Have you heard the story of malware that targets programmable logic controllers (PLCs) on industrial systems and causing fast-spinning centrifuges to tear themselves apart? How about the disgruntled employee in Australia who tampered with a supervisory control and data acquisition (SCADA) system and released 265,000 gallons (~1M l) of sewage from a waste management plant? In this episode we're joined by Operational Technology (OT) Security expert Roger Hill as we discuss OT security, the convergence of OT and IT and how we can defend against OT / IOT attacks.
As the Founder of Hillstrong Group Security, Roger Hill brings over 30 years of deep expertise in industrial automation and cybersecurity, specializing in OT GRC and cybersecurity for manufacturing and critical infrastructure. Throughout his career, he's consistently tackled the most pressing challenges that CISOs face in securing Operational Technology (OT) environments within the ever-evolving industrial landscape. You can connect with Roger on LinkedIn (www.linkedin.com/in/rogerlhill/)
00:00:00 Introduction to OT Security
00:01:03 Welcoming Roger Hill
00:02:15 Roger Hill’s Background in OT
00:03:33 Understanding OT Systems
00:05:40 OT System Vulnerabilities
00:06:30 The Impact of Stuxnet
00:07:41 Lifecycles of OT Systems
00:08:34 Maintaining Legacy Systems
00:09:13 Challenges in Nuclear and Other Sectors
00:10:11 OT Security in Global Industries
00:12:11 Segmentation and Risk Management
00:13:22 Human Element in OT Security
00:14:19 Insider Threats and Ransomware
00:16:58 Cost of Downtime in OT
00:18:07 Remote Connectivity and Supply Chain Risk
00:19:01 Evolution of IT and OT Integration
00:21:06 Connectivity and Expanding Attack Surfaces
00:23:45 Solutions and Protocols for OT Security
00:25:09 Security by Obscurity and Historical Examples
00:27:09 Modern Risks and Threats
00:29:16 Positive Advances in OT Security
00:31:04 Skills for Entering OT Security
00:34:24 Cross-Functional Teams in OT Security
00:37:10 Organizational Preparedness in OT
00:38:16 CISOs Taking on OT Security
00:39:02 Asset Management and Discovery
00:41:06 Segmentation and Microsegmentation
00:43:09 Roger Hill’s Closing Thoughts
00:44:10 Securing Critical Infrastructure
00:44:32 Concluding Remarks and Farewell