Cybersecurity Under Pressure. Real Attacks, Real Lessons

Antonio González

Cybersecurity Under Pressure examines real incidents, technical research and security decisions across industrial systems, railways and connected vehicles. Antonio González connects attack mechanisms with engineering constraints, operational resilience and product-security evidence. Explore OT and ICS security, automotive and railway cybersecurity, software supply chains and the decisions behind secure operations.

Play

Open in

148 episodes
daily
Avg 35 min
English

Episodes 148

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

April 8 · 34 min
IBM X-Force: Exploiting Vulnerabilities Without Authentication
Attackers do not always need credentials to exploit an exposed vulnerability. Explore the IBM X-Force findings through exploitation speed and the changing barrier to initial access. The episode examines what those patterns mean for defensive priorities. Related CUP episodes: KEV-First Patching: Prioritizing the Exposed Control Plane PLCnext Vulnerabilities: Assessing the Real OT Attack Path PowerLogic T300 Security: When SSH Access Crosses the Trust Boundary OT Patch Management: Protecting Security and Production Windchill Security: Restoring Trust in Engineering Data Zero Trust for Brownfield OT: Working Within Legacy Constraints Siemens Siveillance: When Edit Access Enables Code Execution Legacy Railway Security: Patching and Validation Constraints Industrial Firewall Security: The Hidden Software Lifecycle Weidmüller Router Security: When Segmentation Becomes an Attack Path
April 6 · 42 min
Security Scanner Supply Chains: The Trivy and CERT-EU Case
A trusted security scanner can become part of a software supply-chain attack. Explore the Trivy and CERT-EU case through tool provenance and exposure beyond the scanning function. The episode examines controls intended to limit the impact of a compromised dependency. Related CUP episodes: OpenPLC Supply Chain Security: When Compilation Builds the Attack AI Sandbox Security: The OpenAI–Hugging Face Trust Boundary NIST IR 8536: Verifying the Software Supply Chain Kudankulam Supply Chain Breach: Protecting Engineering Information Railway AI Supply Chains: Managing Subcontractor Data Leaks Stadler Rail Extortion: Securing Supplier Data Exchanges Automotive Extortion: Protecting Cloud, APIs and the Update Chain Windchill Security: Restoring Trust in Engineering Data
April 3 · 23 min
Cybersecurity Assurance: Why Evidence Does Not Equal Confidence
Documented evidence does not automatically establish confidence in a system. Explore cybersecurity assurance through cases involving industrial control and physical consequences. The episode questions how evidence supports the conclusions a security team is prepared to defend. Related CUP episodes: Automotive Supply Chains: Who Owns the Cybersecurity Fix? SBOM and VEX: Turning Vulnerability Data into OT Risk Decisions NSA ASIC Assurance: Verifying Trust in Silicon
April 1 · 28 min
Legacy Railway Cybersecurity: Why Policy Is Not Enough
Legacy railway assets need technical controls alongside security policy. Explore railway incidents and the constraints of protecting long-lived infrastructure. The episode examines why operational exposure remains a problem when the asset cannot readily be modernized. Related CUP episodes: Railway Cybersecurity: Service Risk Beyond the SIL Boundary Legacy Railway Security: Patching and Validation Constraints Railway Cybersecurity Patches: When the Safety Case Must Be Revisited Railway API Security: When Authenticated Data Contradicts Reality OT Time Synchronization Security: When the Clock Lies Railway Patch Management: When an Update Stops the Network Railway Cybersecurity: Why Attack Detection Does Not Prove Safety Legacy Railway OT: Reducing Risk When You Cannot Harden the Asset FRMCS Security: Why a Mobile Network SLA Is Not a Safety Case Frauscher FDS102: Securing Railway Diagnostic Access
March 30 · 24 min
Secure ECU Reflashing: When Workshop Pressure Creates Shortcuts
