(CS)²AI Podcast Show: Control System Cyber Security

Derek Harp

Control System Cyber Security Association International, or (CS)²AI, is the premier global non-profit workforce development organization supporting professionals of all levels charged with securing control systems. With over 34,000 members worldwide, we provide the platform for members to help members, foster meaningful peer-to-peer exchange, continue professional education, and directly support OT and ICS cyber security professional development in every way. Our founder, Derek Harp, interviews cyber security leaders and brings relevant insights to help any company handle cybersecurity effectively.

  1. 15h ago

    The FDA's Biggest Stick: Medical Device Cybersecurity with Billy Rios

    Billy Rios, (CS)²AI Fellow, Cybersecurity Researcher, Author, & Co-Founder of QED Secure Solutions, joins Derek Harp for the audience Q&A after presenting his team's research on a connected wheelchair that was later recalled. Billy explains why the FDA's power to keep a device off the US market is the biggest stick in any industry, what a recall means when the problem is software, and why a manufacturer can't simply switch off a core feature to fix a flaw. They get into legacy "big iron" devices (Billy has bought a CT scanner and a C-arm), why the FDA's guidance works even though it isn't prescriptive, and how manufacturers' behavior has changed in about ten years. Billy also gives advice to researchers: bug bounties, making a living as an independent, how the CFAA and DMCA good-faith exception affect legal risk, and a plain-English explanation of side-channel attacks. Watch the wheelchair clip: https://youtu.be/6-iBC5ugiSo More from (CS)²AI on YouTube: https://www.youtube.com/@cs2ai Guest: Billy Rios, (CS)²AI Fellow, Cybersecurity Researcher, Author, and Co-Founder of QED Solutions Host: Derek Harp, Founder and Chairman, (CS)²AI Recorded live during a (CS)²AI Online webinar on October 21, 2026. Chapters: 00:42 Welcome from Trisha Harp and the wheelchair research 02:01 Who decides whether a manufacturer reports to the FDA? 04:44 Are manufacturers getting better? Why the FDA matters 08:43 The FDA's biggest stick: keeping a device off the market 09:16 What a recall means when the problem is software 11:15 Guidance that isn't prescriptive 14:16 Controlled vs. uncontrolled vulnerabilities, and the wheelchair dilemma 17:30 How the FDA process changed manufacturers 20:11 Legacy "big iron": CT scanners, C-arms and VBScript 24:08 Standards, secure by design and the "soup" analogy 26:10 Connected devices multiplying inside and outside the hospital 28:24 Advice for researchers: the 300 backdoor passwords and the PATCH Act 30:58 Bug bounties and making a living as a researcher 34:55 Legal risk: the CFAA and the DMCA good-faith exception 37:11 Side-channel attacks explained 38:56 Why only the FDA can do this 41:13 Parting words Legal topics in this episode are Billy's views, not legal advice. Produced by (CS)²AI (Control System Cyber Security Association International).

    The FDA's Biggest Stick: Medical Device Cybersecurity with Billy Rios

  2. Oct 27

    138: From Army Engineer to Critical Infrastructure Security with Marcus Sachs

    From Army Engineer to Critical Infrastructure Security with Marcus Sachs Marcus Sachs, SVP and Chief Engineer at the Center for Internet Security, joins Derek Harp for a long-overdue conversation about how a civil engineer in the Army ended up securing critical infrastructure. Marcus traces his path from an unusual start across Alabama, Pakistan and Germany, through ROTC and the Army Engineers, to the events of the mid-1990s that gave rise to the formal term "critical infrastructure." He explains what Y2K taught the military about inventory and interdependencies, how far OT security has come since SCADA was the term of art, and the advice he would give people entering the field today. They close with the Enigma machines he brings to Level Zero and why technology alone never covers all the bases. Guest: Marcus Sachs, SVP and Chief Engineer, Center for Internet Security Host: Derek Harp, Founder and Chairman, (CS)²AI Chapters: 00:42 Welcome and introducing Marcus Sachs 02:24 An unusual starting point: Alabama, Pakistan and Germany 05:53 ROTC, the Cold War and early hacking in Germany 09:30 Choosing engineering and the Army Engineers 14:59 Fort Belvoir: staying behind to fix things 20:00 Physics, culture and new technology in OT 22:48 From civil engineering to cyberspace 27:31 Oklahoma City, PDD 63 and critical infrastructure 31:00 The 1998 intrusion, Y2K and the great inventory 35:48 How far OT security has come 40:51 Crossing paths: a Navy flagship and Haiti 42:34 Advice for people entering the field 51:20 Enigma machines and mechanical encryption 54:39 People, process and technology: the work never ends 56:36 Closing thoughts and thanks Produced by (CS)²AI (Control System Cyber Security Association International).

