@BEERISAC: OT/ICS Security Podcast Playlist

The asset-list-versus-asset-inventory distinction is genuinely useful and covers meaningful attributes (firmware versioning, communications relationships, end-of-life status, owner/responsible party), but the 13-minute runtime is dominated by a structured enumeration of known concepts rather than novel ideas. Most of the guidance is standard OT practice with little that would surprise an informed practitioner.

“what's the criticality of that asset, you know, what's the process impact rating of it, Is it a crown jewel?”

“if there is something that does occur in your environment, if uh, your, the asset is a, is um, is manipulated in a way that is off its known baseline. You can identify that rather quickly”

The entire episode recycles well-established OT security doctrine - inventory as a living document, passive monitoring, people-process-technology framing - with no contrarian or first-principles arguments. The closing sentiment ('hope's not a plan') is a well-worn cliché that exemplifies the episode's reliance on familiar platitudes.

“asset inventories are an asset management in general is, is, is, is a living document, it's not a static document”

“it kind of moves the organization from a posture of like hope to uh. One of ah resilience”

Dan Ricci is the founder of the ICS Advisory Project, a legitimate practitioner credential that signals real domain immersion in OT/ICS vulnerability tracking. However, the transcript reveals no evidence of having run OT security at industrial scale inside an asset-owning organization, and he explicitly declines to speak to how operators behave in practice.

“ics uh advisory project supports it. You can use CISA directly. You can go to the vendor's website”

“I wouldn't be able to speak directly on how um, how many like asset owners are actually uh, going in that direction”

A handful of open-source tool names are cited (Wireshark, T Shark, Network Miner) and CISA guidance is referenced, but there are zero named customer examples, no metrics, no dollar figures, and no timelines. The guest openly admits he cannot quantify adoption, which underlines the episode's dependence on abstraction.

“There's passive tools out there that can help do this asset identification uh such as like Wireshark, T Shark, you can use uh Network Miner”

“I wouldn't be able to speak directly on how um, how many like asset owners are actually uh, going in that direction”

The host asks logical sequencing questions that keep the conversation moving, but every question is anticipatory or validating rather than probing - he frequently completes the guest's point and moves on. There is no pushback, no challenging of vague claims, and the episode functions as a promotional discussion of a pre-existing article rather than an interview that extracts new thinking.

“So that really becomes like a business impact discussion at that point.”

“And that's the goal.”