Cybersecurity Under Pressure. Real Attacks, Real Lessons

Antonio González

Cybersecurity Under Pressure examines real incidents, technical research and security decisions across industrial systems, railways and connected vehicles. Antonio González connects attack mechanisms with engineering constraints, operational resilience and product-security evidence. Explore OT and ICS security, automotive and railway cybersecurity, software supply chains and the decisions behind secure operations.

Play

Open in

21 episodes
daily
Avg 14 min
English

Episodes 21

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Today · 40 min
How Volt Typhoon Weaponizes Active Directory
Volt Typhoon turns trusted administration into a path toward critical infrastructure. This episode examines how stolen credentials, Active Directory compromise and living-off-the-land activity can undermine confidence in the systems operators depend on. We explore the identity boundary between enterprise IT and operational technology, the evidence defenders need to distinguish legitimate administration from an intrusion, and the recovery decisions that follow a suspected domain compromise. Sources and further reading: Joint CISA advisory AA24-038A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a Joint CISA advisory AA23-144A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a Cybersecurity Under Pressure. Real Attacks, Real Lessons.
Yesterday · 2 min
Industrial Router Security: When SMS Authentication Fails Open | CUP Micro Brief
An industrial router disables SMS password checks after five failed attempts. This CUP Micro Brief examines the availability logic behind the fail-open design and why it becomes dangerous on a cellular attack surface. Related CUP episodes: Weidmüller Router Security: When Segmentation Becomes an Attack Path Industrial Network Security: Designing for Operational Resilience Legacy VPNs in OT: Remote Access and the Cost of Disruption OT Remote Access: Closing the Path When the Work Ends
Yesterday · 4 min
SBOM and VEX: Proving Vulnerability Reachability | CUP Focus
Component presence and practical exposure are different facts. This CUP Focus explains how static and dynamic reachability analysis support VEX decisions, reduce false positives and create defensible evidence when an actively exploited vulnerability appears. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Cyber Resilience Act: Evidence and the 24-Hour Reporting Clock SBOM and VEX: Turning Vulnerability Data into OT Risk Decisions SBOM and VEX: Challenging Supplier Vulnerability Claims NIST IR 8536: Verifying the Software Supply Chain
Monday · 36 min
A Trusted Engineering Workstation Can Still Deploy a Malicious Flow
An unauthenticated flow editor can turn an industrial gateway into a code-execution platform. This episode examines the Siemens SIMATIC IoT2050 Advanced case and the operational choices around patching, access restrictions and containment. Siemens advisory SSA-834709 documents CVE-2026-58115 in affected devices running Industrial OS with Node-RED installed before V4.3.4.1. An unauthenticated attacker who can reach the vulnerable HTTP interface may create malicious flows and execute code with maximum privileges. Siemens recommends updating to V4.3.4.1 or later. Editorial clarification The factory and incident-response situations in the discussion are hypothetical. Compromise of this gateway does not by itself prove authority to write to a PLC or manipulate a physical process. That depends on reachable services, protocols, credentials and controller-side controls. Any dependence of HMI visibility or alarms on this gateway must also be established for the actual installation; it is not a product-wide finding in the Siemens advisory. The discussion overstates the difficulty of detection at approximately 16:48. Legitimate-looking HTTP traffic can make malicious intent difficult to distinguish, but detection is not inherently impossible. Flow-change records, access logs, approved-configuration comparisons and host or network monitoring may provide evidence, depending on deployment and coverage. Containment must follow the plant-specific response plan and process-safety assessment. Neither disconnecting every gateway nor keeping every connection alive is a universal rule. Preserve required safe control and trustworthy monitoring while restricting the attacker's access. These qualifications take precedence over broader language in the discussion. Chapters 00:00 Introduction 00:47 The Siemens Node-RED case 07:24 The Technical Breakdown 16:48 The Operational Decisions 25:19 The Pressure Test 32:56 The Key Takeaways 35:34 Closing Cybersecurity Under Pressure. Real Attacks, Real Lessons. https://cybersecurityunderpressure.com/ Primary sources Siemens ProductCERT SSA-834709: https://cert-portal.siemens.com/productcert/html/ssa-834709.html Node-RED security guidance: https://nodered.org/docs/user-guide/runtime/securing-node-red NIST SP 800-82 Rev. 3: https://csrc.nist.gov/pubs/sp/800/82/r3/final
Saturday · 3 min
Connected Vehicle Security: From Cloud API to In-Vehicle Control | CUP Focus
The API gateway may validate a remote command while the internal vehicle network accepts it without equivalent checks. This CUP Focus explains why cloud authorization, telematics and in-vehicle trust must be assessed as one attack path. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Your License Plate Is the Password: What the Kia API Hack Revealed When a License Plate Becomes a Password | CUP Micro Brief Jeep Hack Lessons: Testing Vehicle Gateway Trust Boundaries Automotive Extortion: Protecting Cloud, APIs and the Update Chain
