Unsolicited Response

Dale Peterson interviews the ICS Detection Challenge Winner - Claroty and the runners up - Nozomi and Security Matters. They discuss where the competitors did well, how the products are likely to improve in the future, and what the future direction of the ICS product detection category is likely to be.

The ICS Detection Challenge at S4x18 last January pitted Claroty, Gravwell, Nozomi and Security Matters in a competition to determine who could create the most complete asset inventory and who could do the best job detecting attacks through passive ICS network monitoring only. 

Dale Peterson and Eric Byres discuss the packets used in the test and analyze the results. What this product category can and cannot do. The last 15 minutes talking about the future of the ICS Detection product category.

After quickly agreeing that vulnerabilities in medical devices & software are dense, Dale Peterson and Josh Corman discuss where time and money should be spent on improving Medical Sector cybersecurity. Does the find and patch vulns make sense when the vulns are dense? Why does a hospital shut down for a week when a single application has an exploited vuln? How is the FDA doing in forcing change? What can we expect in the future. This and more in this episode.

I had the pleasure of interviewing Dan Geer on the S4x18 Main Stage for 30 minutes. He typically speaks from prepared papers, so an interview is a bit unique, and his papers provided plenty of topics and questions.

We covered a wide range of issues including how complexity and dependencies impact risk, silent failure, "different redundancy", the value of patching based on vulnerability density, and much more.

Dale Peterson talks about the 2018 plans for this podcast, S4 and his consulting in this shorter 13-minute episode. He also talks about Digital Bond alumni spread throughout the industry and how this is likely the best time in ICS security for career opportunities and the opportunity to make a difference.

This episode is a bit different. Rob Lee of Dragos & I have been having a friendly argument on a number of topics:

(1) the true risk of a cyber attack on the electric sector

(2) the value, or lack thereof, of the ICS Detection Challenge that will take place at S4x18

(3) how an asset owner should evaluate ICS detection solutions

(4) whether or not most ICS detection solutions are doing behavioral analytics

(5) the value & accuracy of ICS threat information

An interview with Harry Paul of OSIsoft on how they have improved the Bandolier Security Audit files in what they call the PI Security Audit Tools. They have moved them to PowerShell, created a community and put them on GitHub, expanded them to additional PI applications, integrated into their deployment processes. We talk about how their customers are using them, the future of the PI Security Audit Tools, and close with some hints for those competing in the S4x18 CTF.

This is a shorter episode on the ICS Capture The Flag (CTF) that will take place at S4x18, Jan 16-18 in Miami South Beach. This will be the third year Reid has created and run the S4 CTF, and we talk to him about: 1) What makes the S4 ICS CTF different than other ICS CTFs and ICS Villages 2) Flag examples from 2017 3) Tips on preparing to compete in the S4x18 CTF 4) CTF team composition and strategy 5) Why to visit the CTF even if you are not playing.

Adam Crain has been a regular on the S4 stage talking about securing ICS protocols, and we are finally getting to secure ICS protocols. We discuss fuzzing ICS protocols, wrapping protocols in TLS vs new secure protocols, quantum key distribution, and key / certificate management challenges. The key management discussions starting at 27:15 is the highlight for me.

This month we announced the ICS Detection Challenge, that will take place at S4x18, https://s4x18.com. In this podcast I speak with Eric Byres, who is helping me put together the challenge along with John Cusimano of aeSolutions. We talk about

- the 5 contestants and those that have declined to participate

- what we hope the Challenge will show and accomplish

- the scoring

- the delivery of the packets

- requests for help

- and more