Security Breach

Send us Fan Mail

While there are plenty of unknowns when it comes to protecting the OT attack surface, there are some things that are undeniably true.

We know that the frequency of attacks will continue to increase.

We know that it’s not if your ICS will be probed, but when.

And we also know that asset and connection visibility is an ongoing challenge due to the implementation of more automated technology.

Finally, we also know that one of the most important aspects of any cybersecurity plan is the portion that lays out the response. 

One of the most effective ways to address these concerns can be the use of attack simulations. In this episode we tap in to the expertise of Tom Marsland, VP of Technology for Cloud Range, a leading provider of live-fire cybersecurity exercises and training. Watch/listen as we discuss:

• All the little things that are continuing to pose challenges to industrial cybersecurity.
• Why state-sponsored hacker groups in China are getting more of his attention lately.
• Why successful incident response is about the people, not the tools.
• The importance of "training like you fight."
• His role with VetSec, and the role it can play in filling cybersecurity talent gaps. 
• How to bring IT and OT together and why the onus on strengthening these bonds might fall more on IT.
• Why the culture of security needs to permeate throughout the entire organization.
• How AI can help make the most of your people.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Maybe you’re sick of hearing about phishing schemes and the way hackers are using this strategy to infiltrate your networks, access intellectual data, shut down production, or hold your assets for ransom. If that’s the case, then you’ve made a lot of hackers very happy.

And based on Proofpoint’s 2024 State of Phish report, protecting against phishing schemes is simply not being reinforced or given the proper priority. For example,

• 71% of surveyed users admitted to taking a risky action, and 96% knew they were doing something risky when interacting with email or text messages.
• 85% of security professionals said that most employees know they are responsible for security, but 59% of employees weren’t sure or claimed that they’re not responsible.
• Furthermore, 24% admitted to responding to emails or text messages from someone they don’t know, and 19% clicked on links in emails from people they don’t know.
• Finally, 73% of surveyed companies reported a business email compromise, but only 29% are actively teaching users about BEC attacks. 

To address these and other phishing attack dynamics, I sat down with Craig Taylor, co-founder of Cyberhoot, a leading provider of phishing prevention solutions. Watch/listen as we discuss:

• How hackers are going after session tokens to steal valuable credential data.
• Why phishing prevention training spends too much time on avoiding the click instead of positive reinforcement of proper actions.
• The need for worker training to go beyond any impact to the company, to the individual cyber risks as well.
• How adding "friction" to email could be a solution.
• The bad password advice that many high-level organizations continue to distribute.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

So, my daughters like to give me a hard time about growing old. 

Said another way, I’m a legacy asset - just like most of the devices many of you observe, manage and secure every day. Your machines are still in place because they work. While the technology around these assets has evolved, their core functionality and value to the production process has remained constant. 

But as sensors, network connections and access parameters have been upgraded to improve output, these highly prized pieces of equipment are showing their age from a cybersecurity perspective. The challenges they present are reinforced with findings from Fortinet’s 2024 State of Operational Technology and Cybersecurity Report. 

A couple of key takeaways include findings that show nearly one-third of respondents experiencing six or more intrusions in the last year. Additionally, fewer respondents claimed 100 percent OT system visibility – with that number decreasing from 10 to five percent. On the bright side, we’re getting better in some areas, with 20 percent of organizations establishing visibility and implementing segmentation, up from only 13 percent the previous year.

Joining us to discuss these and other trends is Jon Taylor, Director and Principal of Security with Versa Networks, a leading provider of digital transformation and edge security solutions. Watch/listen as he discusses:

• Why the Purdue model might re outdated and preventing many from using new strategies like SASE.
• Why he believes visibility is security - "you have to see it  do defend it," and how AI could be the solution.
• The need for OT to look at vulnerabilities from a network or architecture perspective, not by device or connection point.
• How air gapping help feed the division between IT and OT.
• The weaponizing of OT networks stems from the lack of an adaptive network strategy fed by archaic infrastructure.
• Instead of Security by Design, we need to implement Patching by Design.
• Why the industrial sector needs to be more vocal about the need for embedded security and embedded micro-segmentation.
• How state-sponsored hackers are helping elevate the industrial sector's response and prioritization of cybersecurity.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast. And if you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected]. 

