Securing BACnet and Modbus in Building Management Systems
Why BACnet and Modbus trust anyone on the wire, BBMD exposure, BACnet/SC, segmentation and monitoring.
Insights
Technical library.
Practitioner notes on OT and ICS, IEC 62443, BMS, Entra ID, ZTNA, and Azure. Search by keyword or filter by topic.
Technical notes for defenders. Use them only on systems you are authorized to test or change. Legal disclaimer.
Writing Cybersecurity Requirements into BMS Tenders
What to specify in BMS tenders, how to make each requirement testable, and the gaps that recur at handover.
Building an OT Incident Response Playbook
Safety-first OT incident response: who decides on shutdown, PLC backups, golden images and tabletops.
OT Patch Management When You Cannot Patch
Risk-based OT vulnerability triage, vendor-qualified patching, compensating controls and residual risk.
Securing Remote and Vendor Access to OT
DMZ jump hosts, brokered sessions, just-in-time approval, MFA, recording and taming vendor cellular modems.
Building an OT Asset Inventory
Passive vs active discovery, SPAN/TAP placement, key attributes, and using the inventory for vulnerability management.
IEC 62443 in Practice: Zones, Conduits and Security Levels
How to draw zones and conduits, set SL-T vs SL-C vs SL-A, and carry 62443-3-2 risk into 62443-3-3 SRs.
A Practical Methodology for OT Cyber Risk Assessment
A consequence-first OT risk method: scoping, crown jewels, threat scenarios, OT likelihood, register, roadmap.
Part 1: Why AI Is Entering Air-Gapped Critical Infrastructure
Isolation does not make an imported model, dataset, or AI decision trustworthy.
Entra ID & Intune Device Compliance Architecture
Report-only CA, grace periods, token lifecycle, and AADSTS53000 diagnostics.
Hardening Guest Lifecycle and External Collaboration
Guest permissions, invitation authority, Access Reviews.
Securing and Auditing Service Principal Credentials
Orphaned apps, long-lived secrets, permission drift.
Implementing ZTNA in Azure Cloud
Identity-centric access, Conditional Access, microsegmentation.
Hardening Cross-Tenant Access and Trust Chains
Multi-tenant apps, XTAP controls, and consent audits against supply-chain abuse.
Blocking Legacy Authentication Protocols in Entra ID
Stop IMAP/POP/SMTP AUTH MFA bypass paths.
The OT Cybersecurity Standards Guide
IEC 62443, NIST, NERC CIP, NIS2, and a unified stack.
Designing PIM and Break-Glass Architectures
Just-In-Time elevation and emergency access accounts.
The Myth of the Air-Gap: Why Dark Sites Must Tighten OT Security
Telemetry links, edge routers, sneakernet, visibility gaps.
Securing Non-Human Identities with Workload Federation
Replace static secrets with OIDC federation for CI/CD.
Architectural Deep Dive: ZTNA vs. Traditional VPN
Implicit trust vs continuous per-application verification.
Tenant-Wide Settings Hardening and Shadow IT Prevention
App registration, groups, and portal access defaults.
Cybersecurity for Modern Building Management Systems
Smart-site risks and practical BMS resilience steps.
Defending Hybrid Identity against Golden SAML
Golden SAML, MagicWeb, AD FS Tier 0, cloud-primary migration.
Mitigating OAuth Consent Phishing and Malicious Apps
App registration lockdown, admin consent, workload identities.
Mitigating AiTM Phishing and Session Hijacking
Token Protection, phishing-resistant MFA, CAE.
The Identity Bridge: Securing Evolving IT/OT Boundaries
Convergence risks and cryptographic boundary design.
Transitioning to Phishing-Resistant Passwordless Auth
FIDO2, CBA, and authentication strengths.
Implementing Risk-Based Conditional Access Policies
User risk and sign-in risk in Conditional Access.
Continuous Access Evaluation Architecture
Close the OAuth token lifetime gap with near real-time revocation.
IT/OT Segmentation: What Actually Works in the Field
Zones, conduits, and operational reality.
Log Analysis and Threat Hunting in Microsoft Sentinel
Diagnostic forwarding, retention, and KQL hunts.
Hardening Entra ID Token Issuance and Verification
Storm-0558-style token forgery, shorter lifetimes, MSAL validation.
Security by Design in Greenfield Data Center Projects
Soon
Coming soon - cyber requirements across RFP, PDR, HLD, and LLD.
Vendor-Neutral Advisory: Why Independence Matters in OT Projects
Soon
Coming soon - conflicts of interest and independent governance.
No articles match your search.
New articles are published periodically. For consultancy inquiries, get in touch.