About Cybersecurity Under Pressure. Real Attacks, Real Lessons
Cybersecurity Under Pressure examines real incidents, technical research and security decisions across industrial systems, railways and connected vehicles. Antonio González connects attack mechanisms with engineering constraints, operational resilience and product-security evidence. Explore OT and ICS security, automotive and railway cybersecurity, software supply chains and the decisions behind secure operations.
Who Can End a Supplier Session When the Line Is Down?
A production line is stopped, and a supplier needs an engineering connection to diagnose the fault. In this explicitly hypothetical CUP scenario, the same legacy session can also download a PLC program. The question is who can constrain and end its authority when recovery is urgent.
We trace the path from supplier identity through remote access, a plant-controlled workstation, the engineering tool and the controller. A broker disconnect, account disable and controller-side termination do not necessarily have the same effect; none can undo a program already downloaded. MFA, recording and a jump host add control points, but do not make a change-capable tool read-only.
We discuss named access, expiry, local supervision, alternative routes, surviving sessions and a bounded non-production acceptance exercise. This is an engineering analysis, not a reported incident, product vulnerability or completed experiment. NIST SP 800-82 Rev. 3 provides context; the revocation sequence and acceptance checks are CUP recommendations.
Read the companion analysis: https://cybersecurityunderpressure.com/analysis-supplier-session-revocation-legacy-ot
6 Nov 2026
How Attackers Weaponized Evernote Against SCADA
What happens when a trusted note-taking workflow becomes a route into an industrial control environment? This episode examines an Evernote-to-SCADA attack path and the boundary between ordinary collaboration tools and operational access.
We consider how attackers can use familiar cloud content, links or shared documents to influence users and systems that support industrial operations. The practical questions are where trust is established, what privilege is needed to reach an engineering workstation or SCADA component, and which actions the available evidence actually supports. A suspicious document alone does not prove process manipulation.
For OT teams, the response starts with controlled access paths, isolation between corporate and plant networks, application and identity telemetry, and verification of changes at the engineering and control layers. Detection and containment must respect plant safety and availability. The lesson is to test the complete route from external content to privileged industrial action, not merely the first click.
4 Nov 2026
How Incomplete SBOMs Hide Critical Vulnerabilities
An SBOM is only as useful as the components and relationships it captures. This episode examines how incomplete software bills of materials can hide critical vulnerabilities when transitive dependencies, embedded packages, firmware or build artifacts are missed.
We discuss the difference between generating an SBOM and accepting it as evidence: checking scope against the delivered build, reconciling package and version identifiers, testing dependency depth and validating the tool configuration. A clean vulnerability scan cannot establish absence of risk if the underlying inventory is incomplete.
For automotive and industrial systems, OEMs, suppliers and operators must trace findings to the exact delivered baseline, assess exploitability in context and maintain that evidence as products change. An SBOM supports this work; it does not replace product-level security analysis.
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
Spotify
5.0 / 5
1 ratings
Contact Cybersecurity Under Pressure. Real Attacks, Real Lessons
Guest appearances
Does not typically book guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Cybersecurity Under Pressure. Real Attacks, Real Lessons?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
