Show Notes
Welcome to the Final Episode of the Year—Episode Six! In this closing episode of 2024, we dive into the critical topic of management of change (MoC) in the context of OT cybersecurity.
We kick things off with a look at the iconic failure of the Empire's Death Star and explore how its downfall can teach us valuable lessons for managing change in operational technology environments.
In this Episode we cover:
The Death Star Example: A discussion of one of the most iconic and catastrophic management of change (MoC) failures, analysing how overlooked risks and gaps in planning led to its downfall—and what lessons we can apply to cyber security today.
MoC Assessment Basics: Exploring the foundational elements of a robust MoC process, including conducting thorough risk assessments, maintaining accurate and up-to-date documentation, and identifying critical records essential to cyber security.
Supply Chain Risk: Understanding the risks posed by vendor-supplied default configurations—do you really know what’s in them? Examining how changes in the supply chain may impact current physical security controls and whether those changes could alter the criticality of your operations.
Employee Training: Highlighting the importance of employee education and preparedness in the MoC process. How do training programs ensure staff adapt to and manage changes effectively while maintaining a strong security posture?
Join us as we uncover the complex layers of OT cybersecurity, the importance of thorough risk assessments, and the real-world impacts of implementing robust change management strategies.
Thank you for tuning in throughout 2024. We wish you a Merry Christmas and look forward to bringing you Series 2 of the Cyber Brews Podcast in 2025, with even more exciting episodes planned!
More from Cyber Brews - The Operational Technologies Podcast
Series 3 - Episode 7 A step back in time to 11 December 2005. 06:01 in the morning. A series of explosions at the Buncefield oil storage depot near Hemel Hempstead shook the surrounding area. The blast could be heard up to 125 miles away and registered 2.4 on the Richter scale. In this episode of Cyber Brews, we explore the three questions posed by the UK Competent Authority following the Buncefield incident and consider how they can help organisations rethink their approach to cybersecurity: 🔹 Do we understand what can go wrong? 🔹 Do we know what systems are in place to prevent this happening? 🔹 Do we have information to assure ourselves that they are working effectively? These questions may sound straightforward, but they raise some important challenges for organisations responsible for critical infrastructure. We discuss how they apply to OT cyber risk assessments, security controls, organisational accountability and the evidence needed to demonstrate that cybersecurity measures are actually working. Because having firewalls, procedures and security policies in place is one thing. Understanding what could go wrong, knowing whether the right protections exist, and having evidence that they remain effective is another. Whether you're an OT engineer, cybersecurity professional, site owner or process safety specialist, join us as we explore how lessons from Buncefield can help us ask better questions about industrial cybersecurity. ☕ Grab a brew and join the conversation. Are we asking the right questions about OT cyber risk?
What does a French military fortification from the 1930s have to teach us about OT cybersecurity? Quite a lot, actually.
Series 3 - Episode 3! Artificial Intelligence is rapidly becoming part of the industrial cyber landscape but is it strengthening critical infrastructure, or introducing entirely new risks? In this episode we explore the growing relationship between AI and OT security, discussing how organisations are beginning to rely on AI-driven technologies within critical infrastructure environments.