The ICS Detection Market has achieved almost all of the funding and attention the last two years, including my analysis. So I decided to get the creator of the industrial firewall / gateway market, Eric Byres, on the podcast to help me analyze this market in 2019 and where it will go in the future.

At 33:50 of the podcast we shift topics and discuss aDolus’s FACT score for software and firmware. They say it is like a FICO credit score that measures the authenticity and security of SW / FW.

Consequence Based Techniques for ICS Risk Management ... This recording is from a panel discussion on understanding and reducing the consequence side of the risk equation (risk = consequence * likelihood). Joining me in this discussion are: John Cusimano of aeSolutions and their CyberPHA, and Andy Bochman of INL and their Consequence Driven Cyber Informed Engineering (CCE).

In a recent article a researcher proclaimed it's "not hard for a hacker to capsize a ship at sea". This was quickly followed by the Viking Sky cruise ship having its engines shut off due to a sensor reading.

Not knowing much about maritime control systems I brought two experts from Moran Cyber on the podcast to discuss the issue: Captain Alex Soukhanov (a Master Mariner and Director at Moran Cyber) and Greg Villano (Senior Maritime Cybersecurity Engineeer at Moran Cyber).

I went back to the RSA Conference for the first time in over a decade. Here is my 25-minute report on the event for those considering attending or participating in the future. Includes:

1) the first RSA Conferences and when cybersecurity first looked like a real market 2) tips on working the massive RSA Expo Floor

3) interview with Thomas Van Norman on the ICS Village at RSA

4) should an ICS security vendor exhibit at RSA 5) the value of side events at RSA (or any event)

I interviewed Robert Graham on the S4x19 Main Stage. We brought him to the S4 Stage for his contrarian views.

Some of the topics we discussed in the podcast:

- The downside to IoT regulation and virtue signaling

- Likely threat agents, broad not specific targets and the birthday paradox

- Does Rob expect another Stuxnet?

- Whether seat belts actually save lives and questioning controls (and can we apply this to anti-virus in ICS)

This episode of the Unsolicited Response Podcast features a discussion on the S4x19 Main Stage with Brad Hegrat, Joel Langill and Dale Peterson. The question: Is the Purdue Model Dead?

The three coalesced around an answer (unexpected). And it's not dead, but also not terribly useful going forward in helping with OT network architecture. Have a listen, maybe you will get a different takeaway.

The first Unsolicited Response episode of 2019 is a shorter solo-sode. It begins with my four major takeaways from 2018:

1. Finally figuring out the OT / IT issue

2. Consequence based risk reduction

3. Detection market acceleration and shake out

4. The ICS bane called Cyber Hygiene

And then at 10:20 in the podcast I've included my S4x19 minute mini-keynote Create The Future, with a bit of help from Patrick Miller, Eireann Leverett and Rob Lee.

Dale Peterson interviews Rob Lee of Dragos and Rob Smith of INL on a Department of Energy funded program called Neighborhood Keeper. The program attempts to provide threat detection and intelligence in an easy and affordable way to small and medium sized asset owners. It is trying to tackle the information sharing problem and the resource strain on SMB asset owners.

I’m trying something a bit different in this short 22 minute episode. I rant about two flawed ICS mantras that are gaining traction and detract from useful discussions, and there is an overview of the S4x19 agenda and OnRamp training.

1:47 Mantra: “If you are in critical infrastructure, you will be targeted. If you are targeted, you will be compromised”.

14:06 Mantra: If it isn’t secure, it isn’t safe.

In this episode I speak with Ralph Langner of Langner Communications about the ICS Product Security Market. Ralph is famous for his work on Stuxnet, and he has done a lot of great work before and after Stuxnet. For the last two years he has set aside his decades of being in the ICS Security Consulting business and focused on developing the product he feels his clients have needed.