Security Breach

Send us Fan Mail

Elevated social engineering, more connections and growing extortion amounts will drive attack growth.

Late last year we discussed Lockbit’s ransomware attack on Boeing, and the ensuing “cyber incident” that resulted in a large quantity of the aerospace giant’s data being stolen. One of the experts we tapped into in breaking down the attack, and its fallout, was Tony Pietrocola.

In addition to serving as the president of AgileBlue, he also heads the Northern Ohio chapter of InfraGard, which works directly with the FBI on cybercrime.

You can check that Boeing episode out in our archives.

In addition to his extensive knowledge on threat actors like Lockbit, Tony also has a tremendous amount of insight on ways to improve attack surface visibility, especially as hackers are beginning to utilize next-gen tools like AI.

For more information on the work AgileBlue does, you can check them out at agileblue.com

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Coordinating patches, covering the basics and not falling for 'pinky promises.'

Late last year we discussed Lockbit’s ransomware attack on Boeing, and the ensuing “cyber incident” that resulted. One of the experts we tapped into in breaking down the attack, and its fallout, was KnowBe4’s Erich Kron.

You can check that episode out in our archives.

In addition to his extensive knowledge on threat actors like Lockbit, Erich also has a tremendous amount of insight on a number of cybersecurity challenges that continue to plaque the industrial sector, including the human elements. His knowledge seems especially timely given that one of the most significant vulnerabilities uncovered in the last month stems from a hacktivist group using unchanged default passwords to access PLCs in water treatment facilities and manufacturing plants.

Just like Colonial Pipeline and numerous other attacks, this global vulnerability started with the actions, or inactions, of a human being. This episode offers some additional insight from Erich Kron at KnowBe4.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

A former black hat offers insight on defending against hackers that "go for the throat every time."

One of the mindsets shared by hackers and their corporate victims is the desire to put a successful bow on the calendar year. For you this could mean hitting a collection of shipping dates, production quantities or equipment implementations. What many are beginning to realize is that the black hat community has a number of year-end targets to hit as well.

The focus on closing out orders, dealing with holiday-related slowdowns and potentially fewer employees on the plant floor often leave doors open to hackers. It’s no surprise that these dynamics often result in the last quarter of the year producing large spikes in ransomware, DDoS and credential harvesting attacks.

Our guest, Matthew Wolfe, Director of Cybersecurity Operations at Impero, offers insight on these attacks and how some of his previous experiences have given him a unique take on the bad guy's tactics.

We’re also excited to announce that Palo Alto Networks is sponsoring this episode. For more information on zero trust security for all OT environments and simplified operations, go to www.paloaltonetworks.com/network-security.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected]. 

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Accidental advancements by state-sponsored hackers are impacting ICS security, and elevating network visibility needs.

Amongst the traditional threats to manufacturing enterprises and industrial control systems are the escalating roles of state-sponsored hacker groups. Refined through recent hostilities in the Ukraine and Gaza Strip, more and more cyber attacks against critical infrastructure around the world has cybersecurity experts looking beyond independent RaaS groups and malware drops.

What makes these organizations so concerning is that they are more focused on stealing data and manipulating operations than extorting funds. This means the challenges associated with dwell time and asset visibility now take on even greater prominence.

That’s why we’ve invited Paul Ernst to the show. Paul will call upon his military experience, as well as his current role, to help us better understand these nation-state threats and vital ICS vulnerabilities.

We’re also excited to announce that Palo Alto Networks is sponsoring this episode. For more information on zero trust security for all OT environments and simplified operations, go to www.paloaltonetworks.com/network-security

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

MITRE’s ATT&CK knowledgebase, and the intrusion patterns, hacker tactics and response data it provides.

While there are a number of indicators showing the positive direction in which industrial cybersecurity is heading, it's still worth taking a look at some of the more alarming facts impacting our current situation. For example, Fortinet is reporting that:

• Three-fourths of industrial enterprises reported at least one OT intrusion in the last year.
• Nearly one-third of all ransomware attacks continue to target the industrial sector, with a nearly 10 percent uptick in attacks going undetected until the extortion or blackmail note arrives.
• Intrusions from malware and phishing attacks have increased by one-third.

But there is good news. Fortinet reports that 98 percent of organizations now include its OT cybersecurity posture in briefings with executive leadership. We also know more about the bad guys today, then we ever have before, with some of this progress attributed to the work being done by today’s guests - Adam Pennington and Jake Steele from MITRE’s ATT&CK knowledge database.

We’re excited to announce that Palo Alto Networks is sponsoring this episode. For more information on zero trust security for all OT environments and simplified operations, go to www.paloaltonetworks.com/network-security.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected]. 

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Balancing resources to keep the bad guys out, improve real-time visibility, and develop quicker responses to new attacks.

In what might be legendary singer Johnny Cash's most famous song, he speaks of keeping his eyes wide open all the time, and those tasked with OT security responsibilities are finding that they too need to walk the line. 

In the cybersecurity world this means balancing between the priorities of different operational environments, selecting tools and technologies that best match these priorities, and then understanding how all these investments can be intertwined to carry out your strategy. Unfortunately, this makes it bit more difficult to stay true to original plans. 

