In this episode of the Nexus podcast, Bishop Fox researchers Dan Petro and David Vargas explain their research into the Open Supervised Device Protocol (OSDP), meant to bring encryption to badge readers and controllers providing physical access controls at secure facilities. Petro and Vargas explain a number of protocol weaknesses and vulnerabilities that defeat OSDP's promise of encryption and security. Through the attacks they describe, they're able carry out—among others—replay or downgrade attacks, which are enabled by severe key exchange vulnerabilities or weakened crypto keys as described in the protocol.Petro and Vargas unveiled this research during a presentation at Black Hat USA in Las Vegas. 

In this episode of the Nexus podcast, Bishop Fox researchers Dan Petro and David Vargas explain their research into the Open Supervised Device Protocol (OSDP), meant to bring encryption to badge readers and controllers providing physical access controls at secure facilities. Petro and Vargas explain a number of protocol weaknesses and vulnerabilities that defeat OSDP's promise of encryption and security. Through the attacks they describe, they're able carry out—among others—replay or downgrade attacks, which are enabled by severe key exchange vulnerabilities or weakened crypto keys as described in the protocol. Petro and Vargas unveiled this <a href="https://bishopfox.com/blog/breaking-into-secure-facilities-with-osdp" rel="nofollow" target="_blank">research</a> during a presentation at Black Hat USA in Las Vegas.

Bishop Fox on OSDP Weaknesses Putting Secure Facilities at Risk

Jennifer Lyn Walker

Jennifer Lyn Walker, Director of Infrastructure Cyber Defense for the WaterISAC, joins the Nexus podcast to discuss the state of cybersecurity within the water and wastewater critical infrastructure sector. Walker explains where the cybersecurity technology, funding, and skills  gaps currently exist among smaller—and larger—water providers. She also covers recent improvements from water utilities, and what, in an ideal world, the cybersecurity industry and government could do to help. 

Jennifer Lyn Walker, Director of Infrastructure Cyber Defense for the WaterISAC, joins the Nexus podcast to discuss the state of cybersecurity within the water and wastewater critical infrastructure sector. Walker explains where the cybersecurity technology, funding, and skills  gaps currently exist among smaller—and larger—water providers. She also covers recent improvements from water utilities, and what, in an ideal world, the cybersecurity industry and government could do to help.

Jennifer Lyn Walker on Cybersecurity Risks in the Water Sector

Kathleen Moriarty

Kathleen Moriarty, Chief Technology Officer of the Center for Internet Security (CIS) joins the Nexus podcast to discuss CIS' recently published IoT Embedded Security Guidance. The document walks vendors, developers, DevOps professionals through the most commonly used IoT  protocols and analyzes them from a security perspective. The aim is to help vendors and developers with this selection process and assist with building security in at the protocol level. Download the guidance here.

Kathleen Moriarty, Chief Technology Officer of the Center for Internet Security (CIS) joins the Nexus podcast to discuss CIS' recently published IoT Embedded Security Guidance. The document walks vendors, developers, DevOps professionals through the most commonly used IoT  protocols and analyzes them from a security perspective. The aim is to help vendors and developers with this selection process and assist with building security in at the protocol level. <a href="https://www.cisecurity.org/insights/white-papers/internet-of-things-embedded-security-guidance" rel="nofollow" target="_blank">Download the guidance here.</a>

Kathleen Moriarty on CIS' IoT Security Guidance

Walter Risi

Walter Risi, Global OT Lead and the Technology and Cyber Security Consulting leader at KPMG in Argentina, joins the Nexus podcast to discuss the CISO's journey from IT to OT. Risi explains what's driving this convergence of security disciplines, and the challenges security leaders are facing across industries. You'll also learn why resilience should be the goal of enterprise security programs, the tools and experience necessary to successfully converge IT and OT security operations, and the importance of bringing cybersecurity awareness and experience to OT engineers and operators. 

Walter Risi, Global OT Lead and the Technology and Cyber Security Consulting leader at KPMG in Argentina, joins the Nexus podcast to discuss the CISO's journey from IT to OT.  Risi explains what's driving this convergence of security disciplines, and the challenges security leaders are facing across industries. You'll also learn why resilience should be the goal of enterprise security programs, the tools and experience necessary to successfully converge IT and OT security operations, and the importance of bringing cybersecurity awareness and experience to OT engineers and operators.

