A lot of organisations have an incident response plan. Far fewer have proved that it works in an OT environment. And there’s an important difference between the two. One of the weaknesses I see most often is an incident response plan that is essentially an IT plan with OT added to the title. The terminology…
Seeing more is useful. Knowing what to do with what you’re seeing is where it starts to make a difference. I see this regularly when organisations start sending OT security data into their Security Operations Centre (SOC). On paper, it makes perfect sense. More visibility. More monitoring. More alerts. Better coverage of the OT environment.…
OT cybersecurity budgets are rarely unlimited. There is always something else that could be improved. Another system that needs attention. Another site. Another control. Another risk somebody wants addressed. So one of the most important questions isn’t: What should we buy next? It’s: Where will the next pound actually make a difference? That sounds obvious.…
One of the easiest ways to slow down an OT cybersecurity improvement is to get stuck deciding who owns it. I saw this with a food manufacturer that needed to introduce separation between its IT and OT networks. Everyone agreed a firewall was needed. What stalled progress was ownership. Engineering wanted authority over connectivity to…
Most cybersecurity conversations start with technology. In OT, I think we need to start somewhere else. Earlier this year, I opened the OT Defenders Summit in London with a keynote called The State of OT Defence: From Cyber Controls to Operational Resilience. My job was to set the scene for the day. Rather than talk…
OT Remote Access is a Trust-Boundary Problem. When OT teams discuss remote access, they often begin with the wrong questions. The conversation quickly turns to MFA, session recording, PAM integration, centralised management, or whether the product claims to follow Zero Trust principles. These features may matter, but they do not explain what kind of remote…
What Does a Realistic OT Cybersecurity Baseline Actually Look Like? From Reflection to Action by an OT Cybersecurity Practitioner Across the previous series (Part 1, Part 2, Part 3 & Part 4), I reflected on governance behaviour, visibility gaps, incentives, and the tendency to wait for perfection. A consistent theme emerged: maturity stalls not because…
Progress Beats Perfection in OT Cybersecurity Reflections from an OT Cybersecurity Practitioner Across the previous parts of this series (Part 1, Part 2 & Part 3), I’ve reflected on recurring patterns that shape OT cybersecurity maturity far more than technology alone. Governance structures influence intent. Visibility determines the quality of decisions. Incentives quietly guide behaviour. Taken…
Actions Follow Incentives, Not Policies Reflections from an OT Cybersecurity Practitioner In Part 1 and Part 2 of this series, I reflected on how OT cybersecurity maturity is shaped more by governance, visibility, and decision-making than by technology. A third pattern that emerges repeatedly across OT environments is the role of incentives, particularly the gap…
The Visibility Gap in OT Cybersecurity Reflections from an OT Cybersecurity Practitioner In Part 1 of this series, I reflected on why OT cybersecurity maturity is often constrained by governance behaviour, incentives, and decision-making rather than technology. One related theme that repeatedly surfaces in practice is the issue of management visibility, specifically, the gap between…
Governance, Not Technology, Is Holding OT Cybersecurity Back Reflections from an OT Cybersecurity Practitioner After another year delivering OT cybersecurity services and solutions, one observation continues to surface, a pattern repeated consistently over time. While technology is often challenging, OT cybersecurity maturity is more often constrained by governance behaviour, organisational incentives, and how decisions are…
The decision to patch ICS assets is a topic of significant debate in the cybersecurity community. Unlike IT systems, where patching is generally encouraged to address vulnerabilities, ICS environments often prioritize stability and availability, leading to differing views on whether patching should be immediate or even necessary in every case. Many experts argue that patching…
Today is the Deadline for NIS2, So What? As of today, October 17, 2024, the deadline for the EU’s Network and Information Security Directive 2 (NIS2) has officially arrived. However, only Belgium and Croatia have fully implemented the required cybersecurity measures into national law. This is worrying, as many critical sectors, including energy, utilities, healthcare,…
Riyadh, Saudi Arabia, LEAP Event, March 2024 – OTIFYD, EMEA’s next-generation OT security services provider, has signed a partnership with MAD20™ Technologies, the MITRE ATT&CK® DefenderTM training and certification provider across the GCC and Turkey regions. The partnership between OTIFYD and MAD20 helps to close the persistent cybersecurity skills gap, teaching cyber practitioners how best…
December 12, 2023 – NanoLock Security, a leading provider of device-level, zero-trust OT protection for industrial manufacturing companies, and OTIFYD, EMEA’s next generation OT security services and solutions provider with an elite team of highly trained industrial and cybersecurity engineers and certified experts, are partnering to provide manufacturing and industrial companies with device-level zero-trust OT…
Beyond Compliance: Will Cybersecurity Regulations Keep Up with the Evolution of Threats? In the age of digital connectivity, the critical importance of securing Operational Technology (OT) systems cannot be overstated. Governments and industries are responding to the escalating threats by introducing regulations tailored to OT security. Prominent examples include the Network and Information Systems Directive…
10 Things You Should Do After a Ransomware Attack : Step by Step Guide 2023 1. Stay Calm and Think Rationally Feeling anger or fear as your initial response is completely normal. You’re angry because somebody is trying to extort your company, while fear might stem from the hackers’ threats to expose private or…
Hacking Controller Area Network (CAN Bus) What is Controller Area Network (CAN Bus)? In short words, it’s a communication system made for vehicle intercommunication. It is a network protocol that is commonly used in automobiles to allow different electronic components within the vehicle to communicate with each other over a shared two-wire bus. However, CAN is also…
