@BEERISAC: OT/ICS Security Podcast Playlist

Podcast: Trust Me, It's Air-Gapped
Episode: Small Utility, Big Target: Rethinking Cyber Resilience in Water Treatment
Pub date: 2026-09-21

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

A coordinated nation-state campaign has hit more than 100 water utilities since it was first spotted near Minneapolis two months ago, prompting warnings from CISA and the FBI andtargeting one thing in particular: publicly addressable PLCs and industrial automation systems.
In this episode, GrayMatter's Cyber Practice Director Scott Christensen sits down with water and SCADA veteran Aaron Cromer, along with Zach Vera and Dan Topley from AMDT, makers of Octoplant, to unpack what's actually happening in the field.
They dig into why "we're too small to be a target" no longer holds up (it was the suburban utilities near major cities that got hit first), why claiming you're air-gapped rarely means you actually are, and why utilities should focus more on recovery. Aaron, Zach and Dan walk through what real asset awareness looks like, how change management separates a good recovery from a scramble.
Visit graymattersystems.com.

The podcast and artwork embedded on this page are from GrayMatter, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: OT After Hours
Episode: The EU CRA and OEMs
Pub date: 2026-09-16

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

How can industrial device OEMs comply with the new EU CRA and its requirements for digital devices sent to the European market?
In this episode of OT After Hours, Ken Kully (Delivery Readiness at Rockwell Automation) is joined by Lance Lamont (Special Projects & Protocols Team Lead at Rockwell Automation), Tyler Bergman (Principal Security Consultant at Rockwell Automation), Zach Woltjer (Technical Account Manager), and by special guests Maria Else (Global Product Manager for Industrial Cybersecurity) and Stefan Turi (EMEA Cybersecurity Lead for OEMs) to discuss the EU Cyber Resilience Act (CRA), its implications for industrial device original equipment manufacturers (OEMs), and how the SecureOT™ solution suite can help drive both compliance and security in response.
Key Takeaways
EU Cyber Resilience Act Scope: The CRA applies broadly to products with digital elements placed on the EU market, including industrial machines. These responsibilities extend across manufacturers, OEMs, system integrators, importers, distributors, and end users.
OEM Compliance And Product Lifecycle: CRA obligations include having a secure-by-design processes, vulnerability handling, documentation, risk analysis, and support throughout the product lifecycle. OEMs must establish repeatable processes rather than simply purchase security technology.
Asset Inventory And Vulnerability Traceability: Under the CRA, maintaining a durable record of shipped equipment, its configuration, ownership, location, and software or firmware versions so OEMs can identify affected customers and respond to newly disclosed vulnerabilities across their installed base.
Vulnerability Remediation And Patching: Vulnerability findings should be prioritized and remediated without disrupting industrial production, including update limitations for embedded devices, vendor dependencies, maintenance windows, and the need for tested procedures.
Digital Twins And Security Validation: Digital twins can be used to model manufacturing lines and test patches before deployment. Rockwell's Emulate3D and associated consulting capabilities provide a solution for validating dependencies and developing secure operational procedures.
Cybersecurity Governance And Safety: CRA compliance requires sustained organizational ownership and collaboration, while cybersecurity must be treated as part of machine safety because exploitation can affect operators, equipment, production, and the surrounding environment.
Subscribe
Follow and subscribe for more episodes on Apple Podcasts, Spotify, YouTube, or wherever you get your podcasts.
Get in Touch
🔗 LinkedIn | YouTube | X | Contact Us

The podcast and artwork embedded on this page are from Rockwell Automation, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Trust Me, It's Air-Gapped
Episode: What a Water Cyber Event Teaches You About Building an OT Security Program
Pub date: 2026-09-08

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Host Scott Christensen, cyber practice director for GrayMatter, talks with Dr. Eric Dowdy, IT director and data systems manager for City of Fort Collins Water, about building an OT cybersecurity program in the aftermath of a real water sector cyber event. Dowdy, who joined the utility after the incident, shares what it took to lead recovery, win board-level support for cybersecurity funding, and break down the historic silos between IT and OT teams. The episode covers steps for any critical infrastructure organization: getting plugged into threat intelligence networks, using the NIST framework to benchmark risk as federal cyber regulations catch up to water and wastewater utilities, and building a multiyear cybersecurity roadmap instead of chasing every vulnerability at once.
What listeners will learn:
How a water utility recovers operationally and culturally after a cyberattack
Why board buy-in and funding are critical to sustaining an OT cybersecurity program
Which threat intelligence sources matter most for water and wastewater utilities
How the NIST framework helps utilities prepare for coming federal cybersecurity regulations
How to build IT/OT collaboration instead of an adversarial "office of no" dynamic

The podcast and artwork embedded on this page are from GrayMatter, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Cyber Brews - The Operational Technologies Podcast
Episode: The Maginot Line & OT Cybersecurity: Lessons in Defence in Depth
Pub date: 2026-09-03

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

What does a French military fortification from the 1930s have to teach us about OT cybersecurity? Quite a lot, actually.