Walter Risi on the CISO's Journey from IT to OT

Noam Moshe

Claroty Team82's Noam Moshe joins the Nexus podcast to discuss a recent research collaboration with OTORIO looking at Teltonika's 4G industrial routers and cloud management platforms. Eight vulnerabilities were uncovered and patched by the vendor in a recent update. Moshe discusses the vulnerabilities, attack vectors involved, and the state of secure development for IIoT routers. Read Team82's report: "Triple Threat: Breaking Teltonika Routers Three Ways"

Claroty Team82's Noam Moshe joins the Nexus podcast to discuss a recent research collaboration with OTORIO looking at Teltonika's 4G industrial routers and cloud management platforms. Eight vulnerabilities were uncovered and patched by the vendor in a recent update. Moshe discusses the vulnerabilities, attack vectors involved, and the state of secure development for IIoT routers. Read Team82's report: <a href="https://claroty.com/team82/research/triple-threat-breaking-teltonika-routers-three-ways" rel="nofollow" target="_blank">"Triple Threat: Breaking Teltonika Routers Three Ways"</a>

Noam Moshe on Teltonika 4G IIoT Router Cybersecurity Research

Charles Carmakal

Mandiant Chief Technology Officer Charles Carmakal joins the Claroty Nexus podcast to discuss real-world threats to healthcare organizations. Mandiant has a unique vantage point as an incident response team involved in many high-profile cyberattacks. Based on that insight, Carmakal is able to comment on the conventional and opportunistic attacks healthcare delivery organizations and providers are dealing with. Some of those include multifaceted extortion as well as intellectual property theft. He also discusses whether attacks targeting medical devices are a reality. 

Mandiant Chief Technology Officer Charles Carmakal joins the Claroty Nexus podcast to discuss real-world threats to healthcare organizations. Mandiant has a unique vantage point as an incident response team involved in many high-profile cyberattacks. Based on that insight, Carmakal is able to comment on the conventional and opportunistic attacks healthcare delivery organizations and providers are dealing with. Some of those include multifaceted extortion as well as intellectual property theft. He also discusses whether attacks targeting medical devices are a reality.

Charles Carmakal on Cybersecurity Threats to Healthcare

Lorrie Cranor

Lorrie Cranor, Director and Bosch Distinguished Professor in Security and Privacy Technologies at Carnegie Mellon University's CyLab, joins the Nexus podcast to discuss an IoT security and privacy label initiative under way at CyLab. The labels are meant not only to help consumers make informed buying decisions, but also to nudge vendors and manufacturers closer toward delivering secure smart devices to market. 

Lorrie Cranor, Director and Bosch Distinguished Professor in Security and Privacy Technologies at Carnegie Mellon University's CyLab, joins the Nexus podcast to discuss an <a href="https://iotsecurityprivacy.org/" rel="nofollow" target="_blank">IoT security and privacy label</a> initiative under way at CyLab. The labels are meant not only to help consumers make informed buying decisions, but also to nudge vendors and manufacturers closer toward delivering secure smart devices to market.

Lorrie Cranor on IoT Security and Privacy Labels

Skip Sorrels, director of cybersecurity at Ascension Technologies, which oversees the technology needs for Ascension Healthcare, one of the country’s biggest non-profit healthcare providers, joins the Nexus podcast to discuss the 405(d) Task Group's  Health Industry Cybersecurity Practices (HICP).The HICP identifies top cybersecurity threats to the healthcare industry, and 10 blocking-and-tackling mitigation practices and sub-practices aimed at not only larger, more resourced organizations, but also smaller healthcare providers.

Skip Sorrels, director of cybersecurity at Ascension Technologies, which oversees the technology needs for Ascension Healthcare, one of the country’s biggest non-profit healthcare providers, joins the Nexus podcast to discuss the 405(d) Task Group's <a href="https://405d.hhs.gov/protect/hicp" rel="nofollow" target="_blank">Health Industry Cybersecurity Practices (HICP)</a>. The HICP identifies top cybersecurity threats to the healthcare industry, and 10 blocking-and-tackling mitigation practices and sub-practices aimed at not only larger, more resourced organizations, but also smaller healthcare providers.

Skip Sorrels on the 405(d) HICP, Healthcare Cybersecurity

Dave Elfering

Dave Elfering, senior vice president at Marsh, a global insurance broker and risk management company, joins the Nexus podcast to discuss the current state of cyber insurance. A longtime figure in information security, Elfering explains the current volatility around coverage, premiums, and exclusions. He goes deep into what can sometimes be contentious discussions about qualifications and controls that must be implemented in order to be eligible for coverage, in addition to policy exclusions. 

