need to do better. This year I was joined by Rob Lee of Dragos and Zach Tudor of INL.

Also note that the S4x20 Call For Presentations closes on Thursday (August 15).

Links

• S4x20 Call For Presentations

Sponsors

This episode was sponsored by aeSolutions. aeSolutions is an engineering and consulting company specializing in process safety and industrial cybersecurity. aeSolutions has pioneered the CyberPHA methodology which is a proven method to assess industrial control system (ICS) cybersecurity risk leveraging well established process safety techniques.

This episode was sponsored by CyberX. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation. Check out the 2019 CyberX Global ICS and IIoT Risk Report, the CyberX report on the NIS Directive, and my podcast from last year on the report with Phil Neray.

Listed in: Technology

Rockwell Automation Cybersecurity

In this episode of the Unsolicited Response Podcast I interview Megan Samford and Rick Cherney of Rockwell Automation.

We cover two main topics. First, we discuss how they are dealing with vulnerabilities reported to them by researchers and other means. We focus on how this has progressed over the years as well as how vendors could provide more useful vulnerability and remediation information to their customers.

Second we discuss the Rockwell Automation getting past the Insecure By Design issue that has plagued the Level 1 / PLC devices. Most notably the signed firmware and ICS protocol security in CIP Security. We also delve into the challenges of getting CIP Security deployed in both green field and legacy systems.

I begin the podcast with a brief tribute to Mike Assante's unique skills and how they helped the ICS security effort. They pale in importance to the tributes of Mike as a father, friend and mentor, but nevertheless were impressive and hopefully some can pick up the load.

Links

• CIP Security Video from S4
• Rockwell Automation Security Home Page
• Rockwell Automation Industrial Security Advisory Index (Requires Account Registration)
• Factory Talk Policy Manager Getting Results Guide (CIP Security Configuration Software)
• S4x20 Call For Presentations
• Just three of the many Mike Assante tributes are an article on CSO from Aaron Turner, Rob Lee’s blog and a final message from Mike to the community.

Sponsors

This episode was sponsored by CyberX. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation.

This episode was sponsored by aeSolutions. aeSolutions is an engineering and consulting company specializing in process safety and industrial cybersecurity. aeSolutions has pioneered the CyberPHA methodology which is a proven method to assess industrial control system (ICS) cybersecurity risk leveraging well established process safety techniques.

Listed in: Technology

Forescout's Strategy Post SecurityMatters Acquisition

Forescout's acquisition of SecurityMatters for $113M in cash was the first major exit from the OT Detection Space (or broader passive monitoring market as you will hear in the podcast). I spoke with Brian Proctor about a number of issues including:

• What it was like moving from an asset owner to a vendor
• The best way for an asset owner to recruit or develop ICS security talent in this high demand environment
• His thoughts on the OT Detection and broader passive monitoring space (and my Endgame article)
• Forescout's strategy for the OT capabilities in their "platform" and the market in general

WARNING: If you are one who gets offended by commercial content in a presentation or podcast, perhaps you should skip this episode. When the primary topic is a company's strategy to address the market it is impossible to expect the guest to not promote their offerings. The answers to me questions almost required a response that would be considered promotional. I will write up my analysis of the Forescout strategy in the upcoming weeks.

Links

• Forescout's Website
• ICS Detection Endgame Article
• S4x20 Call For Presentations
• OnRamp Online Registration

Sponsors

This episode was sponsored by CyberX. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation.

This episode was sponsored by aeSolutions. aeSolutions is an engineering and consulting company specializing in process safety and industrial cybersecurity. aeSolutions has pioneered the CyberPHA methodology which is a proven method to assess industrial control system (ICS) cybersecurity risk leveraging well established process safety techniques.

Listed in: Technology

An Interview With Jonathan Homer of DHS

In this episode, I interview Jonathan Homer, the Chief of the Industrial Control Systems Group / Hunt and Incident Response Team at DHS.

We discuss:

• What changes will asset owners see with the creation of CISA organization in DHS?
• A detailed discussion of the metrics DHS will use to determine if they are successful / having an impact?
• Why or if DHS is competing with industry in many of their ICS security services.
• The CISA Strategic Risk Management Process and how it will prioritize ICS security related efforts based on critical functions and specific assets.

Links

• DHS CISA Critical Infrastructure Vulnerability Assessments
• DHS National Critical Functions and Risk Register
• S4x20 Call For Presentations
• OnRamp Online Registration

Sponsors

This episode was sponsored by CyberX. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation.

