@BEERISAC: OT/ICS Security Podcast Playlist

Podcast: Trust Me, It's Air-Gapped
Episode: What a Water Cyber Event Teaches You About Building an OT Security Program
Pub date: 2026-09-08

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Host Scott Christensen, cyber practice director for GrayMatter, talks with Dr. Eric Dowdy, IT director and data systems manager for City of Fort Collins Water, about building an OT cybersecurity program in the aftermath of a real water sector cyber event. Dowdy, who joined the utility after the incident, shares what it took to lead recovery, win board-level support for cybersecurity funding, and break down the historic silos between IT and OT teams. The episode covers steps for any critical infrastructure organization: getting plugged into threat intelligence networks, using the NIST framework to benchmark risk as federal cyber regulations catch up to water and wastewater utilities, and building a multiyear cybersecurity roadmap instead of chasing every vulnerability at once.
What listeners will learn:
How a water utility recovers operationally and culturally after a cyberattack
Why board buy-in and funding are critical to sustaining an OT cybersecurity program
Which threat intelligence sources matter most for water and wastewater utilities
How the NIST framework helps utilities prepare for coming federal cybersecurity regulations
How to build IT/OT collaboration instead of an adversarial "office of no" dynamic

The podcast and artwork embedded on this page are from GrayMatter, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Cyber Brews - The Operational Technologies Podcast
Episode: The Maginot Line & OT Cybersecurity: Lessons in Defence in Depth
Pub date: 2026-09-03

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

What does a French military fortification from the 1930s have to teach us about OT cybersecurity? Quite a lot, actually.

In this episode of Cyber Brews, we take a trip back to the Second World War and explore the story of the Maginot Line a hugely engineered defensive system that largely worked as designed, but failed to stop the attack because the attacker didn't follow the route its designers expected.
We explore what this can teach us about modern OT and industrial cybersecurity, including why having a firewall doesn't mean you have a security strategy, why defence in depth is about more than simply adding more security products, and why organisations need to plan for what happens when a control fails.
We discuss:

Network segmentation, zones and conduits
Identity, authentication and least privilege
Physical and application security
Monitoring, detection and incident response
Recovery, resilience and maintaining safe operations
And perhaps most importantly challenging the assumptions behind our security strategy.

Because the lesson of the Maginot Line isn't that walls don't work. It's that a wall is only useful if you've thought about what happens when someone gets around it.
So grab a brew and join us for another Cyber Brews story.

The podcast and artwork embedded on this page are from Dave A. and Chris F., which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure (LS 30 · TOP 5% what is this?)
Episode: How DARPA Is Preparing for the Next Technological Surprise with Patrick Lincoln
Pub date: 2026-09-01

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Cybersecurity has spent decades in a reactive cycle: find a vulnerability, patch it and wait for the next one. Dr. Patrick Lincoln joins Frank Cilluffo to discuss DARPA's effort to break that cycle by building systems that are inherently secure, private and resilient from the start. They explore lessons from the AI Cyber Challenge, the role of mathematical proof in eliminating vulnerabilities and the challenge of making complex systems trustworthy even when individual components fail. The conversation also examines how research can move beyond isolated demonstrations to strengthen the technologies and infrastructure society increasingly depends on.
Main Topics
Preventing and providing technological surprise
IPTO's return to computer science foundations
Inherent security and privacy
AI-enabled vulnerability discovery and patching
Formal methods and mathematical proof
Trust and resilience in megasystems
Moving research into real-world use
Key Quotes
"This back and forth or cat and mouse game has been going on a long time. I'm getting tired of that. And so we're trying to find new foundations to build inherently secure systems and inherently private systems." — Patrick Lincoln
"We need power tools to let people do more, better, faster, with quicker reaction time and higher assurance that what they do actually does lead to really fixing the problem and not creating new problems, not causing harm to the system." — Patrick Lincoln
"Software is difficult. And so how can you get to high assurance for a complex system involving the analog systems, the sensors and actuators, the digital systems and hardware, and the digital systems and software? And there are processes for this, some of those involving mathematical proof and formal methods." — Patrick Lincoln
"If you've got a million subsystems, there will be failures, and perhaps some of them even maliciously so. ... By building these compositional—think internal firewalls—within a complex system, and ways that we can understand the emergent properties of a large collective of systems, ... we can then predict and therefore give assurance about its behavior long term." — Patrick Lincoln
"My favorite answer to this problem, the world's most urgent critical problem, I'll say the DARPA answer is improving our collective ability to solve urgent critical problems." — Patrick Lincoln
Links and Resources
DARPA Information Processing Techniques Office
Patrick Lincoln biography
DARPA AI Cyber Challenge
PROVERS formal-methods program
Resilient Software Systems Capstone
About the Guest:
Patrick Lincoln is director of the Information Processing Techniques Office at DARPA, where he leads work spanning artificial intelligence, cybersecurity and privacy, and resilient complex systems.
Before joining DARPA, Lincoln held senior research leadership roles at SRI, an independent nonprofit research and development institute, where he led multidisciplinary work across computing, cybersecurity, artificial intelligence, and advanced systems research.
Lincoln holds a Ph.D. in computer science from Stanford University and a B.S. in computer science from MIT.