Dave Elfering, senior vice president at Marsh, a global insurance broker and risk management company, joins the Nexus podcast to discuss the current state of cyber insurance. A longtime figure in information security, Elfering explains the current volatility around coverage, premiums, and exclusions. He goes deep into what can sometimes be contentious discussions about qualifications and controls that must be implemented in order to be eligible for coverage, in addition to policy exclusions.

Dave Elfering on Cyber Liability Insurance

Team82 researcher Vera Mens joins the Nexus podcast to discuss her research that uncovered 13 vulnerabilities in the popular Akuvox E11 smart intercoms. These devices are used to control access to offices, residential, and commercial establishments. The vulnerabilities range in severity, and pose serious privacy implications for users. Vera will discuss her research and a challenging disclosure withe vendor that began 15 months ago.  Read Team82's technical report on this research here. Read Team82's blog here. 

Team82 researcher Vera Mens joins the Nexus podcast to discuss her research that uncovered 13 vulnerabilities in the popular Akuvox E11 smart intercoms. These devices are used to control access to offices, residential, and commercial establishments. The vulnerabilities range in severity, and pose serious privacy implications for users. Vera will discuss her research and a challenging disclosure withe vendor that began 15 months ago.  <a href="https://claroty.com/team82/research/the-silent-spy-among-us-modern-attacks-against-smart-intercoms" rel="nofollow" target="_blank">Read Team82's technical report on this research here</a>. <a href="https://claroty.com/team82/blog/akuvox-smart-intercom-vulnerabilities-leave-privacy-ajar" rel="nofollow" target="_blank">Read Team82's blog here</a>.

Vera Mens on Akuvox E11 Vulnerabilities

Nexus is a cybersecurity podcast hosted by Claroty Editorial Director Mike Mimoso. Nexus will feature discussions with cybersecurity leaders, researchers, innovators, and influencers, discussing the topics affecting cybersecurity professionals in OT, IoT, and IoMT environments. Nexus is formerly known as Aperture.

Mike Rogers

Adm. Mike Rogers, USN (Ret.) joins the Nexus podcast to discuss the recently released National Cybersecurity Strategy, the first such strategy from the Biden administration. The strategy codifies many of the cyber-physical systems security initiatives the White House has produced since 2021 in the aftermath of the Colonial Pipeline ransomware attack. Adm. Rogers shares his past contributions to previous strategies, and provides insight into the document's five pillars and how they will impact critical infrastructure security in the near term. 

Adm. Mike Rogers, USN (Ret.) joins the Nexus podcast to discuss the recently released <a href="https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf" rel="nofollow" target="_blank">National Cybersecurity Strategy</a>, the first such strategy from the Biden administration. The strategy codifies many of the cyber-physical systems security initiatives the White House has produced since 2021 in the aftermath of the Colonial Pipeline ransomware attack. Adm. Rogers shares his past contributions to previous strategies, and provides insight into the document's five pillars and how they will impact critical infrastructure security in the near term.

Adm. Mike Rogers on the National Cybersecurity Strategy

Katherine Gronberg

Katherine Gronberg, head of government services at cybersecurity venture capital firm NightDragon, joins the Nexus Podcast to discuss what's driving the federal government's renewed interest and investment in OT and IoT cybersecurity. Katherine brings insight from her unique perspective on these issues, especially as it pertains to upcoming requirements facing asset owners and operators, how vendors must respond to mandates put out by the White House, and what might be in the impending national cybersecurity strategy from the  White House Office of the National Cyber Director. 

Katherine Gronberg, head of government services at cybersecurity venture capital firm NightDragon, joins the Nexus Podcast to discuss what's driving the federal government's renewed interest and investment in OT and IoT cybersecurity. Katherine brings insight from her unique perspective on these issues, especially as it pertains to upcoming requirements facing asset owners and operators, how vendors must respond to mandates put out by the White House, and what might be in the impending national cybersecurity strategy from the  White House Office of the National Cyber Director.

Katherine Gronberg on the Federal Government and OT/IoT Cybersecurity

Claroty Team82 researcher Noam Moshe joins the podcast to discuss his recent research and development of a generic bypass of leading vendors' web application firewalls.This research was presented at Black Hat Europe and on the Team82 blog.  The technique involves prepending JSON syntax to a SQL injection payload. Prior to this research, WAFs were blind to JSON syntax and would not flag these payloads as malicious. All of the leading vendors have since added JSON support to their SQL injection processes. 

Claroty Team82 researcher Noam Moshe joins the podcast to discuss his recent research and development of a generic bypass of leading vendors' web application firewalls. This research was presented at Black Hat Europe and on the <a href="https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf" rel="nofollow" target="_blank">Team82 blog</a>.  The technique involves prepending JSON syntax to a SQL injection payload. Prior to this research, WAFs were blind to JSON syntax and would not flag these payloads as malicious.  All of the leading vendors have since added JSON support to their SQL injection processes.