Workshop time pressure can turn a secure DoIP reflashing workflow into a manual workaround. Explore the tension between release traceability, controlled access and the technician’s operating conditions. The episode examines how usable security protects the update trust chain. Related CUP episodes: DoIP Reflashing: Securing the Workshop Without Creating Shortcuts Bendix EC80 Recall: Balancing Urgent Repair and Cybersecurity ECU Flashing Stations: Where Factory and Product Security Meet Automotive Software Updates: Securing the Firmware Delivery Path Euro 7 Cybersecurity: Protecting Emissions Compliance Data Signed Firmware: Why the Signature Is Only Part of the Trust Chain Automotive Software Releases: When Security Rejects the Code Espressif Secure Boot: Where Firmware Trust Can Break ECU Flashing Security: The Evidence Needed Before Production Software-Defined Vehicles: Securing Factory Cryptographic Provisioning
March 27 · 36 min
Jeep Hack Lessons: Testing Vehicle Gateway Trust Boundaries
The Jeep hack remains a useful test of vehicle trust boundaries. Explore how gateways, domain controllers and embedded firewalls mediate connected functions. The episode examines why clean architectural isolation is harder to establish in a deployed vehicle. Related CUP episodes: UC San Diego Research: Aftermarket Anti-Theft Device Security Automotive Extortion: Protecting Cloud, APIs and the Update Chain Automotive Software Updates: Securing the Firmware Delivery Path
March 25 · 35 min
Railway Cybersecurity: Service Risk Beyond the SIL Boundary
Railway service can be disrupted through systems outside the safety integrity boundary. Explore interconnected operational technology and the wider rail attack surface. The episode examines how service risk extends beyond the components associated with a SIL claim. Related CUP episodes: Railway Cybersecurity: Why Attack Detection Does Not Prove Safety Legacy Railway Security: Patching and Validation Constraints Railway Cybersecurity Patches: When the Safety Case Must Be Revisited Railway OT Segmentation: Protecting the Certified Core Legacy Railway Cybersecurity: Why Policy Is Not Enough Railway Patch Management: When an Update Stops the Network Railway API Security: When Authenticated Data Contradicts Reality FRMCS Security: Why a Mobile Network SLA Is Not a Safety Case OT Time Synchronization Security: When the Clock Lies Frauscher FDS102: Securing Railway Diagnostic Access
March 23 · 19 min
Oldsmar and OT Remote Access: Questioning Standing Trust
Persistent maintenance trust can become a route to physical consequences in OT. Explore the Oldsmar case and the wider exposure created by IT/OT convergence. The episode questions when authorized connectivity should cease to authorize control. Related CUP episodes: Oldsmar Incident: When Maintenance Access Becomes the Attack Path OT Remote Access: Closing the Path When the Work Ends OT Remote Access: Securing the Path to Physical Control OT Session Hijacking: Revoking Trusted Engineering Access Legacy VPNs in OT: Remote Access and the Cost of Disruption OT Session Theft: When a Token Bypasses the Jump Host Control Plane Security: When Network Segmentation Is Rewritten AiTM Phishing: Why MFA Does Not Prevent Session Theft OT Emergency Access: Designing Secure Break-Glass Operations Zero Trust in OT: Secure Access Beyond the HMI
S1 · E15
March 20 · 24 min
Post-Quantum Security in OT: Planning for Long-Lived Infrastructure
Industrial information can retain strategic value long after it has been collected. Explore harvest-now-decrypt-later risks and the transition to post-quantum cryptography in OT and railway infrastructure. The episode examines migration challenges for long-lived systems. Related CUP episodes: NSA ASIC Assurance: Verifying Trust in Silicon Chip Security Assurance: Making Silicon Security a Design Gate Espressif Secure Boot: Where Firmware Trust Can Break Signed Firmware: Why the Signature Is Only Part of the Trust Chain Automotive Cybersecurity: Why Local Access Can Have High Impact
S1 · E2
March 19 · 8 min
Stolen Credentials and Machine Identities in OT: Executive Brief
Stolen credentials and third-party exposure create operational risk beyond the human user account. This executive brief connects findings from the Verizon 2025 DBIR with machine identities and Zero Trust in OT. It focuses on resilience decisions that preserve process determinism and safety. Related CUP episodes: How Stolen Credentials Break Industrial Plants The Illusion of MFA: AiTM Phishing and Session Token Theft
