Cybersecurity Under Pressure. Real Attacks, Real Lessons

Antonio González
  • 0.0 (0)
  • Technology
  • Updated Weekly

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. Topics covered: OT security, ICS cybersecurity, industrial control systems, critical infrastructure protection, NIS2 compliance, Zero Trust architecture, operational technology resilience, railway cybersecurity, automotive security, and cyber-physical systems.

  1. 1h ago ·  Bonus

    An Automotive Alert Is Not an Incident Response | CUP Focus

    Detection creates a signal, not a decision. This CUP Focus separates the responsibilities of the VSOC and PSIRT, from initial fleet triage and first-mile forensics to root-cause analysis and long-term remediation. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Listen to the full episode: https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/An-IDPS-Alert-Is-Not-an-Incident-Response-Capability-e3knv4g

  2. 8h ago ·  Bonus

    When Digital Actions Create Physical Impact | CUP Micro Brief

    In OT, a digital action can move machinery, interrupt fabrication or weaken detection without obvious warning. This CUP Micro Brief links active scanning risk, IEC 62443 segmentation and AI model drift to physical resilience. Listen to the full episode: https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/The-Threat-Has-a-Body-Defending-Critical-Infrastructure-Against-Kinetic-AI-e3lv01v

  3. 1d ago

    Schneider Electric’s CVE-2026-77120: The Dangerous Assumption Behind Authenticated Access

    An authenticated user is not necessarily a trusted user. CVE-2026-77120 in Schneider Electric PowerLogic T300 shows how an account with SSH access can cross a weak privilege boundary and reach root-level control through OS command injection. This episode examines the vulnerability as an operational security problem, not just a patching task. We break down the technical path, the assumptions that make exploitation possible, and the decisions asset owners must take when an RTU supports critical electricity distribution. We discuss: • why authentication does not prove authorization or trustworthiness • how SSH exposure, account governance and privilege separation change the real attack path • why segmentation must restrict both access to the RTU and the actions possible after login • what to log and monitor when legitimate credentials may be abused • how to balance firmware remediation, service continuity and compensating controls in long-lived OT environments Affected scope: PowerLogic T300 versions 2.9.8-5620 and earlier. Check the latest Schneider Electric guidance before making operational changes. Chapters: 00:00 Context and central question 15:33 The Technical Breakdown 33:15 The Operational Decisions 48:11 The Pressure Test 01:00:16 The Key Takeaways More analysis: https://cybersecurityunderpressure.com/

  4. 2d ago ·  Bonus

    When EV Charging Becomes a Cyber-Kinetic Risk | CUP Micro Brief

    An EV charging cable initiates a cloud-connected transaction with physical consequences. This CUP Micro Brief follows the path from complex connectivity, through unsafe input validation, to cyber-kinetic manipulation of electrical limits. Listen to the full episode: https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/How-EV-Chargers-Could-Crash-the-Grid-The-Cyber-Risk-Behind-Mass-Electrification-e3lkh8c

  5. 2d ago ·  Bonus

    A Clean Backup Does Not Prove a Safe Restart | CUP Focus

    Restoring files is not the same as restoring operational confidence. This CUP Focus explains why an OT restart requires trusted control logic, known-good engineering baselines and a defensible go/no-go decision before physical production resumes. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Listen to the full episode: https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/The-Restart-Bottleneck-Is-Not-the-Backup--It-Is-the-Evidence-e3knunc

  6. 3d ago

    Detecting the Attack Is Not Proving Safety: IAM4RAIL and Railway Cybersecurity

    n a railway system, detecting malicious activity and understanding its safety consequence are two different engineering problems. In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we use work developed within Europe’s Rail FP3-IAM4RAIL as a case study in one of the most important distinctions in railway cybersecurity: cybersecurity monitoring can tell us that something suspicious is happening, but it does not automatically tell us what authority the attacker has gained, which operational functions are affected or whether train safety has actually been compromised. IAM4RAIL includes an onboard cybersecurity monitoring and threat-detection capability for rolling stock. A secure edge device integrated into onboard networks continuously observes communications, telemetry and operational behaviour and can generate alerts when it identifies anomalous or suspicious activity. This provides a valuable new layer of visibility in railway environments that historically have had limited technical cybersecurity monitoring. The Technical Breakdown examines what must happen after an alert. A cyber event has to be mapped through the real architecture: from the initial entry point to the affected component, across network and system boundaries, toward the functions that carry operational authority. Detecting anomalous traffic near a critical railway subsystem is important evidence, but proximity is not the same as control. The engineering question is which boundaries the attacker can actually cross and what the compromised component is technically capable of influencing. The Operational Decisions become harder in legacy railway environments. Systems may have long service lives, strict availability requirements and safety constraints that limit how aggressively cybersecurity teams can patch, isolate or reconfigure equipment. Monitoring, segmentation and compensating controls therefore have to reduce cyber risk without creating new operational or safety hazards. Cybersecurity cannot be applied in isolation from the engineering context in which the railway must continue to operate. In The Pressure Test, you are responsible for a fleet containing legacy cyber-physical systems. Monitoring detects suspicious activity inside the onboard environment, but the evidence does not yet establish whether the attacker can reach train-control functions. Isolating everything immediately may affect availability or operational procedures. Doing nothing leaves an unresolved attack path. The decision has to be based on architecture, authority, containment and evidence — not simply on the presence of an alert. The key lesson is that detection, cybersecurity impact and safety consequence are related, but they are not interchangeable. Effective railway cybersecurity requires visibility into the attack, understanding of the affected architecture and evidence connecting cyber compromise to the physical functions that matter. An alert tells us that something may be wrong. The architecture tells us what the attacker can reach. The safety analysis tells us what that actually means for the railway. Thanks for listening to Cybersecurity Under Pressure. Follow the show for more real attacks, technical breakdowns and practical lessons for cybersecurity leaders. Explore all episodes and resources: https://cybersecurityunderpressure.com/episodes

