Many responsible for addressing OT cyber risk have difficulty getting budget for their efforts. There are a long list of reasons including: They have not experienced a loss due to an OT cyber incident. They are viewed as spreading FUD because they have not experienced...

I'm a big fan of cover songs. Not the covers that become more popular than the original. Rather the odd cover that it takes you 5 seconds to realize it's a cover of a song you know and like. They're not always good, rarely better, but often interesting. A lot of what...

The OT and ICS security community has unwarranted confidence in our ability to manage OT cyber risk. I write this as someone who has been working on this problem for 23 years now and has finally descended Mount Stupid and is making my way out of...

1. Turning Down The Demand Curve A market has a supply curve and demand curve. Most OT security workforce shortage discussions focus on the lack of supply, the lack of the people in the field. This is to be expected for a new career category and with many companies...

Last week CISA published Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default. While most of the attention has been on Security by Design, Security by Default can be a much more immediate result and a long...

We have a diversity problem in OT security. The obvious lack of diversity is social diversity. Racial, gender and even age diversity. It's important the community is taking this seriously and making progress.  However there is another type of diversity lacking...

A Seth Godin blog and Peter Drucker daily digest one day last week brought me back to my IEC 62443's Future ... Encyclopedia Brittanica and AI article, originally published in January 2023. The article raised the ire of many on the 62443 committee, primarily...

Governments have greatly increased the activity level on addressing OT security. Unfortunately, much, if not most, of the activity is wasted. I’ll use the US Dept of Energy’s CESER program as the example. This recipe applies to all government organizations, US and...