Nexus is a cybersecurity podcast hosted by Claroty Editorial Director Mike Mimoso. Nexus will feature discussions with cybersecurity leaders, researchers, innovators, and influencers, discussing the topics affecting cybersecurity professionals in OT, IoT, and IoMT environments. Nexus is formerly known as Aperture.
…
continue reading
There are great stories in the security industry that aren’t being told. Fascinating people who fly below the radar and aren’t being heard. We know because we encounter them in hallways, hotel lobbies and just about everywhere imaginable across the globe. Everytime we think “I wish I had recorded that conversation so that everyone could hear it…” Our goal with Security Voices is to provide a place for clear-headed dialogue with great people that’s unencumbered by the hyperbole and shouting t ...
…
continue reading
Want to know how to build market-leading technology products? Want to know how to take a startup from nothing multi-billion dollar exit? Zero To Exit is the best business and technology podcast series that will share deep insights from industry leaders on how they successfully led multiple products and companies to critical success. We will invite guests who have been on the battlefield for many years and can share their unique insights on building products, sales machines, company culture, ...
…
continue reading

1
Danielle Jablanski on Critical Infrastructure Protection
41:26
41:26
Play later
Play later
Lists
Like
Liked
41:26Danielle Jablanski, Industrial Control Systems Strategist & Subject Matter Expert at CISA, joins the Nexus podcast to discuss her perspectives on critical infrastructure protection and government's role as a cybersecurity partner on implementation guidance and enablement. Danielle touches on a number of areas of CI security and protection, ranging …
…
continue reading

1
Cassie Crossley on Hardware Security, HBOMs
28:20
28:20
Play later
Play later
Lists
Like
Liked
28:20Schneider Electric Vice President of Supply Chain Security Cassie Crossley joins the Nexus Podcast to discuss the nuances of hardware security and the growing need for hardware bills of materials (HBOMs) within critical infrastructure. Cassie covers the use cases and features that matter most within an HBOM, some of the threats and weaknesses they …
…
continue reading

1
Christiaan Beek on Ransomware's Evolution and Economics
30:05
30:05
Play later
Play later
Lists
Like
Liked
30:05Rapid7 Senior Director of Threat Analytics Christiaan Beek joins the Nexus Podcast to discuss the technical evolution and economic models that maintain ransomware's viability among threat actors. Ransomware became a for-profit threat more than a decade ago and has progressed into the No. 1 threat facing many critical infrastructure organizations. I…
…
continue reading

1
Florence Hudson on the IEEE/UL 2933 Clinical IOT Cybersecurity Standard
40:39
40:39
Play later
Play later
Lists
Like
Liked
40:39Florence Hudson, working group chair of the IEEE/UL 2933 standard and framework for Clinical IOT Data and Device Interoperability with TIPPSS, joins the Nexus Podcast. Published last September, the standard establishes a framework for secure data exchanges between clinical IoT and medical devices and systems. The frameworks is based on TIPPSS princ…
…
continue reading

1
Mike Holcomb on Starting and Succeeding in OT Cybersecurity
42:40
42:40
Play later
Play later
Lists
Like
Liked
42:40Mike Holcomb, global lead for ICS and OT cybersecurity at Fluor, joins the Nexus Podcast to discuss his advocacy and efforts to educate engineers and IT cybersecurity professionals in the nuances of protecting operational technology and industrial control systems. Mike produces and hosts a learning series available for free on YouTube called "Getti…
…
continue reading

1
Ron Fabela on Low-Skilled OT and ICS Threat Actors
36:33
36:33
Play later
Play later
Lists
Like
Liked
36:33Ron Fabela of ABS Consulting joins the Nexus Podcast to dispel some of the myths surrounding threat actors targeting operational technology and industrial control systems. Groups such as the Russian Cyber Army, UserSec, and the CyberAv3ngers have different ideological motivations, and have decidedly carried out low-impact attacks on OT. Fabela cove…
…
continue reading

