Craig and Dino dive deep into the critical yet often overlooked aspects of industrial cybersecurity in relation to IIoT. 

They discuss the misconception that many OT assets are isolated when, in reality, they are interconnected and vulnerable. 

The conversation highlights the importance of complete asset inventory, IT-OT collaboration, and the hidden risks posed by vendor access, remote connections, and unmonitored network traffic. 

With real-world insights, they explore how organizations can leverage cybersecurity tools not just for threat prevention but also for process integrity and operational efficiency. 

If you’ve ever wondered how to bridge the gap between IT-driven cybersecurity and OT-focused operations, this episode is a must-listen.

Chapters:

• 00:00:00 - Introduction: Why OT Security Matters More Than You Think
• 00:01:08 - Meet Craig and Dino: Experts in Industrial Cybersecurity
• 00:01:16 - Breaking Down IoT vs. OT: Understanding the Differences
• 00:02:33 - Why Asset Inventory in Industrial Environments is a Challenge
• 00:03:42 - The Hidden Risks of Overlooking Connected OT Assets
• 00:04:32 - The IT-OT Divide: Why Collaboration is Crucial for Security
• 00:08:29 - Industrial IoT Blind Spots: What You’re Missing
• 00:09:08 - Preventing Downtime: How Cybersecurity Tools Can Help
• 00:12:00 - How Sensors and Data Can Predict and Prevent Failures
• 00:14:20 - Digital Threats to OT: Why Anomalies Matter
• 00:16:42 - Why OT Teams Need to Fully Understand Cybersecurity Tools
• 00:19:13 - Finding the Right Partner for IT-OT Cybersecurity Integration
• 00:20:04 - Bridging the Gap: Building Stronger IT and OT Relationships
• 00:21:07 - Final Thoughts: How to Take Action on OT Security Today

Links And Resources:

• Velta Technology
• Dino Busalachi on LinkedIn
• Craig Duckworth on LinkedIn

Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!

Roya Gordon, previously the Executive Industry Consultant - Operational Technology (OT) Cybersecurity at Hexagon Asset Lifecycle Intelligence and currently, is the Deputy CISO at ENGIE North America Inc., joins Derek Harp live from Hack the Capitol 7.0 to explore the evolving landscape of asset inventory in operational technology (OT). Roya breaks down the differences between asset visibility, inventory, and management, sharing her firsthand experiences from both passive and configuration-based methodologies.

Roya highlights the critical role of asset inventory in building a strong OT cybersecurity foundation. From distinguishing between passive and active network monitoring to the importance of configuration management, she emphasizes how a multi-layered approach can offer comprehensive visibility and risk management. Roya also dives into why organizations often overlook configuration change management, and how integrating different solutions can optimize security efforts.

Whether you’re a seasoned OT professional or just starting your cybersecurity journey, this episode offers valuable insights into improving asset management, reducing risks, and fostering collaboration between vendors and operators.

In this episode, host Aaron Crowe speaks to Dan Ricci, founder of the ICS Advisory Project, to delve into OT cybersecurity. Dan brings a wealth of experience from his time in the Navy, transitioning through various cybersecurity roles, and finally taking the leap to establish a platform that addresses the complex needs of critical infrastructure sectors. 

In this conversation, they explore the genesis of the ICS Advisory Project, a tool designed to streamline vulnerability management for small to medium-sized organizations. Aaron and Dan also discuss the challenges of transitioning from military service to civilian cybersecurity roles, emphasizing the importance of mentorship, risk-taking, and continual self-improvement. 

This episode offers valuable insights for anyone in the cybersecurity community and those looking to bridge the gap between IT and OT spheres. Join us as we explore strategies to enhance resilience and share lessons from the field.

Key Moments: 

09:17 Building Dashboards with Google Studio

14:41 Cybersecurity: Secondary Concern for Operators

20:48 Supporting Small Supply Chain Contributors

23:23  OT Cybersecurity Impact and Mentorship

27:48 Bridging Cybersecurity and Critical Sectors

34:16 Opportunities to Share Project Insights

38:24 Adapting Skills for Career Growth

45:58 Cyber Career Evolution and Growth

56:14 Leadership vs. Management Distinction

01:00:56 Relentless Daily Self-Improvement

About the guest : 

With over 28 years of Cybersecurity experience, Dan is the Senior Cybersecurity Consultant at

Ampyx Cyber, leading engagements with Rural Cooperatives and Utilities to improve their

Cybersecurity programs and protect critical infrastructure. In 2023, he founded Industrial Data Works to provide independent consulting and vulnerability intelligence API subscription services.

He is also the founder of the ICS Advisory Project, an open-source initiative to help small and medium-sized ICS asset owners across the 16 critical infrastructure sectors prioritize vulnerabilities and plan mitigation for their ICS/OT environments. He aims to provide free and accessible resources to secure critical infrastructure and protect the public.

