The Institute for Homeland Security at Sam Houston State University published my paper –Whos_in_Charge_of_OT_Security.pdf (ihsonline.org). CISOs have traditionally been responsible for cyber security of enterprise IT networks excluding the control system (operational) assets which were under the purview of the engineering organizations. After the 2006 Gartner Research paper that coined the term “OT”, the CISOs […]
Category: Internet of Things
Process sensors are different than IOT and IIOT devices
December 2022, the US Government Accountability Office (GAO) issued Critical Infrastructure Actions Needed to Better Secure Internet-Connected Devices (GAO-23-105327). According to GAO, the scope of the report was governed by a legislative mandate in The Internet of Things Cybersecurity Improvement Act of 2020, which (along with conversations with GAO’s Congressional clients), which dictated the terms […]
Lack of applicability of NIST Special Publication 1800-32 to process sensors
As there is still confusion about the cyber security of process sensors and other Purdue Reference Model Level 0,1 field devices, I was asked to review NIST Special Publication (SP) 1800-32 “Securing Distributed Energy Resources: An Example of Industrial Internet of Things Cybersecurity” for applicability to legacy process sensors. The title of SP 1800-32 is […]
IIOT session on control system cyber security – Why hasn’t control system cyber security been solved yet?
October 6, 2021, 2-2:55pmEastern, I will be moderating a session on control system cyber security entitled “Why haven’t we solved control system cyber security yet?” The session was originally entitled “Protection for SCADA systems, plant control systems, PLCs, and other field control devices”. However, the title and session direction changed when it was recognized that […]
Sensor monitoring technology can make critical infrastructures less attractive targets for ransomware
Ransomware and other IT-originated cyberattacks can affect control systems when IT networks are connected to OT networks or insecure IOT devices are connected to OT networks. Off-line sensor monitoring technology doesn’t stop a ransomware attack, rather the technology is oblivious to the ransomware or IT attack. The off-line process sensor monitoring can provide real time […]
Good news for ICS protection: ISA providing new ISA/IEC 62443 based industrial cybersecurity training
The great Chinese military strategist Sun Tzu in his book the “Art of War” stated that (to paraphrase) “if you know yourself and the enemy, you will prevail in every battle”. This saying is applicable to the protection of industrial control systems that comprise the technical foundation for today’s critical infrastructure. One of the long-term […]
When “IoT” Becomes “Expl-IoT”
Ok, so I am being sarcastic with the title — I get it. But let me ask you when you read this: are you entirely certain that the ‘Internet of Things’ — more importantly — (a new term recently introduced by several industry ‘leaders’) the ‘Industrial Internet of Things’…isn’t just another ‘sales job’? First, why […]
How the “Internet of Things” is Becoming the “Internet of Junk”
Several years ago, a new and revolutionary device was introduced to consumers – one that would allow homeowners with abilities to control the temperature and comfort of their home anywhere in the World. The product that I am talking about is “Nest”. Designed to communicate with external servers using the Internet, these devices provided pathways […]