Jowanza’s guest is Trae Mazza, a Senior Security Engineer at RMC Global and the researcher who discovered critical vulnerabilities in Siemens RuggedCom devices that triggered multiple CISA advisories. His job is to break into power plants, water treatment facilities, and industrial control systems—legally—and what he finds should keep every industrial operator awake at night.

Trae Mazza’s Philosophy

You need to think like an attacker to defend effectively—and sometimes you need to hire someone to show you just how creative those attackers can be.

Offensive cybersecurity uses the same tools, techniques, and mindset as cybercriminals, but with permission, documentation, and the singular goal of making critical infrastructure more secure.

Episode Highlights:

🔓 What “Offensive Cybersecurity” Actually Means

“Offensive cybersecurity” is another term for ethical hacking—using attacker techniques to test defenses. For a long time, “hacking” carried a strictly negative connotation, and Trae discusses how he helps organizations embrace ethical hacking as the path to understanding and fixing their weaknesses before adversaries exploit them.​​

⚠️ The Siemens RuggedCom Discovery

Trae walks through how he and his team at RMC identified critical vulnerabilities in Siemens RuggedCom ROXOS II devices—widely deployed industrial networking equipment—that led to multiple CISA advisories. The vulnerabilities involved a remote code execution attack chain, and he explains in accessible terms what makes this type of vulnerability so dangerous for industrial networks, where a single compromised dependency can undermine an entire operation.​

🏭 OT vs. IT: A Different Security Universe

Trae works with SCADA and Industrial Control Systems daily and explains how securing a power plant or water treatment facility differs fundamentally from securing a corporate network. The stakes, the legacy equipment, the protocols, and the consequences of failure all create a uniquely challenging environment.​​

🏙️ Exploiting Smart City Deployments

Smart grid and smart city deployments are expanding rapidly, and Trae’s 2023 SecurityWeek ICS Cyber Security Conference presentation revealed the unique vulnerabilities that emerge when we make infrastructure “smart”. His research on the Wi-SUN wireless communication protocol—used in street lighting, smart metering, public safety, and environmental monitoring—exposes how expanded connectivity creates expanded attack surfaces.​

🔧 From Firmware to Front Door: The Full Attack Spectrum

Trae’s expertise spans web applications, hardware hacking, firmware analysis, and physical penetration testing. He reveals which type of assessment typically uncovers the most critical vulnerabilities in industrial environments, and shares examples of how physical access can lead to complete system compromise in OT environments.​​

🎭 Social Engineering in Critical Infrastructure

Social engineering remains a powerful attack vector, and Trae discusses how he approaches social engineering assessments for critical infrastructure—where the consequences of a successful attack extend far beyond data theft.​​

📡 IIoT: Adding Risk Faster Than We're Fixing It?

Industrial IoT devices are proliferating rapidly, and Trae shares his methodology for identifying vulnerabilities in embedded systems and IIoT devices that traditional scanners miss. From his testing experience, he assesses whether manufacturers are getting better at security or whether we’re adding risk faster than we’re addressing it.​

🔮 The Future of Ethical Hacking in Industrial Security

The cybersecurity profession is maturing, with more emphasis on ethics and responsible disclosure, as demonstrated by Trae’s coordinated disclosure process with Siemens. He discusses where he sees the role of ethical hackers evolving in industrial security over the next decade.

📚 Resources & Contact

* RMC Global: rmcglobal.com

* Siemens RuggedCom Research: ROXOS II OS Remote Code Execution Attack Chain

* Smart Cities & AMI Security: AMI: the Key to Safeguarding Smart Cities & Urban Energy

* Connect with Trae: Trae Mazza

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit parakeetinc.substack.com