    138: From Army Engineer to Critical Infrastructure Security with Marcus Sachs

  3. Oct 20

    137: From Conference to Change: Asset Owners on What They Actually Did After Level Zero

    From Conference to Change: Asset Owners on What They Actually Did After Level Zero Asset owners from UPS, Southern California Edison and ExxonMobil get specific about what changed after Level Zero: a talk that became a deployed AI harness, a team member who went on to NIMS certification after the tabletop, and ideas borrowed across sectors. Christian Harter, Blake Gilson, and Brian Foster debate who should attend (almost everyone), how to prepare (don't just show up), why the hallway track matters most, and why more asset owners should take the stage. They close on AI: powerful, but it needs an operator. Guests: Blake Gilson (IT Planning & Strategy Manager, ExxonMobil); Brian Foster (Grid Security – Enterprise Sr Advisor, Southern California Edison) Host/Moderator: Christian Harter (BISO OT & Director of OT Security and Engineering, UPS) Chapters: 00:41 Panel introductions 02:02 What stuck from Level Zero 04:48 Bringing a team (UPS brought 16) 09:12 What actually changed afterwards 14:49 Send a group or one person? Budgets and training 19:28 Who should attend 23:12 How to prepare 24:38 The hallway track 30:11 What to preserve and grow: asset owner stories 43:19 Where AI ends and humans begin 49:40 A new class of worker Recorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections." Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back. Questions: info@levelzeroconference.com · Sponsorship: sponsor@levelzeroconference.com Produced by CS²AI (Control System Cyber Security Association International).

    137: From Conference to Change: Asset Owners on What They Actually Did After Level Zero

  4. Oct 13

    136: Inside the Tabletop: What an Airport OT Incident Taught Us About Command, Cost, and Chaos

    Inside the Tabletop: What an Airport OT Incident Taught Us About Command, Cost, and Chaos The team behind and inside Level Zero 2026's tabletop exercise breaks down what happened when an airport OT incident played out in real time. Derrik Oates and panelists from UPS, the Department of War, and the finance table walk through the ICS4ICS incident command framework, what it's like to be a first-timer when the pressure hits, why "keep your receipts" is real advice, and how to make sure exercise lessons actually change an organization. They also explain why the 2027 exercise becomes a dedicated full day. Guests: Christian Harter (UPS); Donovan Tindill (DeNexus); Brad Willet (UPS); Daryl Haegley (United States Department of the Air Force) Host / moderator: Derrik Oates (UTSI) Chapters: 00:00 Panel introductions 04:50 Why run tabletop exercises at all 08:48 The finance table: 'keep your receipts' 13:02 ICS4ICS sections and logistics 14:43 Decisions under fire 18:59 One voice: incident communications 20:46 Using the ICS4ICS framework anywhere 23:04 First-timer experience 27:45 Understand the problem before you fix it 30:30 Lessons learned and changes for 2027 35:20 Making lessons stick: ownership and after-action 40:56 Why practice matters: downtime and safety Recorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections." Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back. Questions: info@levelzeroconference.com Sponsorship: sponsor@levelzeroconference.com Produced by CS²AI (Control System Cyber Security Association International).

    136: Inside the Tabletop: What an Airport OT Incident Taught Us About Command, Cost, and Chaos

  5. Oct 6

    135: The Cassandra Panel: OT Threat Intelligence from April to September 2026

    The Cassandra Panel: OT Threat Intelligence from April to Now Bryan Singer revisits an April threat briefing to ask what changed in six months, and the answer is a lot. Georgia Tech's Saman Zonouz shares research on thousands of internet-exposed PLCs, web-enabled controllers, shared firmware code across vendors, and exposed solar inverters. Daryl Haegley explains why threat intel has to start with knowing what's inside the fence, and Brad Willet brings the asset owner's view: stray contractor routers, insider risk, and why no newsletter replaces a trusted network. Vivek dubbed it "the Cassandra Panel" for a reason. Guests: Saman Zonouz (Georgia Tech); Daryl Haegley (United States Department of the Air Force); Brad Willet (UPS) Host / moderator: Bryan Singer (Accenture) Chapters: 00:00 April recap: nothing sophisticated about it 03:53 Georgia Tech CPSEC and anonymous incident reporting 11:35 What changed since April 13:44 Looking inside the fence 16:08 How the Iranian campaign is progressing 18:37 Internet exposure and inventory 23:27 Not fighting the last war 24:51 Capacity gaps and web-enabled PLCs 28:53 Inside-out threat intelligence 33:38 Relationships as threat intel 37:08 Contractors, modems, and insiders 41:14 SBOM and shared firmware code 43:03 Impact-first risk and wrap-up Recorded at the (CS)²AI Online Symposium, "Level Zero: Visions & Reflections." Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back. Questions: info@levelzeroconference.com Sponsorship: sponsor@levelzeroconference.com Produced by CS²AI (Control System Cyber Security Association International).

