7 Things Every Kid Needs to Hear: 1. I Love You 2. I’m Proud of You 3. I’m Sorry 4. I Forgive You 5. I’m Listening 6. Vulnerability management is only one aspect of cyber risk, which is a complex function including impacts and threats. 7. You’ve Got What It Takes

…what if ICS/OT security professionals got an annual “wrapped” summary for 2023 like Spotify provides? Industrial cybersecurity sometimes feels like an uphill battle, but I promise you— we are constantly improving and doing better. What metrics would be in your 2023 wrapped?

At #GridSecCon2023? Be sure to check out the @SANSICS booth! Both @cutaway & I are here to talk about our courses, grid security, & the future of ICS workforce development. Also be sure to check out the SANS-Dragos CtF tonight & my session on “future-proofing” NERC CIP tomorrow!

In 2013, I was the federal energy sector lead for the NIST Cybersecurity Framework, which included a robust discussion on cybersecurity incentives. Ten years later, the landscape has shifted significantly, but it still comes down to insurance: lawfaremedia.org/article/if-…

This could get fun: schneier.com/blog/archives/2…

Sorry, had to be done…

The evolving role of industrial CISOs is something @deancybersec and I discuss in the @SANSInstitute #ICS418 course. Happy to get a chance to explore it more in this week's #ControlLoop podcast!

I don’t post much any more, but want to plug my @SANSICS research project on ICS/OT visibility. Looking for some input on industrial orgs with SOC capabilities (both IT and OT). Provide insights, help the community, & maybe win a $250 Amazon gift card! sans.org/u/1pqp

You'll want to check this one out-- expect some great discussion around measuring OT cyber risk, some memes, and more than a few actionable tools that you can immediately apply. What more could you ask for?

Curious about how to measure the effectiveness of your ICS security program? Check out my latest @SANSInstitute blog on what to measure, how, and what your team should look like:

Federal cyber contractor bingo in full force right now. An hour in and “zero-trust,” “machine learning,” “artificial intelligence,” & “quantum encryption” have all been pitched as ways to automate reduction in cyber risk. It’s too early for this drinking game.

Me: Post-COVID, I will never wear a tie again. Be happy I’m wearing shoes. Every federal defense contractor at their first cyber conference in 2+ years:

I've got a busy couple of weeks coming up! A few webinars of interest for folks below, as well as a LiveOnline run of @SANSInstitute ICS418. Want to chat in person? You can catch me at both the @NatlCyberSummit in Huntsville, AL or at @BsidesCLT later this month!

...wait, you guys _haven't_ been doing risk-based vulnerability management? Uh oh. cpomagazine.com/cyber-securi…

Another proof-of-concept, but I <3 this one too... because "air gap." Nothing totally new about exfiltrating data using acoustic or optical methods, but I like the addition of an infected phone to do the dirty work: thehackernews.com/2022/08/ne…