1
Munish Walther-Puri on Creating a Scale for Cybersecurity Incidents
33:25
33:25
Play later
Play later
Lists
Like
Liked
33:25Munish Walther-Puri of the Center for Global Affairs at New York University joins the Claroty Nexus podcast to discuss a homegrown severity scale for critical infrastructure cybersecurity incidents. The Infrastructure Cyber Incident Scale, or INCI Scale, brings a Richter-Scale-like criticality index to incidents based on the intensity, magnitude, a…
…
continue reading

1
Brian Foster on the Risks of a Hyperconnected Grid
27:17
27:17
Play later
Play later
Lists
Like
Liked
27:17Brian Foster, Senior Advisor for Grid Security at Southern California Edison, joins the Nexus Podcast to discuss a presentation he gave at the S4 Conference called . Foster covers the impending risk and host of exposures expected as smart meters and other similar devices are centrally managed online. This scenario gives attackers the ability to att…
…
continue reading

1
CISA's Matthew Rogers on Secure by Demand for OT
39:23
39:23
Play later
Play later
Lists
Like
Liked
39:23Matthew Rogers, ICS Cybersecurity Strategy & R&D Lead at the Cybersecurity & Infrastructure Security Agency (CISA) joins the Nexus Podcast to discuss the agency's latest publication: “Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products.” This guide features 12 cybersecurity recom…
…
continue reading
Claroty Team82 researcher Noam Moshe joins the Nexus Podcast to discuss the IOCONTROL malware used by an Iranian APT actor known as the CyberAv3ngers to target civilian critical infrastructure in the U.S. and Israel. The malware acts as a Linux-based backdoor and has a modular configuration that can be adapted for IoT, OT, and SCADA devices. Read T…
…
continue reading

1
Team82 on Attacking the Insecure IoT Cloud
31:38
31:38
Play later
Play later
Lists
Like
Liked
31:38Claroty Team82's Noam Moshe and Tomer Goldschmidt join the Nexus Podcast to discuss the research team's latest publication on 10 vulnerabilities discovered in Ruijie Networks' Reyee OS cloud platform. A chain of these vulnerabilities could allow an attacker to remotely execute code on any device connected to the Ruijie cloud. Team82 also developed …
…
continue reading

1
Volexity's Steven Adair on the Nearest Neighbor Attack
37:23
37:23
Play later
Play later
Lists
Like
Liked
37:23Volexity founder Steven Adair joins the Claroty Nexus Podcast to discuss the Nearest Neighbor Attack, a unique attack carried out by Russia's APT 28 against a high-value target in an attempt to gain intelligence on Ukraine prior to the start of the war in February 2022. APT 28 was able to compromise the Wi-Fi network of its target without being in …
…
continue reading

1
Joe Saunders on Advanced Cyberattacks Against Critical Infrastructure
34:43
34:43
Play later
Play later
Lists
Like
Liked
34:43Runsafe Security CEO and Cofounder Joe Saunders joins the Nexus Podcast to discuss the strategic shift from certain APTs toward destructive cyberattacks targeting U.S. critical infrastructure. Groups such as Volt Typhoon and Sandworm have aggressively focused their efforts on hacking OT, IoT, and healthcare organizations, opening new fronts that as…
…
continue reading

1
Grant Geyer on the Business Impact of Disruptions from Cyberattacks
25:03
25:03
Play later
Play later
Lists
Like
Liked
25:03Claroty Chief Strategy Officer Grant Geyer joins the Nexus Podcast to discuss the results of a survey of 1,100 cybersecurity leaders and practitioners on the business impact of disruptions from cyberattacks on cyber-physical systems. The financial losses are steep from these attacks impacting connected systems that are so central to our way of life…
…
continue reading

