Takeaways
New Zealand cybersecurity legislation islikely to be similar to Australia’s SoCI regulations.
Cost of living from the power side is astrong factor in defining measures for critical infrastructure.
An OT vulnerability assessment is the firststep in the OT security journey.
Risk analysis involves people, processes,networks, technologies and communication.
Any assessment will identify bothlow-hanging fruits and more strategic long-term measures.
OT companies should define and test theirisolation processes to ensure fast and reliable disconnection of OT from IT incase of an attack.
There are several low-hanging fruits thatorganization can grab to build OT security fast.
To make spill-over more difficult, a cleanprotocol break between IT and OT can help.
Cyber resilience must be based on genuinerisk scenarios that are real and palpable to get that budget.
Sound Bites
For mostindustrial organizations, their core business is in that OT world. That's wherethey should be spending their time to improve their resilience and outcomes.
One ofmy favorite tools is the SANS “5 critical controls for ICS”. It’s basicallyabout being prepared for a bad day.
As we'vebuilt up that connectivity and we're increasing risk, we want to move from thatrobustness piece into that resilience piece.
Securityalways makes things a little bit harder, but we don't want to make it too hard,because then it's impossible for people to do their jobs.
Chapters
00:00 Introduction
02:00 Legislationin New Zealand
03:40 Right-sizinglegislation
04:40 Riskfrom a holistic perspective
05:10 Howan OT vulnerability assessment as the first step works
08:00 UnderstandingOT as core business
10:15 3low-hanging fruits in OT security
15:06 Thecylinder of excellence in OT security
16:52 Howto segment correctly
18:50 Challengeof new technologies in OT
20:10 Cyberresilience based on genuine risk scenarios
23:10 CommunicatingOT security to the management
23:50 Wrap-up
