(CS)²AI Podcast Show: Control System Cyber Security

Derek Harp

Control System Cyber Security Association International, or (CS)²AI, is the premier global non-profit workforce development organization supporting professionals of all levels charged with securing control systems. With over 34,000 members worldwide, we provide the platform for members to help members, foster meaningful peer-to-peer exchange, continue professional education, and directly support OT and ICS cyber security professional development in every way. Our founder, Derek Harp, interviews cyber security leaders and brings relevant insights to help any company handle cybersecurity effectively.

  1. 129: Why OT Cybersecurity Isn't a One-Tool Problem: Insights to be discussed at Level Zero

    27 MAR

    129: Why OT Cybersecurity Isn't a One-Tool Problem: Insights to be discussed at Level Zero

    In this insightful episode of the (CS)²AI Podcast, host Derek Harp welcomes Jay Gignac, Vice President of Sales at FoxGuard Solutions, (CS)²AI Fellow and a passionate OT cybersecurity evangelist. The conversation centers around some of the most pressing challenges in the control systems industry—asset visibility, patch management, and community collaboration. Jay, who will be speaking at the upcoming Level Zero OT Cybersecurity Conference, offers expert-level advice for professionals navigating the complex world of operational technology security. Listeners will hear real-world examples of how OT differs from IT, particularly in areas like patching and compliance. Jay shares how asset discovery and lifecycle management remain fundamental hurdles, even after over a decade of cybersecurity initiatives. The discussion explores the nuances across industry verticals—energy, manufacturing, oil & gas—and underscores why tailored approaches are critical when securing diverse OT environments. This episode is a must-listen for OT professionals, cybersecurity leaders, and anyone attending Level Zero or looking to deepen their understanding of control systems security. Discover why collaboration, not just technology, is key to long-term success in the OT space. Whether you’re an engineer, a procurement officer, or a seasoned CISO, there’s valuable insight here for everyone working to protect the core of their company’s operations.

    15 min
  2. 128: From the Pentagon to Public Safety: Lucian Niemeyer’s Mission to Secure OT

    18 FEB

    128: From the Pentagon to Public Safety: Lucian Niemeyer’s Mission to Secure OT

    Lucian Niemeyer, Chief Executive Officer of Building Cyber Security and former Assistant Secretary of Defense, joins Derek Harp to discuss the growing cyber risks to operational technology (OT) systems and the urgent need for proactive frameworks to protect public safety. Recorded live at Hack the Capitol 7.0, this episode delves into the vulnerabilities in smart buildings, connected infrastructure, and critical systems that could have life-threatening consequences if exploited. Lucian shares how his experience in national security shaped his focus on OT cybersecurity, emphasizing the physical impacts of cyberattacks on HVAC systems, elevators, and even water utilities. He introduces the concept of cyber commissioning, a process that ensures building systems are configured securely from the start. Lucian also explains how Building Cyber Security is creating industry-specific frameworks to help facility managers, building owners, and policymakers mitigate risks and reduce insurance liabilities. With increasing threats from ransomware, nation-states, and insider errors, this episode highlights why securing operational technology is critical to protecting both property and lives. Learn how Lucian’s nonprofit is driving collaboration across industries to address this rapidly evolving threat landscape.

    28 min
  3. 127: Unlocking the Power of Asset Inventory in OT Cybersecurity with Roya Gordon

    11 FEB

    127: Unlocking the Power of Asset Inventory in OT Cybersecurity with Roya Gordon

    Roya Gordon, previously the Executive Industry Consultant - Operational Technology (OT) Cybersecurity at Hexagon Asset Lifecycle Intelligence and currently, is the Deputy CISO at ENGIE North America Inc., joins Derek Harp live from Hack the Capitol 7.0 to explore the evolving landscape of asset inventory in operational technology (OT). Roya breaks down the differences between asset visibility, inventory, and management, sharing her firsthand experiences from both passive and configuration-based methodologies. Roya highlights the critical role of asset inventory in building a strong OT cybersecurity foundation. From distinguishing between passive and active network monitoring to the importance of configuration management, she emphasizes how a multi-layered approach can offer comprehensive visibility and risk management. Roya also dives into why organizations often overlook configuration change management, and how integrating different solutions can optimize security efforts. Whether you’re a seasoned OT professional or just starting your cybersecurity journey, this episode offers valuable insights into improving asset management, reducing risks, and fostering collaboration between vendors and operators.

    24 min
  4. 126: Shifting Left: Why Secure Software Starts at the Design Stage

    4 FEB

    126: Shifting Left: Why Secure Software Starts at the Design Stage

    In this episode of the (CS)²AI Podcast, host Derek Harp welcomes Mehdi Tarrit Mirakhorli, Associate Professor at the University of Hawaii and a Cybersecurity Expert, to discuss Secure by Design—a fundamental shift in how we develop and deploy software in industrial control systems (ICS) and operational technology (OT). With over 15 years of R&D experience for DARPA, the Air Force, and DHS, Mehdi shares why modern software is inherently vulnerable and how we can learn from aviation, medical, and safety-critical industries to build resilient systems from the ground up. The conversation dives deep into the risks of insecure by design software, the challenges of implementing true security practices, and the role of government policies in shifting liability from users to vendors. Mehdi explains the importance of threat modeling, attack surface analysis, and secure architecture frameworks to mitigate cyber threats before they arise. He also highlights how software development must evolve beyond rapid deployment cycles to integrate security as a core design principle. If you’re an ICS professional, cybersecurity engineer, or software developer, this episode provides actionable insights on reducing vulnerabilities at scale, implementing proactive security measures, and preparing for the future of cyber threats. Subscribe now and stay ahead in the ever-evolving world of industrial cybersecurity!

