Unsolicited Response

Dale Peterson interviews acting CISA Director Nick Andersen. They briefly begin with the impact of the personnel changes at CISA, both at the leadership level and widespread exodus of anyone involved in OT. What are the plans for the rebuild of OT capabilities.

The bulk of the discussion is on the need, implementation, and metrics related to CISA's ruthless prioritization of efforts and resources. What CISA and US critical infrastructure must do, and what they won't have the resources to do.

Few topics get as much heat as the current, future, and ideal relationship between OT and IT. One of the first posts someone just discovering OT makes is how OT is different than IT. As you dig deeper into OT you find an increasing case of the technology, processes, and even the people being similar to IT.

In this 90 minute long conversation format, we will try to bring some enlightenment to this question with a specially curated group of 9 S4x25 attendees.

About The Long Conversation Format

Two people begin the discussion on stage. After 10 minutes a third person will tap one of the participants on the shoulder and replace them in the conversation. This continues for the 90 minutes. Participants are on stage for 20 minutes talking to two different people for 10 minutes each.

Dale Peterson discusses with Maggie how she got into OT security, her recent move to the Financial Sector, women in ICS security, and more.

If you're not interested in S4, skip this episode. Dale goes over the feedback from the survey and S4 Event's own thoughts on the event, Tampa, and more.

Dale Peterson speaks with Joel Langill, the SCADAHacker, about his new training course entitled Conducting Threat, Vulnerability, and Risk Assessments For ICS. A two day version of this course will be offered prior to S4x25.

Of course Dale and Joel jump around a bit on training, the workforce and other items. Take a listen.

Stewart Baker is one of the preeminent lawyers on topics of cyber law with an impressive career in and out of government. Stewart also hosts the Cyberlaw podcast.

The Biden administration is contending that vendors should be held liable for security deficiencies in their products.

Assuming this is turned into law and/or executive orders, what does it mean? What can we learn from other liability law to inform us what would be required for a vendor to be held liable for a security issue? How would the judgment / damages be determined.

Dale's note: We talk about the SEC charges against SolarWinds in this interview.

Dale Peterson interviews Rob Lee on the S4 Main Stage. They cover a lot of ground and Rob is never shy about sharing his opinions and analysis. They discuss:

• Rob's first S4
• PIPEDREAM deployed v. employed distinction … and why 2 years later is it still the most dangerous ICS malware?
• Are we really more homogenous?
• What makes a group something that Rob/Dragos tracks as an ICS focused attacker?
• If the answer to intel is do the basics, do I need intel?
• What ICS specific data was VOLTZITE exfiltrating?
• What countries are targeting critical infrastructure? Is it realistic to expect any country to not target its adversaries CI?
• Threat actors focused on manufacturing
• How should an asset owner measure the effectiveness of their detection solution?

Chris Hughes and Nikki Robinson recently wrote the book Effective Vulnerability Management. Dale and Chris discuss the topic and book including:

• The definition and scope of vulnerabilities. It's much more than coding errors that need patches.

• Are ICS protocols lacking authentication "vulnerabilities"

• The reality that most organizations have 100's of thousands of unpatched vulnerabilities. Some statistics and will this change.

• Ways to prioritize what vulnerabilities you address.

• The SSVC decision tree approach that was introduced at S4 as Never, Next, Now

• Tooling … vulnerability management, software configuration, ticketing, remediation.

• And much more.

Links:

• Effective Vulnerability Management, https://www.amazon.com/Effective-Vulnerability-Management-Vulnerable-Ecosystem/dp/1394221207/

• Dale's ICS-Patch Decision Tree, https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

Waterfall Security Solutions and ICSSTRIVE put out an annual threat report that Dale Peterson believes is the best in OT. Why? It only includes incidents that had physical consequences on systems monitored and controlled by OT.

Dale and Andrew discuss:

• What is in and out of scope for the report.

• The breakdown of the 68 incidents that occurred in 2023 by industry sector, cause, threat actor and more.

• The impact reporting requirements may have on these numbers in the future.

• What percentage of OT cyber incidents with physical consequences are made public.

• Ransomware on IT causing physical consequences, exfil v. encryption, and what asset owners should do given this represents 80% of the known incidents in the report.

• And more.

Links:

• 2024 Threat Report: https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/2024-threat-report-ot-cyberattacks-with-physical-consequences/

• ICSSTRIVE: https://icsstrive.com

• S4 Events YouTube Channel: https://youtube.com/s4events