Critical Assets Podcast

Patrick Miller
  • 5.0 (2)
  • TECHNOLOGY
  • UPDATED SEMIWEEKLY

The Critical Assets Podcast covers important OT and ICS security topics with an eye toward standards and regulation to keep you ahead of your adversaries... and your auditors. Ampyx Cyber. Securing your world. See our other content such as blogs, cybersecurity news and more at www.ampyxcyber.com

Episodes

  1. Policy Pulse: Regulatory Roundtable - NERC CIP, Cybersecurity Strategy, AI & Electric Sector

    FEB 1

    Policy Pulse: Regulatory Roundtable - NERC CIP, Cybersecurity Strategy, AI & Electric Sector

    Welcome to the Policy Pulse Panel, a new monthly series within the Critical Assets Podcast. Hosted by Patrick Miller (Ampyx Cyber), Earl Shockley (CEO, Inpowerd), and Joy Ditto (CEO, Joy Ditto Consulting), this recurring panel dives into the most significant policy shifts and regulatory developments impacting critical infrastructure, operational technology (OT), and industrial cybersecurity. Each month, we unpack emerging legislation, agency actions, and standards updates - connecting the dots between policy and the practical realities faced by asset owners, utilities, vendors, and government partners. If you're trying to stay ahead of your auditors and your legislators, this is your monthly must-listen. https://ampyxcyber.com/podcast/policy-pulse-regulatory-roundtable-nerc-cip-cybersecurity-strategy-ai-electric-sector

    1h 2m
  2. Vulnerability Overload: Making Prioritization Work in the Real World

    07/20/2025

    Vulnerability Overload: Making Prioritization Work in the Real World

    In this episode, Patrick Miller speaks with Kylie McClanahan, CTO at Bastazo, about the practical (and often messy) realities of patch and vulnerability management in operational technology (OT) environments. Kylie shares grounded insights into patching challenges, the gaps between IT and OT remediation cycles, and the real-world implications of relying too heavily on scoring systems like CVSS. The conversation covers CISA’s Known Exploited Vulnerabilities (KEV) catalog, exploring how it’s being used (and possibly misused) in prioritization workflows, and where the disconnects lie between policy directives and operational feasibility. Kylie also critiques the current state of vendor responsiveness, machine-readable vulnerability disclosure (CSAF), and the importance of asset and exposure awareness. This episode is essential listening for practitioners wrestling with patching fatigue, program prioritization, and the tradeoffs between theoretical vulnerability data and applied security outcomes in critical infrastructure environments. Links: CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities CISA vulnrichment: https://github.com/cisagov/vulnrichment Vulnrichment, Year One: https://www.youtube.com/watch?v=g5pSVMnWD7k CISA SSVC: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc Carnegie Mellon SSVC: https://certcc.github.io/SSVC/ CSAF: https://www.csaf.io/ VulnCheck KEV: https://vulncheck.com/kev Kylie McLanahan on LinkedIn: https://www.linkedin.com/in/kyliemcclanahan/ Bastazo: https://bastazo.com

    36 min
  3. From CISO to Startup: OT Security, Leadership, and Lessons from the Field

    04/13/2025

    From CISO to Startup: OT Security, Leadership, and Lessons from the Field

    In this episode of the Critical Assets Podcast, Patrick Miller interviews Darren Highfill, former CISO of Norfolk Southern, for a candid look behind the curtain of life as a security executive. Darren shares hard-won lessons from building and leading a cybersecurity program in a critical infrastructure environment, including how to gain executive buy-in, scale a team, and align security with business priorities. He reflects on the challenges of translating cyber risk into business risk, managing real-world incidents, and the evolving expectations of the CISO role. Whether you're in the chair now or working toward it, this conversation is packed with practical insights for anyone navigating cybersecurity leadership. Show links: Darren Highfill LinkedIn Profile - https://www.linkedin.com/in/darrenhighfill/NIST Cyber Security Framework (CSF) - https://www.nist.gov/cyberframeworkAnkrd website - https://www.ankrd.com/

    44 min
  4. Critical Conversations: IR, Forensics, and Regulation in OT

    01/04/2025

    Critical Conversations: IR, Forensics, and Regulation in OT

    In this episode, we sit down with Lesley Carhart (@hacks4pancakes), a renowned expert in OT/ICS incident response and forensics, to explore the unique challenges of defending critical infrastructure against cyber threats. Lesley shares insights into how internal OT teams can better support external IR teams, evaluates global and sector-specific preparedness, and discusses the impact of regulations on effective incident response. We delve into the complexities of defining and reporting incidents, the potential for improved approaches, and actionable advice for those looking to enhance their IR and forensics skills. Lesley also gives a glimpse into the future of their work and their continued mission to strengthen cybersecurity in critical infrastructure. Show Links: https://www.linkedin.com/in/lcarhart/ https://www.threads.net/@hacks4pancakes https://bsky.app/profile/hacks4pancakes.com https://infosec.exchange/@hacks4pancakes