This episode was sponsored by aeSolutions. aeSolutions is an engineering and consulting company specializing in process safety and industrial cybersecurity. aeSolutions has pioneered the CyberPHA methodology which is a proven method to assess industrial control system (ICS) cybersecurity risk leveraging well established process safety techniques.

Listed in: Technology

ICS Firewall Market & Scoring SW/FW

Listed in: Technology

Truth or Consequences?

This recording is from a panel discussion on understanding and reducing the consequence side of the risk equation (risk = consequence * likelihood). Joining me in this discussion are:

• John Cusimano of aeSolutions and their CyberPHA
• Andy Bochman of INL and their Consequence Driven Cyber Informed Engineering (CCE)

The two gentleman begin by explaining their respective consequence based risk assessment and risk management, and the diagrams they refer to are below.

After the initial descriptions we discuss:

• how the two approaches are similar and different?
• how long it takes to perform a CCE or CyberPHA?
• what are some of the novel consequence reduction solutions?
• the difference between disruption and destruction as a consequence?
• will the CyberPHA be integrated into the PHA?

Links

• aeSolutions CyberPHA
• INL CCE
• OnRamp Online

This episode was sponsored by CyberX. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation.

Check out the 2019 CyberX Global ICS and IIoT Risk Report, the CyberX report on the NIS Directive, and my podcast from last year on the report with Phil Neray.

Listed in: Technology

Maritime Cybersecurity

In a recent article a researcher proclaimed it's "not hard for a hacker to capsize a ship at sea". This was quickly followed by the Viking Sky cruise ship having its engines shut off due to a sensor reading.

Not knowing much about maritime control systems I brought two experts from Moran Cyber on the podcast to discuss the issue: Captain Alex Soukhanov (a Master Mariner and Director at Moran Cyber) and Greg Villano (Senior Maritime Cybersecurity Engineeer at Moran Cyber). Both Alex and Greg have spent their careers on ships and now are working to secure the control systems that are becoming more essential every year.

Not knowing much about this sector, you hear the line of questioning that is used to begin to understand risk. It actually focuses more on impact and recovery than a list of specific security controls. It appears the maritime industry will face increasing challenges as they move away from ships that can continue to operate with manual operations.

Listed in: Technology

RSA Conference / ICS Village Report

Listed in: Technology

An Interview With Robert Graham

Listed in: Technology

Is The Purdue Model Dead?

Listed in: Technology

4 Takeaways from 2018 ... And Kicking Off 2019 With My S4x19 Mini Keynote

Listed in: Technology

Neighborhood Keeper

Listed in: Technology

Flawed ICS Mantras

Listed in: Technology

Ralph Langner on the ICS Security Product Market

Listed in: Technology

Blake Sobczak on Electric Sector Cybersecurity

Listed in: Technology

CCE with Andy Bochman of INL

Listed in: Technology

Michael Assante Interview

Listed in: Technology

Cyber Hygiene?

Listed in: Technology

What's Happening At ICS & IT Security Conferences

Listed in: Technology

Press Coverage of ICS Security

Listed in: Technology

Iatrogenics - Harm Done By The Healer

Listed in: Technology

Enterprise SOC or IT SOC

Listed in: Technology

ICS Detection Challenge Part 2

Listed in: Technology

S4x18 ICS Detection Challenge Analysis

Listed in: Technology

Medical Sector Cybersecurity & Dense Vulnerabilities

Listed in: Technology

Dan Geer Interview at S4x18

Listed in: Technology

2018 Plans: Podcast, S4, Consulting & Your Career

Listed in: Technology

Threat and Detection Debate

Listed in: Technology

Next Generation Security Audit Files for ICS

Listed in: Technology

ICS Capture The Flag at S4x18

Listed in: Technology

Securing ICS Protocols

Listed in: Technology

The ICS Detection Challenge at S4x18

Listed in: Technology

Understanding & Interpreting ICS Security Statistics

Listed in: Technology

Kaspersky and Cyber Nationalism

Listed in: Technology

SCADA Apologist or SCADA Realist

Listed in: Technology

NERC CIP's Impact on Electric Sector Security

Listed in: Technology

State of Fuzzing ICS Protocols in 2017

Listed in: Technology

Interview with Steve Bitar of Exxon Mobil on Open Process Automation

Listed in: Technology

Selecting an IDS Detection Solution

Listed in: Technology

Interview with Joel Langill, aka the SCADAhacker

Listed in: Technology

John Matherly - The Creator of Shodan

Listed in: Technology