Pedro Umbelino, Principal Research Scientist at Bitsight Technologies, joins the Nexus Podcast to discuss his team's research into Automatic Tank Gauge (ATG) systems and how they uncovered 11 vulnerabilities in ATGs manufactured by five different vendors. 

ATG systems are an industrial control system that monitors fuel levels inside storage tanks, including those at gasoline stations, military bases, hospitals, airports, and elsewhere. ATGs track fuel levels, and are meant to detect leaks, help with inventory management, and are key in regulatory compliance efforts.

The vulnerabilities uncovered by Pedro and his team expose these systems to catastrophic risks, from environmental hazards to significant economic losses, including physical damage.

Worse yet is that these systems are old and challenging to update. 

Read Bitsight's research here [https://www.bitsight.com/blog/critical-vulnerabilities-discovered-automated-tank-gauge-systems].

Listen to the Nexus Podcast on your favorite podcast platform [https://nexusconnect.io/podcasts].

 

Pedro Umbelino on Exploiting ATG Devices in Fuel Storage

Steven Sim, Chair of the OT-ISAC Advisory Committee, joins the Nexus Podcast to catch us up on the ISAC's activities, and some of the upcoming community-driven initiatives sponsored by the group. Steven shares the processes by which member organizations share incident, threat, and vulnerability information. He also discusses how member organizations contribute and participate in discussions and events that level up the maturity of cybersecurity practices within OT asset-heavy enterprises. 

Listen to the Nexus Podcast on your favorite podcast platform [https://nexusconnect.io/podcasts].

Steven Sim on OT-ISAC and the State of Information Sharing

Cybersecurity and technology expert Sarah Fluchs joins the 100th episode of the Nexus Podcast to discuss the EU's Cyber Resilience Act [https://fluchsfriction.medium.com/cyber-resilience-act-in-5-minutes-018f43f69508] and what it means for manufacturers of "products with digital elements" as they aim toward a 2027 compliance deadline. 

Sarah provides her insight on the regulation's essential requirements, its focus on secure-by-design and overall cyber resilience of products, and the milestones manufacturers need to hit as their compliance efforts get under way. 

Sarah also discusses her thought leadership and work in bringing cybersecurity to engineers, asset operators, and other non-security teams [https://fluchsfriction.medium.com/make-the-big-decisions-with-cyber-decision-diagrams-f950b6966542]. It's important, she says, to eliminate cybersecurity's innate complexity and bring these concepts to engineers and others on their terms. 

Listen to the Nexus Podcast on your favorite podcast platform [https://nexusconnect.io/podcasts].

Sarah Fluchs on the Cyber Resilience Act

Andrew Ohrt, the resilience practice area lead at West Yost, joins the Nexus Podcast to discuss cyber-informed engineering (CIE) and how it informs engineers and asset operators to understand their role in creating and maintaining a cyber resilient organization. According to Ohrt, CIE is one of the best examples of delivering cybersecurity concepts to non-security teams, speaking to them in their language, and avoiding the often-intimidating jargon that can dominate cybersecurity discussions.

Listen to the Nexus Podcast on your favorite podcast platform [https://nexusconnect.io/podcasts].





Andrew Ohrt on Cyber-Informed Engineering

Megan Stifel, Chief Strategy Officer for the Institute for Security and Technology, joins the Nexus Podcast to discuss the four years of progress and challenges experienced by the Ransomware Task Force [https://securityandtechnology.org/ransomwaretaskforce/]. 

The RTF was created days before the Colonial Pipeline ransomware incident and in a landmark report [https://securityandtechnology.org/ransomwaretaskforce/report/], laid out 48 recommendations to the industry that included a framework for critical infrastructure organizations that could help deter and disrupt the operations of ransomware gangs. 

Stifel covers the growth of the task force and which the of the 48 recommendations have been tackled and which remain. 

Listen and subscribe to the Nexus Podcast on your favorite platform [https://nexusconnect.io/podcasts].

Megan Stifel on the Impact of the Ransomware Task Force

Security researcher Joe Slowik joins the Nexus Podcast to discuss the broad interpretation of what critical infrastructure entities are truly "critical," and how that creates an ethical wedge between protecting the well-resourced and those that are resource-strapped. 

Slowik acknowledges that while calling everything "critical" ensures that nothing is critical, serious discussions must be had about getting the most return in terms of defensive resources while recognizing the ethical dilemmas that some entities cannot be left behind because they're not as important to overall national and economic security. 

Listen and subscribe to the Nexus Podcast on your favorite platform [https://nexusconnect.io/podcasts].

Joe Slowik on Identifying Truly 'Critical' Infrastructure

Danielle Jablanski, Industrial Control Systems Strategist & Subject Matter Expert at CISA, joins the Nexus podcast to discuss her perspectives on critical infrastructure protection and government's role as a cybersecurity partner on implementation guidance and enablement. 

Danielle touches on a number of areas of CI security and protection, ranging from the challenges arising from the high percentage of private sector ownership of critical infrastructure, to the assistance available from CISA and other agencies to lesser-resourced entities in the 16 CI sectors. 

Listen and subscribe to the Nexus Podcast on your favorite platform [https://nexusconnect.io/podcasts].

Danielle Jablanski on Critical Infrastructure Protection

Schneider Electric Vice President of Supply Chain Security Cassie Crossley joins the Nexus Podcast to discuss the nuances of hardware security and the growing need for hardware bills of materials (HBOMs) within critical infrastructure.

Cassie covers the use cases and features that matter most within an HBOM, some of the threats and weaknesses they can illuminate for users, and how they can change the current status quo for CI sectors that have concerns about the provenance of hardware components and the threats they pose. 

Cassie is an experienced cybersecurity technology executive in information technology and product development and author of “Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware.” [https://www.amazon.com/Software-Supply-Security-Cassie-Crossley-ebook/dp/B0CTWFSB2K?ref_=ast_author_mpb]

Listen and subscribe to the Nexus Podcast here [https://nexusconnect.io/podcasts]. 





Cassie Crossley on Hardware Security, HBOMs

Rapid7 Senior Director of Threat Analytics Christiaan Beek joins the Nexus Podcast to discuss the technical evolution and economic models that maintain ransomware's viability among threat actors. Ransomware became a for-profit threat more than a decade ago and has progressed into the No. 1 threat facing many critical infrastructure organizations. 

In this episode, Beek covers extortion characteristics, the stealthiness of some attacks, and how the future may include hardware-based ransomware that maintains indefinite persistence. 

Follow and subscribe to the Nexus Podcast [https://nexusconnect.io/podcasts]. 

Christiaan Beek on Ransomware's Evolution and Economics

Florence Hudson, working group chair of the IEEE/UL 2933 standard and framework for Clinical IOT Data and Device Interoperability with TIPPSS, joins the Nexus Podcast. Published last September, the standard establishes a framework for secure data exchanges between clinical IoT and medical devices and systems. The frameworks is based on TIPPSS principles (trust, identity, privacy, protection, safety, and security) clinical IoT such as in-hospital devices, wearable devices, investigational devices.

Follow and subscribe to the Nexus Podcast [https://nexusconnect.io/podcasts].

Florence Hudson on the IEEE/UL 2933 Clinical IOT Cybersecurity Standard

Nexus is a cybersecurity podcast hosted by Claroty Editorial Director Mike Mimoso. Nexus will feature discussions with cybersecurity leaders, researchers, innovators, and influencers, discussing the topics affecting cybersecurity professionals in IoT and OT environments. 

Michael Mimoso

Shows