Noam Moshe on a Generic WAF Bypass Technique

Sharon Brizinov

Claroty Team82 Director of Research Sharon Brizinov joins the podcast to discuss the recent Pwn2Own Toronto event. Brizinov was successful in three categories at the event, finding and exploiting zero day vulnerabilities in two network-attached storage devices and a popular router. In this episode, Brizinov explains his preparation for the contest, and compares and contrasts hacking industrial control systems and internet of things connected devices. 

Claroty <a href="https://claroty.com/team82" rel="nofollow" target="_blank">Team82</a> Director of Research Sharon Brizinov joins the podcast to discuss the recent <a href="https://www.zerodayinitiative.com/blog/2022/12/8/pwn2own-toronto-2022-day-three-results" rel="nofollow" target="_blank">Pwn2Own Toronto</a> event. Brizinov was successful in three categories at the event, finding and exploiting zero day vulnerabilities in two network-attached storage devices and a popular router.  In this episode, Brizinov explains his preparation for the contest, and compares and contrasts hacking industrial control systems and internet of things connected devices.

Sharon Brizinov on Hacking IoT

Joe Slowik

Triton Malware

Joe Slowik, threat intelligence and detections lead at Gigamon, joins the podcast to discuss the XENOTIME hacking group, the entity believed to be responsible for the 2017 Triton attack. Triton was deployed within a petrochemical facility in Saudi Arabia and triggered a fault in the Schneider Electric Triconex Safety Instrumented Systems that initiated a shutdown of the plant. The Triton intrusion and malware deployment could have been much worse, resulting in harmful physical consequences and loss of life. Slowik's recent Virus Bulletin paper and presentation describes the complex ecosystem behind XENOTIME, its connections to Russian intelligence, and the tooling it built enabling the Triton attack and deployment.One question does linger: Who wrote Triton?  

Joe Slowik, threat intelligence and detections lead at Gigamon, joins the podcast to discuss the XENOTIME hacking group, the entity believed to be responsible for the 2017 Triton attack. Triton was deployed within a petrochemical facility in Saudi Arabia and triggered a fault in the Schneider Electric Triconex Safety Instrumented Systems that initiated a shutdown of the plant. The Triton intrusion and malware deployment could have been much worse, resulting in harmful physical consequences and loss of life. Slowik's recent <a href="https://www.virusbulletin.com/conference/vb2022/abstracts/zeroing-xenotime-analysis-entities-responsible-triton-event/" rel="nofollow" target="_blank">Virus Bulletin paper</a> and <a href="https://www.youtube.com/watch?v=KmYQvG0Lvfk" rel="nofollow" target="_blank">presentation</a> describes the complex ecosystem behind XENOTIME, its connections to Russian intelligence, and the tooling it built enabling the Triton attack and deployment. One question does linger: Who wrote Triton?

Joe Slowik on TRITON Malware, XENOTIME Hacking Group

Team82's Noam Moshe, one of the researchers involved in developing the EvilPLC attack, discusses the technique of using a weaponized programmable logic controller to compromise an engineer's workstation and gain access to other PLCs on the OT network. Read more about the EvilPLC techniqueDownload Team82's paper on EvilPLC

Team82's Noam Moshe, one of the researchers involved in developing the EvilPLC attack, discusses the technique of using a weaponized programmable logic controller to compromise an engineer's workstation and gain access to other PLCs on the OT network. <a href="https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey" rel="nofollow" target="_blank">Read more about the EvilPLC technique</a> <a href="https://claroty.com/team82/research/white-papers/evil-plc-attack-weaponizing-plcs" rel="nofollow" target="_blank">Download Team82's paper on EvilPLC</a>

Inside Team82's EvilPLC Attack

Sarah Fluchs

Sarah Fluchs, CTO at Admeritia, joins the Aperture podcast to discuss the Top 20 Secure PLC Coding Practices List. Written for engineers by engineers, the list provides recommendations that can be used to securely design and code programmable logic controllers (PLCs). The first iteration of the list was published in 2021, and since then, its core group of maintainers has grown to 75 and more than 1,000 engineers and experts registered as contributors. The list has been prominent referenced in training materials and other resources, including the NATO guide for protecting automation and control systems, and MITRE is considering integrating the list into its CWE database. In this episode, Sarah discusses secure PLC programming, how the list was developed, and how it should be used by engineers and security practitioners. 

