Episode 125
Federal Agencies Can Enter Private Networks to Hunt Malware. Is Your Plant Prepared?
Dino and Jim break down a major shift in the cyber threat landscape: federal agencies obtaining legal authority to enter private networks to hunt down state-sponsored malware, and what that signals for industrial organizations.
Chapters
- 00:00:00 — Why identity, trust, and vendor access are breaking down in modern plants
- 00:01:00 — The episode’s trigger: government-led operations to remove malware from private networks
- 00:03:00 — “Machete scanning” and why IT-style tactics can disrupt OT operations
- 00:05:00 — The real target set: critical infrastructure, supply chains, and smaller utilities with limited resources
- 00:08:00 — Collateral damage and how cyber “weapons” trickle down to criminal ransomware
- 00:13:00 — Why OT is still a soft target: visibility gaps, unpatched systems, and weak segmentation
- 00:14:00 — Remote access everywhere: OEM/SI pathways, unknown identities, and lack of governance
- 00:20:00 — The logging gap: what IT sees vs. what OT can’t see (and why that matters for incident response)
- 00:24:00 — Building automation and facilities systems as weak links attackers love
- 00:26:00 — Executive accountability: what boards should be measuring after breaches (and why progress stalls)
Show notes
Dino and Jim break down a major shift in the cyber threat landscape: federal agencies obtaining legal authority to enter private networks to hunt down state-sponsored malware, and what that signals for industrial organizations.
They discuss why critical infrastructure and supply chains are prime targets, how “soft targets” in OT and building automation get exploited, and why many companies still lack visibility into what’s happening on the plant floor.
The conversation zooms in on real-world exposure points, especially unmanaged vendor remote access and end-of-life equipment, and closes with practical themes for leadership.
- Stop assuming “IT has it covered”
- Define measurable OT security outcomes
- Start taking steps that make disruption harder and detection faster.
Chapters:
- (00:00:00) Why identity, trust, and vendor access are breaking down in modern plants
- (00:01:00) The episode’s trigger: government-led operations to remove malware from private networks
- (00:03:00) “Machete scanning” and why IT-style tactics can disrupt OT operations
- (00:05:00) The real target set: critical infrastructure, supply chains, and smaller utilities with limited resources
- (00:08:00) Collateral damage and how cyber “weapons” trickle down to criminal ransomware
- (00:13:00) Why OT is still a soft target: visibility gaps, unpatched systems, and weak segmentation
- (00:14:00) Remote access everywhere: OEM/SI pathways, unknown identities, and lack of governance
- (00:20:00) The logging gap: what IT sees vs. what OT can’t see (and why that matters for incident response)
- (00:24:00) Building automation and facilities systems as weak links attackers love
- (00:26:00) Executive accountability: what boards should be measuring after breaches (and why progress stalls)
Links And Resources:
- Want to Sponsor an episode or be a Guest? Reach out here.
- Industrial Cybersecurity Insider on LinkedIn
- Cybersecurity & Digital Safety on LinkedIn
- BW Design Group Cybersecurity
- Dino Busalachi on LinkedIn
- Craig Duckworth on LinkedIn
Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!
About Industrial Cyber Security Insider
Industrial Cybersecurity Insider brings clarity to one of the most urgent gaps in manufacturing and critical infrastructure: the divide between IT and OT. Hosts Craig and Dino talk with plant leaders, engineers, and security practitioners about protecting industrial operations in the real world — practical conversations for the people responsible for keeping production running and secure.