This episode is a republish from Aaron’s own PrOTect It All podcast, where it was originally released.

If you'd like to reach out to Tom, his email address is tom@tomalrich.com.

Additional links/resources mentioned during the episode or relevant to the discussion (if the links are not clickable please visit cybellum.com/podcasts to find them)

• The SBOM Forum's 2022 white paper on fixing the CPE problem in the NVD
• Tom's post from yesterday on the problem with vulnerability management
• The link to the SBOM Forum's website, where donations can be made (please email Tom before donating)
• An additional post he published on the day we recorded the episode which further highlights the NVD issue
• Tom's book "Introduction to SBOM and VEX" which is out now

Tom also mentioned that he misspoke when he said at the end that the OWASP Vulnerability Database Working Group is meeting twice weekly. In reality, they are only meeting twice monthly, as he can't afford to dedicate more time than that. They would love to meet at least weekly and also create documents, webinars, and more. Therefore, they are seeking some modest donations to support these efforts.

Steve shares valuable insights on product cybersecurity, emphasizing the growing interest from governments worldwide, as seen in regulations like the FDA Premarket Guidance and the Cyber Resilience Act. He offers advice to vendors, suppliers, and users on navigating this evolving regulatory landscape.

On that note, we share our interview with Matanyahu Englman, Israel’s state comptroller and Ombudsman. Mr. Engelman has held countless key positions across government, academia, and the private sector, and is one of the main voices promoting cybersecurity in the state of Israel and abroad. He invited us to his Jerusalem office to discuss his pioneering approach to cybersecurity, hear insights from his team's research, and learn about his multi-national cybersecurity cooperations.

Please note the interview was recorded before the terrorist attacks in Israel.

His latest book “Threats: What Every Engineer Should Learn From Star Wars” is available now: https://www.amazon.com/Threats-Every-Engineer-Should-Learn/dp/1119895162#:~:text=In%20Threats%3A%20What%20Every%20Engineer,how%20to%20develop%20secure%20systems.

During our conversation, Adam mentioned a book by Csikszenmihality, which can be found here:

https://www.amazon.com/Finding-Flow-Psychology-Engagement-Everyday-ebook/dp/B086SVQ1MJ/ref=sr_1_1?crid=132R6QL2KYRZU&keywords=finding+flow&qid=1675723854&sprefix=finding+flow%2Caps%2C166&sr=8-1

He also mentioned a book called "Don't Bother Me Mom", which can be found here: https://www.amazon.com/Dont-Bother-Me-Mom-Im-Learning/dp/1557788588

We sat down with him to discuss the frightening reality of industrial control systems. and the importance of including engineers in industrial product security.

Anthony Fernando is President and CEO of Asensus Surgical, a company that is reimagining how surgeries are being done. Anthony is a veteran of the medical device industry, having held key positions at Stryker, Becton Dickinson & Company, PerkinElmer, and more.

Ken is an expert in everything product cybersecurity and has held key positions at Boston Scientific and Honeywell. He is a senior technical leader with demonstrated capabilities to drive broad cross-functional teams to create effective solutions to complex problems, with particular emphasis on safety and security-critical, regulated industries.

Joseph Steinberg is a world-renowned speaker, advisor, and expert witness talking about cybersecurity, AI, and IoT. He was ranked as one of the top cybersecurity influencers in the world, wrote numerous successful books about cybersecurity, and is instrumental in shaping the cybersecurity world as we know it.

Dr. Allan Friedman is a Senior Advisor and Strategist at the U.S Cybersecurity and Infrastructure Security Agency (CISA). He is both a technologist and a policymaker, with more than 15 years of experience in international cybersecurity and technology policy. He is known for his ability to design, convene, and facilitate complex, multi-stakeholder policy processes, which he demonstrated more than once while leading CISA's efforts to coordinate SBOM standards around the world.

We sat down with him to learn from his vast experience about supply chain security, SBOMs, VEXs, and how they all tie together.

John sat down with us and explained why Florida is one of the greatest hubs for medical device manufacturers and reveals what he learned about medical device cybersecurity after working with dozens of medical technology companies.

In this thought-provoking interview, one of the world's leading medical device cybersecurity experts shares his hopes and concerns for the medical device industry and reveals the personal reasons behind why he chose this challenging -- and fascinating -- profession.

During the past 40+ years, Chris Gates – Director of Product Security at Velentium, has built a huge legacy as a product security expert for embedded systems, especially medical devices. He has helped dozens of leading medical device manufacturers create their product security practice, and greatly contributed to the working groups designing the security frameworks used by the entire industry, such as SBOMs.

In this thought-provoking interview, one of the world's leading medical device cybersecurity experts shares his hopes and concerns for the medical device industry and reveals the personal reasons behind why he chose this challenging -- and fascinating -- profession.

During the past 40+ years, Chris Gates – Director of Product Security at Velentium, has built a huge legacy as a product security expert for embedded systems, especially medical devices. He has helped dozens of leading medical device manufacturers create their product security practice, and greatly contributed to the working groups designing the security frameworks used by the entire industry, such as SBOMs.

Thomas is a veteran cybersecurity expert and engineer in the automotive industry, including in areas such as controllers, autonomous cars, and regulation.

Felipe is a Cyber Security Manager at Jaguar Land Rover. He is an expert in all things automotive cybersecurity, from RF systems to IoT and embedded hardware design. In the past, he was Head of Vehicle Cyber Security LATAM at Fiat Chrysler.

David is the founder of Colombo Technologies. He is a very prolific cyber security researcher who, despite his young age, has managed to build quite a name for himself in multiple industries. During the past few years, he's exposed critical vulnerabilities in government offices, banks, and, most recently, Tesla cars.

We’ve noticed everyone’s running into the same problems, but they take different approaches. Another thing they all have in common is that they wanna learn what the other person is doing.

And then it hit us - why not start a podcast?

Left to Our Own Devices is the name of our new podcast. Dedicated to everything product security, from Medical SBOM, to WP. 29 and the latest industrial security threats.

We’ve invited policymakers, engineers, and industry leaders to hear their war stories and insider tips for surviving the product security jungle.

Product security teams - this podcast is for you. Whether you’re from the Automotive, Medical Device or Industrial equipment industries, you’ve come to the right place.

So buckle up, make yourself a good cup of coffee, and join us for a peek under the hood.

Left to Our Own Devices is brought to you by Cybellum. To learn more, visit Cybellum.com