Jennifer Lyn Walker and Michael Arceneaux of the Water ISAC join the podcast to discuss the recent cybersecurity incident at the Oldsmar, Fla., water-treatment facility, the state of cybersecurity inside the water & wastewater critical infrastructure sector, and whether organizations are reticent about sharing information about attacks with others in the sector. 
Walker is a cyber threat analyst with the Water ISAC, while Arceneaux is managing director of the organization. Water ISAC has more than 400 member utilities serving much of the United States. 

Justin Searle, director of ICS security at InGuardians and a SANS Institute ICS security senior instructor, joins the Aperture podcast to discuss penetration testing ICS environments.  Justin is a leader in the ICS security community, a 21-year veteran immersed in conducting and teach security assessments worldwide.  In this episode, Justin discusses the challenges in pen-testing production industrial environments, the state of pen-testing tooling for ICS, how digital transformation and IT/OT convergence are changing the way cybersecurity is managed inside enterprises, and also industrial cybersecurity threats facing companies. 

Tom Tervoort, a senior security specialist with Netherlands-based Secura, joins the Aperture Podcast to discuss the Zerologon vulnerability in Windows Netlogon. This critical crypto bug in the Netlogon authentication mechanism was discovered by Tom and the Secura team, and patched in August by Microsoft. 
Since then, exploit code has surfaced and the vulnerability has been used by two separate APT groups. Tom discusses how he "accidentally" discovered Zerologon, the risks posed by successful exploits, how and why APTs might use it, and the resources required to use it in attacks against Active Directory, domain controllers, and other Windows authentication mechanisms. 

Richard Thomas of the University of Birmingham and Joseph Gardiner of the Bristol Cyber Security Group, University of Bristol, discuss their recently published paper: "Catch Me If You Can: An In-Depth Study of CVE Discovery Time and Inconsistencies for Managing Risks in Critical Infrastructures." The paper examines how long ICS and OT vulnerabilities are in the wild before being discovered, and also shortcomings in ICS-related CVEs, which are often the first touch organizations have with vulnerabilities on their networks.  Learn how long vulnerabilities are present before they're uncovered, and exactly what the gap is between CVE information and the details about affected products. The researchers also share recommendations for suggested improvements. 

Dustin Childs, Communications Manager for the Zero Day Initiative (ZDI) joins the Aperture podcast to talk about vulnerability disclosure and its evolution since the early 2000s. Dustin also covers the legacy of ZDI as a vulnerability clearinghouse as it turns 15 this year, some milestones for bug-hunters, and the role of Pwn2Own in maturing disclosures for vendors and researchers alike. The conversation also includes the growing interest in uncovering vulnerabilities in industrial control systems and the very different patching dynamic for operational technology. 

Welcome to Claroty's brand new podcast, Aperture! hosted by Editorial Director Mike Mimoso.
Aperture will feature regular discussions with IT and OT security experts as we focus on protecting the critical infrastructure that impacts so much of our day-to-day lives.
Please share the word about the podcast. It will be available on all the major platforms, and on the Claroty blog. 
Subscribe now so you don't miss any of our discussions. 
We'll be back soon with compelling discussions with the best minds in IT and OT security. 
Thanks for listening.