STUFF is on Fire - a Panel

The panel opens with two cloud incidents that the speakers describe as largely avoidable. In one, an admin account without working multi-factor authentication had a weak password that leaked to GitHub, and attackers used it to spin up crypto-mining virtual machines that raised monthly spend sharply. In the other, a misconfigured network security group left a cloud environment open, and an outside party took hundreds of gigabytes of data and threatened public disclosure. Both were framed as human error that basic checks and staffing could have prevented. The discussion then turns to risk: panelists argue that organizations should start from their mission, identify the assets and processes that support it, and explain impact to business leaders in their own terms.

The middle section moves through critical infrastructure sectors. A water-sector speaker describes funding gaps, aging pipe, workforce loss and the cultural gap between utilities and private industry, and notes that a left-on legacy machine enabled tampering at one plant. The food and agriculture discussion focuses on concentration risk, citing a meat processor hit by ransomware that stopped production and a single infant formula plant whose shutdown caused shortages. It also covers connected tractors that collect large volumes of farm data in centralized portals. Municipal and school examples show segmentation helping one city, while a county and a school district lost services and struggled with unclear responsibilities. The speakers also challenge common assumptions, including the Purdue model, the idea of an air gap, and the labeling of every scan as an attack.

The closing takeaways stress rehearsing response through tabletop exercises, since the Colonial Pipeline shutdown was attributed to unpracticed fear. Attendees are urged to join local utility board meetings, ask about risks, and share information across sectors. The panel also points to the ICS FOR ICS response framework as a standardization effort for industrial incidents.