Cybersecurity Under Pressure. Real Attacks, Real Lessons

Antonio González

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. Topics covered: OT security, ICS cybersecurity, industrial control systems, critical infrastructure protection, NIS2 compliance, Zero Trust architecture, operational technology resilience, railway cybersecurity, automotive security, and cyber-physical systems.

  1. 10h ago

    Stadler Rail Extortion: When Supplier Trust Becomes the Attack Surface

    Stadler Rail refused a multimillion-dollar extortion demand after attackers accessed technical information through a supplier-linked data exchange platform. Production continued, its core IT environment remained operational, and trains in service were reportedly unaffected. So where did the security failure actually occur? This episode examines an attack that did not begin inside the manufacturer’s network, but at the boundary where suppliers, identities, engineering data and operational responsibilities intersect. We explore why compromised supplier access can create risks far beyond the initial breach, how apparently non-sensitive technical information can support reconnaissance and impersonation, and why data classification alone cannot determine the true impact of an incident. The Stadler case reveals a wider challenge for industrial organisations: third-party access is not simply a technical integration. It is a continuous decision about trust, visibility and accountability. We conclude with practical lessons for strengthening supplier identity controls, data exchange platforms, incident response obligations and supply-chain resilience. Thank you for listening to Cybersecurity Under Pressure. Follow the show to receive future episodes, and share this episode to anyone that can enjoy it.

  2. 2d ago

    The 6-Step Supply Chain Bleed: When Your Safety Blueprints Leak and the Lifeboats Catch Fire

    In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we follow the evidence into one of the most consequential architectural debates in industrial cybersecurity today: Should Safety Instrumented Systems (SIS) be strictly segregated from Basic Process Control Systems (BPCS)? The conversation is no longer theoretical. CISA Advisory AA-2026-2697 details Iranian-linked actors actively targeting internet-exposed PLCs, and the threat landscape has shifted from opportunistic ransomware to deliberate, physics-aware attacks. Adversaries are no longer just locking screens—they are hunting for PLC project files, logic diagrams, and network maps to understand your process before they break it. We map the six-stage Supply Chain Bleed in forensic detail: Classification – sensitive engineering assets locked in a fortified central repository. Distribution – access granted to a vetted prime contractor. Delegation – specialized tasks farmed out to tier-3 and tier-4 subcontractors. Export beyond the trust boundary – files converted to PDF, CAD, or raw logic and pulled onto unmanaged endpoints. Peripheral exposure – those files sit on personal laptops, consumer cloud drives, and vulnerable small-business networks. Delayed detection – the plant operator remains completely blind while attackers quietly exfiltrate the blueprints they need to craft a targeted strike. Then we confront the architectural nightmare: common mode failure. When BPCS and SIS share engineering workstations, network switches, or Active Directory credentials, a single compromise collapses both control and safety simultaneously. The ship loses its bridge and its lifeboats. We debate the standards and the reality: IEC 61511 demands safety-oriented independence. IEC 62443 mandates zones and conduits. NIST SP 800-82 Rev. 2 warns that true air-gaps are operational myths in modern facilities. We explore the tension between strict physical segregation (data diodes, isolated workstations) and the operational need for visibility, predictive maintenance, and remote diagnostics. And we draw a critical parallel to the automotive sector—where ISO/SAE 21434 and UN R155 are forcing hardware-level isolation between infotainment and braking ECUs—to show why industrial OT must evolve beyond flat networks. The episode closes with a live Pressure Test: A self-propagating ransomware strain has fully encrypted your BPCS. Your operators are locked out. Reactor pressure is building. The SIS must autonomously initiate a safe shutdown without any human intervention, any shared credential, or any network bridge to the compromised control layer. You have incomplete evidence, no live-fire test history, and terrifying uncertainty about hidden network bridges installed during past maintenance windows. What is your reversible move? What you’ll take away: Why the six-step supply chain bleed is the most overlooked attack surface in OT. How shared infrastructure between BPCS and SIS creates fatal common mode failures. The difference between visibility through integration and safety through isolation—and why data diodes may be the only defensible compromise. A concrete crisis escalation trigger: when to pull the plug, trigger an ungraceful shutdown, and prioritize life safety over production. Why your SIS must be capable of autonomous safe shutdown without relying on the BPCS, shared AD services, or remote command. Thank you so much for spending part of your Wednesday with us, diving deep into these critical and complex issues. We know how valuable your time is, and we truly appreciate you choosing to explore these hard questions alongside us. The stakes for our industry have never been higher, and conversations like this are exactly what move us forward. We will be back tomorrow with a shorter, highly focused follow-up episode diving even deeper into this topic—so please stay with us, and we will see you in the next episode.

