Unsolicited Response

Kelly joins Dale to discuss her new book Security Chaos Engineering: Sustaining Resilience in Software and Systems. Kelly points out the second part of the title is the most descriptive, and she is not a big fan of the Chaos term that has taken hold.

They discuss:

• A quick description of Security Chaos Engineering
• Is there similarity or overlap with the CCE or CIE approach?
• The value of decision trees
• Her view of checklists of security controls like CISA's CPG
• Lesson 1 - "Start in Nonproduction environments"
• The experiment / scientific method approach and how it can start small
• The Danger Zone: tight coupling and complex interactions
• How should ICS use Chaos Engineering

Don Weber joins Dale Peterson to describe his IACS STAR Methodology to score the risk of a vulnerability to an ICS (or IACS in 62443-speak). It is a modification of the OWASP Risk Rating Methodology. Don has modified some of the 16-factors to create IACS STAR. The methodology and code is available on GitHub and a calculator is available on line.

Don and Dale discuss:

• What Don likes about the OWASP Risk Rating
• Potential issues with putting numbers to SME judgment
• Differences between IACS STAR and the OWASP Risk Rating
• The weighting of the 16 factors
• The future of IACS STAR

Links

Slides Discussed In The Show: https://dale-peterson.com/wp-content/uploads/2023/10/IACS-STAR.pdf

IACS STAR GitHub Repo: https://github.com/cutaway-security/IACS_STAR_Methodology

IACS STAR Calculator: https://iacs-star-calculator.com/iacs_star_calculator.html

Cutaway Security Website: https://www.cutawaysecurity.com

ICS-Patch Decision Tree: https://dale-peterson.com/wp-content/uploads/2020/10/ICS-Patch-0_1.pdf

Dave Whitehead, CEO of SEL, joins Dale on the show to talk about:

• The new SEL printed circuit board (PCB) factory in Idaho. Why they bucked the trend and did this. The benefits, the ROI, and more.
• SEL's position on providing SBOMs to customers and their internal use of SBOMs - Where leaders tend to go wrong.
• Substation shootings
• Market acceptance of SEL's Blueframe virtual platform

Links

• Dave Whitehead's previous appearance on the Unsolicited Response Show
• Want to advertise on the Unsolicited Response Show in 2024?

Dale and Nicole Sundin of Axio discuss CRQ, how to deal with the precision challenge, Axio's prioritization of impact, ransomware on IT affecting operations as an example, and more.

They also discuss UX and the single pane of glass.

Links

Axio web site

Former Congressman and Presidential candidate Will Hurd is a rarity with a tech background in someone who was elected to the US Congress, and even rarer in someone running for President. Will graduated Texas A&M with Computer Science degree. Worked as a Senior Adviser to the cybersecurity company FusionX, which was acquired by Accenture. More recently he was on the board of OpenAI.

This is probably one of the most technical interviews with a Presidential candidate you will hear. Dale asks Will:

• How he would rate CISA's performance (he co-sponsored the bill to create CISA)?
• Does the Executive Branch have the authority required to secure critical infrastructure?
• His views on Cyber Command / DoD policy of "defend forward"?
• The current level of Congress's technical literacy?
• What type of cybersecurity legislation, if any, Congress should pass?

Patrick Miller of Ampere Industrial Security joins Dale to discuss the three big stories of the quarter and give their win, fail and prediction.

Stories

1. US National Cybersecurity Strategy Implementation Plan + CISA 2024-2026 Strategic Plan
2. The cybersecurity / OT cybersecurity vendor market news. We just had Cisco buy Splunk, plus the Dragos "extension", and SCADAfence selling to Honeywell. Seems like some tough times.
3. Ransomware again … Port of Nagoya, Clorox, hospitals, CISA Ransomware Vulnerability Notification Service

Links

• S4x24 Ticket Sales
• Ampere Industrial Security
• Critical Assets Podcast

Dale Peterson was recently interviewed by Jay Johnson of Sandia and Tom Tansy of the Sunspec Alliance as part of their distributed energy resources (DER) Sunspec webinar series. We covered a lot of issues and Dale was not shy in throwing out some analysis and opinions. After 5 minutes discussing the S4x24 ticket process, the topics discussed:

• How DER will deal with the complex, large number of users and stakeholders PKI environment.
• The Sunspec device security specification and the benefits of a limited, key set of security controls.
• What is the role of government regulation to solve DER security issues?
• The potential power of the utility companies to levy requirements and be a choke point for access.
• The Patch Act, FDA and DER.
• shift left and product liability due to security flaws
• and more

Marina Krotofil recently published the paper Industrial Control Systems: Engineering Foundations and Cyber-Physical Attack Lifecycle which is a detailed paper on cyber attacks that cause a physical impact on the system being monitored and controlled. It took Marina 1.5 years to write this paper, which is more accurately described as a short book. We discuss:

• the work she is doing to help Ukrainian critical infrastructure security during wartime
• what got Marina interested in cyber-physical security 10+ years ago
• the current understanding of cyber-physical in the OT security community
• Chapter 2: Engineering Foundations as a great intro for those in IT to understand basic automation principles
• Chapter 3: Very detailed explanation of a specific process (we don't spend much time on this)
• The Cyber-Physical Attack Lifecycle with emphasis on the Damage Loop. "Plant shutdown is risky for the attacker as it may instigate an investigation"
• Chapter 4.6 is a great conclusion

Steve Springett is the Chair of the OWASP CycloneDX Core Working Group. CycloneDX is one of the two main machine readable formats that SBOMs are being created in, although CycloneDX can capture all sorts of BOMs.

In this episode we assume listeners know what a SBOM is and why it might be desired by a vendor and asset owner. The beginning of the show we cover some basics of CycloneDX

If you know the basics, skip to 14:24 where we get into the details

• Statistics on who is generating and using CycloneDX SBOMs, and the impact of governement regulations on the use.
• Steve's view of the NTIA Minimum Elements for SBOM v. CycloneDX elements.
• How CycloneDX tries to capture the completeness of and confidence in the SBOM.
• The naming problem. CPE, CVE, NVD, SWID, PURL and more. Steve describes the problem and what he thinks is the way forward.
• Vulnerabilities ... and why Steve thinks VEX is a missed opportunity.
• Outdated component analysis (this could be very useful in a procurement decision)
• and more

Links

CycloneDX document: Authoritative Guide To SBOM

ICS-Patch (what to patch when in ICS / risk based decision tree)

S4x24 CFP