After quickly agreeing that vulnerabilities in medical devices & software are dense, Dale Peterson and Josh Corman discuss where time and money should be spent on improving Medical Sector cybersecurity. Does the find and patch vulns make sense when the vulns are dense? Why does a hospital shut down for a week when a single application has an exploited vuln? How is the FDA doing in forcing change? What can we expect in the future. This and more in this episode.

I had the pleasure of interviewing Dan Geer on the S4x18 Main Stage for 30 minutes. He typically speaks from prepared papers, so an interview is a bit unique, and his papers provided plenty of topics and questions.

We covered a wide range of issues including how complexity and dependencies impact risk, silent failure, "different redundancy", the value of patching based on vulnerability density, and much more.

Dale Peterson talks about the 2018 plans for this podcast, S4 and his consulting in this shorter 13-minute episode. He also talks about Digital Bond alumni spread throughout the industry and how this is likely the best time in ICS security for career opportunities and the opportunity to make a difference.

This episode is a bit different. Rob Lee of Dragos & I have been having a friendly argument on a number of topics:

(1) the true risk of a cyber attack on the electric sector

(2) the value, or lack thereof, of the ICS Detection Challenge that will take place at S4x18

(3) how an asset owner should evaluate ICS detection solutions

(4) whether or not most ICS detection solutions are doing behavioral analytics

(5) the value & accuracy of ICS threat information

An interview with Harry Paul of OSIsoft on how they have improved the Bandolier Security Audit files in what they call the PI Security Audit Tools. They have moved them to PowerShell, created a community and put them on GitHub, expanded them to additional PI applications, integrated into their deployment processes. We talk about how their customers are using them, the future of the PI Security Audit Tools, and close with some hints for those competing in the S4x18 CTF.

This is a shorter episode on the ICS Capture The Flag (CTF) that will take place at S4x18, Jan 16-18 in Miami South Beach. This will be the third year Reid has created and run the S4 CTF, and we talk to him about: 1) What makes the S4 ICS CTF different than other ICS CTFs and ICS Villages 2) Flag examples from 2017 3) Tips on preparing to compete in the S4x18 CTF 4) CTF team composition and strategy 5) Why to visit the CTF even if you are not playing.

Adam Crain has been a regular on the S4 stage talking about securing ICS protocols, and we are finally getting to secure ICS protocols. We discuss fuzzing ICS protocols, wrapping protocols in TLS vs new secure protocols, quantum key distribution, and key / certificate management challenges. The key management discussions starting at 27:15 is the highlight for me.

This month we announced the ICS Detection Challenge, that will take place at S4x18, https://s4x18.com. In this podcast I speak with Eric Byres, who is helping me put together the challenge along with John Cusimano of aeSolutions. We talk about

- the 5 contestants and those that have declined to participate

- what we hope the Challenge will show and accomplish

- the scoring

- the delivery of the packets

- requests for help

- and more

The CyberX report is interesting because they are pulling hard data from 375 different ICS networks and some of the statistics were not what I expected. In this episode I talk with Phil Neray of CyberX about their Global ICS & IIoT Risk Report.  

We start on the data, then we dive into some of the more interesting statistics. Throughout the discussion we talk about ways the statistics could be improved for future updates of the report. I'd welcome your suggestions and will pass them along to Phil.

I had 20 minutes to interview Eugene about the US Government claims that Kaspersky software is subject to Russian Government influence and needs to be removed and not used from USG computers. As you can imagine he defends the security of his company's products and makes the case why the US Government's claims are strictly political. We also cover the Kaspersky OS and their ICS products and services.

After the interview I give my thoughts on the Kaspersky issue and cyber nationalism.