    45 min
  5. Energizing Cybersecurity Careers: Workforce Development in OT/ICS

    03/03/2024

    Energizing Cybersecurity Careers: Workforce Development in OT/ICS

    Join us for a discussion on Energizing Cybersecurity Careers: Workforce Development in the OT/ICS Community. Guests Cynthia Hsu and Erin Owens dive into the cybersecurity challenges facing Industrial Control Systems and Operational Technology asset owners. Through open conversations, we explore everything from skill gaps and career pathways to diversity, continuous learning, and the impact of new technologies. This session aims to provide insights into developing a skilled, diverse cybersecurity workforce – starting from the ground up – with a focus on practical strategies for professionals, educators, and anyone interested in the future of ICS/OT security. Show links: Cynthia Hsu LinkedIn profile https://www.linkedin.com/in/cynthiahsu33/ Erin Owens LinkedIn profile https://www.linkedin.com/in/erinowens/DOE CESER Cybersecurity Training for the Utility Workforce, free 3-day ICS Cybersecurity training for electric and ONG utility staff.  Next training event: Buffalo, NY, April 23-25,  Register at: Eventleaf | Event Registration Software and Mobile Event Apps   DOE CESER CyberStrikeTM professional cybersecurity training for operational technology environments: https://inl.gov/cyberstrike/ ·       LIGHTS OUT – focus on Ukraine attacks ·       NEMESIS – focus on nation-state TTPs ·       STORMCLOUD – focus on renewable energy     DOE CESER CyberForce® workforce development program for college students focused on building a pipeline of cyber professional candidates in operational technology cybersecurity:  https://cyberforce.energy.gov/   Sandia National Laboratory Tracer FIRE (Forensic Incident Response Exercise): https://github.com/sandialabs/Tracer-FIRECenter for Cyber Defenders:  https://www.sandia.gov/careers/career-possibilities/students-and-postdocs/internships-co-ops/institute-programs/titans-technical-internships-to-advance-national-security/titans-cyber/  Cyber Defense Center https://www.cyberdefensecenter.org/

    1h 8m
  6. CIE: Architecting Infrastructure Immunity

    11/09/2023

    CIE: Architecting Infrastructure Immunity

    In this episode, we take a deep dive into the world of Cyber Informed Engineering (CIE), joined by Ginger Wright, Program Manager at Idaho National Laboratory. This episode unpacks CIE's strategic efforts to integrate cybersecurity into the very fabric of engineering critical infrastructure. We discuss the evolution of CIE and how it's transforming the approach to system design. We cover the synergy between engineers and cybersecurity experts and the implementation of engineering-based mitigations. Get insights on building resilience into critical systems from the ground up.

    54 min
  7. One Rule to Rule Them All

    09/05/2023

    One Rule to Rule Them All

    Join Patrick Miller, CEO of Ampere Industrial Security and his guest Danielle Jablanski, OT Cybersecurity Strategist at Nozomi Networks as they continue their debate on the topic: "If you could have only one cybersecurity regulation, what should that be?" They cover everything from threat hunting, vulnerability management, attack surface management, incident response, breach notification, risk quantification, cybersecurity insurance, NIS2, NERC CIP, and what's best for corporate vs. public good.

    59 min
  8. Ghost in the Machine: a Future Look at AI and OT

    06/26/2023

    Ghost in the Machine: a Future Look at AI and OT

    Join Patrick Miller, CEO of Ampere Industrial Security and his guest Amanda Freick, CRO of Altruistic as they discuss the need for collaboration and breaking down cultural barriers to effectively utilize data and drive innovation in the energy sector with AI/ML. We also touch upon the importance of approaching generative AI and language models like GPT with a strategic mindset, understanding the specific needs and goals of the organization before implementation. Additionally, we talk about the importance of recognizing and leveraging the untapped skills and potential within an organization to drive transformation and democratize access to meaningful work. Show Links: Amanda Freick LinkedIn - https://www.linkedin.com/in/amandafreick/ Altruistic Video Case Study - https://vimeo.com/733720685 Tony Robbins Book, Life Force - https://amzn.to/3qTXRfj

    44 min
  9. Breaking into the OT Cybersecurity Field

    05/11/2023

    Breaking into the OT Cybersecurity Field

    Hear from an experienced ICS/OT Security Manager, Gabe Agboruche, on how to enter or upskill into the ICS/OT cybersecurity field. He answers questions such as… What training is available? What are the biggest obstacles? What are some common job roles? What are the best paying job roles? We also cover the asset owner’s perspective on how they can obtain and retain new cybersecurity professionals.SHOW LINKS:Gabe Agboruche LinkedIn ProfileGabe’s YouTube channel - Struggle SecurityMalware Traffic AnalysisFree Network EmulatorsICSVillageICS Village Youtube ChannelSans ICS Free ResourcesSANS ICS ConceptsDNP3 SimulatorsScapyCompTIA (Security+ and Network+ certifications)

