Start / Nexus: A Claroty Podcast / Top 20 secure plc coding practices list

Top 20 Secure PLC Coding Practices List

40 min • 28 september 2021

Martin Scheu and Dirk Rotermund of the Top 20 Secure PLC Coding Practices project join Claroty's Aperture podcast to discuss how engineers can integrate secure coding practices into PLC programming.
The group's list of secure coding practices was released earlier this year and is available as a free download. It’s a 44-page document that includes not only the list of secure coding practices, but also detailed guidance for each, and where they map to on certain frameworks such as MITRE ATT&CK.
In this discussion, you'll learn more about how this project came together, the current state of PLC security by design, where current cybersecurity gaps exist, and how engineers can best make use of the guidance provided in the list of secure coding practices.

Senaste avsnitt

Top 20 Secure PLC Coding Practices List

Senaste avsnitt

Austin Allen on the Cybersecurity Realities Facing Healthcare

Gentry Lane on the Use of 'Salami Cuts' in Cyber Conflict

Pedro Umbelino on Exploiting ATG Devices in Fuel Storage

Steven Sim on OT-ISAC and the State of Information Sharing

Sarah Fluchs on the Cyber Resilience Act

Andrew Ohrt on Cyber-Informed Engineering

Megan Stifel on the Impact of the Ransomware Task Force

Joe Slowik on Identifying Truly 'Critical' Infrastructure

Danielle Jablanski on Critical Infrastructure Protection

Cassie Crossley on Hardware Security, HBOMs

Christiaan Beek on Ransomware's Evolution and Economics

Florence Hudson on the IEEE/UL 2933 Clinical IOT Cybersecurity Standard

Mike Holcomb on Starting and Succeeding in OT Cybersecurity

Ron Fabela on Low-Skilled OT and ICS Threat Actors

Munish Walther-Puri on Creating a Scale for Cybersecurity Incidents

Brian Foster on the Risks of a Hyperconnected Grid

CISA's Matthew Rogers on Secure by Demand for OT

Noam Moshe on the IOCONTROL Malware

Team82 on Attacking the Insecure IoT Cloud

Volexity's Steven Adair on the Nearest Neighbor Attack

Joe Saunders on Advanced Cyberattacks Against Critical Infrastructure

Grant Geyer on the Business Impact of Disruptions from Cyberattacks

Alethe Denis on Social Engineering, Red-Teaming

Alon Dankner on Extracting Crypto Keys from PLCs

Noam Moshe on Extracting Forensic Data from Unitronics PLCs

Alexander Antukh on Cyber Risk Quantification

Vincente Diaz on Using AI for Malware Analysis

Ahmik Hindman on Patching OT and ICS

Dr. Bilyana Lilly on Information Warfare

Vinnie Liu on Offensive Security Testing During Incidents

Diana Kelley on Protecting the AI Lifecycle

Jennifer Minella on OT Cybersecurity Convergence

Charles Blauner on the Changing Role of the CISO

Mikko Hypponen on a Decade of Corporate Ransomware Attacks

Adm. Michael Rogers on Geopolitics and Cybersecurity

Abel Archundia on Complexity in Critical Infrastructure

Adam Gluck on Industrial DevOps

Greg Garcia on the Change Healthcare Cyberattack

Ryan Pickren on New Web-Based PLC Malware Research

Mike Rogers on Understanding a CISO's Personal Exposure in Cyber Incidents

Team82 Answers More of your OT Cybersecurity Questions

Juan Piacquadio on Securing Pharma 4.0

David Elfering on CISOs and Cyber Liability Insurance

Team82 Answers Your Vulnerability Research Questions

Mandiant on Sandworm APT Attacks in Ukraine

Don Weber on Security Culture in Control Environments, STAR Methodology

MITRE on Caldera for OT

Jim LaBonty on the OT Security Stack

Stephen Reynolds on Protecting the CISO During Incident Investigations

Team82 on NAS Research, OPC UA Exploit Framework

Bishop Fox on OSDP Weaknesses Putting Secure Facilities at Risk

Jennifer Lyn Walker on Cybersecurity Risks in the Water Sector

Kathleen Moriarty on CIS' IoT Security Guidance

Walter Risi on the CISO's Journey from IT to OT

Noam Moshe on Teltonika 4G IIoT Router Cybersecurity Research

Charles Carmakal on Cybersecurity Threats to Healthcare

Lorrie Cranor on IoT Security and Privacy Labels

Skip Sorrels on the 405(d) HICP, Healthcare Cybersecurity

Dave Elfering on Cyber Liability Insurance

Vera Mens on Akuvox E11 Vulnerabilities

Adm. Mike Rogers on the National Cybersecurity Strategy

Katherine Gronberg on the Federal Government and OT/IoT Cybersecurity

Noam Moshe on a Generic WAF Bypass Technique

Sharon Brizinov on Hacking IoT

Joe Slowik on TRITON Malware, XENOTIME Hacking Group

Inside Team82's EvilPLC Attack

Sarah Fluchs Revisits the Top 20 Secure PLC Coding Practices List

Vergle Gipson on Cyber-Informed Engineering

Noam Moshe on the Evil PLC Attack

Dan Gunter on Threat Hunting in Industrial Control Systems

Dan Ricci on the ICS Advisory Project

Vera Mens on Hacking Flow Computers

Don C. Weber on ICS Cybersecurity Training, Education

Idaho National Lab on the INL Control Environment Laboratory Resource (CELR)

Thomas Schmidt and Martin Scheu on the Common Security Advisory Framework

Daniel Kapellmann Zafra on Incontroller/Pipedream ICS Attack Tools

Sharon Brizinov on Hacking and Securing PLCs

Kylie McClanahan on Automating the Gathering of Vulnerability Information