S1 · E14
March 18 · 26 min
Verizon DBIR: Stolen Credentials and Industrial Plant Security
Stolen credentials and supplier exposure connect enterprise incidents to plant risk. Explore the Verizon 2025 DBIR alongside industrial access paths. The episode examines how identity decisions affect operational resilience beyond the corporate network. Related CUP episodes: Stolen Credentials and Machine Identities in OT: Executive Brief Ransomware in OT: How Stolen Access Disrupts Production Legacy VPNs in OT: Remote Access and the Cost of Disruption
March 17 · 12 min
Prompt Injection and Agentic AI Security: Executive Brief
Documents and web pages can carry instructions that undermine enterprise AI workflows. This executive brief explores indirect prompt injection, adversarial methods and the move from DevOps to MLSecOps. It connects those technical risks to governance questions for higher-risk AI deployments. Related CUP episodes: Why Hidden Text Hacks Enterprise AI [2026] Urgent: When AI Agents Become the New Insider Threat - Zero Trust When AI Crossed the Trust Boundary: The OpenAI–Hugging Face Incident
S1 · E13
March 16 · 36 min
Indirect Prompt Injection: How Hidden Text Targets Enterprise AI
Indirect prompt injection can hide instructions in material an enterprise AI system is expected to read. Explore how agentic AI expands the consequences of that trust problem. The episode examines security decisions around models that can interact with systems and perform actions. Related CUP episodes: Prompt Injection and Agentic AI Security: Executive Brief Agentic AI Security: Controlling Autonomous System Access AI Sandbox Security: The OpenAI–Hugging Face Trust Boundary Kinetic AI and Critical Infrastructure: Connecting Cyber and Physical Risk Siemens S7 PLC Security: How AI Changes Attack Feasibility When Digital Actions Create Physical Impact | CUP Micro Brief AI Sensors in OT: Why Plausible Data Can Mislead the PLC AI Welding Inspection: Why Software Integrity Is Not Process Integrity Legacy PLC Security: Where Digital Controls Meet Physical Limits Railway AI Supply Chains: Managing Subcontractor Data Leaks
S1 · E12
March 14 · 41 min
DDoS and Hacktivism: Operational Disruption as a Business Risk
DDoS and hacktivism can turn digital disruption into a business and operational problem. Explore the effect of unavailable customer services and the decisions required to sustain operations. The episode connects response planning with leadership accountability and resilience. Related CUP episodes: OT Patch Management: Protecting Security and Production NIS2 Incident Recovery: Aligning IT and Engineering Decisions Minnesota Water Cyberattacks: When OT Security Meets Physical Risk
S1 · E11
March 11 · 40 min
Agentic AI Security: Controlling Autonomous System Access
An AI agent with system access can act beyond the role of a conversational assistant. This episode examines agentic AI and autonomous access as an identity and trust-boundary problem. Related CUP episodes: Indirect Prompt Injection: How Hidden Text Targets Enterprise AI Prompt Injection and Agentic AI Security: Executive Brief AI Sandbox Security: The OpenAI–Hugging Face Trust Boundary Railway API Security: When Authenticated Data Contradicts Reality Kinetic AI and Critical Infrastructure: Connecting Cyber and Physical Risk Siemens S7 PLC Security: How AI Changes Attack Feasibility AI Sensors in OT: Why Plausible Data Can Mislead the PLC AI Quality Inspection in OT: When a Bad Weld Passes Railway AI Supply Chains: Managing Subcontractor Data Leaks When Digital Actions Create Physical Impact | CUP Micro Brief
March 9 · 23 min
Railway Identity Security: When Attackers Use Valid Access