  7. 4d ago ·  Bonus

    What Actually Starts the CRA 24-Hour Clock? | CUP Micro Brief

    Not every vulnerability starts the Cyber Resilience Act reporting clock. This CUP Micro Brief explains the two triggers, why reachability and VEX matter, and how CRA product obligations differ from NIS2 operator duties. Listen to the full episode: https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/The-24-Hour-Trap-Defensible-Decisions-Under-the-Cyber-Resilience-Act-e3lumm0

  8. 5d ago

    Secure Boot Is Not a Checkbox: Espressif AR2026-006 and the Limits of Firmware Trust

    Secure Boot is often represented as a simple security property: enabled or disabled. But a configuration flag does not tell us whether the complete chain used to establish trust at boot actually behaves as intended. In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine Espressif security advisory AR2026-006, affecting ECDSA-based Secure Boot on specific revisions of the ESP32-H2, ESP32-C5, ESP32-C61, ESP32-P4 and ESP32-S31. The issue sits inside ROM-based ECDSA signature verification, where invalid signatures can under certain conditions be accepted as valid. The Technical Breakdown looks at what that actually means. The affected verification workflow does not sufficiently validate whether the ECDSA signature components fall within their required range. ESP32-C5 also contains an initialization issue affecting the ECDSA peripheral during the ROM verification process. If an attacker can replace the signed firmware image and manipulate its signature in external flash, the device can accept attacker-controlled firmware during boot. But the vulnerability does not eliminate the attack preconditions. Exploitation requires a path to modify external flash. That can mean supply-chain access or physical access combined with flash-write capability. Packaging, Secure UART configuration, disabled download paths and Flash Encryption can therefore materially change attack feasibility even though they do not repair the underlying ROM defect. The Operational Decisions become especially difficult because this is not simply a software patching problem. The affected behaviour exists in immutable ROM on currently affected devices. Product teams therefore need to know the exact SoC and hardware revision deployed, which Secure Boot scheme is configured, how flash is protected, which programming and service interfaces remain available, and which additional security controls surround the boot process. For new production, Espressif recommends RSA-based Secure Boot where supported. Migration of already-deployed devices depends on their existing eFuse configuration and available Secure Boot digest blocks. Another important distinction is scope. The advisory states that application-layer ECDSA verification is not affected, and the ECDSA verification path used for OTA updates is therefore separate from the vulnerable ROM-based boot verification. That distinction matters because “ECDSA is vulnerable” would be a much broader claim than the evidence supports. In The Pressure Test, imagine managing a global population of connected devices built across different hardware revisions and configurations. A Secure Boot vulnerability is disclosed, but there is no universal software fix for the affected ROM. Some devices have Flash Encryption and tightly controlled programming interfaces. Others may have different manufacturing or service paths. The decision is no longer simply whether Secure Boot is enabled. It is which deployed configurations actually expose a viable attack chain and what evidence proves that the remaining barriers still hold. The key lesson is that a security feature is not an assurance argument. Secure Boot depends on the verification implementation, key and eFuse configuration, flash integrity, programming interfaces, hardware revision and the lifecycle processes surrounding the device. “Secure Boot enabled” is configuration data. Knowing whether the complete boot chain can still be trusted is security evidence. Thanks for listening to Cybersecurity Under Pressure. Follow the show for more real attacks, technical breakdowns and practical lessons for cybersecurity leaders. Explore all episodes and resources: https://cybersecurityunderpressure.com/episodes

See All (110)

About

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. Topics covered: OT security, ICS cybersecurity, industrial control systems, critical infrastructure protection, NIS2 compliance, Zero Trust architecture, operational technology resilience, railway cybersecurity, automotive security, and cyber-physical systems.

Information