Unsolicited Response

Tom Alrich dives deep on the items he works and writes about. For a long time it was NERC CIP, and he recently added SBOMs to his repertoire. We go deep and I think the business model portion may be the best and most accessible part of the episode.

1:21 The 2 main SBOM formats. There differences and what will win.

12:30 VEX ... identifying what vulnerabilities in the SBOM are exploitable

24:00 What EO 14028 will require the USG to do with SBOMs in August

34:00 Who and how SBOMs will be provided and used. Business models.

Links

Tom Alrich's Blog

Tom's Who Should Be Responsible article

Subscribe to Dale's ICS Security - Friday News & Notes

My article from 8 Feb 2022 looks at what the two most successful OT security product segments have in common.

Check out S4x21, April 19-21 in Miami South Beach

Dale's weekly article covers the importance of some serious security testing of four popular OPC UA stacks that will take place at Pwn2Own Miami at S4x22.

The last Pwn2Own Miami awarded $280K for 0days in ICS targets.

We've been busy with the date change for S4x22, so here is a great replay of the S4x20 closing panel. Ralph and Zach have a ton of experience and make it a lot of fun.

Dale's weekly article dives into the Merck / Ace American case on NotPetya damages covereage.

Check out S4x22, April 19-21 in Miami South Beach

With the recent cyber activities and near hostilities in Ukraine I thought it would be a good time to replay my S4x20 Main Stage interview with Andy Greenberg, author of Sandworm: A New Era of Cyberwar and the Hunt for the Kremin's Most Dangerous Hackers.

Check Out S4x22: April 19-21 in Miami South Beach

Dale's weekly article looks at a new feature in Industrial Defender that measures risk per endpoint. Right direction, and the calculation needs to be more than a cyber hygiene measure.

Subscribe to Dale's ICS Security - Friday News & Notes

Industrial Cybersecurity, listed as 2nd Edition but actually a completely new Volume 2 is 1027 pages on Security Monitoring, Threat Hunting and Security Assessments and Intel. In this episode, Dale Peterson talks with its author Pascal Ackerman.

Links

Industrial Cybersecurity Volume 1

Industrial Cybersecurity Volume 2

Dale's weekly article looks back at the dichotomy of must never go down and don't touch it or it might go down. And how a reduction of fragility can be a good metric of your next cyber risk reduction expenditure in ICS.