Andy Bochman's guest appearances

Andy Bochman

Unsolicited Response

@BEERISAC: OT/ICS Security Podcast Playlist

OODAcast

WE'RE IN!

Control System Cyber Security Association International: (CS)²AI

The Electric Wire

Marty Edwards

Blake Sobczak

Dave Lewis

Matt Wyckhouse

Kelly Jackson

Rob Caldwell

Vivek Ponnada

Bosch CyberCompare

Joel Langill

Jay Healey

Edgard Capdevielle

John Matherly

Mikko Hypponen

Dan Geer

Steve Bitar

OwlTail

Andy Bochman is the Senior Grid Strategist-Defender for Idaho National Laboratory’s National and Homeland Security directorate. In this role, Andy provides strategic guidance on topics at the intersection of grid security and climate resilience to INL leadership as well as senior U.S. and international government and industry leaders. Andy is a frequent speaker, writer, and trainer who has testified before the U.S. Senate Energy and Natural Resources Committee on energy infrastructure cybersecurity issues and before FERC on the maturity of smart grid cybersecurity standards. He has had recurring conversations on grid security matters with the Senate Select Committee on Intelligence and the National Security Council. In this OODAcast we discuss Andy’s most recent book, Countering Cyber Sabotage: Introducing Consequence-based Cyber-Informed Engineering. This book introduces INL’s new approach for defending against top-tier cyber adversaries. Watch as we learn how a hockey player transformed into a cybersecurity champion and author of one of the most important books for engineering for critical infrastructure defense.

Andy Bochman is the Senior Grid Strategist-Defender for Idaho National Laboratory’s National and Homeland Security directorate. In this role, Andy provides strategic guidance on topics at the intersection of grid security and climate resilience to INL leadership as well as senior U.S. and international government and industry leaders. Andy is a frequent speaker, writer, and trainer who has testified before the U.S. Senate Energy and Natural Resources Committee on energy infrastructure cybersecurity issues and before FERC on the maturity of smart grid cybersecurity standards. He has had recurring conversations on grid security matters with the Senate Select Committee on Intelligence and the National Security Council. In this OODAcast we discuss Andy’s most recent book, Countering Cyber Sabotage: Introducing Consequence-based Cyber-Informed Engineering. This book introduces INL’s new approach for defending against top-tier cyber adversaries. Watch as we learn how a hockey player transformed into a cybersecurity champion and author of one of the most important books for engineering for critical infrastructure defense.

Episode 111:  Andy Bochman on Countering Cyber Sabotage

Sarah Freeman

Why you should listen:Hackers are targeting critical infrastructure and there’s an urgent need for smarter cybersecurity defenses to protect Operational Technology. The best practices to defend against attacks on utilities.Why there is no such thing as “taking down the whole US grid.”Five Key Quotes: “How can you secure what you don’t even know you have? If you don’t even know what you have down to some level of detail...you’re not going to be in a good position to defend it.”  - Andy Bochman “The most senior person with the word cyber in their title ideally is at least at the VP level.” - Andy Bochman “You have to not only understand how the attacker can gain access to your network but ultimately gain access to the accounts that are most valuable – where are those crown jewel accounts?” - Sarah Freeman“IT and OT needs to be merged …the problem is cyber is here to stay and everybody needs to take part in this security process.” - Sarah Freeman“The government is most interested in who conducted the attack... The fact that there are two parties here with differing interests is a core issue.” - Sarah FreemanRelated Links:Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE) 1st Editionhttps://hbr.org/2018/05/internet-insecurityhttps://medium.com/cxo-magazine/the-missing-chief-security-officer-11979a54fbf9https://www.synack.com/LinkedIn: Andy BochmanSarah FreemanTwitter:@andybochman

Why you should listen:<ul><li>Hackers are targeting critical infrastructure and there’s an urgent need for smarter cybersecurity defenses to protect Operational Technology. </li><li>The best practices to defend against attacks on utilities.</li><li>Why there is no such thing as “taking down the whole US grid.”</li></ul>Five Key Quotes: <ul><li>“How can you secure what you don’t even know you have? If you don’t even know what you have down to some level of detail...you’re not going to be in a good position to defend it.”  - Andy Bochman </li><li>“The most senior person with the word cyber in their title ideally is at least at the VP level.” - Andy Bochman </li><li>“You have to not only understand how the attacker can gain access to your network but ultimately gain access to the accounts that are most valuable – where are those crown jewel accounts?” - Sarah Freeman</li><li>“IT and OT needs to be merged …the problem is cyber is here to stay and everybody needs to take part in this security process.” - Sarah Freeman</li><li>“The government is most interested in who conducted the attack... The fact that there are two parties here with differing interests is a core issue.” - Sarah Freeman</li></ul>Related Links:<ul><li><a href="https://www.amazon.com/Countering-Cyber-Sabotage-Consequence-Driven-Cyber-Informed/dp/036749115X" rel="nofollow" target="_blank">Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE) 1st Edition</a></li><li><a href="https://hbr.org/2018/05/internet-insecurity" rel="nofollow" target="_blank">https://hbr.org/2018/05/internet-insecurity</a></li><li><a href="https://medium.com/cxo-magazine/the-missing-chief-security-officer-11979a54fbf9" rel="nofollow" target="_blank">https://medium.com/cxo-magazine/the-missing-chief-security-officer-11979a54fbf9</a></li><li><a href="https://www.synack.com/" rel="nofollow" target="_blank">https://www.synack.com/</a></li><li>LinkedIn: <ul><li><a href="https://www.linkedin.com/in/andybochman" rel="nofollow" target="_blank">Andy Bochman</a></li><li><a href="https://www.linkedin.com/in/sarah-freeman-7817b121/" rel="nofollow" target="_blank">Sarah Freeman</a></li></ul></li><li>Twitter:<ul><li><a href="https://twitter.com/andybochman" rel="nofollow" target="_blank">@andybochman</a></li></ul></li></ul>

