Chris Blask has a long career bringing new ideas to reality. He currently is Vice President of Strategy at Cybeats, who has a SBOM Studio product.

Cybeats is different in that SBOM Studio does not create SBOMs. This requires SBOMs to be available from somewhere, and Dale & Chris spend a lot of the podcast talking about the SBOM market today and in the future.

• What percentage of the OT software solutions have SBOMs today? What will that number be in three years, five years, seven years?
• When will the top 10% asset owners be able to be get value worth the effort from SBOMs and related tools and information?
• What will the SBOM marketplace look like?
• the DBOM.io project

Of course being Dale and Chris, they deviate into a lot of other topics. Such as Chris's quotes:

• "Security comes through transparency and automation"
• "2020, this is the last decade of cybersecurity" "the last decade when entirely new fields will be discovered" I think we have covered the field.

The August 2021 Unsolicited Response episode with Edgard Capdevielle, CEO of Nozomi Networks, was a fan favorite. So Dale invited Edgard back, like the first time it was a wide ranging and fun conversation. His budget analogy of OT security and a new child in the family was Dale's favorite part.

They cover a lot of ground including:

• the OT visibility and detection market growth in the last two years
• whether he stands by his 2021 view that a company that does "X, Y, Z and OT security" doesn't really do OT security
• how much of the back end (non-sensor) part of the market is moving to the cloud now and what will it be in three years. Plus some disagreements / discussion on architecture
• budget muscle and momentum
• what sort of metrics should an asset owner use to determine the value of these OT visibility and detection solutions
• how is the US Government affecting the market Enjoy!

Dale Peterson interviews cybersecurity legend Gene Spafford on the S4x23 Main Stage. Some of what they cover is:

• how to deal with securing legacy systems
• the incredibly productive 3 years of firsts including host IDS, network IDS, honeypot, network vulnerability scanner, and more. What led to this amazing production?
• The upcoming 25th year of CERIAS
• His new book Cybersecurity Myths and Misconceptions ... Avoiding the Hazards and Pitfalls that Derail Us and digging into some of those myths (Cyber Offense is Easier than Defense, Sharing More Threat Intel Will Make Things Better, Everyone Should Solve A Given Cybersecurity Problem In The Same Way)

Marty Edwards joins Dale Peterson to discuss the big stories of the first quarter of 2023.

• The US National Cybersecurity Strategy
• ISA / ISASecure starting an OT Site Assessment Certification
• Ransomware Affecting Operations (indirectly)

Marty and Dale then give their win and fail for Q1 and a prediction.

Dale Peterson talks with Matt Wyckhouse, Founder and CEO, of Finite State about where the SBOM products and market is today and where it will go in the future. This discussion was informed by the SBOM Challenge at S4x23.

• Who is the primary buyer of SBOM products and services today? (Hint: Matt thinks that 80% of the code in a product is third party)
• How accurate are the products, and the Finite State product in particular, in creating a SBOM?
• How much is the value of a SBOM degraded if it is not perfect? If it is missing software or has inaccuracies?
• Are the offerings now a product? A semi-custom service that uses a developed product? (with an apt comparison to the detection market)
• What will the US Government do with all these SBOMs if they actually get them? If they get an exponential increase in software inventory and the patching and cyber maintenance burden.
• Will there be a separate/distinct OT SBOM market? Will there be a SBOM market in the long run or will it get subsumed in some sort of asset management market?
• Early thoughts on the SBOM marketplace (a place to collect and distribute and respond to queries on SBOMs)
• Where is the industry / products now on VEX?
• Do configuration files belong in a SBOM?
• Surprise data points from the SBOM Challenge

Dale Peterson interviewed Puesh Kumar on the S4x23 Main Stage. Puesh is the Director of the US Dept of Energy's Cybersecurity, Energy Security, & Emergency Response (CESER). The lead US Government OT cybersecurity agency in the energy sector.

After Puesh gives a 3 minute overview on CESER, they dig into it.

• How are they measuring CRISP's detection and analysis progress? Has it stopped or limited the impact of any attacks?
• What is one of the CESER programs that didn't work and what did they learn from it?
• Why is the US Government testing products for GE, Hitachi and other large companies and questioning the results.
• The push for Cyber Informed Engineering and what success looks like
• Competing with industy
• and more ... CESER is tackling a lot so there was much to squeeze into 30 minutes

Steve Mustard took his 30 years of experience and wrote Industrial Cybersecurity: Case Studies and Best Practices, published by ISA. After talking about who the book is for and the writing process, Dale and Steve dig into the details.

Given Steve's longtime involvement and leadership with ISA, it's not surprising the book leans heavily on ISA/IEC 62443. They talk chapters on architecture, certification, optimism / pessimism, risk management and a fundamental misunderstanding of IT by OT. Some agreement, some disagreement, and always a civil discourse.

Dale's interview with Michael Fischerkeller, co-author of the bood Cyber Persistence Theory. The first half of the interview digs into Cyber Persistence Theory.

• Why Michael believes cyber is a new and third strategic environment (in addition to conventional and nuclear)
• What is meant by cyber being an environment of exploitation and not coercion
• The theory's different use of initiative and why the theory believes it is the important element to winning ("initiative rather than restraint is necessitated")
• How a series of smaller, fait accompli, actions that are not responded to can have a strategic-level cumulative effect

The second half of the interview looks at what the world will look like and what asset owners should do if multiple nations believe in and act on this Cyber Persistence Theory.

• Michael argues it already is in place and the US is late to the game
• Persistence presence in critical infrastructure would not "cross the threshold"
• How organizations will reach a cyber agreed competition
• Will this be escalatory (Michael says no)

Dale believes this is an incredibly important theory to understand because it is taking hold in the world's major powers.

Links

Cyber Persistence Theory book

Matt Morris and Mark Mattei of 1898 & Co. joined Dale to talk OT Managed Security Services as 1898 recently introduced an OT Managed Threat Protection and Response service. The discussion included:

• what they are monitoring in the OT environment
• the OT MSP competitive landscape (OT detection vendors, ICS vendors, large consulting vendors, ...)
• can you / should you monitor OT separate from IT
• how 1898 deals with competing partners (such as Claroty, Dragos and Nozomi) that they resell and install and competing against them for MSP
• the active response and threat hunting services and how that is accepted in the generally conservative
• and more

Bill Fehrman is the CEO of Berkshire Hathaway Energy, co-chair of the Electricity Subsector Coordinating Council, and chair of the E-ISAC.

The major topics Dale and Bill discuss include:

• The US Government / Electric Sector information sharing program around detection information and threat intel. Have they stopped or reduced the impact of attacks? What are the metrics they are using to determine if these resources are worth it?
• How is the industry and BHE positioned to recovery from a major outage due to a cyber attack? The mutual assistance agreements in the electric sector … the transformer and critical sparing programs. BHE has drills that take away technology and see if they can still deliver power.
• Who will pay for all this cyber risk reduction? Will there be rate increases due to these efforts? Does customer demand for climate change actions or security actions drive investment? Be required for investment? What does he think of the FERC incentives to get utilities to invest in security?
• Is the single point person representing the electric sector, now Bill, by design and a good idea?