  3. 4d ago

    The Device Meant to Secure Your Car Is the Exact Thing Exposing It: The UC San Diego Disclosure

    In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we dissect the staggering UC San Diego research disclosure revealing how dealer-installed aftermarket anti-theft modules bypassed entire OEM security architectures. What starts as a localized dealer convenience ends as a systemic collapse of the trust boundary. We go under the hood—literally—to trace the five-stage failure chain: from the initial blind trust of physical splicing, through CAN bus propagation with zero source authentication, to the nightmare of containment when 2.2 million cars cannot be fixed with an over-the-air update. But this is not just a post-mortem. We dive into the central engineering dilemma of the decade: Regulatory mandates (UN R155, ISO/SAE 21434) demand rigorous, state-aware cyber risk management. Right-to-repair legislation demands open, interoperable access to the exact same systems. Can both coexist? We debate hardline transaction-level state checking versus risk-based interoperability APIs, and we propose a defensible tiered architecture: an unbreakable vault for propulsion, braking and steering; a monitored turnstile for diagnostics and infotainment. The episode closes with a live Pressure Test: a nationwide repair chain’s certified diagnostic tool has been compromised through its cloud backend and is actively probing your zonal gateways. You have incomplete evidence, a 72-hour regulatory clock, and millions of dollars in operational exposure. What is your reversible move? What you’ll take away: Why physical proximity must never equal digital trust in zonal architectures. The difference between session-level and transaction-level authentication—and why your gateway needs both. How to build a tiered access model that keeps mechanics working without handing them the keys to the drivetrain. A concrete decision framework for SOC teams facing compromised third-party certificates under fire. Thank you so much for spending your time with us today. Your attention and your curiosity are what keep this conversation moving forward. If you found value in this debate, please share it with a colleague wrestling with the same trust-boundary questions. We’ll be back soon with another real attack, another real lesson, and another hard decision under pressure, so stay tuned, and we’ll see you in the next episode.

  4. Jul 24

    The Euro 7 Data Trap: When Emissions Compliance Becomes an Attack Surface

    What if the system designed to prove that a vehicle is compliant becomes the easiest way to manipulate what regulators see? In this episode of Cybersecurity Under Pressure, we examine how emissions compliance is evolving from a controlled laboratory exercise into a continuous, software-dependent data operation. Modern vehicles rely on sensors, engine control units, calibration software, diagnostic functions, onboard memory, connectivity and backend platforms to demonstrate how they behave in real driving conditions. That creates a much broader attack surface. An attacker may not need to disable the emissions system itself. Manipulating a sensor input, an ECU calibration, a diagnostic function or the telemetry sent to the backend could be enough to corrupt the evidence used to demonstrate compliance. We also explore the operational reality behind this model. Vehicles must collect, protect, transmit and validate large volumes of information without creating unacceptable latency, storage costs, connectivity dependencies or availability problems. Cryptographic protection strengthens trust, but it also introduces key-management, processing and scalability challenges across millions of vehicles. The central lesson is that emissions compliance can no longer be separated from cybersecurity architecture. Protecting the engine is not enough. Manufacturers must protect the complete evidence chain, from the physical sensor to the regulatory record. Follow Cybersecurity Under Pressure: Real Attacks, Real Lessons for practical analysis of the technical decisions, operational constraints and hidden dependencies shaping connected mobility.

  5. Jul 22

    When Compiling Becomes the Payload: The OpenPLC Supply Chain Trap

    What if the attacker does not deliver malware to your industrial controller? What if your own engineering pipeline builds and deploys it for them? In this episode of Cybersecurity Under Pressure, we examine public research affecting OpenPLC and a more significant problem behind it: the moment when trusted source code, engineering repositories and automated compilation processes become part of the attack path. The research demonstrates a proof-of-concept scenario, not evidence of a confirmed campaign against production environments. However, the implications extend far beyond a laboratory. Industrial integrators increasingly use shared repositories, reusable libraries, automated builds and remote deployment workflows to move control logic from engineering workstations into operational systems. An attacker who compromises source code, an intermediate repository, a dependency or the build environment may not need direct access to the final PLC. The legitimate compiler and deployment process can transform the attacker’s changes into trusted operational code. We explore why scanning the finished binary is not enough, where traditional IT security controls fail to account for industrial engineering workflows, and how signed commits, protected repositories, isolated build environments, reproducible builds, software provenance, deployment approval and runtime monitoring can reduce the risk. The central lesson is uncomfortable: in modern industrial environments, the payload may not arrive from outside. It may be compiled, approved and deployed by the victim’s own trusted process. Follow Cybersecurity Under Pressure: Real Attacks, Real Lessons for practical analysis of the vulnerabilities, engineering decisions and operational dependencies shaping industrial cybersecurity.