1
Alethe Denis on Social Engineering, Red-Teaming
43:45
43:45
Play later
Play later
Lists
Like
Liked
43:45Bishop Fox senior security consultant Alethe Denis joins the Claroty Nexus podcast to discuss social engineering in cybersecurity and how it has become part of red-team engagements, especially inside critical infrastructure organizations. She explains the value of open source intelligence and data stolen in breaches to scammers and extortionists in…
…
continue reading

1
Alon Dankner on Extracting Crypto Keys from PLCs
27:58
27:58
Play later
Play later
Lists
Like
Liked
27:58Alon Dankner of the Technion Institute for Technology in TelAviv Israel joins the Claroty Nexus Podcast to discuss a presentation he gave at the recent Black Hat cybersecurity conference in Las Vegas. Dankner and colleague Nadav Adir's presentation looked at the attack surface of programmable logic controllers (PLCs), in particular Siemens’ S7 prot…
…
continue reading

1
Noam Moshe on Extracting Forensic Data from Unitronics PLCs
27:52
27:52
Play later
Play later
Lists
Like
Liked
27:52Claroty Team82 researcher Noam Moshe joins the Nexus Podcast to talk about Team82’s research into Unitronics Vision series integrated HMI/PLC devices. The OT devices were exploited last year in attacks against water treatment facilities in the U.S. and Israel. Team82 researched the security of these devices and developed a pair of tools that allowe…
…
continue reading

1
Alexander Antukh on Cyber Risk Quantification
43:05
43:05
Play later
Play later
Lists
Like
Liked
43:05Alexander Antukh, CISO of AboitizPower in the Philippines, the country's largest power and renewable energy provider, joins the Nexus Podcast to discuss cyber risk quantification (CRQ). CRQ is a popular framework used to assess the financial impact of a cybersecurity threat on an organization. Antukh is an advocate of CRQ, and discusses his approac…
…
continue reading

1
Vincente Diaz on Using AI for Malware Analysis
27:38
27:38
Play later
Play later
Lists
Like
Liked
27:38Vincente Diaz, Threat Intelligence Strategist on Google’s VirusTotal team and formerly the EU director of Kaspersky Lab’s Global Research & Analysis Team, joins the Nexus Podcast to discuss how artificial intelligence and machine learning is an integral part of what VirusTotal is doing around malware analysis. Vincente describes the advantages thes…
…
continue reading
Ahmik Hindman, Senior Network and Security Solution Consultant at Rockwell Automation, joins the Claroty Nexus podcast to discuss the challenges and success stories he's experienced in patching operational technology equipment and industrial control systems. Hindman has been at Rockwell Automation for 28 years and has expansive experience with cust…
…
continue reading
Dr. Bilyana Lilly, an expert on geopolitics and Russia’s codification of information warfare as a strategy, says that the war in Ukraine has only temporarily delayed Russia’s activity against the West in cyberspace. On this episode of the Nexus podcast, she reinforces the idea that despite the fact that Russia is operating under severe resource con…
…
continue reading

1
Vinnie Liu on Offensive Security Testing During Incidents
29:30
29:30
Play later
Play later
Lists
Like
Liked
29:30Bishop Fox CEO and Cofounder Vinnie Liu joins the Nexus Podcast to discuss his team's role during security incidents in conducting offensive security testing alongside incident response activities. In healthcare environments where ransomware is the leading threat, red-teams and other offensive security specialists are called in, Liu said, to ensure…
…
continue reading

1
Diana Kelley on Protecting the AI Lifecycle
26:11
26:11
Play later
Play later
Lists
Like
Liked
26:11Protect AI Chief Information Security Officer Diana Kelley joins the Claroty Nexus podcast to discuss the intricacies of securing machine learning and artificial intelligence use inside the enterprise. She also explains the concept of MLSecOps and how it compares and contrasts to DevOps used in application development. For more, visit nexusconnect.…
…
continue reading

