Unsolicited Response

Some quick info on the release of S4x22 content and then my weekly article published on 24 April 2022.

Links:

S4x22 Video Release Schedule

David White, Co-Founder and CEO of Axio, joins Dale on the Unsolicited Response show to discuss cyber risk quantification. Axio makes the bold statement, "Quick time to value: quantify risk in hours not months; board reports readily available in minutes".

Dale digs in on their approach do to this, how they deal with the likelihood challenge, and how the process differs for OT as opposed to IT. The issue of deciding where to put the next dollar is a thread through the entire conversation.

They finish talking about how risk questionnaires and other methods will be used by the cyber insurance industry today and in the next 3 - 5 years.

Dale Peterson's guest on the Unsolicited Response show is Sergio Caltagirone, VP of Threat Intel at Dragos.  

• What is good threat intel?
• How does threat intel "reduce harm by reducing operational meantime to recovery"?
• Should an asset owner care about the various threat actors named by Dragos, Mandiant and others?
• Does it matter if it was Petrovite or Erythracite?
• Why are the top recommendations in Dragos and other threat intel annual reports the typical, same as they always are, recommendations? What is the value if this is the case?
• What does an asset owner need to have in place to make use of threat intel?
• How does threat intel deal with the fact we are very bad at calculating or predicting likelihood?
• Why did you feel the new Journal of Threat Intelligence and Incident Response was needed?

Links:

• Dragos 2021 Year In Review
• Webinar with Sergio on 2021 Year In Review
• Sergio's Threat Intel Class at the Threat Intelligence Academy
• S4x22, April 19-21 in Miami South Beach

My weekly article originally published on 15 March 2022.

Dan Geer and Olav Lysne join Dale Peterson to discuss Cyber Nationalism and how this will affect ICS asset owners and ICS vendors should and will deal with increased pressure by nation states to insert back doors and other weaknesses in ICS.

• Why would a vendor even consider cooperating with a government asking for a special favor?
• What are some of the different levels of cooperation?
• The benefits of deniability, and what is the likely business impact if the vendor is caught.
• How is a global vendor to deal with multiple knocks on the door from competing 'teams'. Does the vendor need to pick a side?
• How should asset owners view a solution from a vendor coming from a different 'team'? Should they assume there is a way the team could compromise their system?

Dale Peterson's weekly article suggests we develop a list of actions to take when the threat has a significant increase. He provides some examples of what should and should not be on that list.

Subscribe to Dale's ICS Security Friday News & Notes

Chris Sistrunk joins Dale Peterson to discuss the month's big 3 stories.

1. Urkraine from an ICS preparation standpoint.

2. DHS's new Cyber Safety Review Board

3. What to take from ICSsec vendor annual / semi-annual activity reports

Plus wins, fails and predictions.

My weekly article originally published on 2/22/22.

Two cyber insurance underwriters, Monica Tigleanu of Munich Re and Paul Gooch of Tokio Marine Kiln, join Dale Peterson on the Unsolicited Response show to talk cyber insurance.

Most of the episode discusses exclusions. Recently we had the high profile ruling that Merck's property policy in fact covered NotPetya losses because there was not a cyber exclusion statement.

The more interesting and important discussion is around the four recommended exclusions related to cyber war for cyber insurance policies that Lloyd's Market Association issued. These will likely by used by many in the Lloyd's syndicate and will affect other insurers. We look at the language around cyber operations, attribution, and other key terms.

Then the last part of the podcast talks about how insurers will be looking to set cyber insurance rates. How do they determine the cyber security posture of a potential insured.

It's an area that cybersecurity pro's in OT, and IT, need to understand better if they are part of cyber risk discussions.

Links

Merck's NotPetya Insurance Claim

Lloyd's Market Association Cyber War Exclusions

Dale's ICS Security: Friday News & Notes

My weekly article suggests that Level 0 / 1 monitoring and detection vendors should pivot to process variable anomaly detection.

Subscribe to my ICS Security - Friday News & Notes