Nerd Out EP 75. Insider threat and election security

On the latest episode of Nerd Out, Dave and Alec dove deep into Insider Threat risk and discussed some of the key points of their recently published White Paper. This included some of the common risks, the impacts, recent examples and how it can be manifested, as well as steps that organizations can take. They transitioned to talk more about election security, not just within the U.S., but around the world. This includes the always important need to be situationally aware as an individual and within the organization.They wrapped up the pod with some pop culture discussions around Vision Quest, Lanterns, and Doomsday. References from the show include:Insider Threats in the Water Sector A Growing and Underestimated Risk - https://798e9613-17b7-4abe-89e5-b34415cf6158.usrfiles.com/ugd/798e96_a263d7354ae641058e2451e030c1fefe.pdf Mitigating Insider Threats to U.S. Election Systems - https://www.ic3.gov/CSA/2026/261008-2.pdfThe Terrorism Threat to the 2026 Midterm Elections: What the Data Tells Us - https://www.csis.org/analysis/terrorism-threat-2026-midterm-elections-what-data-tells-us

On this week's Security Sprint, Dave and Andy covered the following topics:Opening:• 15th Annual GridSecCon Advances Unified Resilience — North American Electric Reliability Corporation — 22 Oct 2026. More than 1,000 electricity-sector security professionals participated in the 15th annual GridSecCon, hosted by NERC, the Electricity Information Sharing and Analysis Center, and SERC, with a focus on strengthening coordinated cyber and physical security resilience. The conference included more than 50 sessions and contributions from over 100 government and industry leaders addressing evolving threats, operational readiness, and collaboration across the North American electricity sector. • Join the GRIP! GRIP Alerts - TLP GREEN: Critical PHP Vulnerabilities – Update 3 - PHP2Shell — Third Vulnerability, Exploitation Activity, and New Defensive Guidance, sent Sunday, 25 Oct. Main Topics: Election Security!• Suspicious Letters Containing White Powder Mailed to State and Local Election Officials, Media Organizations, and Public and Private Polling Companies — FBI & USPS • Election Offices in at Least 32 States Have Received Suspicious Letters • Increasing Anti-Muslim and Anti-Arab Political Rhetoric — NPR / Associated Press / Newsweek • Gate 15's recently updated Hostile Event Attack Cycle framework• Spot the Lie: 6 Moves of “Rigged Election” Rumors • Trump offers $1 million reward for voter fraud tips that lead to convictions • U.S. officials quietly advise states fearing Trump election meddling • States face foreign threats — and a fractured federal partnership — ahead of midterms • Trump Administration Expands Voter Fraud Crackdown As Midterms Approach • FBI: Connecticut man vowed to kill Republicans, kept a target list of homes with Trump signs • Monitoring the monitors: US states prepare for surge of Justice Dept election watchers • Ahead of Midterm Elections, Warner, Padilla, Himes, and Morelle Urge Leading Tech Companies to Not Detract From Efforts to Ensure Elections are Free, Fair, and Secure • Blanche: DOJ could block election certification in ‘doomsday scenario’ • U.S. Political Money Funnels to Indian Bots to Lure Voters • Governor Abbott Praises Law Enforcement Arrest In Islamic Terror Plot Against Congressman Self Extremism:• The Rising Islamic State Threat to Europe and the West — Lawfare — 18 Oct 2026. Terrorism analysts Lucas Webber, Peter Smith, and Colin P. Clarke assess that Islamic State-Sahel Province is evolving from a regional insurgency into a transnational terrorist threat, supported by emerging recruitment, logistics, and facilitation networks connecting West Africa with Europe. • "You Will Become a Saint If You Kill": The Networks Recruiting School Shooters — Red Pill Reversal — 24 Oct 2026. Researcher Michael Corech documented online communities associated with nihilistic violent extremism and the 764-linked Com ecosystem openly encouraging school shootings and recruiting prospective attackers through Telegram and other social platforms. Quick Hits:• Exploited Flaws Typically Take Three Months to Patch, Moody’s Finds • Silent Ransom Group - Leak Analysis — Ransom-ISAC: Leaked materials revealed planning for physical infiltration, kidnapping, insider placement at defense contractors, and intelligence collection targeting military personnel. • #StopRansomware: SafePay Ransomware — CISA, FBI, U.S. Secret Service, partners• NSA and Others Advise Organizations with Practices to Prepare for and Manage Super Intelligence Related Incidents — National Security Agency — • Introducing a new AI chapter in the NCSC research problem book — UK National Cyber Security Centre • New data show cleared employees are bigger targets than ever • U.S. and Israel Draw Up Plans for Renewed Strikes on Iran After Elections • U.S. Intelligence Warns Iranian Plots to Kill American Officials Abroad Have ‘Reached Advanced Stages’

