Security Breach

Send us Fan Mail

Those of you with a military or law enforcement connection are probably, and unfortunately, familiar with the term collateral damage. While this phrase has a legacy in these environments, it’s also become an unwelcome addition to the realm of cybersecurity.

Examples of this dynamic can be found in a number of hacktivist attacks that targeted infrastructure in a certain region, but either through unrealized connections or other bad actors simply following the blueprint, impacted facilities across the globe.  

Jason Oberg, the CTO of Cycuity, a leading provider of vulnerability mitigation solutions for semiconductor manufacturers, recently joined us to discuss some of the potential fallout from hacks, and how to prevent or respond to them in minimizing the collateral damage. We also talked about:

• How hackers are getting smarter in their hacks against chip makers.
• Why awareness of hacker tactics is not enough, and how manufacturers of all types can enhance their knowledge level pertaining to the growing sophistication of hackers and attacks.
• Addressing the baked-in compromises of hardware products, and the long-term impacts on all users and industries.
• Focusing on the inherent vulnerabilities of production processes, not just the associated technology.
• Balancing the goals of "getting product out the door" with embedding greater levels of security.
• How greater transparency can help with secure-by-design challenges.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Viewing hacks as diseases to address evolving threats, vulnerabilities and tools like AI.

Like many of you, I recently dove into Verizon’s 2024 Data Breach Investigations Report (DBIR).  And while there’s a plethora of data housed in the report that could fuel conversations on a multitude of topics, I chose the following two pieces of information:

• While credential harvesting and phishing attacks still led the way, the use of exploitable vulnerabilities to access networks tripled from last year, and were primarily leveraged by Ransomware and other Extortion-related threat actors.
• The reported median time to click on a malicious link after an email is opened is 21 seconds, and then only another 28 seconds for the person caught in the phishing scheme to enter their data. So, basically, a successful phishing attack can be executed in less than 60 seconds. 

These two items caught my eye because they seem like the low-hanging fruit when it comes to cybersecurity. In this episode, Roland Cozzolino, CTO/CIO of InsightCyber, a global provider of asset visibility, risk management and security services delivered via an AI-driven platform, offers his perspective on these types of exploits, as well as:

• Why state-sponsored hacker groups are his biggest concern.
• The problems caused by patient hackers and their live-off-the-land, or dwelling approach to network intrusions.
• How manufacturers can and need to improve their use of AI tools for enhancing visibility, asset management and threat detection.
• The advantages of designing OT security processes as though you're working in a disease-driven environment.
• Viewing cybersecurity as less about saving money and more about not losing control of an operation.
• Developing a strategy that goes beyond just "unplugging the machine".

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

It starts with a dedication to enhanced visibility.

One of the big conversations regarding OT security revolves around the use of tools. Some have too many, others not enough and everyone is searching for the funds to mange and obtain the right ones for a constantly evolving threat landscape.

The key to understanding which tools are right for you and your organization not only demands a comprehensive understanding of your OT environment’s assets, APIs and connections, but a working situational awareness. Here to discuss some of these topics, and more, is Sharon Brizinov, Director of Research at Claroty’s research arm, Team82.

Claroty is a leading provider of ICS and OT security, with partners that include Rockwell, Schneider Electric and Siemens. Watch/listen as we discuss:

• How creating patching windows can help address vulnerabilities more quickly.
• How tools can help manage the proliferation of connected devices.
• Why OT will benefit from IT's lessons-learned.
• Creating a defense against your daughter's iPad.
• Why manufacturers have to do a better job of knowing what they're defending against.
• The non-complicated, but terrifying strategies of hacktivists and state-sponsored attack groups. (Click here to view the report discussed in this episode breaking down a recent hack on Russian manufacturing.)
• The evolution of component-level connectivity, and what that will mean for industrial cybersecurity.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

Many attacks on manufacturers are just the first step in going after even bigger targets.

One of the inescapable truths about the industrial sector is that it is usually the ultimate proving ground for product performance. When we look at some of the technologies that have created seismic social shifts, tools like operational software, wireless connectivity and numerous monitoring devices were not ready for the demanding industrial environment right away.

When it comes to cybersecurity, that dynamic has done a 180. Hackers initially went after healthcare and financial institutions because they were seen as easy targets with deep pockets that would pay to make the problem go away as quickly as possible. 