In this episode of Cyber Brews, we take a trip back to the Second World War and explore the story of the Maginot Line a hugely engineered defensive system that largely worked as designed, but failed to stop the attack because the attacker didn't follow the route its designers expected.
We explore what this can teach us about modern OT and industrial cybersecurity, including why having a firewall doesn't mean you have a security strategy, why defence in depth is about more than simply adding more security products, and why organisations need to plan for what happens when a control fails.
We discuss:

Network segmentation, zones and conduits
Identity, authentication and least privilege
Physical and application security
Monitoring, detection and incident response
Recovery, resilience and maintaining safe operations
And perhaps most importantly challenging the assumptions behind our security strategy.

Because the lesson of the Maginot Line isn't that walls don't work. It's that a wall is only useful if you've thought about what happens when someone gets around it.
So grab a brew and join us for another Cyber Brews story.

The podcast and artwork embedded on this page are from Dave A. and Chris F., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure (LS 30 · TOP 5% what is this?)
Episode: How DARPA Is Preparing for the Next Technological Surprise with Patrick Lincoln
Pub date: 2026-09-01

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Cybersecurity has spent decades in a reactive cycle: find a vulnerability, patch it and wait for the next one. Dr. Patrick Lincoln joins Frank Cilluffo to discuss DARPA's effort to break that cycle by building systems that are inherently secure, private and resilient from the start. They explore lessons from the AI Cyber Challenge, the role of mathematical proof in eliminating vulnerabilities and the challenge of making complex systems trustworthy even when individual components fail. The conversation also examines how research can move beyond isolated demonstrations to strengthen the technologies and infrastructure society increasingly depends on.
Main Topics
Preventing and providing technological surprise
IPTO's return to computer science foundations
Inherent security and privacy
AI-enabled vulnerability discovery and patching
Formal methods and mathematical proof
Trust and resilience in megasystems
Moving research into real-world use
Key Quotes
"This back and forth or cat and mouse game has been going on a long time. I'm getting tired of that. And so we're trying to find new foundations to build inherently secure systems and inherently private systems." — Patrick Lincoln
"We need power tools to let people do more, better, faster, with quicker reaction time and higher assurance that what they do actually does lead to really fixing the problem and not creating new problems, not causing harm to the system." — Patrick Lincoln
"Software is difficult. And so how can you get to high assurance for a complex system involving the analog systems, the sensors and actuators, the digital systems and hardware, and the digital systems and software? And there are processes for this, some of those involving mathematical proof and formal methods." — Patrick Lincoln
"If you've got a million subsystems, there will be failures, and perhaps some of them even maliciously so. ... By building these compositional—think internal firewalls—within a complex system, and ways that we can understand the emergent properties of a large collective of systems, ... we can then predict and therefore give assurance about its behavior long term." — Patrick Lincoln
"My favorite answer to this problem, the world's most urgent critical problem, I'll say the DARPA answer is improving our collective ability to solve urgent critical problems." — Patrick Lincoln
Links and Resources
DARPA Information Processing Techniques Office
Patrick Lincoln biography
DARPA AI Cyber Challenge
PROVERS formal-methods program
Resilient Software Systems Capstone
About the Guest:
Patrick Lincoln is director of the Information Processing Techniques Office at DARPA, where he leads work spanning artificial intelligence, cybersecurity and privacy, and resilient complex systems.
Before joining DARPA, Lincoln held senior research leadership roles at SRI, an independent nonprofit research and development institute, where he led multidisciplinary work across computing, cybersecurity, artificial intelligence, and advanced systems research.
Lincoln holds a Ph.D. in computer science from Stanford University and a B.S. in computer science from MIT.


The podcast and artwork embedded on this page are from Frank Cilluffo / McCrary Institute, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.