Show Notes
Dale Peterson talks with Matt Wyckhouse, Founder and CEO, of Finite State about where the SBOM products and market is today and where it will go in the future. This discussion was informed by the SBOM Challenge at S4x23. Who is the primary buyer of SBOM products and services today? (Hint: Matt thinks that 80% of the code in a product is third party) How accurate are the products, and the Finite State product in particular, in creating a SBOM? How much is the value of a SBOM degraded if it is not perfect? If it is missing software or has inaccuracies? Are the offerings now a product? A semi-custom service that uses a developed product? (with an apt comparison to the detection market) What will the US Government do with all these SBOMs if they actually get them? If they get an exponential increase in software inventory and the patching and cyber maintenance burden. Will there be a separate/distinct OT SBOM market? Will there be a SBOM market in the long run or will it get subsumed in some sort of asset management market? Early thoughts on the SBOM marketplace (a place to collect and distribute and respond to queries on SBOMs) Where is the industry / products now on VEX? Do configuration files belong in a SBOM? Surprise data points from the SBOM Challenge
More from Unsolicited Response
Dale Peterson interviews acting CISA Director Nick Andersen. They briefly begin with the impact of the personnel changes at CISA, both at the leadership level and widespread exodus of anyone involved in OT. What are the plans for the rebuild of OT capabilities. The bulk of the discussion is on the need, implementation, and metrics related to CISA's ruthless prioritization of efforts and resources. What CISA and US critical infrastructure must do, and what they won't have the resources to do.
It's great to have my friend Rob Lee back on the podcast. Rob and I discuss:
Few topics get as much heat as the current, future, and ideal relationship between OT and IT. One of the first posts someone just discovering OT makes is how OT is different than IT. As you dig deeper into OT you find an increasing case of the technology, processes, and even the people being similar to IT. In this 90 minute long conversation format, we will try to bring some enlightenment to this question with a specially curated group of 9 S4x25 attendees.
Dale Peterson discusses with Maggie how she got into OT security, her recent move to the Financial Sector, women in ICS security, and more.
If you're not interested in S4, skip this episode. Dale goes over the feedback from the survey and S4 Event's own thoughts on the event, Tampa, and more.