Then 2020 came and put many industries on pause – except for manufacturing. Like moths to a flame, the hackers were drawn to OT networks and found not only a vulnerable target, but a lucrative one. We tackle these issues and many others in this episode with Sam Moyer, MxD’s Lead Cybersecurity Engineer. Some of the topics we discuss include:

• The lingering (live-off-the-land) nature of many state-sponsored or hacktivist group attacks.
• Finding the right ways to prioritize cybersecurity in manufacturing, and how the industry works "in it's own time."
• The disruptive or competitive push that manufacturing is missing.
• AI, and the potential traps to avoid in eliminating too much human knowledge.
• Why manufacturers are a target because of who they work with on a regular basis.
• Improvements in landscape visibility.
• The rise in frequency of manufactures paying ransomware demands.
• Navigating the regulatory landscape, and learning from past mistakes.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

In this episode, we dive into some of the most notorious attacks to hit manufacturing over the last six months.

In addition to speaking with cybersecurity experts from around the world for this podcast, I’ve also been able to do a fair amount of reporting on our websites regarding several high-profile industrial attacks. So, I felt like it could be interesting to present some of these articles via the Security Breach podcast in helping further the conversation around tactics and lessons learned.

So sit back and watch or listen as I dive into some of the most notorious attacks to hit the industrial community over the last six months.

• The first hack I’d like to cover is one that we’ve referenced several times here on the podcast – the  Cyber Av3ngers Unitronics PLC hack.
• The second attack I'm going to discuss involves a large player that those involved with industrial networking will immediately recognize – the Dark Angels penetration of Johnson Controls. This hack serves as a strong example of how a growing number of OT attacks can originate within IT systems or assets.
• We'll also take a look at another familiar company within the ICS community, and how they responded to a double-extortion ransomware attack from the Cactus RaaS group.
• Finally, we take a deep dive into another Dark Angels attack. This time the victim was Nexperia, a leading manufacturer of silicon-based processors based in The Netherlands, and a subsidiary of China-based Wingtech Technology.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

A look back at Security Breach guest's most accurate and timely industrial cybersecurity predictions.

As we near our 100th episode of Security Beach, I thought it would be a good time to take a look back at some of our guest’s predictions from the previous 12 months. 

If you want to check out the full episodes from any of these previous guests, you can find them in the show archives, or by clicking through to our website. So, join me as we take a look back at a collection of predictions from:

• Pete Lund at OPSWAT
• John Dwyer from IBM
• Siemens’ Kimberly Cornwell
• Moty Kanias from Nanolock
• NovaCoast’s Elise Manna-Browne
• Brian Haugli from SideChannel
• Huxley Barbee from runZero
• Forescout’s Daniel Trivellato
• Dragos’ Dawn Cappelli
• Impero’s Matthew Wolfe
• KnowBe4’s Erich Kron
• Tony Pietrocola from Agileblue

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

The new factors impacting a growing attack surface, and how to evolve your cyber risk strategies.

The origins of what we talk about here on Security Breach can go back to any number of transformational events, but the reality is that all of them contributed an individual component to the unique mosaic that is the legacy of industrial cybersecurity. What is most interesting is that the first hacks of industrial control systems occurred at water treatment facilities, oil and gas pipelines and energy plants.

These targets were chosen because they simultaneously provided great visibility, heightened social impact, and, most notably, easily exploitable vulnerabilities. In most cases, these attacks allowed the hackers to accomplish all of their early financial and self-promotional goals, along with longer-term benefits that we’re all dealing with now – how to successfully probe the ICS.

John Cusimano, VP of OT Security at Armexa is our guest for this episode. He's seen hackers apply these lessons learned about the industrial control system first-hand, and has some interesting thoughts on the current threat landscape, as well as solutions for keeping your systems secure. Watch/listen as we discuss:

• How he transitioned from a safety and automation engineer to a career in OT cybersecurity.
• The benefits of failing in a safe manner.
• The new dangers of remote monitoring.
• Ways to implement application safe listing.
• Always being prepared to answer the 'what if?' question.
• Micro-segmentation and DMZ strategies.
• Best practices for patching and avoiding alarm floods.
• Why his biggest concern lies in a large-scale, coordinate attack on the ICS.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

How a greater focus on new and legacy OT connections could alter the cybersecurity battlefield.