On this week's Security Sprint, Dave and Andy covered the following topics:Opening:• The Gate 15 Interview EP 75. E-ISAC’s Jesse Sythe on GridEx, Resilience, Fromage, and MTV! — Gate 15 — 19 Oct 2026. Gate 15's latest interview features Jesse Sythe of the Electricity Information Sharing and Analysis Center, discussing GridEx, electric-sector resilience, and the importance of collaboration across the critical infrastructure community. • We’re making some changes to the SUN video edition and will briefly pause video delivery. We look forward to returning soon with a new and improved format highlighting the SUN’s top stories in a way that’s easy to share with your team!• Ideas for our podcasts in 2027? Send ‘em to [email protected]!! Main Topics:Hostile Events! White Paper: The Hostile Event Attack Cycle (HEAC), 2026 Update — Gate 15 — 14 Oct 2026. Gate 15 released an updated Hostile Event Attack Cycle white paper examining how individuals and groups plan, prepare for, and carry out hostile attacks, drawing on recent incidents including the New Orleans truck attack, Uvalde school shooting, and Crocus City Hall attack. The update retains the model’s seven phases while examining the influence of online radicalization, geopolitical conflict, encrypted communications, drones, and artificial intelligence on hostile-event planning. • FB-ISAO Releases an All-Faiths Analysis of Attacks on U.S. Houses of Worship in 2025 — FB-ISAO — 09 Oct 2026. The Faith-Based Information Sharing and Analysis Organization released its third annual all-faiths review, documenting 915 reported incidents at U.S. houses of worship in 2025, up 8.8% from 2024. • Police: Palatine man was plotting mass shooting at Hindu temple — Daily Herald — 14 Oct 2026. Drones Are Threatening U.S. Assets Overseas, but Their Threat to the U.S. Homeland is Higher — The Soufan Center — 14 Oct 2026. The Soufan Center assesses that the proliferation of inexpensive drones is increasing threats to U.S. military assets abroad and to domestic military and civilian facilities. France Supermarket Hacks Expose Risks of Internet-Facing Refrigeration Systems — Claroty — 12 Oct 2026. Claroty examined cyberattacks that reportedly disrupted refrigeration systems at French supermarket chains, including an incident affecting 150 Intermarché stores. • Cyberattack shuts down refrigerators at French supermarkets • Cyberattack on French supermarkets causes fires, millions in losses• Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération — CERT-FR • Frostbitten in France: A Danfoss StoreView Internet Exposure Report • Analysis After the Refrigeration System Attack in France: Two Thirds of Exposed Refrigeration Controllers Share an Address with Cameras, Remote Desktop, and VPNs Quick Hits:• Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation — CISA, NSA, NIST • AI Models Can Be Easily Modified to Assist Terrorist and Extremist Activity • AI models may be capable of self-replicating without access to a datacenter • FBI Warns Voters on Election Crimes Ahead of the November 2026 Midterm Election — FBI IC3 • Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials — CISA • FBI Cautions About Threats to Election Workers Ahead of the November 2026 Midterm Election — FBI IC3 • Scammers Exploit 2026 U.S. Midterm Election to Perpetrate Multiple Fraud Schemes — FBI IC3 • FEMA and FCC Schedule Nationwide Emergency Alert System Test for 17 November

In this episode of The Gate 15 Interview, Andy Jabbour speaks with Jesse Sythe, E-ISAC GridEx Program Manager. Jesse has spent over two decades in the electricity industry. From serving as an aircraft carrier reactor operator on the West Coast to transmission operator on the East Coast, his career has been steeped in operations. Over the years, his primary focus has been on the improvement of operations, processes, and procedures through emergency response exercises. Starting in 2013, Jesse coordinated GridEx II through VI at Eversource’s Connecticut control center, managing inject and MSEL development, developing full-fidelity simulator scenarios, and developing action items following the exercise. Joining E-ISAC in 2022, he now manages the entire GridEx program, including planning the exercise and following up on action items and recommendations.Jesse on LinkedIn!NERCE-ISACGridEx (including GridEx Public Reports for all GridEx events)In the podcast, Jesse and Andy discuss:Jesse’s background and current role.Critical Lifelines, Electricity and E-ISAC!GridEx & GridEx IX: Registration now open!Jesse’s thoughts on “resilience,” getting comfortable being wrong, and being fearless.Looking ahead, technology, and staying optimistic.Always moving forward, imposter syndrome, video games, Panic at the Disco, and some deep cuts!NERC’s 2025 Long-Term Reliability Assessment (LTRA) NLR’s Interconnection Seams Study (PDF)2021 Texas power crisisNERC’s Large Loads Working Group (LLWG)Northeast blackout of 2003The Sifl and Olly Show (on YouTube)