Link to Industrial Data Works:

https://www.industrialdataworks.com/ics-advisory-project-api

Links to ICS Advisory Project:

https://www.icsadvisoryproject.com/

ICS Advisory Project Github Repository:

https://github.com/icsadvprj/ICS-Advisory-Project

Receive ICS Advisory Project Weekly Summary Slides and Other CERT & Vendor Advisory Summaries in your email every Monday:

https://docs.google.com/forms/d/e/1FAIpQLSfC490BHoCR4gHekZcMLBgbHMhUQZr7ZVYZG1OkaWdKGwH73g/viewform

Connect With Aaron Crow:

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

Michael and Sam are gearing up for OT.SEC.CON. with keynote speaker, Marco Ayala! Marco is an ISA Fellow, and President of InfraGard Houston with over 30 years of experience in industrial automation controls and OT/IT security. They chat about some exciting OT Cybersecurity initiatives in Texas, the incident that led him to cybersecurity, and what to expect at his talk in April. 

Things Mentioned:

·      Governor Abbott Announces Texas Cyber Command An Emergency Item - https://gov.texas.gov/news/post/governor-abbott-announces-texas-cyber-command-an-emergency-item

·      Marco’s Talk at S4: Normalization of Deviance - https://youtu.be/u1xmyJmGsS0?si=UrSlqVVfvyasvz68

·      Marco’s panel at OTCEP in Singapore - https://www.linkedin.com/pulse/2023-otcep-embracing-new-perspectives-strengthening-ayala/?trackingId=OyeuSlWZQBSNUKgxBl%2BZmQ%3D%3D

Do you have a question for the hosts? Reach out to us at [email protected] 

Keep up with HOU.SEC.CON.:

·      LinkedIn

·      Twitter

·      Facebook

·      Instagram

·      YouTube

·      Bluesky

Check out our other show:

·      CyberSunday

Check out our Conferences and Events:

·      HOU.SEC.CON.

·      OT.SEC.CON.

·      EXEC.SEC.CON.

·      HSC User Group

 Support or apply to our Scholarship Program:

·      TAB Cyber Foundation

 In this episode:

·      Host: Michael Farnum

·      Host: Sam Van Ryder

·      Guest: Marco Ayala

·      Production and editing: Lauren Andrus

·      Music by: August Honey

The cybersecurity challenges of industrial environments are unique and complex, requiring a shift in mindset from traditional IT security strategies.

Dan Cartmill, Sr. Global Product Marketing Director for TXOne Networks, joins Dino Busalachi for this episode. They discuss the critical divide between IT and OT security, why collaboration is essential, and how organizations can take the first steps toward securing their industrial control systems (ICS).

Drawing from his experience in the Royal Australian Navy, IT security, and product marketing, Dan shares key insights on the operational risks of cybersecurity tools, the importance of ownership in security decisions, and why companies must move beyond fear-based approaches to focus on practical, incremental solutions.

If your organization struggles with securing legacy systems, aligning IT and OT teams, or justifying cybersecurity investments, this episode offers real-world strategies and actionable takeaways.

Chapters:

• 00:00:00 - The First Step to Securing OT: Why You Can’t Afford to Wait
• 00:01:00 - Meet Dino and Dan: A Conversation on Industrial Cybersecurity
• 00:01:51 - From the Navy to Cybersecurity: Dan’s Journey into Protecting Industrial Systems
• 00:05:30 - The Biggest Cybersecurity Challenges Facing Industrial Environments Today
• 00:09:00 - IT vs. OT: Who Owns Cybersecurity and Why It Matters
• 00:14:01 - Breaking Down Silos: How Collaboration Can Make or Break Your Security Strategy
• 00:22:35 - Cybersecurity is a Team Sport: How the Right Partners Can Make All the Difference
• 00:25:00 - Think Globally, Act Locally: Why OT Security Must Be Customized for Each Plant
• 00:29:15 - Who Owns OT Security? Why IT and OT Leaders Need a Unified Strategy
• 00:33:00 - The Power of Collaboration: Bringing IT, OT, and Vendors to the Same Table
• 00:36:10 - The Cost of Cybersecurity: Why Companies Struggle to Justify OT Security Investments
• 00:38:45 - Legacy Systems & Cyber Risk: Why Ignoring the Problem is Not an Option
• 00:40:53 - The Takeaway: Why Action Beats Perfection in OT Security

Links And Resources:

• Dan Cartmill on LinkedIn
• TXOne Networks
• Dino Busalachi on LinkedIn
• Craig Duckworth on LinkedIn

Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!

In this episode of the (CS)²AI Podcast, host Derek Harp welcomes Mehdi Tarrit Mirakhorli, Associate Professor at the University of Hawaii and a Cybersecurity Expert, to discuss Secure by Design—a fundamental shift in how we develop and deploy software in industrial control systems (ICS) and operational technology (OT). With over 15 years of R&D experience for DARPA, the Air Force, and DHS, Mehdi shares why modern software is inherently vulnerable and how we can learn from aviation, medical, and safety-critical industries to build resilient systems from the ground up.

