Show Notes
How much does a security control reduce cyber risk? What control or mix of controls provides the most efficient cyber risk reduction? Tough questions that a team of researchers at INL and Sandia tried to answer in a project. Two of the researchers, Jay Johnson of Sandia and Jake Gentle of INL, join Dale on the show to talk about the metrics and results. The project was Cyber Resilience for Wind Installations, but the metrics and results are applicable to every sector. We get into the weeds on this episode and discuss: how they created the test environment the two attack scenarios (and why only two and how easy it would be to expand) the physical resilience score the cyber resilience score the results from four different mixes of security controls areas for further testing and improvement and a tiny bit about trying to calculate an Expected Benefit from Cybersecurity Investment, which is a bit like ROI and how much money to spend. Links • Video: https://www.youtube.com/watch?v=bBLbLUFKzIc • IEEE Access Journal Paper: https://ieeexplore.ieee.org/document/10043706 • POWER magazine article: https://www.powermag.com/cyber-resilience-for-wind-power-installations/ • 2-page flyer: https://www.researchgate.net/publication/367074443_Cyber_Resilience_for_Wind_Installations_A_Cyber_Resilient_Reference_Architecture • Final project report: https://www.researchgate.net/publication/368599508_Hardening_Wind_Energy_Systems_from_Cyber_Threats-Final_Project_Report
More from Unsolicited Response
Dale Peterson interviews acting CISA Director Nick Andersen. They briefly begin with the impact of the personnel changes at CISA, both at the leadership level and widespread exodus of anyone involved in OT. What are the plans for the rebuild of OT capabilities. The bulk of the discussion is on the need, implementation, and metrics related to CISA's ruthless prioritization of efforts and resources. What CISA and US critical infrastructure must do, and what they won't have the resources to do.
It's great to have my friend Rob Lee back on the podcast. Rob and I discuss:
Few topics get as much heat as the current, future, and ideal relationship between OT and IT. One of the first posts someone just discovering OT makes is how OT is different than IT. As you dig deeper into OT you find an increasing case of the technology, processes, and even the people being similar to IT. In this 90 minute long conversation format, we will try to bring some enlightenment to this question with a specially curated group of 9 S4x25 attendees.
Dale Peterson discusses with Maggie how she got into OT security, her recent move to the Financial Sector, women in ICS security, and more.
If you're not interested in S4, skip this episode. Dale goes over the feedback from the survey and S4 Event's own thoughts on the event, Tampa, and more.