Sarah Fluchs, CTO at Admeritia, joins the Aperture podcast to discuss the <a href="https://plc-security.com/content/Top_20_Secure_PLC_Coding_Practices_V1.0.pdf" rel="nofollow" target="_blank">Top 20 Secure PLC Coding Practices List</a>. Written for engineers by engineers, the list provides recommendations that can be used to securely design and code programmable logic controllers (PLCs). The <a href="https://claroty.com/resources/podcasts/top-20-secure-plc-coding-practices-list" rel="nofollow" target="_blank">first iteration of the list </a>was published in 2021, and since then, its core group of maintainers has grown to 75 and more than 1,000 engineers and experts registered as contributors. The list has been prominent referenced in training materials and other resources, including the NATO guide for protecting automation and control systems, and MITRE is considering integrating the list into its CWE database. In this episode, Sarah discusses <a href="https://fluchsfriction.medium.com/one-year-of-top-20-secure-plc-coding-practices-c2f0042ad4a2" rel="nofollow" target="_blank">secure PLC programming</a>, how the list was developed, and how it should be used by engineers and security practitioners.

Sarah Fluchs Revisits the Top 20 Secure PLC Coding Practices List

Vergle Gipson, senior advisor, at Idaho National Lab's Cybercore Integration Center, joins the podcast to discuss cyber-informed engineering and the maturing discipline of operational technology (OT) cybersecurity. Gipson recently testified before a House Committee on Homeland Security about the need to secure industrial control systems against cyberattacks. One of the recommendations he suggested to the committee was the need for cyber-informed engineering, which has parallels to secure software development for IT.  Gipson discusses CIE and the need for cyber-physical system security and critical function assurance. 

Vergle Gipson, senior advisor, at Idaho National Lab's Cybercore Integration Center, joins the podcast to discuss cyber-informed engineering and the maturing discipline of operational technology (OT) cybersecurity.  Gipson recently testified before a House Committee on Homeland Security about the need to secure industrial control systems against cyberattacks. One of the recommendations he suggested to the committee was the need for cyber-informed engineering, which has parallels to secure software development for IT.  Gipson discusses CIE and the need for cyber-physical system security and critical function assurance.

Vergle Gipson on Cyber-Informed Engineering

Claroty Team82 researcher Noam Moshe joins the podcast to discuss the Evil PLC Attack research published recently. Evil PLC is a technique whereby a weaponized PLC is used to compromise an engineering workstation in order to move deeper onto the OT network, the enterprise network, or other PLCs. Read Team82's blog here. Download our technical paper here (free PDF).

Claroty Team82 researcher Noam Moshe joins the podcast to discuss the Evil PLC Attack research published recently. Evil PLC is a technique whereby a weaponized PLC is used to compromise an engineering workstation in order to move deeper onto the OT network, the enterprise network, or other PLCs. <a href="https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey" rel="nofollow" target="_blank">Read Team82's blog here</a>. <a href="https://claroty.com/resources/reports/evil-plc-attack-weaponizing-plcs" rel="nofollow" target="_blank">Download our technical paper here (free PDF)</a>.

Noam Moshe on the Evil PLC Attack

Dan Gunter

Insane Forensics CEO and founder Dan Gunter joins the Aperture podcast to discuss threat hunting approaches inside industrial control systems (ICS) and operational technology (OT) networks. Gunter describes how Shodan can be used to understand exposures within an industrial network and threats posed by trust relationships to the OT network. Gunter explains what asset operators and owners need in place to begin threat hunting, what they should be looking for, and how to use tools such as Shodan to their greatest effect. 

Insane Forensics CEO and founder Dan Gunter joins the Aperture podcast to discuss threat hunting approaches inside industrial control systems (ICS) and operational technology (OT) networks. Gunter describes how Shodan can be used to understand exposures within an industrial network and threats posed by trust relationships to the OT network. Gunter explains what asset operators and owners need in place to begin threat hunting, what they should be looking for, and how to use tools such as Shodan to their greatest effect.

Dan Gunter on Threat Hunting in Industrial Control Systems

Nexus: A Claroty Podcast

The Best Multi-Part Documentaries, with documentaries on Obama, Federer vs Nadal, the making of Star Wars, Netflix vs Blockbuster and more. Add episodes you're interested into your queue below!

Best Multi-Part Documentaries

The best podcast episodes of the most interesting stories and things. From skyping someone while they're in space, to tracking down and meeting a telephone scammer in person, to the story of a Galapagos. These episodes will keep you and all your friends entertained and captivated for hours. Learn something new in every episode! Add episodes you're interested into your queue below!