Friday · 52 min
A Station Identifier Is Not Proof of Station Identity
What happens when an EV charging backend accepts a station identifier without proving which station is actually connecting? This episode examines the Monta OCPP authentication weakness described in CVE-2026-95102 and CISA ICSA-26-274-02. We break down how identifier-based trust can enable station impersonation, why possession of an ID is not authentication, and what operators should enforce at the WebSocket and deployment layers. We also separate demonstrated impact from broader speculation: the issue supports unauthorized station identity claims, but it does not by itself prove widespread exploitation or direct compromise of vehicles or the power grid. Key lessons: • Treat station identity as an authenticated claim • Enforce credentials or certificates at connection time • Bind provisioning, authorization, and revocation to each charger • Monitor duplicate or anomalous station connections • Validate deployment controls, not only protocol support
Thursday · 2 min
BLE Vehicle Security: The Risk of a Shared Authentication Key | CUP Micro Brief
Researchers found two million aftermarket vehicle devices sharing one Bluetooth authentication key. This CUP Micro Brief shows how manufacturing convenience became a scalable path to vehicle functions. Related CUP episodes: BLE Theft Auto: How Aftermarket Devices Bypass Vehicle Security Aftermarket Car Alarm Security: Managing Vehicle Modifications UC San Diego Research: Aftermarket Anti-Theft Device Security Your License Plate Is the Password: What the Kia API Hack Revealed
Thursday · 3 min
Vehicle-to-Grid Security: Coordinated Charging and Grid Risk | CUP Focus
V2G can support the energy system, but aggregated charging and discharging also create a coordinated control surface. This CUP Focus follows the path from distributed vehicle batteries to frequency disturbance, demand spikes and cascading grid protection events. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: EV Charging Cybersecurity: How Charger Attacks Could Affect the Grid EV Charging and Grid Security: When Mobility Becomes Infrastructure Automotive IDPS, VSOC and PSIRT: From Alert to Response When EV Charging Becomes a Cyber-Kinetic Risk | CUP Micro Brief
October 21 · 2 min
Clean Code Does Not Prove a Safe Process | CUP Micro Brief
Clean code and verified binaries do not prove that a physical process is safe. This CUP Micro Brief explains how attackers can change parameters and references without changing the software, and why independent production evidence matters. Related CUP episode: Why Clean Code Causes Industrial Disasters
October 21 · 37 min
How Reading PLC Data Crashes Industrial Systems
A monitoring function should observe a PLC, not destabilize it. But when diagnostic access, shared buffers and runtime synchronization interact badly, a read operation can become an availability event. This episode examines how an improper synchronization flaw in a CODESYS runtime can turn routine PLC monitoring into a denial-of-service path. We follow the chain from memory handling and race conditions to plant-level consequences, then test the usual responses: patch immediately, isolate the engineering path, restrict monitoring access, or compensate until a controlled maintenance window is available. The central lesson is operational: read-only intent does not guarantee read-only impact. Asset owners need to treat engineering and monitoring services as active trust boundaries, validate vendor fixes against the real process, and detect abnormal diagnostic behavior before it becomes loss of control or loss of visibility. Chapters 00:00 Context and Central Question 09:44 The Technical Breakdown 19:20 The Operational Decisions 26:41 The Pressure Test 34:01 The Key Takeaways Cybersecurity Under Pressure: Real Attacks, Real Lessons. https://cybersecurityunderpressure.com/
October 20 · 1 min
Security Appliance Risks: The Hardcoded Master Key | CUP Micro Brief
A security appliance can become the weakest trust boundary when its vendor embeds an unchangeable master key. This CUP Micro Brief explains why the resulting blast radius extends far beyond one device. Related CUP episodes: Johnson Controls Airwall: The Risk Behind a Hardcoded Key Industrial Firewall Security: The Hidden Software Lifecycle Windchill Security: Restoring Trust in Engineering Data Industrial Network Security: Designing for Operational Resilience
October 20 · 2 min
Industrial 5G Network Slicing: The Limits of Isolation | CUP Focus
A private 5G slice can separate traffic without creating an independent physical network. This CUP Focus examines the SDN controller, hypervisor and cross-slice paths that can turn software-defined isolation into a shared point of failure. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Industrial 5G Security: Designing for Lost Connectivity Industrial 5G Jamming: Protecting Control When the Radio Fails When 40 Milliseconds Become an OT Incident | CUP Micro Brief FRMCS Security: Why a Mobile Network SLA Is Not a Safety Case
October 19 · 33 min
When a Vendor Breach Hits Spain’s Railway Network
