,
5 tweets,
1 min read
Read on Twitter
I endorse this thread, even though he quotes me. It's not just ICS (though ICS is often radically different), but also everybody else that has nuance in their network that can't be covered in a tweet.
Credential theft is your #1 existential risk for your business -- if you are heavily dependent on Windows. But no, it's not really a threat to industrial control systems that aren't based upon Windows.
Credential theft is the only cyber risk I've seen that has bankrupted business -- the only threat to the existence of a business. This fact is underappreciated, and hard to capture in tweets. But of course, it doesn't apply to everyone.
Likewise with patching. There's lots of good reasons why a vendor may take longer than 90 days to patch something, and lots of reasons why customers can't apply them quickly.
But on the other hand, we still live in a world where vulns come as a surprise to vendors and patches come as a surprise to customers, as something they didn't account for.
