Unsolicited Response

Forescout's acquisition of SecurityMatters for $113M in cash was the first major exit from the OT Detection Space (or broader passive monitoring market as you will hear in the podcast). I spoke with Brian Proctor about:

1) What it was like moving from an asset owner to a vendor

2) The best way for an asset owner to recruit or develop ICS security talent in this high demand environment

3) Forescout's strategy for the OT capabilities in their "platform" and the market in general

In this episode, I interview Jonathan Homer, the Chief of the ICS Group/Hunt & Incident Response Team at DHS. We discuss: 1) What changes will asset owners see with the creation of CISA in DHS? 2) A detailed discussion of the metrics DHS will use to determine if they are successful / having an impact? 3) Why or if DHS is competing with industry in many of their ICS security services. 4) The CISA Strategic Risk Management Process and how it will prioritize ICS security related efforts.

The ICS Detection Market has achieved almost all of the funding and attention the last two years, including my analysis. So I decided to get the creator of the industrial firewall / gateway market, Eric Byres, on the podcast to help me analyze this market in 2019 and where it will go in the future.

At 33:50 of the podcast we shift topics and discuss aDolus’s FACT score for software and firmware. They say it is like a FICO credit score that measures the authenticity and security of SW / FW.

Consequence Based Techniques for ICS Risk Management ... This recording is from a panel discussion on understanding and reducing the consequence side of the risk equation (risk = consequence * likelihood). Joining me in this discussion are: John Cusimano of aeSolutions and their CyberPHA, and Andy Bochman of INL and their Consequence Driven Cyber Informed Engineering (CCE).

In a recent article a researcher proclaimed it's "not hard for a hacker to capsize a ship at sea". This was quickly followed by the Viking Sky cruise ship having its engines shut off due to a sensor reading.

Not knowing much about maritime control systems I brought two experts from Moran Cyber on the podcast to discuss the issue: Captain Alex Soukhanov (a Master Mariner and Director at Moran Cyber) and Greg Villano (Senior Maritime Cybersecurity Engineeer at Moran Cyber).

I went back to the RSA Conference for the first time in over a decade. Here is my 25-minute report on the event for those considering attending or participating in the future. Includes:

1) the first RSA Conferences and when cybersecurity first looked like a real market 2) tips on working the massive RSA Expo Floor

3) interview with Thomas Van Norman on the ICS Village at RSA

4) should an ICS security vendor exhibit at RSA 5) the value of side events at RSA (or any event)

I interviewed Robert Graham on the S4x19 Main Stage. We brought him to the S4 Stage for his contrarian views.

Some of the topics we discussed in the podcast:

- The downside to IoT regulation and virtue signaling

- Likely threat agents, broad not specific targets and the birthday paradox

- Does Rob expect another Stuxnet?

- Whether seat belts actually save lives and questioning controls (and can we apply this to anti-virus in ICS)

This episode of the Unsolicited Response Podcast features a discussion on the S4x19 Main Stage with Brad Hegrat, Joel Langill and Dale Peterson. The question: Is the Purdue Model Dead?

The three coalesced around an answer (unexpected). And it's not dead, but also not terribly useful going forward in helping with OT network architecture. Have a listen, maybe you will get a different takeaway.

The first Unsolicited Response episode of 2019 is a shorter solo-sode. It begins with my four major takeaways from 2018:

1. Finally figuring out the OT / IT issue

2. Consequence based risk reduction

3. Detection market acceleration and shake out

4. The ICS bane called Cyber Hygiene

And then at 10:20 in the podcast I've included my S4x19 minute mini-keynote Create The Future, with a bit of help from Patrick Miller, Eireann Leverett and Rob Lee.

Dale Peterson interviews Rob Lee of Dragos and Rob Smith of INL on a Department of Energy funded program called Neighborhood Keeper. The program attempts to provide threat detection and intelligence in an easy and affordable way to small and medium sized asset owners. It is trying to tackle the information sharing problem and the resource strain on SMB asset owners.