  6. Jul 20

    The Kudankulam Supply Chain Breach: When Trusted Partners Expose Critical Infrastructure

    What happens when a critical infrastructure operator protects its own systems, but sensitive information escapes through a trusted supplier? In this episode of Cybersecurity Under Pressure, we examine the reported Kudankulam nuclear supply chain breach and the uncomfortable lesson behind it: your security perimeter is only as strong as the companies that handle your data. We explore how sensitive engineering information can move from controlled environments into local computers, shared repositories, CAD and BIM tools, subcontractor networks and unmanaged exports. We also challenge a common assumption: that contracts, data classifications and traditional information rights management are enough to maintain control. The discussion moves beyond theory to examine realistic measures, including operator-hosted engineering environments, controlled virtual workspaces, export restrictions, supplier segmentation, stronger access governance and evidence-based oversight of lower-tier suppliers. Because in critical infrastructure, the breach may not begin inside the plant. It may begin several suppliers away. Follow Cybersecurity Under Pressure: Real Attacks, Real Lessons for practical analysis of the incidents, technical decisions and operational failures shaping cybersecurity today.

  7. Jul 17

    The Threat Has a Body: Defending Critical Infrastructure Against Kinetic AI

    A firewall cannot stop a drone. A fence cannot stop the algorithm guiding it. Artificial intelligence is moving beyond screens and networks. Combined with drones, autonomous platforms, computer vision and robotic systems, it can observe physical environments, identify targets and support actions with real-world consequences. For operators of energy, transport, manufacturing, telecommunications and other critical services, this changes the threat model. In this episode of Cybersecurity Under Pressure, we examine the emergence of kinetic AI and the convergence of cyber, physical and operational risk. We explore: • How AI can accelerate reconnaissance, target identification and attack planning• Why physical security and cybersecurity can no longer operate separately• How autonomous and semi-autonomous systems could threaten exposed infrastructure• Why traditional perimeter controls may fail against distributed and adaptive threats• How OT monitoring, physical sensors and threat intelligence should work together• The importance of redundancy, manual operation and safe degraded modes• How organisations can exercise their response before a digital incident becomes a physical emergency The objective is not to predict science-fiction scenarios. It is to prepare for a threat environment in which software can perceive the physical world, make decisions and translate them into action. Critical infrastructure resilience must protect more than networks and individual assets. It must preserve the essential service when both the digital and physical layers are under pressure. Cybersecurity Under Pressure. Real Attacks, Real Lessons.

  8. Jul 15

    Your License Plate Is the Password: What the Kia API Hack Revealed

    A modern vehicle can have secure boot, encrypted communications and protected ECUs, yet remain exposed through a dealer website. In this episode, we examine an automotive cybersecurity case where researchers began with a public identifier, a vehicle’s license plate, and built an attack chain capable of reaching personal data, vehicle location and remote functions. The compromise did not begin inside the vehicle. It began in the cloud. A license plate was converted into a VIN. A dealer-facing portal trusted the wrong identity. Excessive backend privileges allowed vehicle ownership to be reassigned. Legitimate APIs then delivered commands that the vehicle accepted as authorized. This episode explores why: • License plates and VINs are identifiers, not authentication factors• Dealer and after-sales portals form part of the vehicle attack surface• Weak API authorization can create cyber-physical consequences• Excessive privileges turn a local web flaw into systemic fleet risk• Automotive threat analysis must include cloud, mobile and business systems• OEMs need stronger ownership controls, dealer authentication and behavioral detection The main lesson is uncomfortable but necessary: the security boundary of a connected vehicle does not end at the CAN bus or the telematics unit. It extends to every portal, API and support process capable of issuing a trusted command. Cybersecurity Under Pressure. Real Attacks, Real Lessons.

See All (77)

About

This podcast breaks down real cybersecurity incidents to understand what actually went wrong, not in theory, but in practice. Each episode analyzes a recent attack, explains the technical mechanics in clear language, and translates them into concrete lessons for security, engineering, and business teams. Topics covered: OT security, ICS cybersecurity, industrial control systems, critical infrastructure protection, NIS2 compliance, Zero Trust architecture, operational technology resilience, railway cybersecurity, automotive security, and cyber-physical systems.

Information