Why Your OT & ICS Cybersecurity is Failing (And How to Fix It for Free)

Why Your OT & ICS Cybersecurity is Failing (And How to Fix It for Free)

by Mike Holcomb · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Mike Holcomb 👥 28K 📅 October 20, 2026 ⏱ 29 min 👁 24 📄 expert opinion 🧭 2026-10-20
Available in: English (current) Français

Keywords

OT securityICSsmall utilitiesB.A.S.I.C.AI

Summary

This presentation, recorded at Industrial Cyber Days, focuses on securing small-scale operational technology (OT) environments that lack dedicated cybersecurity staff and budgets. Mike Holcomb, an OT security consultant, introduces the B.A.S.I.C. framework—an acronym covering Backup & Recovery, Asset Inventory, Secure Network Architecture, Incident Response Planning, and Continuous Vulnerability Management. He argues that mastering these fundamentals can protect critical infrastructure even with minimal resources. Holcomb emphasizes the importance of asset inventory as the foundation for all security activities, recommends network segmentation with even a basic firewall between IT and OT, and advocates for incident response planning based on learning from global incidents. He also explores using free AI tools to create cybersecurity awareness materials and simple monitoring dashboards, such as ‘Fenceline’ for Cisco firewall logs. The talk underscores that many small utilities have fewer than 500 customers and zero budget, so practical, low-cost measures are essential. He illustrates recurring attack patterns with examples like the Port of Nagoya ransomware incident and grocery store freezers in France, highlighting that proactive steps can prevent similar outcomes.

173 words

Critical Evaluation

Value of the Information & Strength of the Argument

The presentation offers high practical value for organizations with limited resources by prioritizing low-cost, high-impact controls. The argumentation is built on a logical progression from understanding the audience’s constraints to presenting a prioritized framework. The speaker strengthens his case with concrete real-world incidents and personal anecdotes, making it relatable. However, the claims are largely anecdotal and not systematically backed by statistical evidence, so the robustness of the argumentation is moderate. The emphasis on free tools and AI as force multipliers is forward-looking and actionable.

Scientific Rigor, Source Quality, Title Accuracy

The talk demonstrates practical expertise but lacks formal citations. It references known frameworks (SANS ICS) and real incidents without providing documented sources. The sole external link provided is the speaker’s website, which aggregates his free resources. The title accurately matches the content, as it addresses the ‘why failing’ and ‘how to fix for free.’ Although the video includes chapters, no external sources are cited in the description beyond the presenter’s site. The information is internally consistent and aligns with industry best practices, though the quality would improve with explicit citations to standards like NIST SP 800-82.

195 words

Title / Content Match

The title accurately reflects the content: it explains common failure points (lack of resources, awareness) and offers a free framework (B.A.S.I.C.) to address them.

Quality & Reliability

7/10

The content is based on the speaker's extensive hands-on experience in industrial cybersecurity and references real-world incidents, but it is an opinionated perspective without formal citations or peer-review. The framework is practical and actionable, but generalizability is not scientifically validated.

Chapters

Cited Sources

Concurring Sources

  • NIST SP 800-82 Rev.2 — Provides guidelines for securing industrial control systems, supporting the importance of asset inventory and network segmentation.

Contribution & Novelties

The original contribution is the B.A.S.I.C. framework tailored for resource-constrained OT environments, combining practices adapted from larger frameworks into a prioritized, low-cost approach. The novel angle is the integration of free AI tools to bridge the gap when staff and budget are absent, such as generating awareness materials and creating simple firewall log dashboards. The talk also stresses that even a minimal firewall between IT and OT is a critical first step, a message often lost in more complex standards.

Pour aller plus loin :

  • NIST SP 800-82 Rev.3 Guide to OT Security — The standard reference for OT security controls, aligning with the fundamentals discussed.
  • SANS ICS Security — Training and resources on industrial control systems security, including the critical controls mentioned.
  • MITRE ATT&CK for ICS — A knowledge base of adversary behaviors in industrial environments, useful for understanding attack paths.

142 words

Radar Profile

The radar profile shows high scores in quantity and quality of information, reflecting the depth of practical advice, but lower in technical level and reliability, indicating a focus on accessibility rather than deep technical detail or rigorous empirical verification. The balance is typical of expert-opinion content aiming for actionable guidance.

Reliability 7/10