Unwarranted Confidence On Mount Stupid
The OT and ICS security community has unwarranted confidence in our ability to manage OT cyber risk. I write this as someone who has been working on this problem for 23 years now and has finally descended Mount Stupid and is making my way out of...
Three Thoughts On The OT Security Workforce
1. Turning Down The Demand Curve A market has a supply curve and demand curve. Most OT security workforce shortage discussions focus on the lack of supply, the lack of the people in the field. This is to be expected for a new career category and with many companies...
The ETHOS Of Unusual Cooperation
There was a surprising announcement yesterday in the OT detection space with the creation of the Emerging Threat Open Sharing (ETHOS) organization, open source project and development plan. Surprising because of the members. The big three in OT detection:...
Will CISA Push Finally Lead To OT Secure By Default?
Last week CISA published Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default. While most of the attention has been on Security by Design, Security by Default can be a much more immediate result and a long...
Wanted: Cognitive Diversity In OT Security
We have a diversity problem in OT security. The obvious lack of diversity is social diversity. Racial, gender and even age diversity. It’s important the community is taking this seriously and making progress. However there is another type of diversity...
Another Swing At Chat62443
A Seth Godin blog and Peter Drucker daily digest one day last week brought me back to my IEC 62443’s Future … Encyclopedia Brittanica and AI article, originally published in January 2023. The article raised the ire of many on the 62443 committee,...
New Recipe for Governments: Stop!, Hypothesis and Metric, Falsify Criteria
Governments have greatly increased the activity level on addressing OT security. Unfortunately, much, if not most, of the activity is wasted. I’ll use the US Dept of Energy’s CESER program as the example. This recipe applies to all government organizations, US and...
One-Way, One-Way
Hat’s off to the Waterfall marketing team on the buildup for their new WF-600. They treated it like a movie release with a trailer and other social media content designed to peak interest in the new product release. Part of the reason it was so...