Critical Infrastructure Risks
Easy Prey11 Helmi

Critical Infrastructure Risks

Most cybersecurity conversations focus on stolen data, breached accounts, and attacks that live entirely on screens. This episode looks at a far more consequential threat: what happens when cyberattacks target the physical systems that keep society running. Power, water, transportation, and manufacturing. When those systems fail, the consequences aren't just digital. They're immediate, visible, and sometimes dangerous.

My guest is Lesley Carhart, Technical Director of Incident Response at Dragos, a cybersecurity firm focused exclusively on protecting critical infrastructure. Lesley specializes in industrial control systems and operational technology, investigating real-world attacks against power plants, water systems, transportation networks, and industrial facilities built on aging, irreplaceable technology.

We talk about why these environments are uniquely vulnerable, how ransomware groups and nation-state actors quietly gain long-term access, and why many compromises go undetected for years. The conversation also explores the limits of traditional cybersecurity thinking, the real-world constraints operators face, and what organizations can realistically do to improve security when failure isn't an option.

Show Notes:
  • [01:30] Lesley Carhart is here and explains what operational technology is and why industrial systems are uniquely vulnerable
  • [03:40] How decades-old computers still run power plants, water systems, and transportation infrastructure
  • [06:10] Why industrial environments can't simply patch, upgrade, or shut systems down
  • [08:25] The mindset shift required when safety and continuity matter more than stopping an intrusion
  • [10:40] Why air-gapped systems are mostly a myth in modern critical infrastructure
  • [13:15] How remote access became unavoidable—and one of the biggest risk factors
  • [16:05] The three main threat categories facing industrial systems: ransomware, insiders, and nation-state actors
  • [18:45] Why ransomware is especially damaging in power, water, and manufacturing environments
  • [21:30] How nation-state attackers quietly establish footholds years before taking action
  • [24:20] Why many industrial compromises go undetected for months—or even years
  • [27:10] What incident response looks like when you can't just "pull the plug"
  • [30:05] The most common causes of industrial failures: human error, maintenance issues, and environment
  • [32:40] A surprising incident that looked like a nation-state attack—but wasn't
  • [34:55] Why critical infrastructure organizations often feel pressure to pay ransoms
  • [37:00] Practical starting steps for organizations with aging, mission-critical systems
  • [39:20] Advice for people interested in industrial cybersecurity and working with legacy technology
  • [42:10] Why mentorship matters and why Lesley chooses to give back to the field

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

Links and Resources:

Jaksot(321)

Art Heists

Art Heists

The world of art theft looks glamorous in the movies, but the reality is far more complicated. From multi-million dollar forgery schemes to undercover FBI operations recovering stolen national treasur...

29 Huhti 37min

The Power of Prediction

The Power of Prediction

We make predictions all the time including about the weather, about traffic, about what someone is going to say next. It feels natural, even rational. But when algorithms start making predictions abou...

22 Huhti 39min

Privacy vs Reality

Privacy vs Reality

Online security advice often sounds simple until you actually try to follow it. Between password managers, privacy settings, and data brokers, protecting yourself can start to feel like a full-time jo...

15 Huhti 58min

Wired to Trust

Wired to Trust

It's easy to think scams only work when someone misses something obvious. In reality, most of them don't look obvious at the start. They show up as normal situations with just enough friction to notic...

8 Huhti 41min

Intimate Partner Fraud

Intimate Partner Fraud

Most scams leave a digital trail. A fake email, a spoofed number, a fraudulent website. You can trace them, report them, sometimes even reverse them. But what happens when the scam has no digital trai...

1 Huhti 45min

Identity without Passwords

Identity without Passwords

Every day, employees at hotels, restaurants, and resorts across the country are doing exactly what they were hired to do: being warm, responsive, and eager to help. It's what makes hospitality work. I...

25 Maalis 38min

When Cybercrime Gets Personal

When Cybercrime Gets Personal

Most security breaches don't begin with sophisticated code or elaborate technical exploits. They begin with a phone call, a convincing email, or someone at a help desk who just wanted to be helpful. T...

18 Maalis 45min

Stopping Phone Scams

Stopping Phone Scams

Phone scams get dismissed as background noise or just annoying interruptions and unknown numbers with robotic voices we learn to ignore. But behind that noise is an industry built on psychology, autom...

11 Maalis 45min

Suosittua kategoriassa Politiikka ja uutiset

uutiscast
aikalisa
politiikan-puskaradio
rss-ootsa-kuullut-tasta
ootsa-kuullut-tasta-2
tervo-halme
rss-podme-livebox
aihe
rss-ulkopoditiikkaa
viisupodi
rss-pinnalla
the-ulkopolitist
et-sa-noin-voi-sanoo-esittaa
rss-vaalirankkurit-podcast
rss-asiastudio
radio-antro
rss-tasta-on-kyse-ivan-puopolo-verkkouutiset
otetaan-yhdet
rss-mina-ukkola
rss-polikulaari-pitka-kiekko-ja-muut-ts-podcastit