When we set out on this journey in late 2020 that has become the Nexus Podcast, we wanted to introduce a forum to bring the most innovative and influential cybersecurity experts together to discuss the protection of operational technology and industrial control systems.
We quickly realized, however, that every enterprise—whether it’s a utility, factory, hospital, or a warehouse—has some measure of OT under its control, and that connectivity and convergence had pushed what we now call cyber-physical systems into the forefront.
With the publication of the 100th Nexus Podcast episode this week, we also realized we’ve encapsulated the rapid growth of this niche within cybersecurity and critical infrastructure protection into a collection of fun and educational conversations.
And since we’re talking about numbers, let’s share a few:
86: The number of individuals who have appeared on the podcast
9: The number of guests who have made more than one appearance
3: The number of Team82 members who have been on the podcast
4: The number of different theme songs we’ve used
1: Former NSA director as a multiple visitor to the podcast
I cannot thank the guests enough who have generously answered my emails and phone calls asking them to come on the podcast. They’ve happily given up their time to record these episodes, and for that I’m forever grateful to all of them.
I invite you to check out our podcast archive page, and relive the shared experiences our guests brought to the table, all of it hopefully helpful knowledge that cybersecurity professionals in critical infrastructure protection can make use of. What follows is a quick recap of the top 10 episodes of all time, many of which feature new and old friends, and people prominent in our field.
And of course, thanks for listening.
Here’s a look at the top 10 episodes based on listens, engagements, and listener feedback.
Claroty Team82 vulnerability research lead Sharon Brizinov explains a unique attack against Siemens SIMATIC 1200 and 1500 PLCs that enabled native code execution on the device. The attack involved an exploit that could allow a threat actor to bypass a memory protection feature on Siemens PLCs to gain read and write access.
Team82’s Noam Moshe explains the Evil PLC Attack, a technique developed by our researchers, whereby a programmable logic controller (PLC) is weaponized in order to compromise engineering workstations and burrow deeper into the OT and enterprise networks.
Insane Forensics CEO and founder Dan Gunter discusses threat hunting in industrial control systems and OT networks, and the need for critical infrastructure operators to understand their defensive posture, have as complete an asset inventory as possible, and close any gaps by adding predictability to find threats faster.
Daniel Kapellmann Zafra, former senior technical analysis manager at Mandiant, specializing in cyber-physical threat intelligence, discusses the Incontroller malware in depth, and why Mandiant and others were so concerned about the flexibility it provides attackers in going after a targeted environment.
Timothy Huddleston, a program manager at INL, discusses the expanded scope of its Control Environment Laboratory Resource (CELR) to include ICS and OT. CELR supports security and risk scenarios within oil and gas, electricity, chemical, building automation, and smart vehicles, with additional capabilities in the works.
Cutaway Security founder Don Weber discusses his career path in information security, which began after serving in the U.S. Marine Corps (he had never picked up a computer until he left the service), to building a two-decade-long career that currently focuses on providing security assessments, penetration testing, and training.
Cybersecurity researcher Joe Slowik covers an entity known as XENOTIME that has been linked to Russian intelligence by cybersecurity companies, the U.S. Treasury Department, and the U.S. Department of Justice and is likely responsible for building the tools that enabled the Triton attack.
Cybersecurity expert Patrick Miller discusses the need for formalized communication plans and information-sharing activities if a nation-state adversary targets a U.S. critical infrastructure provider. He cautions that compromised utilities will be pulled in numerous directions in a crisis – starting with communicating that there's been an incident to numerous government agencies, handling questions from the media, and reassuring possibly frantic customers.
Sean Tufts, the ICS and OT security practice director at Optiv, discusses his experience in helping organizations across different industries implement OT SOC playbooks, some of the cultural challenges that accompany that transition, as well as his unique career path to cybersecurity.
Expert Dan Ricci talks about the ICS Advisory Project, an open source tool that is a searchable dashboard pulling vulnerability advisory information from varied sources, most notably ICS-CERT. The dashboard is an invaluable resource for OT asset operators in mitigating vulnerabilities.
Michael Mimoso is Director of Influencer Marketing at Claroty and Editorial Director of Nexus.
