Simply ICS Cyber

How does Incident Response in ICS/OT/SCADA work? In this episode of Simply ICS Cyber, Don and Tom welcome Kai Thomsen, Director of Global Incident Response Services at Dragos.

Join us as we answer the questions below and provide more insight into how IR works in OCS, OT, and SCADA:

- Is DFIR the same on the OT side as the IT side?
- What are some of the challenges the OT DFIR team faces?
- In an organization, who is responsible for OT incident response?
- What are table tops, how should you conduct them?
- What are some table top exercises?
- How do you get into OT DFIR?

Discover the Dragos 2025 YIR Report: https://www.dragos.com/ot-cybersecurity-year-in-review

Connect with Kai on LinkedIn: https://www.linkedin.com/in/kai-thomsen-a635b21b7

Check out the Incident Response Table top resources below:

- CISA Tabletop Exercise Packages (CTEPs)
- CISA ICS Training
- Dean Parson’s ICS Incident Response Tabletops
- Lenny Zeltser Cheat Sheets and Presentations
- NERC’s Grid Security Exercise (GridEx)
- MITRE Cyber Exercise Playbook
- Black Hills Information Security (BHIS) Backdoors and Breaches ICS/OT Deck
- Center for Internet Security, Tabletop Exercises – Six Scenarios to Help Prepare Your Cybersecurity Team
- Red Canary: Are You Using Tabletop Simulations to Improve Your Information Security Program?
- Dragos: Preparing for Industrial Cyber Response Tookit
- Dragos: Preparing for Incident Handling and Response in ICS
- Dragos Tabletop Exercise
- ICS4ICS Incident Command System for Industrial Control Systems
- European Network for Cyber Security (ENCS) Red Team – Blue Team Training

Join us every other Wednesday for Season 1 of the Simply ICS Cyber podcast, with your hosts, Don C. Weber and Tom VanNorman.

Connect with your hosts on LinkedIn:
- Don linkedin.com/in/cutaway
- Tom linkedin.com/in/thomasvannorman

=========================
Simply Cyber empowers people who want a rewarding cybersecurity career
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials

In this episode, Tom and Don host special guest Michael Hilken, Cyber Physical Engineer at Grimm. The trio review and discuss the Five ICS Cybersecurity Critical Controls.

Links from this episode:
- Michael Hilken: https://www.linkedin.com/in/michael-hilken/
- SANS Whitepaper on the The Five ICS Cybersecurity Critical Controls: https://www.sans.org/white-papers/five-ics-cybersecurity-critical-controls/
- Dragos 2025 OT Cybersecurity Report - 8th Annual Year in Review: https://www.dragos.com/ot-cybersecurity-year-in-review/ 

Join us every other Wednesday for Season 1 of the Simply ICS Cyber podcast, with your hosts, Don C. Weber and Tom VanNorman.

Connect with your hosts on LinkedIn:
- Don https://www.linkedin.com/in/cutaway
- Tom https://www.linkedin.com/in/thomasvannorman

=========================
Simply Cyber empowers people who want a rewarding cybersecurity career
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================

In this episode of Simply ICS Cyber, Don and Tom interview Gus Serino, water sector expert and Owner at I&C Secure, Inc.

Listen in as we will answer the following questions:
- What is Critical Infrastructure?
- What are other types of Industrial and Automation?
- Is cybersecurity different between the two?

Links from this episode:
- Gus Serino LinkedIn: https://www.linkedin.com/in/gusserino/
- Instrumentation & Control Secure, Inc.: https://www.iandcsecure.com/
- S4Events - Water Sector Cyber Risk with Gus Serino: https://www.youtube.com/watch?v=ScigBpXIjgg

Join us every other Wednesday for Season 1 of the Simply ICS Cyber podcast, with your hosts, Don C. Weber and Tom VanNorman.

Connect with your hosts on LinkedIn:
- Don https://www.linkedin.com/in/cutaway
- Tom https://www.linkedin.com/in/thomasvannorman

=========================
Simply Cyber empowers people who want a rewarding cybersecurity career
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================

In episode 2 of Simply ICS Cyber, we answer the following questions for those interested in starting a career in ICS (industrial control systems), OT (operational technology):

- What is Capex vs Opex? And, why does it matter when getting a job?
- What is the compensation versus actual pay?
- What does the OT side consider as important skills?
- How are the rising FTE and consultant wages affecting winning ICS/OT work?

Links to learn more about ICS, OT, SCADA:
- ICS Village: https://www.icsvillage.com
- Contact ICS Village: https://www.icsvillage.com/contact-us
- NICE Framework (Find OT in the Competency Areas): https://niccs.cisa.gov/workforce-development/nice-framework
- SANS ICS NICE: https://www.sans.org/nice-framework/industrial-control-systems

Join us every other Wednesday for Season 1 of the Simply ICS Cyber podcast, with your hosts, Don C. Weber and Tom VanNorman.

Connect with your hosts on LinkedIn:
- Don https://www.linkedin.com/in/cutaway
- Tom https://www.linkedin.com/in/thomasvannorman

=========================
Simply Cyber empowers people who want a rewarding cybersecurity career
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================

Welcome to the first episode of Simply ICS Cyber! Tune in every other Wednesday for new episodes premiering at 9:30 AM ET.

Learn more about what to expect in this episode below:

- Who are Don and Tom?
- What are industrial and automation controls and why are they important?
- What are these terms? ICS, OT, 62443, countermeasures, PLC, DCS
- Why is cybersecurity different in OT versus IT?

Join us every other Wednesday for Season 1 of the Simply ICS Cyber podcast, with your hosts, Don C. Weber and Tom VanNorman.

Connect with your hosts on LinkedIn:
- Don https://www.linkedin.com/in/cutaway
- Tom https://www.linkedin.com/in/thomasvannorman

=========================
Simply Cyber empowers people who want a rewarding cybersecurity career
=========================
All the ways to connect with Simply Cyber
https://SimplyCyber.io/Socials
=========================