Everything old … is new again. While that might seem like a natural lead-in for discussing hacker tactics, that same mantra rings true when discussing OT technology. Mordor Intelligence recently reported that U.S. manufacturing spent over $307 billion on digital transformation technologies last year, and nearly every research and consulting outlet around the world is predicting that those numbers will rise in 2024. 

All this new software, connectivity, automation and equipment creates a familiar challenge when it comes to OT cybersecurity. This meshing of the old and new is something our guest for this episode is all too familiar with, and he’s here to break down everything associated with bringing legacy and next-gen together. 

Listen as Josh Williams, Strategic Account Manager at IriusRisk, offers his thoughts on secure-by-design, as well as:

• How the industrial sector gets a C- when it comes to securely integrating new technology into the OT landscape.
• Why the onus for secure-by-design concepts resides with the buyer.
• How monitoring became a critical vulnerability.
• The double-edged sword of connectivity.
• How state-sponsored hackers are a threat to more than just political targets.
• Why industrial OT is the front line in the cyber war.
• Why he doesn't want to be the "old man yelling at the clouds.".
• How supply chains have become manufacturing's biggest cyber concerns.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

The good, the bad and the ugly of mobile device security in the expanding OT attack landscape.

Included in the challenges associated with securing an ever-expanding OT attack surface is the role played by the increasing use of mobile devices – at both the enterprise and individual level. In fact, according to a recent report from Imprivata, only 46 percent of manufacturing organizations have the ability to maintain control over who has access to such devices and when, and 61 percent are using shared pin numbers to secure these devices. 

Additionally, an average of 16 percent of these devices are lost each year, costing organizations over $5M annually, not to mention the collateral damage from a security perspective.  This translates to an opportunity for hackers to unleash catastrophic damage by leveraging any vulnerabilities in areas like remote monitoring, and potentially new ways to worm into the networks associated with controlling your machines and systems.

Watch/listen as Joel Burleson-Davis, SVP of Cyber Engineering at Imprivata, returns to Security Breach to discuss OT mobile device security, as well as:

• The journey the industrial sector has made from devices that were never intended to be connected, to what Joel describes as OT "super connectivity".
• Why OT continues to be an easy target for hackers.
• The evolution of hacking groups.
• How we might be over-doing all the connectivity.
• The double-edged sword that is mobile use in the industrial sector.
• Avoiding 'mobile defeatism'.
• Combatting the growing number of dwelling or living-off-the-land attacks.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].

Send us Fan Mail

It's not always about the ransom, data theft or denial of service.

Many cheered with the recent crackdowns  on groups like LockBit, and rightfully so. However, the harsh reality is that most of these victories are short-lived. For example, after law enforcement seized control of multiple LockBit websites and stolen data, the group was back to running extortion campaigns within a week.

And the same can be said for many other high-profile busts of groups like Hive and Volt Typhoon. These groups re-build or re-brand, as was the case with the Conti Group offshoot Black Basta. After Conti disbanded, Black Basta reformed from the ashes and tallied over $100 million in ransomware payments last year. 

My point is not to belittle the incredible work that global agencies are performing, but to illustrate that while the industrial sector continues to make tremendous gains - the war continues. And as we evolve and improve, so will the bad guys. 

And perhaps no one knows this better than our guest for this episode - Rod Locke. He’s the director of project management at Fortinet, a leading provider of OT cybersecurity solutions. Watch/listen as Rod shares his thoughts on:

• The growing influence of state-sponsored hacker groups.
• The rise of dwelling or live-off-the-land attacks and how some hackers are more focused on learning about their victims than harming them.
• Why OT can't always place the blame on IT, and the value in understanding both environments.
• How some regulatory efforts might have "swung too far."
• How to attract more "unique individuals" to cybersecurity.
• An anticipated rise in cloud infrastructure and the ways it will impact data security.

As a go-to podcast for our listeners, we want to help you align your brand with our expertise. By sponsoring our podcast, your brand will build trust, and your message will stand out to an audience searching for tools to assist their cybersecurity efforts.
Click Here to Become a Sponsor.

To catch up on past episodes, you can go to Manufacturing.net, IEN.com or MBTmag.com. You can also check Security Breach out wherever you get your podcasts, including Apple, Amazon and Overcast.

If you have a cybersecurity story or topic that you’d like to have us explore on Security Breach, you can reach me at [email protected].