The podcast and artwork embedded on this page are from Frank Cilluffo / McCrary Institute, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure (LS 30 · TOP 5% what is this?)
Episode: CI Fortify: Isolation, Recovery and a Minimum Viable America with CISA's Matt Rogers
Pub date: 2026-08-25

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

If communications fail and operational technology is damaged during a cyber attack, critical infrastructure operators may have to keep essential services running without internet access, outside assistance or readily available replacement hardware.
Matt Rogers of the Cybersecurity and Infrastructure Security Agency (CISA) explains how CI Fortify prepares water, energy and transportation systems for that scenario. He and Frank Cilluffo discuss operating through compromise, uncovering hidden dependencies and testing whether critical systems can isolate and recover before a crisis arrives.
Main Topics
CI Fortify and emergency planning
Operating through compromise
Communications outages
Hidden IT/OT dependencies
Isolation and functional testing
OT sovereignty
Secure by Design for OT
Public service and technical talent
Key Quotes
"If there is another Colonial Pipeline type incident again... how do we make sure that their incentive structure isn't I go from 100 to 0, it's that I go from 100 to 30? 40, where that... X is defense critical infrastructure, it's health and public safety, because we just can't afford to go to zero for our minimal services. We need sort of a minimum viable America." — Matt Rogers
"Nobody is coming to save you unless you've prearranged to be saved, which is a bit grim. But in a communications outage, you can't call for help." — Matt Rogers
"The more you tell me you have an air gap, the less I believe you... It's just really unsustainable for a lot of organizations.." — Matt Rogers
"Security doesn't have to be frictional and hard. The goal should be to design security such that you are kind of the well-lit path, the easy path, the default state is the secure thing to do." — Matt Rogers
Links and Resources
CISA: CI Fortify
CISA: Secure Connectivity Principles for Operational Technology
CISA: ​​Barriers to Secure OT Communication: Why Johnny Can't Authenticate​
CISA: Secure by Design
About the Guest:
Matthew Rogers, PhD is an Industrial Control Systems cybersecurity expert in CISA's Office of the Technical Director and leads the agency's Secure by Design initiative for Operational Technology. He earned his bachelor's degree in software engineering from Auburn University and later completed a DPhil in Cyber Security at the University of Oxford as a Rhodes Scholar, focusing on securing legacy OT networks in vehicles. Before joining CISA, Rogers was a founding engineer at Shift5 and worked on broader ICS cybersecurity efforts at MITRE. His work at CISA focuses on translating ICS research and development into practical capabilities for critical infrastructure.


The podcast and artwork embedded on this page are from Frank Cilluffo / McCrary Institute, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure (LS 30 · TOP 5% what is this?)
Episode: Boarding the Dark Fleet: Coast Guard Cyber and Maritime Security with RADM Jason Tama
Pub date: 2026-08-18

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

The maritime world is more connected than ever, creating new efficiencies—and new ways for cyber incidents to move quickly from shore-based networks to ships operating around the globe. Rear Admiral Jason Tama, Commander of U.S. Coast Guard Cyber Command, joins Frank Cilluffo to explain how the Coast Guard operates across military, intelligence, law-enforcement, regulatory, and homeland-security missions to protect the Marine Transportation System and counter adversaries in cyberspace.
The conversation also examines the Coast Guard's latest Cyber Trends and Insights in the Marine Environment report, including cyber operations aboard Dark Fleet vessels, the growing convergence of IT and operational technology, persistent weaknesses in basic cyber defenses, and the importance of working closely with industry. Tama argues that prevention alone will never be enough: maritime operators also need to be prepared to keep functioning through their "worst digital day."
Main Topics Covered
Coast Guard Cyber Command's three-part mission
Title 10, Title 14, and Title 50 authorities
Coast Guard integration with U.S. Cyber Command
Cyber operations aboard Dark Fleet vessels
Cyber risk across ports and maritime infrastructure
Public-private operational partnerships
Persistent cybersecurity fundamentals
International maritime cyber cooperation
Key Quotes
"You can't wait till the crisis or contingency to bring everyone together." — Rear Admiral Jason Tama
"The great thing about ships now is they're all connected all the time. The bad thing is the ships are all connected all the time." — Rear Admiral Jason Tama
"We're never going to Cyber our way out of this problem, right? There's no Cyber panacea." — Rear Admiral Jason Tama
"Resilience is so important and everybody has to be able to think about and have a plan for how do you continue to operate on your worst digital day because it's not a matter of if, it's a matter of when." — Rear Admiral Jason Tama
"The work we're doing in the wild from whether it's power plants to cranes to locks and dams ... all over the world, it's really incredible mission work." — Rear Admiral Jason Tama
Relevant Links and Resources
Cyber Trends and Insights in the Marine Environment (CTIME)
Guest Bio
Rear Admiral Jason Tama is Commander of U.S. Coast Guard Cyber Command, where he oversees cyberspace operations to defend Coast Guard networks, protect maritime critical infrastructure, and counter adversary activity. He also serves as the Coast Guard's Service Cyber Component Commander to U.S. Cyber Command.
Previously, Tama served as Senior Director for Resilience at the National Security Council and as Captain of the Port of New York and New Jersey. He is a graduate of the U.S. Coast Guard Academy and holds advanced degrees from the University of California, Berkeley, and MIT Sloan School of Management.

The podcast and artwork embedded on this page are from Frank Cilluffo / McCrary Institute, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.