Third-Party Risk Management: Preventing the Next Stuxnet
summary
Claims that Stuxnet reached industrial PLCs via a contractor using a USB and changed centrifuge speeds to destroy more than a 1,000 machines on Siemens S7-4000 PLCs drive the concrete advice here: deploy a formal TPRM cycle, use automated vendor tools that group vendors into tiers and give vendor scoring like credit scores, run annual or more frequent re-assessments, and follow the proposed timeline of selecting tools in one month, sending assessments by three months and remediating or replacing risky vendors by six months.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:52How do you define cyber risk?
- 3:56Black Swan events can happen
- 4:39Cyber Risk in Financial Services
- 5:22Cyber Risk in Healthcare
- 6:13Cyber Risk in the energy sector
- 7:32Cyber Activities
- 9:07The three main vectors of cyberattacks
- 10:22Major Cyber Attacks since 2010
- 12:48Stuxnet Case
- 14:15Attack Phases
- 15:07Security Controls in Industrial Control Systems
- 16:11Third-Party Vendors compromised
- 20:09Third Party Risk Management
- 21:13Vendor Relationships
- 21:41What to do
- 23:02TPRM Tools
- 26:49TPRM Program
- 27:55Recommendations
- 29:20End Goal: Preventing the next attack
related talks
35mEffective Handling of Third-Party Supplier Incidents
51mYour Third-Party Risk Management Program Is Bad and You Should Feel Bad
27mThird-party Risk Management: SOC 2s, Security Questionnaires...
51mThe Overlooked Security Risk: 3rd Party Risk Management
43mGet Smart on Smart Tech!
48mRemaining Resilient in the Supply Chainpocalypse
52mPanel: Industrial Systems In The Crosshairs: What It Really Takes To Defend OT
46mA Systems Approach to Safety and Cybersecurity