Cybersecurity Musings

October 2, 2026
A historian, an operator station, and an engineering workstation may all communicate with the same programmable logic controller...
September 24, 2026
In part one, we discussed how covered entity status gets determined under the proposed CIRCIA rule, including the sector...
September 10, 2026
CISA’s current regulatory agenda targets September 2026 for the final rule implementing the Cyber Incident Reporting...
September 2, 2026
It’s Tuesday afternoon and word comes in that an integrator with remote access to your environment has been compromised....
August 26, 2026
Siemens S7 detection moved up a lot of roadmaps this month. On August 19, 2026, the NSA, CISA, FBI, Department of Energy,...
August 19, 2026
There’s probably a path out of your control network that nobody has written down. In most critical infrastructure environments,...
August 13, 2026
On the morning of Monday, July 27, the operating controls at the well and water treatment plant in Braham, Minnesota, went...
July 30, 2026
A security assessment fills a report with findings the way a Pokedex fills with entries. Neither one wins a fight. Here’s...
July 23, 2026
A CVSS score can tell you how severe a vulnerability looks on paper. It cannot tell you whether that vulnerability is reachable...
July 17, 2026
The dangerous intruder in OT today isn’t bombing the wall. They walked through the front door with a key that shouldn’t...