An intrusion can begin with valid access rather than a visible malware payload. This railway episode frames identity as an operational security boundary. Related CUP episodes: Railway OT Segmentation: When a Network Change Opens the Boundary Zero Trust in OT: Secure Access Beyond the HMI Railway API Security: When Authenticated Data Contradicts Reality Legacy VPNs in OT: Remote Access and the Cost of Disruption OT Remote Access: Closing the Path When the Work Ends OT Session Hijacking: Revoking Trusted Engineering Access OT Session Theft: When a Token Bypasses the Jump Host AiTM Phishing: Why MFA Does Not Prevent Session Theft Control Plane Security: When Network Segmentation Is Rewritten OT Remote Access: Securing the Path to Physical Control
S1 · E10
March 6 · 38 min
KEV-First Patching: Prioritizing the Exposed Control Plane
Actively exploited edge vulnerabilities can require decisions outside the monthly patching cycle. Explore KEV-first prioritization, emergency change windows and compensating controls for exposed services. The episode examines how to connect exploitation evidence with operational patch decisions. Related CUP episodes: IBM X-Force: Exploiting Vulnerabilities Without Authentication PLCnext Vulnerabilities: Assessing the Real OT Attack Path PowerLogic T300 Security: When SSH Access Crosses the Trust Boundary Weidmüller Router Security: When Segmentation Becomes an Attack Path OT Hypervisor Security: Protecting HMIs, Historians and Jump Servers Siemens S7-1500: Managing PLC and Linux Security Lifecycles Industrial Firewall Security: The Hidden Software Lifecycle Zero Trust for Brownfield OT: Working Within Legacy Constraints OT Patch Management: Protecting Security and Production Railway Patch Management: When an Update Stops the Network
S1 · E9
March 4 · 32 min
AiTM Phishing: Why MFA Does Not Prevent Session Theft
Adversary-in-the-Middle phishing can steal session tokens even after a user completes MFA. Explore the attack mechanism, session binding and revocation decisions in banking and insurance environments. The episode examines how authentication and incident response must account for an already established session. Related CUP episodes: OT Session Theft: When a Token Bypasses the Jump Host OT Session Hijacking: Revoking Trusted Engineering Access OT Remote Access: Securing the Path to Physical Control Oldsmar Incident: When Maintenance Access Becomes the Attack Path OT Remote Access: Closing the Path When the Work Ends Control Plane Security: When Network Segmentation Is Rewritten OT Emergency Access: Designing Secure Break-Glass Operations Legacy VPNs in OT: Remote Access and the Cost of Disruption Zero Trust in OT: Secure Access Beyond the HMI Railway OT Segmentation: When a Network Change Opens the Boundary
S1 · E8
March 2 · 40 min
Automotive Extortion: Protecting Cloud, APIs and the Update Chain
Automotive extortion can target cloud services, APIs and software delivery pipelines beyond the vehicle itself. Explore update-chain protection, signing keys and responsibilities across the automotive supply chain. The episode connects those dependencies with ISO/SAE 21434 and UNECE R155 and R156. Related CUP episodes: Stadler Rail Extortion: Securing Supplier Data Exchanges Security Scanner Supply Chains: The Trivy and CERT-EU Case Railway AI Supply Chains: Managing Subcontractor Data Leaks Kudankulam Supply Chain Breach: Protecting Engineering Information Windchill Security: Restoring Trust in Engineering Data
S1 · E11
February 28 · 33 min
Control Plane Security: When Network Segmentation Is Rewritten
Control-plane compromise can change the network boundaries on which segmentation depends. Explore network-management trust, remote maintenance paths and the consequences for industrial and automotive operations. The episode examines why the systems that define access need their own protection. Related CUP episodes: OT Remote Access: Closing the Path When the Work Ends Oldsmar Incident: When Maintenance Access Becomes the Attack Path OT Session Theft: When a Token Bypasses the Jump Host Legacy VPNs in OT: Remote Access and the Cost of Disruption OT Session Hijacking: Revoking Trusted Engineering Access OT Emergency Access: Designing Secure Break-Glass Operations OT Remote Access: Securing the Path to Physical Control AiTM Phishing: Why MFA Does Not Prevent Session Theft Zero Trust in OT: Secure Access Beyond the HMI Railway OT Segmentation: When a Network Change Opens the Boundary

Showing 121–140 of 148 episodes