Hack the Plant

For today’s episode, I’m joined by Lesley Carhart. Lesley is the Director of Incident Response for North America at the industrial cybersecurity company Dragos, Inc . She leads incident response and proactively hunts for threats in customers’ ICS environments. Lesley was the incident response team lead at Motorola Solutions, and retired from the United States Air Force.  Today, we dive into the ki...

For today’s episode, I’m joined by Zach Tudor, the Associate Laboratory Director at Idaho National Laboratory (INL). INL is a Department of Energy national laboratory, is the nation's leading center for nuclear energy research and development. Zach is responsible for INL’s Nuclear Nonproliferation, Critical Infrastructure Protection and Defense Systems missions. We discuss how INL partners with th...

  “One of my favorite topics is disaster resilience. We do quite a bit of work on what mutual assistance looks like and how to improve mutual assistance, how to rebuild systems once they've been hit by something terrible. My more recent interesting example was when a tornado had gone through a co-op and they were looking for what to do when their data server was just plain missing. It was Dorothy...

“What's been most concerning is the rise of wiper malware. Threat actors are no longer interested in hey we're going to lock up all of your data. We're going to encrypt everything and force you to pay a ransom and then maybe give you the decryption key. Now with wiper malware they're just completely wiping it. … This year there's been a total of 5 wiper malwares that has been targeting critical in...

“Most industrial economies only consume about 20% our total end use energy in the form of electricity. The rest, we consume by basically combusting fossil fuel … You could get all of your electricity from wind and solar and you've still only solved 20% of your carbon problem. A lot of the investments we've made at Energy Impact Partners are actually in electrification. Basically electrifying all t...

“Agriculture and cybersecurity has just run under the radar. We're talking about something that's one fifth of the us economy right? This is this is a huge deal here in the US, and globally as well …  We can begin get the right expertise and collateral assembled so we're not the next ransomware victim or we have enough resiliency built into our operations that if we get we get hit and we get smoke...

“You can only cover about 65% of the cybersecurity workforce demand with the existing workforce today. So we need to do something to address that gap. We need to either build that workforce or re-skill existing individuals that are looking to get into new fields. That's the approach that we're taking. So the need is there. We know that cyber risk is there. We know that adversaries are constantly r...

“How do we talk about all the great things we're doing in our communities, in optimizing and trying to reduce carbon, and looking at new solutions and coming up with different technologies that can help advance to help keep prices down and keep reliability up. We're really spoiled at times in the US with how often we have our power. I've had to travel on all seven continents and had times where I...

“I've been educating now for about eight years within the college system and that hands-on experiential learning is critical. When I have students do something that's like a scenario based off of different security assessments I've done or just weaving in some real world stuff, they thrive. They really get excited. They walk away from it energized.” - Dennis Skarr In this episode of Hack the Plant...

Wind energy is one of the most rapidly growing energy generation sources in the US - how can these renewable systems stay resilient in the face of cyber attacks as the industry grows? In this episode, we hear from Megan Culler and Keith Mecham of Idaho National Labs (or INL). Megan Culler is a Power Engineer and Researcher; Keith Mecham is a Critical Infrastructure Cybersecurity Engineer. INL is a...

“Initially it was looking at specific types of attacks and thinking how those could be utilized against our systems, but then it became more sophisticated in thinking of how these attacks could be coordinated together by larger actors? ….  I think that regulation's role is more to draw attention and provide you with a base minimum, and then from there, it's the responsibility of those industries o...

“We had to go out and talk to experts and just have the conversations and then be brutally honest about what those people were telling us about the problem. In many cases, we didn't even tell them what we were thinking about doing. We would call them up and say, "How are you securing your industrial control systems today?" and just listen.” - Joshua Steinman “We really learned to go in, us. Instea...

When will hard infrastructure have machine learning capabilities? It might be sooner than you think. Ariel Stern, formerly an engineer in the Israeli Ministry of Defense and a civil infrastructure project manager, currently CEO of Ayyeka, which offers remote monitoring for industrial Internet of Things (IoT) systems. Ariel has a forward-looking approach to creating resilience in critical infrastru...