Cascading Supply Chain Attack In recent years, supply chain attacks have become one of the most significant threats to cybersecurity. Hackers are using these attacks to gain unauthorized access to systems and data, which can cause a cascade of events that can be devastating to an organization. This article will discuss the cascading supply chain…
OTIFYD and Waterfall Security Partner to Secure OT Networks London, United Kingdom, April 4, 2023: OTIFYD, EMEA’s next generation OT security services and solutions provider , and Waterfall Security Solutions, the OT security company, today announce a strategic partnership to strengthen industrial cybersecurity in many industries. This collaboration provides OTIFYD’s customers with secure and consolidated IT/OT integration technology that…
How to shut down a plant remotely in 3 seconds. 3…2…1… and boom! In my hand, I have a remote trigger that can fry the motherboard of any workstation, laptop, server, router, switch, monitor, IP phone, cell phone, firewall, etc. from up to 100 meters away. We can also schedule a date and time when…
Managing Negative PR Implications After a Cyberattack on Critical Infrastructure Guidelines for Effective Crisis Response Cyberattacks on critical infrastructure can have devastating consequences, including negative PR implications for the organization responsible for maintaining the infrastructure. In addition to the immediate risks to public safety, a hack can damage the organization’s reputation, leading to loss of…
Breaking the Illusion: How some CEOs’ Perceptions of Hacking Differ from Reality Hollywood has given us an unrealistic (with the exception of Mr. Robot) and exaggerated portrayal of hacking in movies and TV shows. From the fast typing and flashy graphics to the unrealistic speed and ease of breaking into secure systems, the depiction of…
Why IT Security Companies are Not the Best Choice for Securing Operational Technology IT Security Company vs OT Security Company: Why IT Security Companies are Not the Best Choice for Securing Operational Technology As industrial organisations increasingly rely on connected devices and digital systems to manage critical operations, the importance of industrial cybersecurity has become…
I’m Going to Get Hacked Anyway In his book The Road Less Stupid, Keith Cunningham makes this correct observation about succeeding in business: “I don’t need to do more smart things. I just need to do fewer dumb things.” When it comes to cyber security, I see a lot of dumb decisions made by smart…
OT Attack Surface Management The attack surface of an operational technology (OT) system refers to the total exposure of the system to potential security threats. It encompasses all the entry points and attack vectors that an attacker can use to gain access to or compromise the system. The attack surface includes a wide range of…
Industry 4.0 Security Risks and Opportunities Industry 4.0, also known as the Fourth Industrial Revolution, is a term used to describe the current trend of automation and data exchange in manufacturing and other industries. This new era of manufacturing is characterised by the use of advanced technologies such as the Internet of Things (IoT), artificial…
Common Mistakes IT Security Staff Make in an OT Environment 1 ) Our ICS network is absolutely air-gapped. Throughout the years, we have heard this statement over and over again, specifically from IT department, but in practice and during our assessments, we discovered some sort of connectivity to internet either through the network or some…
10 Most Common OT Attack Vectors An attack vector is the method or path that an attacker uses to access the active target of the attack, that is, the steps that the attacker follows to materialise the threat, it is known that each attacker follows his own “strategy” to be able to consummate Its objective,…
Vulnerability Assessment : Active Scanning vs. Passive Scanning For quite some time, OT engineers and asset owners were horrified by the sound of the “active scan” and quite frankly, they were partially right. No one would dare to scan an OT network the way IT network scans were performed. An active scan could shut down…
How to Build a Defensible OT Network 1. Assessment Although vulnerability assessment and risk assessment are commonly used interchangeably, but they are two different approaches, and both are needed as part of a comprehensive security assessment. Another misconception is that security assessment is a network anomaly detection tool like Nozomi Networks, Claroty or Tenable. Any…
How to Secure Industrial Networks Against Ransomware in 2023 Since the outbreaks of Wannacry & NotPetya ransomware attacks in 2017, we’ve been witnessing daily occurrences of attacks affecting OT networks that originated on the IT side. The U.S. National Security Agency (NSA) also highlighted this issue for this very simple reason. It works. Ransomware in…
IT and OT Cultural Differences Why It’s Imperative to Bridge the IT & OT Cultural Divide We hear it all the time from security marketers and evangelists alike. “Information technology and operational technology are converging!” It’s a simplistic way of characterizing what is a highly complex web of digital transformations affecting a broad range of…
Is IT & OT Convergence Dead? IT/OT Convergence: Is it bringing two worlds together? IT / OT convergence describes the merging of information technology (IT) and operational technology (OT). In the past, IT and OT departments have been working in silos, but in the past decade, organizations have started to see the benefits of connecting…
Why OT Incident Response is really different? It’s not a secret. There are thousands of companies providing IT incident response, but handful of companies capable of handling OT incident response. Some IT folks believe it’s mission impossible and they are not far from the truth, but the first step is to admit that OT incident…
Bridging the IT & OT Divide Why is it important to bridge the gap between IT and OT department? In the past decade, though IT and operations technology (OT) appear to be working together more frequently than in the past, they’re still far from being a united team, according to Automation World’s latest reader survey…