To download our latest report on industrial cybersecurity,  The Industrial Sector’s New Battlefield, click here.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

While the justifications for additional cybersecurity spending is easy to explain, getting buy-in at the C-level can be difficult. However, some recent research might help you win over those controlling the purse strings.

SonicWall’s Mid-Year Cyber Threat Report found that their firewalls were under attack 125 percent of the time during a 40-hour work week. And if that doesn’t get the attention of the powers that be, it might also be worth mentioning that during these attacks SonicWall also found that, at a minimum, 12.6 percent of all revenues were exposed to cyber threats that were not covered by security tools or procedures. 

Extrahop’s Global Cyber Confidence Index also reported that 31 percent of cyber and IT leaders want more budget, or more accurately, a 50 percent increase in order to effectively manage and mitigate cyber risk. That number might seem a bit inflated, but it does help illustrate how we’re seemingly fighting the cyber battle on multiple fronts.

To help sort through some of these challenges and direct our resources as effectively as possible, I recently sat down with Anusha Iyer, the Founder and CEO of Corsha, a leading provider of OT asset management and access security solutions.

Watch/listen as we discuss:        

• How to retrofit new practices for legacy assets in order to optimize uptime.
• The false confidence generated by many air gap strategies.
• The importance of machine identity strategies in order to understand the best ways to secure assets and their growing number of connections.
• Increases in ICS-focused malware and live-off-the-land attacks.
• The importance of focusing on the "whys" when conducting employee cybersecurity training.
• Reinforcing the "realities of the day" in improving the entire cybersecurity community.
• Using AI to assess more connection behaviors.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

One of the most common topics we explore here on Security Breach is the ongoing challenge of asset visibility in the OT landscape. It's frustrating because it would seem that the solution starts with basic inventory management approaches, i.e. the first step in developing frameworks and plans for everything from tool selection to attack response.

Of course, this is never simple due to the increasing amount of IIoT technology and the connection demands they place on industrial systems. It’s a situation that promises to only get more complex, with Fortinet reporting that in 2023, only five percent of surveyed organizations have 100 percent visibility into their own OT activities – a number that is down from 13 percent in 2022. 

To provide some insight on managing this growing number of machines, connections, access points and other vulnerable areas of the ICS, we connected with Kevin Bocek, the Chief Innovation Officer at Venafi, a leading provider of asset identity management. Watch/listen as he discusses:

• Why cyber incidents are a learning opportunity for everyone.
• The benefits of showing the C-suite all those plant floor connections when working to get proper cybersecurity funding.
• The rise in attacks that will be emanating from legacy software and coding.
• Why software assets should be managed and secured in the same manner as machines or devices.
• How manufacturing can bring Continuous Improvement strategies to OT security.
• Stuxnet's long-term impact.
• How quantum computing will dramatically alter authentication approaches and secure-by-design practices within the next five years.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

According to Veeam’s 2024 Ransomware Trends Report, cyber victims stated that they were unable to restore 43 percent of whatever data was affected by ransomware attacks. This reaffirms what a number of Security Breach guests have stated about trusting hackers after paying their extortion demands. 

Another finding shows that 63 percent of ransomware attack victims restored the compromised systems directly back into their production environment, without some type of quarantine or scanning method. The risk here, obviously, is simply bringing the ransomware right back to where you removed it. This is a big contributor to the ongoing frustrations associated with dwelling, or living-off-the-land attacks. 

As much as we’d like it to, ransomware simply won’t go away. Some of this stems from a hacking community that continues to draw from a growing treasure chest of financial and technical resources. The other is that we continue to fall short in executing some of the basic blocking and tackling of cybersecurity, like protecting logins, improving visibility of our OT environment, and securing key devices.

In this episode, John Terrill, vice president of Phosphorus, a leading provider of security management services and solutions, offers his take on ransomware, as well as:

• How hackers are using replicable tool kits in moving from system to system or victim to victim in the industrial sector.
• Moving past the mindset that vulnerabilities are only a problem if that can't be exploited - hackers will them.
• How those in cyber defense need to unlock their "creative maliciousness", or take a similar approach to hackers in not being afraid to move around the system and potentially break stuff in order to identify soft spots in defenses.
• Why he prefers homegrown OT security expertise.
• The increasing benefits emanating from political discourse on cybersecurity.
• Remembering that non-OT systems, like HVAC or elevators, can be inroads to the ICS, and need to be defended as part of the OT landscape.
• Why we need to look at OT assets like computers, not just machines.
• How to overcome segmentation and micro-segmentation challenges.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

The ongoing theme in industrial cybersecurity centers on two competing dynamics – the desire to expand our implementation of automation and Industry 4.0 technologies with the goal of using more and faster connections, along with the decision-making data each generates to improve the efficiency and quality of production.