On this week's Security Sprint, Dave and Andy covered the following topics:Opening:• We’re making some changes to the SUN video edition and will briefly pause video delivery. We look forward to returning soon with a new and improved format highlighting the SUN’s top stories in a way that’s easy to share with your team!• The Value of InfraGard: A Board Member’s Perspective — Gate 15 — 30 Sep 2026• (TLP:CLEAR) WaterISAC Partners with Cyware to Strengthen Threat Intelligence Sharing for the Water Sector• Insider Threats in the Water Sector: A Growing and Underestimated Risk — Sam Houston State University Institute for Homeland Security — Sep 2026. Gate 15’s Alec Davison and David Pounder developed a new report examining insider threats as a growing and often underestimated risk to the water and wastewater sector, emphasizing that the threat extends beyond malicious employees to negligent users, contractors, vendors, and other trusted individuals with authorized access. • (TLP:CLEAR) WaterISAC’s Quarterly Water Sector Incident Summary, April to June 2026 – Executive Summary • Securing Water and Wastewater Operational Technology Environments — NIST — 01 Oct 2026Main Topics:Hate, Extremism & Terrorism: Three Arrested in Mobile for Alleged Threats Against the President — FBI — 02 Oct 2026. The FBI’s Mobile Division, working with the U.S. Secret Service and multiple federal, state, local, and university partners, arrested three individuals for allegedly making threatening communications directed toward the president of the United States. • Georgia man arrested for alleged threat to kill Hegseth, family if Pentagon chief didn’t kill Chabad Jews • Man arrested, accused in plot to attack Texas Capitol building, DPS says • Places of Worship are Increasingly Being Targeted by Far-Right Extremists • Iran hackers offer bounty for Americans: $15K if alive, $2.5K if dead • Two men charged with suspected terror plot targeting Jewish Community in Manchester • The 10 Priorities Every Church Security Team Should Have, and every security team should consider! • Full Senate Passes Measure to Reauthorize Federal Terrorism Insurance Backstop Russia! Hijacking Trusted Media Brands: Russia’s Favorite Disinformation Tactic Against the West Surged by 850 Percent in the Last Year — NewsGuard — Sep 2026. NewsGuard reports that Russian influence operations increasingly impersonate legitimate news organizations to lend credibility to fabricated stories, videos, websites, and social-media content. Quick Hits: • Measles! Flu! COVID! Ebola!• Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway — CISA • Disruptive cyber attacks – reducing their impact, reducing the risk — National Cyber Security Centre • 2026 Digital Defense Report — Microsoft • Threat Spotlight: What’s Trending? Top Cyber Attacker Techniques: June 2026–August 2026 — ReliaQuest

On the latest episode of Nerd Out, Dave and Alec are joined by Joe Levy (most favorite guest status) and Sharon Dye to talk about National Preparedness Month. Focusing on the human behavior, the discussion focuses on common pitfalls of where preparedness activities fail and ways that organizations can address that. Joe and Sharon founded The HX3 Advisory Group™Find out more at: thehxadvisorygroup.com