1
Jennifer Minella on OT Cybersecurity Convergence
29:56
29:56
Play later
Play later
Lists
Like
Liked
29:56Jennifer Minella, founder and principal advisor of Viszen Security, joins the Claroty Nexus podcast to discuss her experiences advising organizations on operational technology implementations, risk management, and succeeding at IT/OT convergence. This episode was recorded during RSA Conference where Jennifer and Bryson Bort gave a talk on convergen…
…
continue reading

1
Charles Blauner on the Changing Role of the CISO
31:00
31:00
Play later
Play later
Lists
Like
Liked
31:00Charles Blauner, Team8 operating partner and CISO in residence, joins the Claroty Nexus podcast to discuss the rapid changes in responsibilities and liability risks facing today's chief information security officers. Blauner, former CISO at JP Morgan and Deutsche Bank, describes how, for example, the new SEC rules around disclosures and incidents, …
…
continue reading

1
Mikko Hypponen on a Decade of Corporate Ransomware Attacks
32:18
32:18
Play later
Play later
Lists
Like
Liked
32:18Cybersecurity pioneer Mikko Hypponen joins the Claroty Nexus live at the RSA Conference to discuss a decade of ransomware attacks against corporate networks. Hypponen is Chief Research Officer at WithSecure, the former F-Secure for Business. He has observed and analyzed malware from its infancy when it was a merely a means of disruption and attenti…
…
continue reading

1
Adm. Michael Rogers on Geopolitics and Cybersecurity
27:57
27:57
Play later
Play later
Lists
Like
Liked
27:57Former NSA Director Adm. Michael S. Rogers (Ret. USN) joins the Claroty Nexus Podcast live from RSA Conference in San Francisco to discuss the current geopolitical climate, its impact on chief information security officers, and how they can and should response. Rogers discusses how the doctrines of adversaries are changing and that U.S. critical in…
…
continue reading

1
Abel Archundia on Complexity in Critical Infrastructure
35:37
35:37
Play later
Play later
Lists
Like
Liked
35:37Abel Archundia, chief technology officer and global head of advisory for Istari, joins the Claroty Nexus podcast to discuss the nature of complexity, technical debt, and regulation, and how it influences risk decisions in critical infrastructure environments. He explains the challenges complexity brings to manufacturing, pharmaceuticals, and other …
…
continue reading
Adam Gluck, founder and CEO of Copia Automation, joins the Claroty Nexus podcast to discuss the need for DevOps within industrial automation. DevOps practices are popping up more frequently in these environments, but there are still hurdles and challenges for developers and engineers to overcome. Adam covers those, and explains how DevOps can impro…
…
continue reading

1
Greg Garcia on the Change Healthcare Cyberattack
44:35
44:35
Play later
Play later
Lists
Like
Liked
44:35Greg Garcia, the executive director of the Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group, joins the Claroty Nexus podcast to discuss the Change Healthcare ransomware attack and what can be done from a policy perspective to minimize the impact of such attacks in the future. Garcia has had a long career on the…
…
continue reading

1
Ryan Pickren on New Web-Based PLC Malware Research
35:17
35:17
Play later
Play later
Lists
Like
Liked
35:17Ryan Pickren, a Ph.D. student in the School of Electrical and Computer Engineering at the Georgia Institute of Technology, joins the Claroty Nexus podcast to discuss a recently published research paper that explains a new web-based malware attack against programmable logic controllers. Pickren, the lead author, along with colleagues Tohid Shekari, …
…
continue reading

1
Mike Rogers on Understanding a CISO's Personal Exposure in Cyber Incidents
37:26
37:26
Play later
Play later
Lists
Like
Liked
37:26Hormel Foods Chief Information Security Officer and Director of Information Security and Compliance Mike Rogers joins the Claroty Nexus podcast to discuss why it's so important for CISO's to understand their personal liability during cybersecurity incidents. New regulations, including the SEC's cybersecurity rules, are driving this need for securit…
…
continue reading