Navigating that line also entails an understanding that keeping the bad guys out is not the sole function of cyber defense, because the evolution of threats and an expanding OT attack surface has created an incredibly complex environment – a fact that is as obvious as night is dark and day is light. 

So, to keep us walking that line in understanding how to adapt our tools and strategies, we welcome Stephen Tutterow, a team lead at Pentera, to the show. Pentera is a leading provider of automated security validation solutions.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected]. 

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Industry experts assess the ransomware attack, the attacker, and critical takeaways for manufacturers of all sizes.

Recently, one of the most high-profile manufacturers in the world – Boeing – suffered what they’re describing as a “cyber incident”, which resulted in a large, but unknown quantity of data being stolen and held for ransom by the notorious Russian RaaS group, Lockbit.

Lockbit, which is highly recognized as one of the most prolific threat actors targeting the industrial sector, obtained what is currently assessed as Citrix cloud files, security controls, email backups and corporate emails. The leak is potentially tied to a parts distribution company, Aviall, that Boeing purchased in 2006.

What remains to be seen, despite Boeing’s claims, is just how damage this leak could cause, what the ramifications might be moving forward, how Boeing might respond and what the industrial sector can learn from this incident.

We’ve assembled two leading industry experts to break down the attack - KnowBe4’s Erich Kron and Tony Pietrocola, president of AgileBlue and the Northern Ohio chapter of InfraGard.

We’re also excited to announce that this episode is being sponsored by Palo Alto Networks. Protect your OT assets, networks and remote operations with Zero Trust OT Security from Palo Alto Networks. It’s powered by AI and machine learning while offering comprehensive visibility, zero trust security for all OT environments, and simplified operations. For more information on zero trust security for all OT environments and simplified operations, go to www.paloaltonetworks.com/network-security.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Staying ahead of hackers as they look to infiltrate every new connection point.

The balancing act continues when it comes to industrial cybersecurity, with the focus of many organizations split between focusing on known internal weaknesses or harnessing a better understanding of the external black hat organizations wanting to shut them down, steal data or extort payments.

One stat that helps demonstrate this dynamic comes from the IBM Security X Force Threat Intelligence Index, which shows a 94 percent reduction in the average time for the deployment of ransomware attacks. What took attackers over two months in 2019, now takes less than four days. Another example comes from Open Text’s 2023 Cybersecurity Threat Report that took a closer look at the notorious LockBit group. Not only have they dropped more malware than any other in the last year, but they’ve begun to implement triple-extortion tactics.

Joining us to discuss these and other topics related to threat intelligence and how to prioritize it, is Jonathan Tomek, VP of Research and Development at Digital Element, and co-founder of THOTCON, a hacking and security conference hosted in Chicago each spring.

We’re excited to announce that Palo Alto Networks is sponsoring this episode. For more information on zero trust security for all OT environments and simplified operations, go to www.paloaltonetworks.com/network-security.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected]. 

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

There are two common elements of a hacker’s strategy that show up regardless of whether it’s a ransomware attack on a local healthcare system or a malware drop on a global automotive manufacturer. 

The first is speed. Once an exploit is detected by the bad guys, they will work as quickly as possible to take advantage of it, hopefully beating the deployment of any patches. 

The second element is manipulation. Most commonly, hackers take advantage of well-established systems that have unextraordinary access points, legacy connections or human management dynamics that are easily manipulated by altering software code, stealing login data or introducing malware. 

Based on these fundamental dynamics, it would seem that hackers could benefit greatly from a tool that reduces a human being’s grunt work and utilizes algorithms and automation to produce the text for a phishing email, to re-write software code, or to develop data mining protocols to obtain logins and personal information.

That tool is obviously artificial intelligence, and the hackers are all too familiar on how to use AI platforms for their nefarious purposes.

Fortunately, the good guys have also become well-schooled in the art of AI, and one example is Gary Southwell, the VP and General Manager at ARIA Cybersecurity. He joins us to share some AI tricks that can slow down and defeat threat actors.

We’re excited to announce that Palo Alto Networks is sponsoring this episode. For more information on zero trust security for all OT environments and simplified operations, go to www.paloaltonetworks.com/network-security.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected]

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Using hacker tactics against them by getting IT and OT on the same page.

One of the most recent, widespread and hardest hitting cyberattacks is the MOVEit exploit spearheaded by the ransomware gang Clop.

The zero-day vulnerabilities associated with this file transfer tool impacted a number of global manufacturers, including Shell, Schneider Electric, Siemens Energy, Emerson, FANUC, Bristol Myers Squibb, TTI and Honeywell. Essentially,

Clop was able to infiltrate MOVEit files and inject commands that allowed the hackers to access databases and steal a plethora of personal and operational data from over 300 companies.

Since its origins in 2019 Clop has targeted over 10,000 companies around the world.

To help offer some clarity on the depth of this attack, some lessons learned from this ordeal, and things manufacturers need to know about the evolving threat landscape, it’s our pleasure to welcome Mike DeNapoli to the show. Mike serves as the cybersecurity architect and director at Cymulate – a leading provider of attack surface management and cyber risk mitigation solutions. 

We’re excited to announce that Palo Alto Networks is sponsoring this episode. For more information on zero trust security for all OT environments and simplified operations, go to www.paloaltonetworks.com/network-security.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected]. 

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].