Don’t Forget the Little Guy: Vulnerability Management in Operational Technology
summary
Vulnerability management in OT is radically different from IT: regulators impose a 70 day compliance window split into 35/35 review and remediation days, utilities run legacy stacks (Windows 3.1 through XP) across dozens of vendors and thousands of dispersed assets, and the most common NERC noncompliance is patching (CIP‑007 R2 / SEP‑007). Vendor advisories are the actionable source, but only ~18 of 447 CNAs provide CESAP machine-readable advisories so automation is rare, manual work causes missed fixes and millions in fines when availability fails.
AI-written summary · about
chapters (8)
- 0:00Vulnerability management in OT
- 1:04OT vulnerability challenges
- 7:18OT utilities priorities
- 12:13OT vulnerability problems
- 20:56Regulation vs security in OT
- 25:56NERC CIP standards and patches
- 30:31OT vulnerability remediation data
- 43:23Q&A
related talks
39mTo Patch or Not to Patch OT— A Risk Management Decision
47mField Guide to Building an Operational Technology Cybersecurity Capability
52mPanel: Industrial Systems In The Crosshairs: What It Really Takes To Defend OT
48mYou Too Can Secure OT
53mCXO Panel: OT & IoT Risk Management Strategy For CISOs
50mHarmonizing IT and OT Security in the Era of Convergence
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...
21mFrom Wild West to Secure Business: Understanding Data and Standards in OT