The Industrial Security Podcast

The IEC 62443 security standards are evolving. Eric Cosman, co-chair of the ISA SP-99 committee that creates the 62443 standards joins us in this episode. Eric looks at how experience using the 62443 standards is driving change in a number of key areas.

"Lenses" are preconceived notions that limit our ability to evaluate and accept solutions. Dr. Art Conklin from the University of Houston joins us to look at lenses in industrial security and what to do about them.

Change is a risk in industrial operations, but at least on the security side of things, rapid change is the order of the day when connecting an acquisition to a new owner's infrastructures. Anthony Morrone and Marianne Swarter of Level5Cyber join us to look at issues and solutions for mergers, acquisitions and divestitures of industrial operations.

Vulnerability handling costs a lot of time and effort - finding the announcements, evaluating them, comparing to our systems, planning & managing deployment and more. Jens Wiesner of the German BSI joins us to explore a new standard that promises to automate much of this task - the Common Security Advisory Framework.

Ernie Hayden joins us to walk through the big picture of risk assessment as documented in his new book - Critical Infrastructure Risk Assessment. The book is a "how-to" for assessing risks ranging from hurricanes to safety systems to cyber attacks.

OT / industrial cyber risk is tricky. Ask questions about probabilities like we did 10 years ago and you get answers that just don't work well. Mark Fabro, President & Chief Security Scientist at Lofty Perch joins the podcast to look at the modern way to model risk.

Maritime systems are unique in some senses - eg: both having safety critical aspects and being reliant on wireless satellite communications. But these systems are familiar too - PLCs, HMIs and remote access. Marco Ayala, Director of ICS Security at 1898 & Company walks us through the space.

No one person has all the answers. Bill Lawrence, CSO at SecurityGate.io joins us to look at industrial risk assessments in modern, complex environments.

EnergySec is working with colleges & others on the world's first industrial security apprenticeship program. Join Steve Parker, president of EnergySec to see why electric utilities cannot hire the people they need, and what's being done to fix that.

A tool for more secure layer 1 devices is available - The Top 20 Secure PLC Coding Practices. Sarah Fluchs and Vivek Ponnada, two leaders of the initiative, join us to talk about the practices and how to use them.

''Repost (sound problems repaired) Explore how to work with boards of directors on industrial security issues with Level5Cyber industry veterans Anthony Morrone (former CISO @ DuPont) and Michael Piccalo (former Director @ Forescout)

Commodity vs specialty chemical manufacturing is different in kind, not just quantity. Sameer Koranne, Global OT Lead for IBMs X-Force incident response team talks about manufacturing, safety and security. https://www.ibm.com/security/services/ibm-x-force-incident-response-and-intelligence

In boxing, amateurs get hit and go down. Professionals get hit and keep fighting. Join us as Ofir Hason of CyberGym explores how to turn entire organizations from amateurs into professionals when it comes to cyber attacks.

The new cyber rules for sites in Israel handling hazardous materials are the strongest in the world. Join Yosi Shavit, Head of the ICS Cybersecurity Department in Israel's Ministry of Environmental Protection to see what's new and different.

Encryption is everywhere, but making it work in industrial settings is harder than it looks. Join Sam Elsner, Senior Manager for the Kepware-focused applications engineering team at PTC to do the deep dive on how modern systems are connected and encrypted.

Measuring future security costs is easier than measuring today's security benefits. Donovan Tindill, Senior Cybersecurity Strategist at Honeywell Connected Enterprise joins us to explore how to manage industrial cybersecurity spend over the life of industrial automation projects.

Yosi Shneck, long, time CSO at Israel Electric Company, talks about his experience leading cybersecurity efforts in a very difficult threat environment, and about Israel Electric's new initiative to share the company's expertise with other utilities and industrial enterprises.

Sarah Freeman at Idaho National Laboratories and co-author of the new book Countering Cyber Sabotage joins us to discuss the CCE methodology, attacker requirements and "unhackable" mitigations.

So very much about mining and about automation in mining is about safety. Greg Jones, an industrial security specialist at PPLTEK takes us through some unique physical processes and security challenges.

The SolarWinds supply chain breach is arguably the biggest hack in history. OSIsoft's Security Architect, Bryan Owen, joins us to explore the breach and what it means for industrial security.

Like civil engineers building bridges, security engineers should have quantitative goals: How secure must the system be when commissioned? (How much load must the bridge carry?) How long must the system maintain that security level without major maintenance? (How long must the bridge carry that load reliably between major repairs?) Join Terry Ingoldsby to explore the science of security.

CIP-013 is intended to reduce supply chain risks. What are the rules? What are they costing? Are they working? Dr. Joseph Baugh, Managing Consultant at Guidehouse joins us to explore CIP-013, the executive order and other timely NERC CIP topics.

Ed Amoroso of Tag Cyber, former CSO of AT&T talks about the IT perspective & approach for OT security - where to start and what to watch for.

There are those who say that "Industrial" and "Cloud" and "Security" really don't fit together - but is this really true? Our guest today is Andrea Carcano from Nozomi Networks explaining how cloud-based security systems really do improve industrial and IoT security.

Markus Braendle, head of Airbus Cybersecurity, and Falk Lindner, lead architect for Industrial Cybersecurity at Airbus Manufacturing join us to talk about industrial security monitoring and management at one of the most complex industrial enterprises on the planet.