    42 min
  10. Simplifying ICS Security Metrics

    03/09/2023

    Simplifying ICS Security Metrics

    Getting started with ICS and OT security metrics can be hard. What do you measure? How do you represent it? Do you even have the data? In this podcast, we talk with Erin Torruella to share her experience from building and managing metrics for multiple different sectors. She provides great advice on where to start and how to get the effort going in the right direction. ChatGPT response was… Operational Technology (OT) and Industrial Control Systems (ICS) are crucial components of critical infrastructure, and their security is essential for ensuring the safety, reliability, and availability of essential services. To measure the success or failure of an OT/ICS security program, several metrics can be considered, such as: 1. Vulnerability Management Metrics: This metric measures the number of vulnerabilities identified, the number of vulnerabilities remediated, and the time it takes to remediate the vulnerabilities. 2. Incident Response Metrics: This metric measures the effectiveness of the incident response process. It includes the time it takes to detect, contain, and resolve an incident, as well as the number and severity of incidents. 3. Compliance Metrics: This metric measures compliance with relevant security standards, regulations, and policies. It includes the number of audits conducted, the number of non-compliances identified, and the time it takes to remediate non-compliances. 4. Risk Management Metrics: This metric measures the effectiveness of the risk management program. It includes the number and severity of risks identified, the number of risks mitigated, and the time it takes to mitigate the risks. 5. Awareness Metrics: This metric measures the effectiveness of the security awareness program. It includes the number of training sessions conducted, the number of employees trained, and the level of understanding demonstrated by employees. 6. Asset Management Metrics: This metric measures the effectiveness of the asset management program. It includes the number and types of assets identified, the level of asset classification, and the accuracy of the asset inventory. 7. Performance Metrics: This metric measures the performance of the OT/ICS infrastructure. It includes uptime, availability, and response time. Thanks for listening! Show links: Erin Torruella... LinkedIn - https://www.linkedin.com/in/erin-torruella/ Twitter - https://twitter.com/LadySqrrl Mastodon - https://infosec.exchange/@ladysqrrl JD Christopher SANS talk on ICS Security Metrics - https://www.youtube.com/watch?v=gIsLP_Dtv7M JD Christopher SANS blog post on ICS Security Metrics -https://www.sans.org/blog/mature-ics-security-with-metrics/ S.M.A.R.T. Methodology - https://en.wikipedia.org/wiki/SMART_criteria DHS CISA Cross-Sector Cyber Performance Goals - https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

    44 min

  11. 02/08/2023

    What to do about FERC's new INSM Order 887

    FERC has issued Order 887, directing NERC to create new Critical Infrastructure Protection (CIP) cybersecurity standards for Internal Network Monitoring Systems (INSM). In this episode, Patrick Miller, CEO of Ampere Industrial Security talks with Carter Manucy, IT/OT Cybersecurity Director for Florida Municipal Power Authority (FMPA). Hear from a real electric utility asset owner, on what this Order means for the industry and what you should do next. Show links: Carter Manucy LinkedIn Profile - https://www.linkedin.com/in/cmanucy/ FERC Order 887 - https://www.ferc.gov/media/e-1-rm22-3-000 FERC INSM NOPR - https://www.federalregister.gov/documents/2022/01/27/2022-01537/internal-network-security-monitoring-for-high-and-medium-impact-bulk-electric-system-cyber-systems National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems - https://www.amperesec.com/blog/industry-brief-national-security-memorandum-on-improving-cybersecurity-for-critical-infrastructure-control-systems NERC INSM Practice Guide - https://www.nerc.com/pa/comp/guidance/CMEPPracticeGuidesDL/CMEP%20Practice%20Guide%20-%20Network%20Monitoring%20Sensors.pdf Corresponding Ampere Blog post - https://www.amperesec.com/blog/what-to-do-about-fercs-new-insm-order-887

    33 min
  • 11 Episodes

Ratings & Reviews

5
out of 5
2 Ratings

About

The Critical Assets Podcast covers important OT and ICS security topics with an eye toward standards and regulation to keep you ahead of your adversaries... and your auditors. Ampyx Cyber. Securing your world. See our other content such as blogs, cybersecurity news and more at www.ampyxcyber.com

Information

  • Creator
    Patrick Miller
  • Years Active
    2023 - 2026
  • Episodes
    11
  • Rating
    Clean
  • Copyright
    © Ampyx Cyber 2024
  • Show Website
    Critical Assets Podcast

You Might Also Like