    35 min
  5. 125: Decoding SBOMs: Kyle McMillian on Cybersecurity and Supply Chain Transparency

    28 ENE

    125: Decoding SBOMs: Kyle McMillian on Cybersecurity and Supply Chain Transparency

    Derek Harp welcomes Kyle McMillian, Product Security Officer at Siemens, to discuss the evolving landscape of software bill of materials (SBOMs) and their role in modern cybersecurity. Recorded live at Hack the Capitol 7.0, this conversation unpacks the challenges and opportunities posed by SBOMs in an industry grappling with legacy systems and modern threats. Kyle dives into the origins of SBOMs, their role in addressing vulnerabilities like Log4J, and their potential to transform procurement, risk management, and incident response. He emphasizes the importance of balancing transparency with practicality, noting that SBOMs are a starting point for broader cybersecurity conversations. With his unique perspective from a leading equipment manufacturer, Kyle shares insights into how SBOMs can help bridge the gap between IT and OT systems. This episode is essential for anyone looking to understand the future of cybersecurity and the critical role of SBOMs in securing industrial control systems. Learn how these tools can foster trust, streamline risk management, and improve collaboration across the industry.

    27 min
  6. 124: Capture the Flag: Transforming Cybersecurity Training with Kenneth Warren

    21 ENE

    124: Capture the Flag: Transforming Cybersecurity Training with Kenneth Warren

    Derek Harp sits down with Kenneth Warren, Staff OT and Offensive Security Engineer at GRIMM Cyber, to discuss how gamification and Capture the Flag (CTF) competitions are revolutionizing cybersecurity training. Recorded live at Hack the Capitol 7.0, this conversation explores how CTFs and cyber ranges create safe, hands-on environments for learning offensive and defensive cybersecurity skills. Kenneth explains how CTFs offer opportunities to tackle real-world scenarios, from navigating complex networks to interacting with industrial control protocols. Whether you're an experienced professional or a newcomer to the field, CTFs provide a unique way to build and refine your skills. He also highlights how gamification reaches audiences that traditional training might miss, making learning engaging and accessible. This episode provides insights into the growing role of gamified learning in cybersecurity and how it’s inspiring the next generation of professionals. Discover how these competitions foster collaboration, creativity, and innovation in a rapidly evolving industry.

    23 min
  7. 123: From Classroom to Crisis: Immersive Training for ICS Security Professionals

    14 ENE

    123: From Classroom to Crisis: Immersive Training for ICS Security Professionals

    Derek Harp hosts Jeff Hahn, Project Manager at Idaho National Laboratory (INL), to discuss innovative approaches to training in the ICS and OT cybersecurity space. Recorded live at Hack the Capitol 7.0, Jeff shares insights into how INL’s escape rooms provide hands-on, immersive learning experiences for professionals and students alike. The escape rooms integrate learning objectives from INL’s renowned 301 Red Team/Blue Team training, transforming them into engaging, gamified challenges. These exercises offer participants a chance to simulate real-world scenarios, improve teamwork, and develop critical cybersecurity skills. Jeff also highlights the importance of bridging gaps between IT and OT teams through collaborative training initiatives. Whether you're a seasoned professional or a newcomer to the field, this episode explores how gamification and experiential education can help prepare the next generation of cybersecurity experts. Discover how these escape rooms are traveling the world, raising awareness, and making learning accessible to everyone.

    23 min
  8. 122: Securing the Future: Rob Shaughnessy on Innovation, Supply Chain, and Cyber Threats

    7 ENE

    122: Securing the Future: Rob Shaughnessy on Innovation, Supply Chain, and Cyber Threats

    Derek Harp welcomes Rob Shaughnessy, President & CEO, Director of Psymetis, Inc., to discuss critical issues in the world of ICS and OT security, recorded live at Hack the Capitol 7.0. Rob dives into the vulnerabilities surrounding the development of innovative technologies, supply chain risks, and the evolving threat landscape posed by nation-state actors. The conversation highlights the growing need for transparency in supply chains, the legal gaps in cybersecurity requirements for technology companies, and the rise of services like ransomware-as-a-service, which lower the bar for cybercriminals. Rob also shares his perspective on education and workforce challenges in cybersecurity, emphasizing the importance of foundational skills and the risks of over-relying on influencer culture. Packed with actionable insights, this episode offers a nuanced look at the complexities of securing critical infrastructure, balancing innovation with security, and preparing for a more connected, yet vulnerable, future.

    33 min
Ver todo (131)

Información

Control System Cyber Security Association International, or (CS)²AI, is the premier global non-profit workforce development organization supporting professionals of all levels charged with securing control systems. With over 34,000 members worldwide, we provide the platform for members to help members, foster meaningful peer-to-peer exchange, continue professional education, and directly support OT and ICS cyber security professional development in every way. Our founder, Derek Harp, interviews cyber security leaders and brings relevant insights to help any company handle cybersecurity effectively.

Ficha técnica