Defeating OT Security Debt with Zakaria SANKARA

This Ebook explains why industrial plants are exposed to cyber risk through their third-party integrators and through about 20 years of accumulated "security debt." It then sets out a practical plan to reduce that risk without replacing everything at once.

What it covers

1. The open door: integrators are essential, but their remote access is a pivot point into the plant. It includes the 2025 incident from the CISA and FBI fact sheet.
2. CISA and FBI recommendations: what to put in integrator contracts, how to control access, and how to keep backups and manual operations so the plant can run without the integrator.
3. Security debt: three eras of modernization (isolated, connected, converged) stacked on each other with no segmentation between them.
4. Blast radius: on a flat network, one compromised vendor foothold reaches every system.
5. Legacy protocols: Modbus and Profibus cannot be patched, so the fix is architectural. Native control traffic stays inside the trusted zone, and outside access goes through a DMZ, historian or jump server.
6. Expert views: short quotes from practitioners at DeNexus, Arista Cyber and Siemens Gamesa.
7. Financial baseline: quantify OT cyber risk in dollars instead of CVSS scores and fund the highest-return fixes first.
8. 3-year blueprint: visibility and containment, then segmentation and controls, then replacement and resilience, timed to planned shutdowns.
9. Closing message: stop patching symptoms and redesign the architecture of your risk.