On this week's Security Sprint Dave and Andy covered the following topics:Opening:• 15 x 15 GRIP Alerts!!• 27th Annual TribalNet Conference & Tradeshow • Tribal-ISAC• CISA: 2026 Election Infrastructure Security Plan Main Topics:Terrorism and Targeted Violence (T2V) in the United States: Plots Targeting U.S. Schools — START — Sep 2026. The University of Maryland's START program examined 700 premeditated plots targeting U.S. school spaces between January 2023 and March 2026 using its Terrorism and Targeted Violence database. The research analyzes plot rates, locations, weapons, perpetrator intentions and outcomes, perpetrator ages, and the intersection between terrorism and school-based targeted violence. OpenAI Agent Hacked Australia’s Health Service. Their Government Found Out Months Later — WIRED — 24 Sep 2026. An OpenAI agent conducting research on publicly available medicine-spending data gained unauthorized access to a Services Australia Medicare statistics portal on 18 June after encountering restrictions and finding alternative methods to obtain the requested information. • Scoop: Top AI companies probing tens of thousands of security incidents — Axios • The Hugging Face incident and other third-party impact from misaligned models — OpenAI • OpenAI pauses training on some models, says agents targeted government sites • OpenAI agents tried to bruteforce a UN website's API fields • OpenAI's AI agents accidentally uploaded user-provided images to third-party sites • It was a matter of when, not if... — DIVD — 24 Sep 2026. The Dutch Institute for Vulnerability Disclosure reported that its own infrastructure was compromised and said the attack's modus operandi indicates what it believes may be an agentic AI-powered attack, while emphasizing that its forensic investigation remains ongoing. • Cyber Threat Report 2026: Leaders need to prepare now for the impact of AI — New Zealand National Cyber Security Centre — Sep 2026• Protect your organisation’s AI services — Australian Signals Directorate — Sep 2026. Quick Hits:• ENISA Threat Landscape 2026 — European Union Agency for Cybersecurity — 22 Sep 2026. ENISA’s annual threat assessment finds the European cyber environment increasingly shaped by interconnected threats, shared dependencies, geopolitical developments, and blurred boundaries among cybercrime, hacktivist, and state-linked activity. • ShinyHunters hackers say they breached Federal Bureau of Investigation, no immediate comment from FBI • FBI Statement on Compromise of fbijobs.gov Portal and Alleged Impact to FBI Employee PII• Military personnel data exposed in breach, agency warns • Gary Warner on LinkedIn: DMDC breach notification raises questions about notification timing and QR-code delivery • Special agents' blood and urine test results stolen in FBI hack • Russia! US-Based Digital Forensics Firm Hid its Russian Ownership from U.S. Government Customers • Russia! ‘United by chaos:’ Examining the Russian nexus to online networks of nihilistic violence • No Kings: Vote Early nationwide day of action planned for 17 October

On this week's Security Sprint, Dave and Andy covered the following topics:Opening:• CISA Hosts Cyber Storm X, Nationwide Cybersecurity Exercise to Strengthen Resilience — CISA — 18 Sep 2026. • New ASD Guidance: Network Segmentation & Segregation• UK NCSC: Don’t Assume Your Cyber Defenses Work. Test Them.• 27th Annual TribalNet Conference & Tradeshow Main Topics:Severe Weather’s Cascading Effects: Brutal heat, storms threaten football tailgates this weekend; This weekend's football tailgates face two threats: Extreme heat in the Southeast and rounds of rain and storms.• NWS: Thunderstorms and Heavy Rains in the Appalachians. Multiple rounds of moderate to locally heavy rain will impact portions of the Appalachians and Mid-Atlantic, which may lead to flash flooding concerns. • Rare September nor’easter could bring rain, wind and waves to East Coast Russia! Russia Fabricates Celebrity Attacks on Democrats as Midterms Approach — NewsGuard Reality Check — 18 Sep 2026. NewsGuard reports that a Russian influence campaign targeting the 2026 U.S. midterm elections is using manipulated celebrity content and fabricated news reports to attack Democratic candidates and amplify divisive social issues. • 'The rules have changed': has Russia begun to order assassinations on US soil? • Russia Escalates its External Operations Against the United States — The Soufan Center — 18 Sep 2026. • Russian hybrid attacks against Europe intensifying, says Macron • European Parliament adopts new report on foreign information manipulation and interference Russia Boosts the German Far Right — Again • Russia? Suspected sabotage causes major Netherlands rail disruption • Russia? Train derailment in France injures 44, police suspect sabotage North Korean "WaterPlum," commonly referred to as “Contagious Interview,” cyber actor group targeting IT professionals — Australian Signals Directorate’s Australian Cyber Security Centre — 18 Sep 2026. A multinational advisory warns that North Korean WaterPlum actors are targeting software developers and other IT professionals through fraudulent recruitment, technical interviews, and coding assignments designed to deliver malware and steal credentials, sensitive information, and cryptocurrency. • 98% of fraudulent hires have company credentials by the time they’re caught Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes — FBI Internet Crime Complaint Center — 17 Sep 2026. The FBI reiterated its warning about widespread scams in which criminals impersonate U.S. or foreign law enforcement and government officials to obtain money or personally identifiable information. Quick Hits:• Using Cyber Decoys to Strengthen Detection and Response — CISA — 16 Sep 2026. CISA released guidance to help organizations plan and implement cyber decoys to improve detection of adversaries using legitimate credentials, native tools, and living-off-the-land techniques. • Network segmentation and segregation – Overview — Australian Signals Directorate — 17 Sep 2026. 15 from 15 connection:• Network segmentation and segregation – Anti-patterns — Australian Signals Directorate — 17 Sep 2026. • Best practices for setting up a SOC (ITSAP.00.500) — Canadian Centre for Cyber Security — Sep 2026. • Cyber Adversary Simulation (CyAS): scheme documents now available — UK National Cyber Security Centre — 17 Sep 2026.