1
Team82 Answers More of your OT Cybersecurity Questions
31:58
31:58
Play later
Play later
Lists
Like
Liked
31:58Noam Moshe of Claroty Team82 is back to answer more listener questions about OT vulnerability research, threats and risks to OT networks and IoT devices, and the best mitigation and remediation strategies for defenders. This is a follow-up podcast to an episode we recorded in December answering listener questions. You can listen to that episode her…
…
continue reading

1
Wrap-up: Final Episode of Security Voices
41:57
41:57
Play later
Play later
Lists
Like
Liked
41:57After 5 seasons, it’s curtain call for Security Voices. In this final episode, Jack and I reflect on half a decade of podcasting together through times that were both extraordinary for the world and for each of us personally. We discuss some of our favorite moments, most memorable guests, and the lessons learned from roughly 60 episodes of explorin…
…
continue reading
Phlow Corp., CIO Juan Piacquadio joins the Claroty Nexus podcast to discuss the application of Industry 4.0 to pharmaceuticals, also known as Pharma 4.0. The industry is quickly adopting advanced technologies such as artificial intelligence, digital twins, and augmented reality to enhance the development of medicine and improve patient care. Along …
…
continue reading

1
David Elfering on CISOs and Cyber Liability Insurance
44:19
44:19
Play later
Play later
Lists
Like
Liked
44:19David Elfering, CISO at Carrix and former security and risk executive at Marsh, is back for another episode of the Claroty Nexus podcast to discuss cyber liability insurance. Elfering has extensive experience working not only as an enterprise cybersecurity executive, but also with one of the world's leading insurance carriers. Listen as he brings i…
…
continue reading

1
Team82 Answers Your Vulnerability Research Questions
28:47
28:47
Play later
Play later
Lists
Like
Liked
28:47Team82 researchers Sharon Brizinov and Noam Moshe join the Claroty podcast for a special episode where they answer questions submitted by users. This Ask-Me-Anything style of podcast covers the team's OT and IoT vulnerability research process, resources for experienced and beginner vulnerability researchers, and insights from their point of view on…
…
continue reading

1
Cultural Decryption: A Closer Look at Understanding the India/U.S. Relationship in Cyber
1:00:08
1:00:08
Play later
Play later
Lists
Like
Liked
1:00:08The ascendancy of India in Silicon Valley is undeniable. From top executives such as Satya Nadella (Microsoft) and Nikesh Arora (Palo Alto Networks) to leading investors, we’ve become well accustomed to working with and often for people who have immigrated from India. Given the wave of immigration from India started decades ago, our Indian coworker…
…
continue reading

1
Mandiant on Sandworm APT Attacks in Ukraine
30:27
30:27
Play later
Play later
Lists
Like
Liked
30:27Nathan Brubaker, Mandiant and Google Cloud Head of Emerging Threats and Analytics, joins the Claroty Nexus podcast for a timely discussion on his team’s report published this week on the Sandworm APT’s activity in Ukraine. Sandworm leveraged a new TTP—Living off the Land techniques—to target a Ukrainian energy company in October 2022 to cause a pow…
…
continue reading

1
Don Weber on Security Culture in Control Environments, STAR Methodology
44:41
44:41
Play later
Play later
Lists
Like
Liked
44:41Don Weber of Cutaway Security joins the Nexus podcast to discuss a trend in control environments where asset operators and engineers keep trained cybersecurity professionals at arm's length, citing safety concerns. As more control systems are connected and managed online, it's critical for certified security professionals to be included in overall …
…
continue reading
Misha Belisle and Blaine Jeffries of MITRE join the Claroty Nexus podcast to discuss Caldera for OT, a new set of operational technology plugins for the open source core Caldera adversary emulation platform. Caldera for OT supports the Modbus, BACnet, and dnp protocols, and Belisle and Jeffries hope to add future support for additional protocols. R…
…
continue reading

