Celestine Jahren

Most OT security failures don’t happen because teams ignored cybersecurity. They happen because architecture stopped one layer too early. Here’s the thing: A firewall alone does not secure an OT network. It only slows attackers down. If you want real, defensible separation between IT and OT, you need three deliberate layers. Each one has a clear job. 1️⃣ Firewall | First line of defense • Still necessary • Handles access control, segmentation, policy enforcement But: • Firewalls are bidirectional by design • One misrule • One zero-day • One leaked credential ➡️ OT becomes reachable Bottom line: Firewalls reduce risk. They do not eliminate it. 2️⃣ Industrial DMZ | Second line of defense This is where architectures either mature or collapse. A proper I-DMZ is not a jump server zone. It should mirror OT, not expose it. What belongs here: • Read-only historians replicated from OT • Patch staging and backup servers • OT-aware monitoring and visibility platforms The goal: • IT never talks to OT directly • IT talks only to OT replicas in the DMZ ➡️ Pressure absorbed ➡️ Blast radius limited 3️⃣ Data Diode | Final line of defense This is where security becomes physical, not theoretical. • One-way communication enforced in hardware • No return path • No misconfiguration risk Combined with: • Industrial protocol proxies (IEC 61850, DNP3, Modbus, OPC-UA, MQTT) • Application-layer validation • Encrypted one-way transmission to IT / SOC Result: Visibility without exposure. How it works in practice • OT sends data out • IT monitors, analyzes, responds • Attacks can never travel back in What this really means • Firewalls manage access • DMZs manage interaction • Data diodes enforce trust boundaries That’s defense-in-depth done right for real OT environments. If your OT security still relies on “tight firewall rules”, you’re one incident away from learning this the hard way. Real OT security isn’t a product. It’s an architecture decision. 🔗 Learn more: https://blackbear-ics.com/ 📩 Reach me: prashant.mishra@blackbeartechhive.com #OTSecurity #IndustrialCybersecurity #ICSsecurity #SCADAsecurity #CriticalInfrastructure #ITOTConvergence #OTDMZ #IndustrialDMZ #DefenseInDepth #NetworkSegmentation #ZeroTrustOT #UnidirectionalGateway #DataDiode #OTVisibility #OTMonitoring #AssetDiscovery #ThreatDetection #IEC62443 #NERC #NIS2 #CRA #Utilities #OilAndGas #PowerGrid #Railways #Manufacturing #Firewall #IndustrialFirewall #NetworkSecurity #SOC #SIEM #ThreatHunting #CyberPhysicalSystems #OperationalResilience

2

cpe-guesser 2.0 released - Multi-Source CPE Imports, Better Ranking, and Greater Autonomy Beyond NVD Version 2.0 brings major improvements to CPE import, ranking, and CVE v5 data handling. This release focuses on better import performance, broader format support, improved search relevance, and more robust indexing for vendor and product matching. A notable change in this release is that cpe-guesser is no longer limited to NVD as its only practical CPE source. In addition to the NVD feeds, it can also leverage the Vulnerability-Lookup dump available at https://lnkd.in/dX_7DbK3, providing additional CPE sources and more autonomy from the previously NVD-only source model. This release lays an important foundation for improving the GCVE ecosystem, especially by strengthening vendor and product references through better CPE source diversity, indexing, and matching capabilities. If you have ideas for further improvements, additional data sources, or better ways to refine vendor and product identification, we would be very happy to hear your feedback. https://lnkd.in/d5Sku8qj #opensource #gcve #cve #vulnerabilitymanagement #cybersecurity GCVE-EU CIRCL (Computer Incident Response Center Luxembourg)

48

5 Comments

As concern rises over CISA Stakeholder Engagement Division’s ability to share information with the industry, Tenable CSO Bob Huber tells Axios, “The communications functions that this division provides are a nonnegotiable national security mechanism.” http://ow.ly/zUij106oQuk

4

CISA is sounding the alarm over a critical vulnerability in GeoServer that is being actively exploited in the wild, ordering federal agencies to patch immediately. The flaw, tracked as CVE-2025-58360, is an unauthenticated XML External Entity (XXE) vulnerability affecting GeoServer versions 2.26.1 and earlier. When exploited, the bug lets attackers retrieve arbitrary files from vulnerable servers, allowing data theft, denial-of-service attacks, or server-side request forgery (SSRF) that can expose internal systems. GeoServer, an open-source platform for publishing and sharing geospatial data, is widely used across civilian, scientific, and defense-linked federal environments. “GeoServer is widely used across federal agencies that manage land, water, and geoscience data,” said Louis Eichenbaum, federal CTO of ColorTokens, noting that it often runs alongside ArcGIS and remains connected back to enterprise GIS systems, even in otherwise segmented or air-gapped deployments. CISA added CVE-2025-58360 to its Known Exploited Vulnerabilities (KEV) catalog this week, citing active exploitation. Advisories from Wiz and the Canadian Centre for Cyber Security indicate that exploit code has circulated since late November, giving attackers a head start before coordinated patching could happen. https://lnkd.in/gRqEs5Dg

7

Insider risk resources are often scarce, and many large organizations, such as Google, tend to address these issues only after well-publicized incidents. -https://lnkd.in/gxyAny7a. Marshall Heilman and the folks from DTEX partnered with the Ponemon Institute to release the "Cost of Insider Risk 2026 Global Report" - https://ponemon.dtex.ai/. This report is the gold standard in providing trends to evaluate and budget for your own Insider Risk program. Share it with your chronically underappreciated Insider Risk folks Key Insights - Total average annual cost of insider security incidents is US$19.5M - Companies with an insider risk management program save themselves from 7 incidents a year, saving on average 8.2 million dollars - Time to Containment is reduced with a commitment to budgeting for Insider Risk, with an average of 67 DAYS to contain, down from 86 in 2023 - They address the rising COST OF SHADOW AI with cost of $10.3M due to negligent insiders

19