ICS Security: Friday News and Notes

2022 - Week 37

US CISA was created in 2018, and this week released their first Strategic Plan. The best part is each objective had a "Measurement Approach". The approach was worth little, but indicates an intention to measure. I'll judge the seriousness of the strategy by the metrics they develop and reveal. Like a lot of the Cyber Solarium recommendations that have been met, it is tough to tell if this strategy is a required step for something great or rearranging the deck chairs on the Titanic.

The White House/OMB also released this week the memo: Enhancing the Security of the Software Supply Chain through Secure Software Development Practices. This will accelerate the creation and distribution of SBOMs; I'm less optimistic of .gov's use once they get them.
 

S4x23 Tickets 251 - 500 Now On Sale

Links

• My article this week: Cyber Incident Reporting To US Government.
• Getting outside my US myopia ... The EU proposed Cyber Resilience Act factsheet. Who should I have on the show to discuss this?
• Kelly Shortridge has 10 objections to the recent CISA/NSA/ODNI Securing The Software Supply Chain document's approach.
• All those large spending bills from the past two years had non-small carve outs for cybersecurity. Alessandra Zimmermann has a nice cheat sheet for each bill.
• Some hard numbers on the total annual cyber premiums from a few large players.
• The US National Highway Traffic Safety Administration released the Cybersecurity Best Practices for the Safety of Modern Vehicles final draft.
• Unsolicited Response Podcast: SBOM ... Challenge & Thoughts.
• Need a break from your current job? Apply for the DOE OT Defender Fellowship.
• Leisure reading? - Investments Unlimited: A Novel About DevOps, Security, Audit Compliance, and Thriving in the Digital Age.

Unclassified Ads

NEW - Friday News & Notes Unclassified Ads. Here's how to reach the early adopters in OT & ICS Security.

Secure your OT software supply chain with the aDolus FACT platform. Automate vulnerability management, reduce 3rd party risk, prove compliance and gain operational insights. FACT continuously monitors software, providing unprecedented visibility into your entire supply chain.
 

Operational Continuity and Cyber-Attack Recovery for ICS & OT - only 30 Seconds and You're back on Track! Salvador Technologies provides breakthrough solutions to ensure an easy validation of the backup integrity with an instant restoration test.
 

DeNexus DeRisk OT 2nd generation inside out continuous Risk Quantification platform is now available for CISO's and CFO's to build cyber risk mitigation strategies, OT Cyber Insurance budget, and more.

Forwarded This Email and Want To Get It Every Friday?