1
Farewell, Sun Tzu: The Modern Security Mindset with Kelly Shortridge
1:03:12
1:03:12
Play later
Play later
Lists
Like
Liked
1:03:12The classic mindset of cyber security unmistakably originates from its early leaders: financial services, the defense industrial complex, and big companies that had too much to lose from ignoring what was called at the time “information security risk”. They tried to calculate largely unknowable risks to explain digital concepts to analog executives…
…
continue reading
Retired Pfizer Chief Information Security Officer Jim Labonty joins the podcast to discuss the operational technology (OT) security stack, and how it differs from IT. This episode provides especially important for the growing number of security leaders who are newly responsible for OT cybersecurity and the safety of cyber-physical systems. Labonty …
…
continue reading

1
Choosing your own adventure: Frank Wang on academia, VC, sec engineering & side hustles
59:04
59:04
Play later
Play later
Lists
Like
Liked
59:04Let’s say it’s 2012. And you're graduating Stanford with a comp sci degree. You could go to Google, Facebook or any of a number of well-paying emerging juggernauts. If you’re Frank Wang, you move across the coast and do your PhD in cybersecurity at MIT. Now you’re doing your PhD. And you make pals with a local VC. So naturally, you start a cybersec…
…
continue reading

1
Stephen Reynolds on Protecting the CISO During Incident Investigations
33:46
33:46
Play later
Play later
Lists
Like
Liked
33:46Stephen Reynolds, a partner at the law firm of McDermott, Will, and Emery, joins the Nexus Podcast to discuss some of the concerns and questions CISOs and other security executives may have about their personal liability and exposure during breach investigations. The short of it: Don’t panic, but don’t be unprepared either. In this case, preparatio…
…
continue reading

1
Team82 on NAS Research, OPC UA Exploit Framework
34:30
34:30
Play later
Play later
Lists
Like
Liked
34:30Team82’s extensive research into network attached storage devices and the ubiquitous OPC UA industrial protocol came to a head recently in Las Vegas with a pair of presentations at Black Hat USA and DEF CON disclosing vulnerabilities in Synology and Western Digital NAS cloud connections and the unveiling of a unique OPC UA exploit framework. In thi…
…
continue reading

1
Bishop Fox on OSDP Weaknesses Putting Secure Facilities at Risk
26:30
26:30
Play later
Play later
Lists
Like
Liked
26:30In this episode of the Nexus podcast, Bishop Fox researchers Dan Petro and David Vargas explain their research into the Open Supervised Device Protocol (OSDP), meant to bring encryption to badge readers and controllers providing physical access controls at secure facilities. Petro and Vargas explain a number of protocol weaknesses and vulnerabiliti…
…
continue reading

1
Jennifer Lyn Walker on Cybersecurity Risks in the Water Sector
46:42
46:42
Play later
Play later
Lists
Like
Liked
46:42Jennifer Lyn Walker, Director of Infrastructure Cyber Defense for the WaterISAC, joins the Nexus podcast to discuss the state of cybersecurity within the water and wastewater critical infrastructure sector. Walker explains where the cybersecurity technology, funding, and skills gaps currently exist among smaller—and larger—water providers. She also…
…
continue reading

1
Episode #57: Claroty’s Galina Antova on the global infrastructure war & building an $100M OT security juggernaut
1:06:24
1:06:24
Play later
Play later
Lists
Like
Liked
1:06:24This past weekend, the New York Times posted an article explaining the United States is scrambling to clean government systems from a deep, pervasive infiltration of the country’s infrastructure by the Chinese. Much like the Russian attacks on Ukrainian infrastructure, the intent appears to be to disrupt any U.S. action that would be a response to …
…
continue reading

1
Kathleen Moriarty on CIS' IoT Security Guidance
38:38
38:38
Play later
Play later
Lists
Like
Liked
38:38Kathleen Moriarty, Chief Technology Officer of the Center for Internet Security (CIS) joins the Nexus podcast to discuss CIS' recently published IoT Embedded Security Guidance. The document walks vendors, developers, DevOps professionals through the most commonly used IoT protocols and analyzes them from a security perspective. The aim is to help v…
…
continue reading