The conversation dives deep into the risks of insecure by design software, the challenges of implementing true security practices, and the role of government policies in shifting liability from users to vendors. Mehdi explains the importance of threat modeling, attack surface analysis, and secure architecture frameworks to mitigate cyber threats before they arise. He also highlights how software development must evolve beyond rapid deployment cycles to integrate security as a core design principle.

If you’re an ICS professional, cybersecurity engineer, or software developer, this episode provides actionable insights on reducing vulnerabilities at scale, implementing proactive security measures, and preparing for the future of cyber threats. Subscribe now and stay ahead in the ever-evolving world of industrial cybersecurity!

Bryson is joined by Carter Manucy, Director of Cybersecurity at the National Rural Electric Cooperative Association to discuss rural electric cooperatives, the importance of collaboration, and the state of cybersecurity in the energy sector. With over two decades of experience in the sector, Carter was recently awarded E-ISAC’s prestigious Michael J. Assante Award for his leadership on initiatives to protect the grid and electric co-ops. 

How are cooperatives fostering a stronger cybersecurity culture? What are the unique challenges faced by rural electric cooperatives in the cybersecurity landscape? And what does Carter see in his crystal ball for the future of cybersecurity in the energy sector?

“I think as a country, we’ve really got to pull together or else we're going to be behind the eight ball in a few years, and that could really look bad for everybody...power runs all of our lives,” Carter said. “If I had that magic wand, I think I would get rid of a lot of the politics that are there so that we can focus on getting funding to help in the areas that it really is needed, and move that needle forward.” 

Join us for this and more on this episode of Hack the Plan[e]t. 

Hack the Plant is brought to you by ICS Village and the Institute for Security and Technology. 

In this episode, host Aaron Crow welcomes Chris Robertson, CISO at Apogee Defense, to discuss the evolving landscape of cybersecurity, focusing on the distinction and strategy behind Virtual CISO (vCSO) roles. 

Chris shares insights from his dual roles at Apogee Defense and as a virtual chief security officer for various companies. The conversation dives into the intricacies and responsibilities of vCSOs, the importance of understanding IT and OT risks, and the necessity of integrating cybersecurity deeply into business practices. 

Chris and Aaron explore practical solutions for businesses, emphasizing adaptability and continuous improvement in security measures, drawing parallels between accounting a century ago and cybersecurity today. 

They also touch on future trends, the impact of AI on security, and the importance of setting aside egos to foster a culture of learning and collaboration. 

Join them as they navigate the challenges and opportunities at the intersection of IT and OT cybersecurity, offering actionable advice and anecdotes from their extensive experience in the field.

Key Moments: 

00:00 Outsourcing Risk Management Expertise

08:22 Hiring External Experts: Cost-Effective Strategy

12:04 Understanding OT Risks in Cyber Leadership

20:36 MBA Curriculum Needs Security Focus

23:31 Integrating Security in Legacy Systems

27:47 Tech Efficiency and Shadow IT Challenges

35:56 Optimizing Inefficient Appointment Systems

39:08 Bridging Tech and Business Worlds

45:43 Simplifying Risk Communication

51:52 Joe Rogan's Impact and Risks

57:09 AI Evolution: Professionals Riding the Wave

01:05:53 "Embrace Vulnerability, Seek Help"

About the guest : 

Chris Robertson is a seasoned cybersecurity expert, currently serving as the Chief Information Security Officer (CISO) at Apogee Defense. In addition to this role, Chris extends his expertise as a virtual CISO for various companies across multiple sectors. He specializes in implementing robust security solutions that Apogee Defense delivers to its clients, predominantly within the Small and Medium Business (SMB) space. 

With a keen focus on the defense industrial base, Chris's work also spans various other industries, enabling businesses to strengthen their cybersecurity frameworks. He is highly regarded in the industry for facilitating vital connections and contributing to advancing cybersecurity practices.

How to connect Chris: https://www.linkedin.com/in/christophersrobertson/

Connect With Aaron Crow:

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

What did 2024 teach us about securing the IoT and OT landscape? In this special 2024 lookback episode, Alex Nehmy, Asia Pacific CTO at Phosphorus, revisits impactful moments from industry experts and IoT Security Podcast guests, including Jason Taule,  Patrick Gillespie,  Sean Tufts, Michael Lester, Joel Goins, Khris Woodring, Mike Holcomb, and John Threat who share their unique journeys and lessons-learned in the realm of IoT security and beyond. 

Reflecting on learnings from 2024 and looking ahead at 2025, the discussion spans...

• Why remediation beats endless assessments in IoT security.

• Overcoming challenges with legacy systems and device management.

• Trends shaping the future of Cyber-Physical Systems.

• The power of community in tackling cybersecurity risks.

Let’s connect about IoT Security!

Follow Phillip Wylie at https://www.linkedin.com/in/phillipwylie
https://youtube.com/@phillipwylie

The IoT Security Podcast is powered by Phosphorus Cybersecurity. Join the conversation for the IoT Security Podcast — where xIoT meets Security. Learn more at https://phosphorus.io/podcast