Cyber Security: Policies and Threat Modeling in OT security
summary
Company builds servo drives and controls entire device stack for motion applications, site has ~90 staff with ~40 in R&D, devices last 10–20 year lifespans so updates are hard. EU Cyber Resilience Act forces 10 years of security updates and treats embedded products as components with broad scope. Constraints include low‑power microcontrollers that struggle with encryption and increased obligations when using open source. Process so far is documentation, architecture and design planning; practical tool: STRIDE threat modeling applied early to find threats before coding.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:48IT vs OT differences
- 3:57OT cyber security history
- 5:45Cyber Resilience Act overview
- 7:36CRA scope and standards
- 9:25Open source and CRA challenges
- 10:30CRA compliance process
- 11:14Threat modeling basics
- 13:42Closing and contact information
related talks
47mField Guide to Building an Operational Technology Cybersecurity Capability
19mSecuring the future of mobility: Automotive threat modeling
29mSecuring IoT/OT Against Modern Threats
15mDevice Security Matters More Than Ever
53mCXO Panel: OT & IoT Risk Management Strategy For CISOs
22mSecuring IoT for Life: Navigating the Challenge of Constant Change
48mYou Too Can Secure OT
27mSmall Company, Big Threats: Cybersecurity for the Rest of Us