On this week's Security Sprint, Dave and Andy covered the following topics:Opening:• 15 from 15: Blocking and Tackling Cybersecurity & Resilience — Gate 15 — 09 Sep 2026. Gate 15 released 15 from 15: Cybersecurity Mitigation & Resilience Fundamentals, emphasizing that rapidly evolving threats, artificial intelligence, ransomware, exploited vulnerabilities and nation-state activity do not eliminate the importance of consistently executing foundational security practices. The framework identifies 15 practical areas to help organizations “get a little better every day.” • What the FBI Phishing Warning Means for Event Planners — Skift Meetings — 08 Sep 2026. Gate 15 Vice President and Chief Resilience Officer Ben Taylor contributes perspective.• (TLP:CLEAR) WaterISAC – EPA: National Security Information Sharing Bulletin – Q3 2026 — WaterISAC — 10 Sep 2026• Cyberattacks on food and agriculture can turn disruptions into safety crises, threatening public health and supply chains — Industrial Cyber — 08 Sep 2026• 27th Annual TribalNet Conference & Tradeshow Main Topics:FBI cyber chief worries private sector not sharing enough cyber threat information — CyberScoop — 09 Sep 2026. FBI Cyber Division Assistant Director Brett Leatherman said private-sector organizations are still not sharing enough cyber information with the Bureau, in part because some companies incorrectly believe information provided during an incident will be passed to regulators for regulatory purposes. FBI Cyber Strategy — FBI — 09 Sep 2026. The FBI released its first agency-wide unclassified cyber strategy, organizing its approach around disrupting and imposing costs on adversaries, supporting victims, increasing impact through partnerships and strengthening internal cyber capabilities. China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies — CISA — 08 Sep 2026. CISA, NSA and the FBI warn that China-based AI companies are conducting industrial-scale campaigns to systematically extract proprietary capabilities from U.S. frontier AI models, describing malicious knowledge distillation as a core component rather than merely a supplement to their AI development strategies. Insider Threat Mitigation Guide — CISA — 09 Sep 2026. During National Insider Threat Awareness Month, CISA is again highlighting its Insider Threat Mitigation Guide and related resources for organizations building or improving insider-risk programs.Quick Hits:• Congratulations! You Just Lived Through the Hottest Month Ever Recorded — WIRED — 10 Sep 2026. • NSA Highlights Cyber Hygiene Best Practices Effective Against AI-Enhanced Targeting — National Security Agency — 03 Sep 2026• Gateway security guidance package: Overview — Australian Signals Directorate’s Australian Cyber Security Centre — updated 04 Sep 2026• The hidden risks of shadow AI — UK National Cyber Security Centre — 07 Sep 2026• Iran hackers: Dissatisfaction with AT&T services drove decision to target telecom in Texas • Iran hackers, after denial of Texas AT&T claim: ‘Idiots don’t even know what we tampered with’ • Iran hackers claim Texas AT&T outage, vow to ‘intensify’ attacks before 9/11

In this episode of The Gate 15 Interview, Andy Jabbour speaks with Adam Gruszcynski. Responsible for the day-to-day operations of the IT Department for Potawatomi Casino Hotel while ensuring all of the technology needs, whether current orfuture, of the organization are met. Adam joined Potawatomi Casino Hotel in 2008. During his time at PCH, Adam has gained an abundance of experience by taking on various roles including IT Security Manager, Senior Cybersecurity Engineer, Lead Network Administrator, Network Administrator, and ApplicationAdministrator. Prior to PCH, Adam was Network Engineer at the Milwaukee Journal Sentinel where he began his career as Help Desk Intern. In the podcast, Adam and Andy discuss: Adam’s background and his path to his current roleTribal infrastructure and sovereignty Managing and mitigating risks, investing in peopleResilienceTribal-ISAC and some of the great things ISACs do!Celebrating people, building teamsAdam’s adviceWe play Three Questions and go deep on pro wrestling!