There is No ‘Take Down the Whole US Grid’ with Sarah Freeman and Andy Bochman

Podcast: Unsolicited Response Podcast (LS 29 · TOP 10% what is this?)Episode: CCE with Andy Bochman of INLPub date: 2018-07-18Andy Bochman with INL joins me to discuss their Consequence-Driven, Cyber-Informed Engineering methodology (CCE). It is appealing because it places emphasis on the often neglected consequence part of the risk equation. I think you'll hear me struggling to make sense of some of the concepts in the CCE and questioning a number of the underlying precepts and value of stages of the methodology. One of the reasons is there is limited info out on what CCE is, and this podcast should clarify CCE to some degree.   This episode was sponsored by CyberX. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation. Check out the CyberX Global ICS and IIoT Risk Report and my podcast from last year on the report with Phil Neray.  The podcast and artwork embedded on this page are from Dale Peterson: ICS Security Catalyst and S4 Conference Chair, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: <a href="https://www.listennotes.com/podcasts/unsolicited-response-podcast-dale-peterson-6E91QCvGOcU/" rel="nofollow" target="_blank">Unsolicited Response Podcast</a> (LS 29 · TOP 10% <a href="https://www.listennotes.com/listen-score/" rel="nofollow" target="_blank">what is this?</a>) Episode: <a href="https://www.listennotes.com/e/2bbd7a631e49454c9fc1e831339ecb69/" rel="nofollow" target="_blank">CCE with Andy Bochman of INL</a> Pub date: 2018-07-18 Andy Bochman with INL joins me to discuss their Consequence-Driven, Cyber-Informed Engineering methodology (CCE). It is appealing because it places emphasis on the often neglected consequence part of the risk equation. I think you'll hear me struggling to make sense of some of the concepts in the CCE and questioning a number of the underlying precepts and value of stages of the methodology. One of the reasons is there is limited info out on what CCE is, and this podcast should clarify CCE to some degree. This episode was sponsored by <a href="https://cyberx-labs.com/" rel="nofollow" target="_blank">CyberX</a>. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation. Check out the <a href="https://cyberx-labs.com/en/risk-report-2017" rel="nofollow" target="_blank">CyberX Global ICS and IIoT Risk Report</a> and <a href="http://unsolicitedresponse.libsyn.com/understanding-interpreting-ics-security-statistics" rel="nofollow" target="_blank">my podcast from last year on the report with Phil Neray</a>. The podcast and artwork embedded on this page are from Dale Peterson: ICS Security Catalyst and S4 Conference Chair, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

CCE with Andy Bochman of INL

Andy Bochman with INL joins me to discuss their Consequence-Driven, Cyber-Informed Engineering methodology (CCE). It is appealing because it places emphasis on the often neglected consequence part of the risk equation. I think you'll hear me struggling to make sense of some of the concepts in the CCE and questioning a number of the underlying precepts and value of stages of the methodology. One of the reasons is there is limited info out on what CCE is, and this podcast should clarify CCE to some degree.   This episode was sponsored by CyberX. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation. Check out the CyberX Global ICS and IIoT Risk Report and my podcast from last year on the report with Phil Neray.

Andy Bochman with INL joins me to discuss their Consequence-Driven, Cyber-Informed Engineering methodology (CCE). It is appealing because it places emphasis on the often neglected consequence part of the risk equation. I think you'll hear me struggling to make sense of some of the concepts in the CCE and questioning a number of the underlying precepts and value of stages of the methodology. One of the reasons is there is limited info out on what CCE is, and this podcast should clarify CCE to some degree. This episode was sponsored by <a href="https://cyberx-labs.com/" rel="nofollow" target="_blank">CyberX</a>. Founded by military cyber experts with nation-state expertise defending critical infrastructure, CyberX has developed an end-to-end platform for continuous ICS threat monitoring and risk mitigation. Check out the <a href="https://cyberx-labs.com/en/risk-report-2017" rel="nofollow" target="_blank">CyberX Global ICS and IIoT Risk Report</a> and <a href="http://unsolicitedresponse.libsyn.com/understanding-interpreting-ics-security-statistics" rel="nofollow" target="_blank">my podcast from last year on the report with Phil Neray</a>.