(CS)²AI Podcast Show: Control System Cyber Security
Sep 29, 2026 · 43 min · 11 segments
Three veterans of critical infrastructure security trace how the field went from arguing that infrastructure was even a target to treating digital risk as an engineering hazard. Ginger Wright, Sarah…
Sarah FreemanGuest
Marc SachsGuest
Ginger WrightHost
I mentioned in my opening remarks that my background is actually in cyber threat intelligence.
And one of the things that was really interesting about starting in that timeframe was that we still had to make the case that critical infrastructure, operational technology, industrial control systems were all targets of cyber attacks.
Coming from where I started prior to INL, I actually was in financial services, so cyber threat intelligence for the financial sector.
And that was a place where there was already incentive structure for at a bare minimum criminal elements to participate in the wonder of illegally gaining funds and access to your accounts.
So that was a field where people kind of understood already the need for cybersecurity.
They'd already gone through the entire process of saying, we need to beef this up.
When I first started, though, at INL, we had to make that case like, no, these are legitimate targets.
And worse than the credit card companies that I originally worked with, there is a more detrimental impact following these kinds of disruptions and events.
So really what I've seen over my career is kind of first trying to make that argument, why this is important, then realizing very quickly, again, because as you, we were both very correct, critical infrastructure is a great target for cyber attacks.
But even in the early stages, we didn't really have very many data points for how that would be manifested in the target environment.
So a lot of what we had to do wasn't necessarily based on historical attacks, which was good in some ways because we were already forward looking and saying, how do we think this might happen in the future? But it was bad because what inevitably happened next is I think we weren't as prepared for the coming onslaught that happened when it became such a popular target.
So we've gone from not believing it was a target to trying to make that argument to being the target du jour, probably more than we care to admit, trying to respond now to a rapidly shifting environment even before generative AI that involves increasing number of vulnerabilities that are being pushed out, identified, flagged within these environments, additional advanced persistent threats targeting the same space, and All of this making it very apparent, I think, that traditional wait until the problem is identified approaches are insufficient from a resourcing standpoint for us to be able to have significant impact.
And so that arc, I think, perfectly mirrors what we're here to talk about today and fundamentally why it's so critical that we talk about the engineering process.
and the associated security of the decisions we're making early on in the process, because we don't have the people, the money, the time to deal with all of these future problems that are going to be identified.
I am so glad you walked us through the history because it does seem quaint to people who have joined the community recently that what do you mean people didn't think you could make something bad happen in infrastructure by doing cyber things? You know, how could they have not realized that was possible? Mark, you saw a lot of this happening from your roles with the Department of Homeland Security and in other roles that you've had.
except for the few that were worried about elevators stopping and power grids not running and other things that kind of intersect more with the critical infrastructure physical side of the world.
I mentioned in my opening remarks that my background is actually in cyber threat intelligence.
And one of the things that was really interesting about starting in that timeframe was that we still had to make the case that critical infrastructure, operational technology, industrial control systems were all targets of cyber attacks.
Coming from where I started prior to INL, I actually was in financial services, so cyber threat intelligence for the financial sector.
And that was a place where there was already incentive structure for at a bare minimum criminal elements to participate in the wonder of illegally gaining funds and access to your accounts.
So that was a field where people kind of understood already the need for cybersecurity.
They'd already gone through the entire process of saying, we need to beef this up.
When I first started, though, at INL, we had to make that case like, no, these are legitimate targets.
And worse than the credit card companies that I originally worked with, there is a more detrimental impact following these kinds of disruptions and events.
So really what I've seen over my career is kind of first trying to make that argument, why this is important, then realizing very quickly, again, because as you, we were both very correct, critical infrastructure is a great target for cyber attacks.
But even in the early stages, we didn't really have very many data points for how that would be manifested in the target environment.
So a lot of what we had to do wasn't necessarily based on historical attacks, which was good in some ways because we were already forward looking and saying, how do we think this might happen in the future? But it was bad because what inevitably happened next is I think we weren't as prepared for the coming onslaught that happened when it became such a popular target.
So we've gone from not believing it was a target to trying to make that argument to being the target du jour, probably more than we care to admit, trying to respond now to a rapidly shifting environment even before generative AI that involves increasing number of vulnerabilities that are being pushed out, identified, flagged within these environments, additional advanced persistent threats targeting the same space, and All of this making it very apparent, I think, that traditional wait until the problem is identified approaches are insufficient from a resourcing standpoint for us to be able to have significant impact.
And so that arc, I think, perfectly mirrors what we're here to talk about today and fundamentally why it's so critical that we talk about the engineering process.
and the associated security of the decisions we're making early on in the process, because we don't have the people, the money, the time to deal with all of these future problems that are going to be identified.
I am so glad you walked us through the history because it does seem quaint to people who have joined the community recently that what do you mean people didn't think you could make something bad happen in infrastructure by doing cyber things? You know, how could they have not realized that was possible? Mark, you saw a lot of this happening from your roles with the Department of Homeland Security and in other roles that you've had.
except for the few that were worried about elevators stopping and power grids not running and other things that kind of intersect more with the critical infrastructure physical side of the world.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.