Unsolicited Response

Ralph Langner, Megan Samford and Zach Tudor join Dale Peterson on the S4 Main Stage to close out S4x23. This Closing Panel is always an attendee favorite as none of these four are afraid to take a strong and even unconventional stance on at OT security topic or issue.

Dale Peterson interview CESER Director Puesh Kumar on the S4x23 Main Stage. We discuss a number of CESER programs how they are measuring success, what has not worked, why they are doing some things industry is already doing and more.

5:30 Where is the CESER CRISP program (detection and information sharing) today? Has it stopped or reduced the impact (outages and others) of cyber attacks on the electric sector? How will they measure the success of this program?

10:40 What has CESER tried, thought it would work, and ended up failing?

14:05 CESER's CyTRICS program is testing vendor equipment? Why, does GE and Hitachi need help? And the results have been trivial vulnerabilities that could be found in hours. Why is CESER spending millions on this?

19:25 Cyber Informed Engineering (CIE) is it the same as Secure By Design? This is a long process, what will the early wins look like? Two years from now how will we know if we are succeeding? Maintaining a manual capability dominated the examples in the document, why hasn't this been highlighted in the program? How can we accelerate this?

25:20 Clean Energy Cyber Accelerator is looking at solutions (OT detection and MFA remote access to OT) that are well established with vendor offerings and asset owner deployments. Why is CECA doing this and trying to accomplish?

Chris Blask has a long career bringing new ideas to reality. He currently is Vice President of Strategy at Cybeats, who has a SBOM Studio product.

Cybeats is different in that SBOM Studio does not create SBOMs. This requires SBOMs to be available from somewhere, and Dale & Chris spend a lot of the podcast talking about the SBOM market today and in the future.

• What percentage of the OT software solutions have SBOMs today? What will that number be in three years, five years, seven years?
• When will the top 10% asset owners be able to be get value worth the effort from SBOMs and related tools and information?
• What will the SBOM marketplace look like?
• the DBOM.io project

Of course being Dale and Chris, they deviate into a lot of other topics. Such as Chris's quotes:

• "Security comes through transparency and automation"
• "2020, this is the last decade of cybersecurity" "the last decade when entirely new fields will be discovered" I think we have covered the field.

The August 2021 Unsolicited Response episode with Edgard Capdevielle, CEO of Nozomi Networks, was a fan favorite. So Dale invited Edgard back, like the first time it was a wide ranging and fun conversation. His budget analogy of OT security and a new child in the family was Dale's favorite part.

They cover a lot of ground including:

• the OT visibility and detection market growth in the last two years
• whether he stands by his 2021 view that a company that does "X, Y, Z and OT security" doesn't really do OT security
• how much of the back end (non-sensor) part of the market is moving to the cloud now and what will it be in three years. Plus some disagreements / discussion on architecture
• budget muscle and momentum
• what sort of metrics should an asset owner use to determine the value of these OT visibility and detection solutions
• how is the US Government affecting the market Enjoy!

Dale Peterson interviews cybersecurity legend Gene Spafford on the S4x23 Main Stage. Some of what they cover is:

• how to deal with securing legacy systems
• the incredibly productive 3 years of firsts including host IDS, network IDS, honeypot, network vulnerability scanner, and more. What led to this amazing production?
• The upcoming 25th year of CERIAS
• His new book Cybersecurity Myths and Misconceptions ... Avoiding the Hazards and Pitfalls that Derail Us and digging into some of those myths (Cyber Offense is Easier than Defense, Sharing More Threat Intel Will Make Things Better, Everyone Should Solve A Given Cybersecurity Problem In The Same Way)

Marty Edwards joins Dale Peterson to discuss the big stories of the first quarter of 2023.

• The US National Cybersecurity Strategy
• ISA / ISASecure starting an OT Site Assessment Certification
• Ransomware Affecting Operations (indirectly)

Marty and Dale then give their win and fail for Q1 and a prediction.

Dale Peterson talks with Matt Wyckhouse, Founder and CEO, of Finite State about where the SBOM products and market is today and where it will go in the future. This discussion was informed by the SBOM Challenge at S4x23.

• Who is the primary buyer of SBOM products and services today? (Hint: Matt thinks that 80% of the code in a product is third party)
• How accurate are the products, and the Finite State product in particular, in creating a SBOM?
• How much is the value of a SBOM degraded if it is not perfect? If it is missing software or has inaccuracies?
• Are the offerings now a product? A semi-custom service that uses a developed product? (with an apt comparison to the detection market)
• What will the US Government do with all these SBOMs if they actually get them? If they get an exponential increase in software inventory and the patching and cyber maintenance burden.
• Will there be a separate/distinct OT SBOM market? Will there be a SBOM market in the long run or will it get subsumed in some sort of asset management market?
• Early thoughts on the SBOM marketplace (a place to collect and distribute and respond to queries on SBOMs)
• Where is the industry / products now on VEX?
• Do configuration files belong in a SBOM?
• Surprise data points from the SBOM Challenge

Dale Peterson interviewed Puesh Kumar on the S4x23 Main Stage. Puesh is the Director of the US Dept of Energy's Cybersecurity, Energy Security, & Emergency Response (CESER). The lead US Government OT cybersecurity agency in the energy sector.

After Puesh gives a 3 minute overview on CESER, they dig into it.

• How are they measuring CRISP's detection and analysis progress? Has it stopped or limited the impact of any attacks?
• What is one of the CESER programs that didn't work and what did they learn from it?
• Why is the US Government testing products for GE, Hitachi and other large companies and questioning the results.
• The push for Cyber Informed Engineering and what success looks like
• Competing with industy
• and more ... CESER is tackling a lot so there was much to squeeze into 30 minutes

Steve Mustard took his 30 years of experience and wrote Industrial Cybersecurity: Case Studies and Best Practices, published by ISA. After talking about who the book is for and the writing process, Dale and Steve dig into the details.

Given Steve's longtime involvement and leadership with ISA, it's not surprising the book leans heavily on ISA/IEC 62443. They talk chapters on architecture, certification, optimism / pessimism, risk management and a fundamental misunderstanding of IT by OT. Some agreement, some disagreement, and always a civil discourse.

Dale's interview with Michael Fischerkeller, co-author of the bood Cyber Persistence Theory. The first half of the interview digs into Cyber Persistence Theory.

• Why Michael believes cyber is a new and third strategic environment (in addition to conventional and nuclear)
• What is meant by cyber being an environment of exploitation and not coercion
• The theory's different use of initiative and why the theory believes it is the important element to winning ("initiative rather than restraint is necessitated")
• How a series of smaller, fait accompli, actions that are not responded to can have a strategic-level cumulative effect

The second half of the interview looks at what the world will look like and what asset owners should do if multiple nations believe in and act on this Cyber Persistence Theory.

• Michael argues it already is in place and the US is late to the game
• Persistence presence in critical infrastructure would not "cross the threshold"
• How organizations will reach a cyber agreed competition
• Will this be escalatory (Michael says no)

Dale believes this is an incredibly important theory to understand because it is taking hold in the world's major powers.

Links

Cyber Persistence Theory book