Now that we are starting to have secure ICS protocol options and deployments, its time to get serious about key management. The de facto use of self-signed certificates only provide illusory security. Key management in ICS can be simple and the community should start with simple.

Subscribe to Dale's ICS Security: Friday News & Notes at https://friday.dale-peterson.com/signup/

Marc Ayala of 1898 & Co. joins Dale to discuss the month's top stories in ICS security and give their wins, fails and predictions. 

Subscribe to Dale's ICS Security: Friday News & Notes email at https://friday.dale-peterson.com/signup/

My weekly article published on 29 June 2021.

Signup for my ICS Security: Friday News and Notes email

The tables were turned when Jannis Stemmann and Simeon Mussler of Bosch CyberCompare interviewed me for a long form German interview series. They graciously allowed me to record the audio as well for this show.

There is a short discussion on the S4x22 Call For Presentations and the Basic Sponsor application at the start. The interview begins at 4:20.

Subscribe to my ICS Security: Friday News & Notes.

Dale's weekly article covers Claroty's $140M D Round and what it means for the detection space.

Subscribe To Dale's ICS Security: Friday News And Notes.

Dale interviews the two project leaders of a global community effort to create a Top 20 Secure PLC Coding Practices. We cover:

• who it's for
• examples of types/categories of the practices
• some of the ways it can be used
• what following the practices will and will not accomplish
• how you can help make a difference

The document and supporting information is available at https://plc-security.com and the twitter is @secureplc.

Subscribe to my ICS Security: Friday News & Notes at https://friday.dale-peterson.com/signup

My article from 15 June 2021. 

It began with Jake Brodsky's S4x20 session on tips and tricks he had learned in his long career with a water utility to improve the resiliency, maintenance and security of a PLC and the underlying physical process. Today, it results in the release of Version 1.0 of the Top 20 Secure PLC Coding Practices with one of the least restrictive licenses for use, distribution and modification you will ever see. We want this Top 20 list to be used. Listen for more ...

Subscribe to Dale's ICS Security: Friday News & Notes

You know IT / OT integration is getting serious when the popular IT apps and services add OT extensions. The latest is ServiceNow's new OT Management Product.

James Destro of ServiceNow joins Dale Peterson on the Unsolicited Response show to talk about two main things.

1) How does OT Management get the OT asset inventory information? (and what is the single source of truth for OT asset inventory)

2) Once the OT asset inventory is in ServiceNow what types of workflows are envisioned that would be a big benefit to the asset owner.

Links:

Operational Technology Management 1-pager: https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/solution-brief/uc-operational-technology-management-manufacturing.pdf

Detailed documentation of the Operational Technology Classes: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/product/configuration-management/concept/cmdb-ci-class-models-operation-technology.html

Asset Inventory Integrations: https://store.servicenow.com/sn_appstore_store.do#!/store/integrations?freeTrial=service_graph_certified&offeredby=servicenow%253Bpartners

Signup For Dale's Friday News & Notes at https://friday.dale-peterson.com/signup

ICS-Patch leverages the CERT/CC SSVC Decision Tree approach for determining what patches are important and a patching cadence. One of the most important customizations is all of the factors can either be pulled from an asset inventory or a CVSS feed. This means the evaluation of 10's or 100's of thousand asset/patch pairs can be automated and an ASAP, Scheduled, Defer answer provided.

• Links: ICS-Patch Paper: https://dale-peterson.com/wp-content/...
• S4x19 How To Fix CVSS Session: https://youtu.be/-6cThOCm9co
• S4x20 SSVC Session: https://youtu.be/AvKLZZh8NG4

Tweetme: @digitalbond

Subscribe to My Friday News & Notes: https://friday.dale-peterson.com/signup