Articles on enterprise risk, business continuity, operational resilience, incident response and policy, including OT and critical infrastructure.
A risk register becomes dynamic when each risk is linked to the controls that treat it, and the tested results of those controls, not the next quarterly workshop, decide when its residual rating is reviewed. This article explains how to connect risks to controls, how control failures should change residual risk, which signals should update the register, how to govern risk acceptance and how to measure risk reduction from remediation.
A business should recover each service within the limit its own business impact analysis sets, and no universal number applies. This article explains recovery time and recovery point objectives, important business services, dependency mapping, testing and what DORA requires.
How Quickly Should a Business Recover From a Major IT Outage? Read More »
The Center for Vein Restoration breach exposed patient records through routine gaps. This article draws the lessons for healthcare data protection: access control, continuous monitoring and evidence for regulators.
Protecting Patient Privacy: Lessons from the Center for Vein Restoration Data Breach Read More »
Industrial control systems connected to the internet inherit IoT risks they were never designed for. This article lists the exposures and the controls that reduce them without stopping production.
Addressing Cybersecurity Risks of IoT-Enabled Industrial Control Systems Read More »
An incident response plan that works is written before the incident. This article sets out the plan’s parts, from roles and detection to containment, recovery and the review that follows.
How to Build and Implement an Effective Incident Response Plan Read More »
Operational technology cannot be protected if nobody knows what is on the network. This article explains asset inventory and management for OT environments and how it improves security posture.
Critical infrastructure is a target because disruption has consequences beyond data. This article sets out cybersecurity strategies for energy, water, transport and health operators.
Cybersecurity Strategies for Protecting Critical Infrastructure Read More »
Five misconceptions about ICS and SCADA security, from air gaps to legacy protocols, and what is true in each case. The article explains the real exposures and how to address them.
Top 5 Misconceptions about ICS and SCADA Systems Read More »
Pro-Russia hacktivists are attacking operational technology in critical infrastructure. This article explains their methods and the OT security posture measures that reduce the risk.
Strengthening OT Security Posture Against Pro-Russia Hacktivist Threats Read More »
Remote work is permanent and so are its security risks. This article lists the practices to adopt and the ones to avoid for devices, access, data and awareness.
Do’s and Don’ts of Remote Work and Associated Cybersecurity Risks Read More »
Era of Automated Security Risk and Posture Management
Era of Automated Third Party Risk Management: Trust but Verify
Era of Automated Security Plans, Standards, Policies and Procedures
