Skip to main content

Posts

Shadow AI — What New CISOs Need to Do Before It Bites Them

It was a Tuesday afternoon when one of our business analysts dropped a file into the shared drive with a note attached:  “Used Claude to summarize all the customer complaint data — saved me three hours!”  She was thrilled. I was not. Not because she had done something wrong. She hadn’t — not intentionally. But sitting inside that AI summary was a condensed version of thousands of customer records, support tickets, and PII that had just been sent to an external large language model through a free consumer account. No data processing agreement. No approved vendor. No logging. No way to know what had been retained on the other side. That moment was my first real encounter with Shadow AI at scale. And if you’re a new CISO, I can almost guarantee you’ve already got it happening in your organization right now — you just might not know it yet. Shadow AI Is the New Shadow IT, and It Moves Faster We’ve been talking about Shadow IT for two decades. Employees spinning up personal Dropbox...
Read more
Recent posts

NCSC Secure Connectivity Principle 7: Ensure All Connectivity is Logged and Monitored

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Why logging and monitoring is your last line of defense in OT — and what effective OT visibility actually requires All security controls, however well-designed, carry the possibility of failure. Boundaries can be breached. Segmentation controls can be circumvented. Authentication mechanisms can be defeated. Protocols can be exploited. There is no configuration of preventive controls that provides absolute certainty that an OT environment will never be compromised. This is not a counsel of despair — it is a statement of operational reality that serious security programs accept and design around. Principle 7 of the NCSC's Secure Connectivity Principles for Operational Technology is the control that remains effective even when every other control has been bypassed: comprehensive logging and monitoring. When an attacker defeats your boundary, navigates your segmentation, and reaches a critical OT ass...
Read more

NCSC Secure Connectivity Principle 6: Limit the Impact of Compromise

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Assume breach, contain the blast radius — designing OT environments to survive compromise There is a maturity progression in how organizations think about security. The first stage is prevention — the belief that with enough controls, attacks can be stopped at the perimeter. The second stage is detection — the recognition that prevention is never perfect, and that the ability to detect when something has gone wrong is as important as trying to prevent it. The third stage, which the most mature security programs operate at, is resilience — designing systems so that when a compromise occurs, its impact is contained, its blast radius is limited, and recovery is achievable without catastrophic operational disruption. Principle 6 of the NCSC's Secure Connectivity Principles for Operational Technology operates squarely in that third stage. It does not assume that the boundary controls in Principle 5...
Read more

NCSC Secure Connectivity Principle 5: Harden Your OT Boundary

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Why the OT boundary is your primary defensive line — and what it takes to make it hold In most OT environments, the devices and systems inside the network were not designed to defend themselves. Legacy PLCs, older SCADA components, and even relatively modern field devices often lack the security capabilities needed to withstand direct attack — they have no meaningful authentication for incoming commands, no ability to detect or respond to malicious traffic, and limited logging capabilities that would allow forensic investigation after a compromise. Their security was always intended to be provided by the environment around them, not by themselves. This reality makes the OT boundary the primary line of defense. If the boundary holds, the internal systems are protected despite their own security limitations. If the boundary fails, those internal systems are exposed with minimal ability to detect or r...
Read more

NCSC Secure Connectivity Principle 4: Use Standardised and Secure Protocols

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Why the protocols your OT systems use to communicate are as important as the networks they run on Most cybersecurity professionals spend a great deal of time thinking about network architecture — firewalls, segmentation, DMZs, access controls. These are important, and the preceding principles in this series address them directly. But there is a layer of security that sits beneath network controls and is often overlooked in OT environments: the protocols that devices use to communicate with each other. Even a well-segmented, carefully controlled OT network can be undermined by protocols that allow unauthenticated commands, lack encryption, or permit malicious data injection that bypasses perimeter controls. Principle 4 of the NCSC's Secure Connectivity Principles for Operational Technology addresses this layer explicitly. It requires organizations to evaluate the security properties of the protoco...
Read more