Unsolicited Response

At S4x23 Andy Bochman gave a Main Stage performance on the OT Cybersecurity / Climate Nexus. It's a new idea and Dale wanted to dig into it and understand it better. The discussion looks at where there is a nexus/connection/overlap and where there may be parallel efforts where each side might learn from the other.

Links

Andy Bochman S4x23 Video

Slide used in this episode

Earlier episode with Dale and Andy discussing CCE

S4x24 Call For Presentations

Gus Serino worked at a large water utility before joining Dragos in 2019. We're talking water sector so it's obligatory to start with Oldsmar (2:20), but we don't talk cyber. Instead we go through the physical portion of the water system assuming the attacker is able to issue the command to the pump to dump a lot of sodium hydroxide into the water system and what would likely happen. Importantly Gus identifies the simple, unhackable solution to this threat. A hard wired PH sensor that will shut off the pump regardless of the commands from the ICS.

After Oldsmar Dale and Gus discuss:

• how small and medium water systems should approach cyber risk
• the greater challenge to large water systems
• the EPA's early steps on cybersecurity and future regulation - surprises in moving from a water utility to Dragos
• what Gus's new I&C Secure company is doing

This is a solo-sode where Dale reviews two articles from July with comments on comments and additional thoughts. The final section is a must listen if you are going to submit to speak on the S4x24 Stage. The times below are so you can skip to what you are interested in.

1:29 One-Way Data Diodes and School Zones

10:15 SAIDI: What Cyber Incidents Should Be Excluded From Metrics

16:05 Do's and Don'ts For Your S4x24 CFP Submission

Links

Subscribe to Dale's Friday ICS Security News & Notes

Info and Links for the S4x24 CFP

HD Moore is most famous for his creation of the Metasploit penetration testing framework. It began in 2003 and hit the OT world in 2011. HD is now the Founder and CTO of RunZero, another cybersecurity startup that is starting to play in the OT Space. In this episode we spend the first third of the show talking about Metasploit ... early reaction, OT modules, is Metasploit still necessary and useful today. We then shift to creating asset inventories in IT and OT, which is what RunZero does.

• Why HD decided to run back into the cybersecurity startup world?
• How it started as a solo shop with HD writing all the code.
• How HD things Shodan and RunZero are different.
• What technique does RunZero use to 'scan'. A term that many fear in OT. Check out their approach to 'fragile devices'.
• The OT reaction to this type of scanning.
• What role uses the RunZero product?

Links RunZero website S4x24 Call For Presentations

Dale is often critical of the US Government's efforts and programs to address OT cyber risk. So it's a pleasure to highlight a program that is working.

Samantha Ravich, Chair of the Center on Cyber and Technology Innovation at the Foundation for the Defense of Democracies, joins Dale to discuss the US Department of Energy's OT Defender Fellowship Program.

They begin by describing the program, its goals, what are ideal candidates for the program, and the early results from the first few cohorts. Then Timothy Pospisil of Nebraska Public Power District and part of the 2022 OT Defender Fellowship cohort joins the show to discuss his experience in the program.

At the end we discuss how this could be expanded to address water, critical manufacturing and other sectors.

Link

OT Defender Fellowship Program

Eric Cosman had a 38 year career at Dow Chemical, was on the ISA 99 committee its inception, and then he retired. After retirement Eric joined ARC Advisory Group as a Contributing Consultant and got even more active with ISA. He is a long time co-chair of ISA99 and was President of ISA in 2020. Eric and Dale discuss:

• Dow's in house developed DCS and SIS: MOD
• Eric's top trend from 2022: The value of open automation and the Open Process Automation Forum
• ISA/IEC 62433
• Eric's view they are "primarily engineering standards"
• What Eric thinks about the safety / security analogies
• His experience in being ISA President in the first year of COVID
• ISA as "the home of automation"
• Has ISA lost mindshare on ICS security standards to the US Government and training to SANS

Mark Hyman of Verge Management Group joins Dale to discuss the big 3 stories of Q2 along with their win, fail and predication.

Big Stories

1. The OT Security Layoffs (Mark is a recruiter specialized in ICS/OT security)
2. Still No US National Cyber Director?
3. The Merck NotPetya Insurance Claim Ruling

Plus they both have a win, fail and prediction at the end.

Josh Corman is the VP of Cyber Safety Strategy at Claroty, was the Chief Strategist of the CISA COVID Task Force, and founder of I Am The Cavalry. Josh and I dive into Healthcare Security, SBOMs and other topics.

• Can OT in healthcare be treated in a similar way as the factory, power plant, water treatment plant, ... ?
• The first fatality due to a cyber attack on a hospital.
• Should we be focusing our efforts on reducing the impact if ransomware hits a healthcare facility? What is the equivalent to a steel reinforced cockpit door?
• The PATCH Act (included in the Omnibus bill passed in Dec 2022) requiring medical device manufactures to provide a SBOM and a patching program. What is it? What will be the impact of this? (BTW, Josh changed my mind on this as a start to a long term impact)
• Will the PATCH Act provisions delay approval of medical devices?
• How accurate and complete are vendor generated SBOMs today? How will this be solved?
• What will be the impact of SBOM mandates?
• Differing views on the importance to society of attacks and outages in the agriculture / food industry
• I Am The Cavalry turns 10.

We will need to have Josh back for a Part 2.

This episode is a replay of a lively panel from the Cyber Security Agency of Singapore's OT Cybersecurity Expert Panel (OTCEP) last year. It begins with a great introduction to the Top 20 Secure PLC Coding Practices by Sarah Fluchs. At the 35 minute mark the panel discussion begins. There was a lot more disagreement and back and forth than the typical panel. This gives you a variety of points of view and positions to consider.

Paul Griswold moderated the panel of Dr. Ong Chen Hui, Joel Langill, Sarah Fluchs and Dale Peterson.

Links

• Top 20 Secure PLC Coding Practices
• 2023 OTCEP Event Page, August 22 - 23 in Singapore
• S4x24 Call For Presentations

How much does a security control reduce cyber risk? What control or mix of controls provides the most efficient cyber risk reduction? Tough questions that a team of researchers at INL and Sandia tried to answer in a project.

Two of the researchers, Jay Johnson of Sandia and Jake Gentle of INL, join Dale on the show to talk about the metrics and results. The project was Cyber Resilience for Wind Installations, but the metrics and results are applicable to every sector. We get into the weeds on this episode and discuss:

• how they created the test environment
• the two attack scenarios (and why only two and how easy it would be to expand)
• the physical resilience score
• the cyber resilience score
• the results from four different mixes of security controls
• areas for further testing and improvement
• and a tiny bit about trying to calculate an Expected Benefit from Cybersecurity Investment, which is a bit like ROI and how much money to spend.

Links

• Video: https://www.youtube.com/watch?v=bBLbLUFKzIc

• IEEE Access Journal Paper: https://ieeexplore.ieee.org/document/10043706

• POWER magazine article: https://www.powermag.com/cyber-resilience-for-wind-power-installations/

• 2-page flyer: https://www.researchgate.net/publication/367074443_Cyber_Resilience_for_Wind_Installations_A_Cyber_Resilient_Reference_Architecture

• Final project report: https://www.researchgate.net/publication/368599508_Hardening_Wind_Energy_Systems_from_Cyber_Threats-Final_Project_Report