Freight and passenger rail is another industry sector that relies on ICS for safety and services. It has its own language, consequences and standards. 

In this episode, Dale Peterson speaks with Miki Shifman of Cylus. Most of the episode digs into how rail systems work and the key areas to secure. They cover the TS-50701 standard and TSA's regulations in the US, among other things.

The episode concludes with a discussion of the Cylus OT Detection product designed for rail. The big question is a sector specific focus a big enough moat to keep out the big 3 OT detection vendors.

Dale Peterson talks with Mikko Hypponen about his new book: If It's Smart, It's Vulnerable. 

As with all books, Dale asks who Mikko wrote the book for, who is the intended reader. Then they dig into some of the interesting parts for the security professional including:

• What security tasks should we expect users to do (and why security training fails)
• Whose responsible for IoT/IIoT cybersecurity? How are we going to succeed in security IoT, and what regulation might work?
• Hypponen's Law: If It's Smart, It's Vulnerable
• Cyber Deterrence
• Why have their been so few cyber attacks on critical infrastructure?

and more.

Links

• If It's Smart, It's Vulnerable book
• S4x23 Call For Presentations

Unsolicited Response Month In Review show for June 2022. This is a replay of the live episode.

This month's stories:

1. Dragos (Rob Lee/Bloomberg and Dragos OT-CERT)
2. OT:ICEFALL w/ Daniel Dos Santos
3. Dept of Energy's Cyber-Informed Engineering Strategy Document

Plus my win, fail & prediction for the month

Links:

• S4x23 Call For Presentations
• Bloomberg Article on Rob Lee
• Rob Lee's Response to Bloomberg Article
• OT:ICEFALL
• Eric Byres' Comments on OT:ICEFALL
• Dept of Energy CIE Strategy Document
• Demystifying The Myth of the 85% paper
• Google Project Zero Article
• Dick Brooks / REA Patent

Dale Peterson interviewed Richard Seiersen, author of new book The Metrics Manifesto: Confronting Security With Data.

• For security controls - what would I see that would show me it is working? How do I measure the effectiveness and efficiency of my security controls?
• Why is so much of the book code, and can the book be valuable if you don't go through the code?
• A lot of time spent on categories of metrics: burndown and survival, arrival and escapes, and wait time
• Most of the examples in the book are vuln prevention and remediation ... how will the statistics deal with increases due to SBOMs? ... how to address vulnerabilities with very different related risk?
• How to address the CISO wanting a single dashboard with OT and IT metrics with very different risk related to those metrics?
• The concept of value of / return on control and how some CISOs are dealing with cyber risk
• Using SME beliefs as data
• and a lot more

Links

• The Metrics Manifesto
• The book's site with code and other info
• Richard Seiersen's S4x18 video: How To Measure Anything In Cybersecurity Risk

Phil Venables joins Dale to discuss OT's use, today and in the future, of cloud and edge services. They focus on reliability, security and use cases. The end of the episode focuses on how leadership views security. Phil writes some of the most interesting articles on security at philvenables.com.

Check out the links below for some of Dale's recent favorites.

Defense in Depth

Resilience is about Capabilities, Not Plans

If Accounting were like Cybersecurity

Organizational Politics

Also check out the S4x23 CFP

Dale's weekly article originally published on 21 June 2022.

Debating The Pro Case: Monica Tigleanu of MunichRe Speciality Insurance

Debating The Con Case: David White of Axio

(Note - The debaters were charged with making the most compelling case for their position. In some cases this doesn't represent their views).

Links

S4x23 Call For Presenations

They cover a lot of ground including:

• What manager this course was designed for?
• Why does a course for managers need a VM and course labs
• The significant portion of the course addressing metrics. Why, what kind, for whom?
• Does it address consequence reduction, working with engineers
• What sort of team building and management advice is included
• How is the course given? Live? Online?

Links

ICS418 Course Info

This is a solosode with Dale covering the two top stories from the month plus a win, fail and prediction.

Links

• Schneider Electric SAAS on Azure for DERMS
• Emerson ZEDI for water press release.
• Dept of Transportion document on proposed fine for Colonial Pipeline.
• ICS version of Backdoors & Breaches card deck.

This is the audio from my interview with Dave Lewis, a Global Advisory CISO at Cisco, on the S4x22 Main Stage.

Dave has experience securing both IT and OT (he worked for electric utilities in Canada). Even more interesting is he talks every week with a wide variety of CISO's. 

It's a wide ranging discussion that hits a lot of different areas on how to work and communicate best with CISO's and executive management on ICS security and cyber risk.