A supplier compromise can reach rail operations without directly attacking signalling or rolling stock. This episode examines what happens when trust placed in vendors, remote access, credentials, maintenance channels and shared services becomes an operational risk. We trace the path from supplier exposure to the decisions that matter for infrastructure operators: isolating affected access, validating identities, preserving service, collecting evidence and deciding when recovery is safe. The analysis connects third-party risk with NIS2, supply-chain assurance, incident response and OT resilience. You’ll learn: Why a vendor VPN is not the real trust boundary How shared credentials and remote maintenance expand the attack path What to contain first without disrupting railway operations Which evidence supports a defensible recovery decision What operators and suppliers should change before the next incident Chapters 00:00 Why vendor compromise becomes railway risk 05:04 From supplier access to operational exposure 12:13 Trust boundaries, credentials and remote maintenance 18:44 Containment without disrupting service 27:35 Key takeaways for operators and suppliers More analysis: https://cybersecurityunderpressure.com/
October 18 · 1 min
Third-Party ICS Access: The VPN Is Not the Trust Boundary | CUP Micro Brief
Remote access for an ICS integrator is not merely a VPN configuration. It is a temporary operational trust boundary. This CUP Micro Brief explains why access to native industrial protocols and critical parameters must be constrained, monitored and corroborated with physical evidence. Related CUP episode: Third-party ICS Access Is an Operational Trust Boundary, Not a VPN Problem
October 17 · 3 min
Industrial Switch Security: Enforcing OT Segmentation | CUP Focus
Zones and conduits remain diagrams until network devices enforce them. This CUP Focus examines how a compromised industrial switch can erase VLAN boundaries, blind passive monitoring and turn centralized authentication into a plant-wide weakness. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Industrial Network Security: Designing for Operational Resilience OT Supplier Risk: Building Resilience Without Vendor Cooperation OT Asset Visibility: Why Inventory Does Not Contain an Attack OT Remote Access: Closing the Path When the Work Ends
October 16 · 40 min
Why Clean Code Causes Industrial Disasters
Can code be easier to read and still make an industrial process less safe? This episode examines why software refactoring in OT must preserve more than functional output: scan-cycle timing, interlocks, failure behaviour, operator expectations and the evidence behind a validated control baseline. We discuss how engineering teams can review changes, test them against the physical process and control deployment without treating cleaner code as proof of safer operation. Related CUP episodes: When Compiling Becomes the Payload: The OpenPLC Supply Chain Trap When the PLC Project Baseline Becomes a Security Boundary When AI Makes PLC Attacks Easier but Process Authority Stays the Real Risk When a Critical PLC Vulnerability Meets Brownfield Reality
October 15 · 2 min
PLC Patch Management: Why IT Update Cycles Do Not Fit | CUP Micro Brief
Standard IT patch cycles do not map cleanly to deterministic industrial control. This CUP Micro Brief connects real-time constraints, jitter and IEC 62443 defense in depth to the operational reality of PLC remediation. Related CUP episodes: Siemens S7-1500: Managing PLC and Linux Security Lifecycles OT Patch Management: Protecting Security and Production Legacy PLC Security: Where Digital Controls Meet Physical Limits Zero Trust for Brownfield OT: Working Within Legacy Constraints
October 15 · 3 min
How Zero Trust Can Protect a PLC That Cannot Authenticate | CUP Focus
A legacy PLC cannot suddenly gain modern identity controls. This CUP Focus explains how identity-aware proxies can mediate access, translate trusted sessions into legacy protocols and restrict which commands reach the controller. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Industrial Identity Security: The Risk in Software-Defined Factories Zero Trust in Legacy OT: Working With Twenty-Year-Old Systems Zero Trust in OT: Secure Access Beyond the HMI Zero Trust for Brownfield OT: Working Within Legacy Constraints
October 14 · 33 min
Third-party ICS Access Is an Operational Trust Boundary, Not a VPN Problem
A vendor VPN can establish connectivity, but it does not define what a third party may change inside an industrial control system. This episode examines the operational trust boundary around external maintenance: who authorizes the work, how the session is scoped, what happens at the engineering workstation and how access ends without leaving standing authority over production. Related CUP episodes: The Token That Bypassed the Jump Host The Trap of the Trusted Engineering Session Engineer the Path, Not Just the Perimeter Exposed Paths in OT Networks When Maintenance Becomes the Weapon: The Oldsmar Incident Zero Trust in OT does not start at the HMI
October 13 · 1 min
Automotive Attack Paths: Why Local Does Not Mean Physical | CUP Micro Brief
In automotive cybersecurity, a local attack vector does not necessarily require physical access. This CUP Micro Brief follows a low-privilege infotainment foothold through sandbox escape and kernel compromise. Related CUP episodes: Automotive Cybersecurity: Why Local Access Can Have High Impact PowerLogic T300 Security: When SSH Access Crosses the Trust Boundary Siemens S7-1500: Managing PLC and Linux Security Lifecycles KEV-First Patching: Prioritizing the Exposed Control Plane

Showing 1–20 of 21 episodes