Jason Christopher

Be wary when using qualitative and quantitative metrics to avoid 1) bias and 2) bad data. I've seen multiple well-intentioned cyber metrics lead whole companies astray because of their unwavering faith in a measurement... just to find out it was "garbage in, garbage out." How do you avoid these pitfalls? Peer review. Host internal workshops, gain buy-in from stakeholders, and really test the metrics. Do they provide a real view into your security program... or do they simply support the narrative you want? The only way to know for sure is to perform regular critiques of the metrics and improve them with each iteration.

I cannot stress this enough-- use an industry developed standard for KRI/KPI/metric categorization. Which one, you may ask? Here's a secret: it honestly does not matter. Standards should not be a black-and-white tool for implementing programs or demonstrating compliance. They also provide a common lexicon developed by peers to communicate broad themes-- which is exactly what you need when communicating cyber risk. Another secret? Most cybersecurity standards are 75% the same. The terminology may be different, the sector focus could be adapted... but you're not going to open one up and think "oh, so we need firewalls, huh?" Use the standard that maps best to your stakeholders and measure from there.

Remember this? "How can you tell if an engineer is an extrovert? -- they stare at -your- shoes, not theirs." Fight this narrative as much as you can. You can gain a lot of knowledge at events by being a fly on the wall... but you'll gain even more insight and value by being an active participant. As a public speaker at numerous events, I love interacting with the audience-- it lets me know people are paying attention and that the information I'm sharing is worthwhile. And, who knows? The people you talk to at events can lead to new perspectives, friendships, and even career advancement over the years. It's low-risk and potentially high-reward!

“Culture eats strategy for breakfast,” as the saying goes. Building a leading industrial cybersecurity team means nothing if you do not invest in the cultural change management to create & sustain continued success. One of the things we teach in SANS ICS418 is learning from the example set with industrial safety. As a matter of fact, cybersecurity IS safety when talking about control systems & operational technology. This means we can adopt elements of safety culture, which is prevalent in every industrial facility. Safety minutes, toolbox talks, and safety newsletters are all indicators of a “baked in” culture that security professionals should learn from & adapt, if possible. Culture takes time to build, but “cyber safety” is possible.

Similar to incident response plans-- test these as close to real-life scenarios as possible. If your team has only read the policy and never actually restored an asset from back-up, how confident will you (and they) be during an actual incident? Grab some test equipment or spare assets and perform actual restorations. Start small at first, then gradually work your way up to full operational drills.

PID tuning is extremely dependent on your environment and is as close as you get can to a debate of "art vs. science" in industrial control systems. For example, the Ziegler-Nichols method is a manual approach that can include open and closed loop variations. It's a classic approach. However, the method can lead to potentially "aggressive" parameters with a higher degree of oscillation and overshoot than what may be truly ideal for the assets in question. Similarly, any environment with complex dynamics may benefit from a different method of tuning altogether. Be aware of your system, your assets, and your physical processes when evaluating PID tuning techniques.