However, these goals now need to be counter-balanced against the heightened risks that all these connections spawn, and the doors they can open for hackers looking to shut down, extort or steal data from manufacturers. 

In this episode, Joe Saunders, the CEO and Founder of RunSafe Security, offers his take on securing these connections and data, as well:

• The on-going challenges associated with memory-based vulnerabilities.
• Tactics for supporting legacy OT code and minimizing the potential disruptions that can accompany software upgrades.
• Addressing vulnerabilities at a "class" level, instead of the one-at-a-time "whack-a-mole" approach.
• Embracing CISA's secure-by-demand edicts.
• The balancing act of more connections without lowering the security posture.
• Warnings about China and other state-sponsored threat actors.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

We’re back to discuss an all-too-familiar topic – ransomware.

Ironically enough, it seems the topics we describe in this manner become so familiar because we can’t figure out viable, long-term solutions. I think part of the challenge for industrial organizations dealing with ransomware is that we have to divide our energy and resources between prevention, detection and response. Any one of those is a challenge, but managing all three is daunting, and hackers know this. But so do the good guys - one of which is our guest for today’s episode. 

Listen as Jeff Krull, principal and leader of Baker Tilly’s cybersecurity practice discusses their Guide to Ransomware Prevention, as well as his thoughts on:

• The C-suite's growing appreciation of how cyberattacks are impacting profitability, which means cybersecurity has become more than just an IT issue.
• How more resources have made RaaS groups increasingly difficult to detect and stop.
• Paying vs. not paying the ransom.
• Why more cyber regulation is on the way.
• Manufacturing's lack of redundant assets is making it a more attractive target, but also fueling action around response and recovery plans.
• Why not everyone needs access to everything.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

A smarter, well-funded hacker community means embracing basic, yet daunting cyber challenges.

In manufacturing, regardless of your role, avoiding downtime is an obvious priority, and one of the motivating factors driving investments in cybersecurity.

In working to mitigate potential DDoS attacks or malware drops, manufacturers are tapping into more resources in heightening their awareness of vulnerabilities and the associated remedies, which can include updating access protocols, applying patches and replacing old equipment and technology. 

The problem is that the solutions can actually contribute to the problem you were originally trying to avoid – downtime. 

Our guest for today’s episode looks to offer some solutions. Watch/listen as Gabe Dimeglio, VP of Global Security Services at Rimini Street, a leading provider of data security and managed services, offers his take on:

• Patching strategies that minimize downtime.
• Getting employees engaged in cybersecurity strategies.
• Ensuring buy-in from throughout the enterprise when security measures need to be implemented.
• The evolving nature of hacker skills and the volume of attacks they are able to launch.
• How nation states are developing an institutionalized approach to developing new and better-trained hackers.
• Placing a priority on visibility, inventory and segmentation tools.
• Why he's an advocate of better regulatory efforts, not necessarily more of them.
• The under-utilized resources available to constructing response plans.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Sophos recently reported that 65 percent of manufacturing and production organizations were hit by ransomware last year, which, unlike other sectors, is an increase. Overall, these attacks have increased by 41 percent for manufacturing since 2020. Additionally, the cybersecurity firm found that 44 percent of computers used in manufacturing have been impacted by a ransomware attack, and over half of these intrusions can be directly linked to malicious emails and compromised credentials. 

These findings help illustrate what we’ve known for years – hackers would rather log in than break in. And stopping these types of attacks requires starting with your front line defenses – the workforce. 

Our guest for today’s episode will look to offer some solutions for transitioning employees from a weak link to a key cybersecurity asset. Watch/listen as Shawn Waldman, CEO and Founder of Secure Cyber, a leading provider of secure network design solutions, discusses:

• Why he would give the industrial sector a low D when grading their ability to effectively communicate security processes and protocols.
• How to address those employees that continue to click on every link in their emails.
• Why cybersecurity should be treated like a trade.
• Understanding the difference between security tools and IT services.
• Implementing accountability without being overly punitive and rewarding employees for positive cybersecurity actions.
• The concerns he has about 5G and quantum decryption.
• Avoiding the AI "easy button".

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].