    135: The Cassandra Panel: OT Threat Intelligence from April to September 2026

  6. Sep 29

    134: Engineers Belong at the Table: Cyber-Informed Engineering and the End of the OT/IT Boundary

    Three veterans of critical infrastructure security trace how the field went from arguing that infrastructure was even a target to treating digital risk as an engineering hazard. Ginger Wright, Sarah Freeman, and Marc Sachs define cyber-informed engineering in plain terms, share real examples of consequences engineered out of a system, explain why adversaries already read your engineering documentation, and make the case that engineers don't need to become hackers to belong in this conversation. They close with why engineers should come to Level Zero. Guests: Sarah Freeman (MITRE); Marc Sachs (Center for Internet Security) Host / moderator: Ginger Wright (Idaho National Laboratory) Chapters: 00:00 Welcome and panel introductions 02:52 Why engineering is up first at Level Zero 04:24 From 'not a target' to target du jour 08:03 Y2K to WannaCry: when the OT/IT boundary became fiction 12:28 Engineering out the consequence (NIST 800-82 Rev. 3) 14:31 Why engineers belong at the table 19:01 Digital risk and defining CIE / CCE 22:13 Real examples of designed-out consequences 28:34 Where CIE runs into regulation 32:40 Engineer pushback and 'fighting the scenario' 37:01 Digital risk is just another hazard 40:01 The five whys, and why come to Level Zero Recorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections." Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back. Questions: info@levelzeroconference.com · Sponsorship: sponsor@levelzeroconference.com Produced by CS²AI (Control System Cyber Security Association International).

    134: Engineers Belong at the Table: Cyber-Informed Engineering and the End of the OT/IT Boundary

  7. Aug 18

    133: Engineering Expertise: Core Skills for ICS/OT Cybersecurity with Marcus Sachs, Patrick Miller and Christian Harter

    Solving the OT Talent Puzzle: A Career Roadmap from Three Industry Veterans Derek Harp sits down with Marcus Sachs (Center for Internet Security), Patrick Miller (Ampyx Cyber), and Christian Harter (UPS) for a candid conversation about breaking into — and building a career in — ICS/OT cybersecurity. The panel tackles the IT/OT divide, why "dropping your ego" matters more than any certification, how AI is reshaping the skills employers want, and why old-school, face-to-face networking still beats the resume-screening algorithms. Whether you're a plant engineer eyeing cybersecurity or a security pro trying to understand the physical world, this episode is a practical roadmap for finding your way in.

    133: Engineering Expertise: Core Skills for ICS/OT Cybersecurity with Marcus Sachs, Patrick Miller and Christian Harter

  8. Jun 2

    132: Solving Problems at Scale: Kenny Mesker on OT Cybersecurity Strategy, Risk, and Leadership

    Kenny Mesker, OT Cybersecurity Strategist and Distinguished Engineer at Chevron, joins Derek Harp to share his remarkable journey from growing up on a farm in West Texas to becoming one of the industry's leading voices in operational technology (OT) cybersecurity. With more than 30 years of experience spanning electric utilities, SCADA systems, industrial control systems, and cybersecurity, Kenny reflects on the evolution of OT security from the days of air-gapped networks to today's interconnected digital environments. He discusses how a passion for problem-solving led him from electrical engineering into industrial operations and ultimately into cybersecurity strategy. Kenny offers practical advice for professionals looking to enter the OT cybersecurity field, explaining why hands-on operational experience remains one of the most valuable foundations for success. He also explores the challenges of IT/OT convergence, the importance of risk assessment, and how cybersecurity leaders must think beyond individual systems to protect entire organizations and critical infrastructure. Looking ahead, Kenny shares his perspective on artificial intelligence, cloud technologies, and the future of OT architectures, highlighting both the opportunities and challenges these emerging technologies will bring to industrial environments. Whether you're an engineer, cybersecurity professional, student, or industry leader, this episode provides valuable insights into building a successful OT cybersecurity career while helping protect the systems that power modern society.

    132: Solving Problems at Scale: Kenny Mesker on OT Cybersecurity Strategy, Risk, and Leadership
See All (141)

Ratings & Reviews

5
out of 5
2 Ratings

About

Control System Cyber Security Association International, or (CS)²AI, is the premier global non-profit workforce development organization supporting professionals of all levels charged with securing control systems. With over 34,000 members worldwide, we provide the platform for members to help members, foster meaningful peer-to-peer exchange, continue professional education, and directly support OT and ICS cyber security professional development in every way. Our founder, Derek Harp, interviews cyber security leaders and brings relevant insights to help any company handle cybersecurity effectively.

Information

You Might Also Like