On May 12, 2021, the Biden Administration issued an Executive Order “On Improving the Nation’s Cybersecurity.”  This came in the wake of  ransomware attacks drawing national attention: Solar Winds, Colonial Pipeline, and more. We take a deep dive into the Executive Order, and what it means for public and private efforts to keep our critical infrastructure safe with two attorneys and cybersecurity...

In February, severe winter storms and an electricity generation failure left almost 5 million people in Texas without power, leading to hundreds of deaths, and a shortage of heat, food and water. The Electric Reliability Council of Texas (ERCOT) manages the flow of electric power to more than 26 million Texas customers. How did the massive power failure happen? What does this power outage suggest...

Daryl Haegley is the Director of Cyberspace Mission Assurance and Deterrence at the Department of Defense. Daryl oversees cybersecurity efforts to secure control systems (ICS) and operational technology (OT), and focuses on bringing awareness to the ever-increasing cyber threats. He has 30 years of military, civilian and commercial consulting experience. He has successfully advocated to change law...

Congressman Mike Gallagher (R-Wis.) has been instrumental in setting up the Cyberspace Solarium Commission, a bipartisan, intragovernmental body whose goal is to help create a strategic approach to defending the United States from cyber attacks of significant consequence (and for listeners of this podcast, that definitely means attacks on our critical infrastructure). Congressman Gallagher's backg...

Rob Lee, the CEO and founder of the industrial cybersecurity company, Dragos, is a pioneer in the ICS threat intelligence and incident response community. Before Dragos, Rob served as a cyber operations officer in the U.S. Air Force tasked to the National Security Agency, helping protect industrial infrastructure - an issue that leaders around the world are now wrestling with. As he likes to put i...

The Army Cyber Institute has been testing the cybersecurity preparedness of cities around the country in an experiment called Jack Voltaic. It is a major, multi-sector public private exercise aimed at understanding critical infrastructure dependencies on force deployment. We're joined by Lt. Col. Douglas Fletcher - chief data scientist - and Lt. Col Erica Mitchell - key resources research lead for...

For today's episode, I'm joined by Dale Peterson, who is on the leading edge of helping security conscious asset owners in a range of sectors effectively manage and reduce cyber risk to their Industrial Control Systems (known as an “ICS”). ICS is a computer system that monitors or controls a physical process. They  exist everywhere: power generation, water supply systems, transmission, product man...

Megan Samford is the first woman Chief Product Security Officer in industrial control systems (ICS) manufacturing. She's spent time in both the private and public sectors, from Rockwell Automation and General Electric to serving two governors of Virginia and their offices of homeland security. She is also spearheading a project to develop a common language and framework for cyber security between...

Patrick Miller sits at the intersection of cybersecurity and regulation because, as he likes to say, "those two don't fit well." Beyond his decades of work in the space, he also co-founded BEER-ISAC, a network of individuals who comprise the human component of critical infrastructure security. They share war stories, information, intelligence and - as the name says - drinks. In this episode, Patri...

"Securing and having the right measures of cybersecurity relates to the national security of the whole country and our national income." Reem Al-Shammari is the chief information security officer for the Kuwait Oil Company. She sits at the intersection of a massive swath of her country's economy - oil and gas - and the need to secure it against emerging threats faster than government regulations c...

The second half of our interview with author and strategist P.W. Singer. He discusses his latest book - Burn In - where he translates real-world research about Artificial Intelligence into a glimpse at a future we’re not too far away from if things go wrong and we do not protect ourselves. "In our lifetime for the next year 10 or 20 years, artificial intelligence is not about a rebellion of the ro...

Hackers may be our best, last hope as our dependence on connected technology is increasing faster than our ability to safeguard ourselves. This episode you will learn about I Am the Cavalry - a volunteer organization of cybersecurity experts devoted to improving the security of medical devices, transportation, connected homes, and infrastructure - and its co-founder, Joshua Corman, who serves as a...