Assessments19 March 20264 min read
OT cybersecurity is public safety: why risk assessments need to go beyond dollars
When a risk assessment for an industrial plant counts only downtime, lost production and recovery cost, it misses the largest number on the page. OT incidents can hurt people, and the way we score risk has to show it.
Assessments5 January 20266 min read
Conducting a gap assessment for your OT cybersecurity program
A gap assessment is the lightest and most useful first step in OT security. Done well, it gives you quick wins and a roadmap your board can fund, in two to four weeks and without touching production. Done badly, it gives you a thick report that nobody acts on. Here is the difference.
Incident response20 December 20255 min read
Tabletop exercises (TTX) for OT incident response: how to run one that actually teaches you something
Many OT tabletop exercises are theatre: everyone reads a role, agrees the plan is fine, and goes back to work. A useful one is uncomfortable, because that is where the gaps show. Here is how to design, run and follow up an exercise that is worth half a day.
Semiconductor10 December 20256 min read
Semiconductor cybersecurity: what SEMI E187, E188 and E191 mean for fabs and equipment suppliers
The semiconductor industry has its own cybersecurity standards, and fabs now write them into their purchase specifications. Here is what SEMI E187, E188 and E191 require, in plain words, how they fit together, and what to do about them.
Incident response2 December 20255 min read
ICS/OT incident response: why your IT runbook won't save the plant
Your IT runbook says isolate the affected host. On a plant floor, isolating the wrong host can stop production or take away the operator's view of a live process. OT incident response is its own discipline, and it starts with six questions an IT plan never asks.
Architecture1 December 20255 min read
IEC 62443 zones and conduits explained (without the standard's language)
IEC 62443 is precise, thorough and hard going on a first read. Here is the zone and conduit model the way I explain it to engineers on their first day: what a zone is, what a conduit is, what security levels mean, and how to apply it to a real plant.
Governance and leadership10 October 20254 min read
Real leadership in ICS/OT cybersecurity is an attitude, not a title
The best OT security leaders I know do not have 'Head of' in their title. They have technicians who trust them, operators who call them before the vendor, and a plant manager who reads their report. Here is what that kind of leadership looks like.
Architecture16 September 20254 min read
What makes an OT network perfectly air-gapped? (And why yours probably isn't)
Online debates keep asking whether a network was really air-gapped. So what would a truly air-gapped OT network look like? Here are five strict criteria, why very few plants meet all of them, and what to do instead.
Assessments15 September 20254 min read
What do you really want from your OT cybersecurity risk assessment?
Many OT risk assessments end up as thick reports on a shelf. Before you commission one, answer a harder question: what do you want it to do for you? The answer changes the scope, the method and the report.
OT fundamentals1 September 20255 min read
Why OT security is different from IT security (and why the distinction still matters)
IT friends often ask me why they cannot run their existing playbook on the plant. The short answer: a plant protects people and the process first, its equipment lives for decades, and its protocols trust everyone. Here are the eight differences that matter, and how to converge without breaking anything.
Architecture21 August 20255 min read
Understanding the industrial DMZ (Level 3.5): the security buffer that keeps industrial systems safe
What the Industrial DMZ (Level 3.5 in the Purdue model) is, why it exists, and the design principles that separate a real IDMZ from two firewalls someone labelled 'DMZ' on a drawing.
Careers and learning20 August 20254 min read
Is it too difficult to start? No. Here is exactly where to begin.
Breaking into OT cybersecurity can feel overwhelming: PLCs, DCS, SCADA, IEC 62443, the Purdue model, GICSP, GRID and fifty more acronyms. The good news is that you do not have to start with all of them. Here is a sequence that builds on itself.
Governance and leadership28 July 20254 min read
Cyber governance in ICS/OT: where most programs quietly fail
Most OT security programmes do not fail for lack of technology or tools. They fail because nobody owns them. Three governance questions separate mature programmes from the rest, and fixing them in the first 90 days needs no new tools.
Careers and learning10 July 20254 min read
Will AI steal your OT cybersecurity job? Here's what I told a group of students
I sat down with a group of undergraduate students planning a move into OT cybersecurity. Their first question was not about certifications or salary. It was whether AI would make the field irrelevant before they finished learning it.
OT fundamentals25 July 20244 min read
Rising threats in OT cybersecurity: what has changed, and the five controls that still work
Ransomware groups now go after manufacturers more than any other industry, the air gap has mostly gone, and many plants still run controls designed for another era. None of this calls for panic. The controls that work are known, and most start with what a plant already owns.
OT fundamentals16 May 20234 min read
You don't always need tools to protect your OT environment
Tools add a real layer of security, but they are not where OT security starts. Before you buy anything, there are six things you can do that cost almost nothing and often matter more.
Careers and learning27 February 20234 min read
A guide to your certification journey in ICS/OT cybersecurity
Certificates will not make you an OT cybersecurity expert, but the right order will speed up the journey. Here is the path I recommend to people starting out, and what each certificate actually prepares you to do.