John Hellickson

The most dangerous phrase in any SOC? “It’s probably nothing.” That’s what nearly led to a mass poisoning at a U.S. water treatment plant. Oldsmar, Florida – February 5, 2021 Just got to know - the FBI (2023) and Oldsmar’s former city manager Al Braithwaite now indicate that: - No cyberattack occurred. - The remote access incident was likely a result of poor cybersecurity hygiene, not an external intrusion. - FBI’s investigation found no evidence of a hack or a coordinated attack. A plant operator glanced at his screen. His mouse was moving and he wasn’t touching it. Then it happened: The attacker changed the level of sodium hydroxide (lye) in the water → From 100 ppm → To 11,100 ppm That’s a corrosive chemical. It’s used to clean drains. And it was heading toward the public water supply. The attacker got in through a TeamViewer session left open for remote troubleshooting. No MFA. No alerts. No segmentation. If the operator hadn’t noticed and reversed it instantly, thousands could’ve been harmed. → So why is this a cultural failure not just a technical one? - No one expected danger. - Remote access was normalized. - Risks were ignored in favor of convenience. - There was no escalation protocol. - The operator acted on instinct, not policy. - “Anomalies” weren’t treated as security events. - They were treated as noise. No urgency. No ownership. That’s not a tooling issue. That’s organizational culture. → What can be done? - Define and drill escalation paths. - Anyone in operations should know exactly what to do if “something feels off.” - Treat OT anomalies like real threats. - Don’t wait for malware. Weird is enough to act. - Review remote access policies regularly. - Kill the convenience-first logic. Secure by default. - Include cultural readiness in your security audits. Tools don’t act. People do. And they need permission, training, and clarity. This wasn’t a drill. It was a quiet moment that nearly became a mass tragedy. Most threats don’t start with malware. They start with access, silence, and comfort. You can’t patch culture. But you can design for escalation. And you should. If you're responsible for critical infrastructure or OT risk: Let’s walk through what escalation, alignment, and live-fire readiness actually look like. #CyberSecurity #OTSecurity #ICSsecurity #CriticalInfrastructure #IndustrialCybersecurity #SCADASecurity #CyberResilience

293

38 Comments

Ransomware doesn’t need direct access to your OT network to shut down your plant - even if you’re part of Critical National Infrastructure (CNI). It can start in IT - and still bring production to a halt. 78% of ransomware attacks in industrial environments start in IT. 64% of those still cause OT downtime. Why? - ERP encrypted? No materials, no production run. - MES offline? Schedules freeze, lines stop. - Workforce management locked? No shifts, no operations. - Financial systems hit? Vendors don’t get paid, suppliers cut you off. In a CNI context, the stakes are even higher. Disruption in supporting IT systems can ripple across supply chains and essential services. The Real Gap Traditional OT standards focus on ICS segmentation and firewalls—while ignoring how ransomware can cripple the IT services that OT depends on. If your ransomware plan isn’t prioritizing operational resilience, it’s just a compliance checklist. Practical Solutions - Identify Critical Dependencies: Map out IT systems (ERP, MES, finance) that affect production. - Strengthen Backups: Regularly back up and test restores for both IT and OT. Segment & Monitor: Separate critical systems and track network activity. - Access Control: Limit permissions and enforce multi-factor authentication. - Unified Incident Response: Align IT/OT playbooks for ransomware. - Supplier Readiness: Vet vendors and keep backup suppliers. - Culture & Training: Train everyone on phishing and secure practices. Let’s ensure operational resilience, not just compliance. Feel free to connect or comment if you’d like to learn more! What’s Next? My team and I are in stealth mode, developing a platform to strengthen CNI security against evolving OT threats. Our prototype is coming in April. Watch this space! #CNI #CyberSecurity #OTSecurity

638

182 Comments

NSA, CISA, EPA, FBI, and allied cyber agencies published prescriptive guidance for building and maintaining an OT asset inventory and taxonomy—the foundation for a modern, defensible OT architecture. If you already run RedSeal, you can fulfill most of the guidance quickly by modeling your hybrid networks, auto-grouping assets into OT zones, validating segmentation, and continuously monitoring drift. If you don't there are manual processes outlined in the guidance.  #redseal #cybersecurity #OTsecurity #CTEM https://lnkd.in/gYdnbntX

24

1 Comment

Threat Actors Don’t Care About Your Compliance Score In today’s cybersecurity landscape, organizations are navigating a complex web of compliance frameworks—NIST-CSF, CMMC, ISO 27001, PCI-DSS, HIPAA, NERC, and GDPR, to name a few. Each requires thorough documentation to validate governance practices, policies, and technical safeguards. Successfully passing these audits offers value: it helps organizations benchmark their security posture and align with industry expectations. But the key to success lies in maintaining clear, consistent documentation—not just checking boxes, but demonstrating genuine security maturity. However, passing an audit doesn’t mean you’re safe. Threat actors don’t care about your audit score or whether your last assessment earned gold stars—they’re looking for weak spots, misconfigurations, and overlooked vulnerabilities. And ironically, the process of preparing for audits can drain crucial resources—hundreds of man hours that could be spent on active defense, network monitoring, and incident response. In some cases, chasing compliance may divert attention from more pressing security needs. That’s why it’s important to strike a balance. If an audit is required—by regulators, partners, or customers—it must be done right. But organizations shouldn’t lose sight of the bigger picture. Real security depends on visibility, context, cyber hygiene, and threat intelligence. A framework may tell you what “good” looks like on paper, but the attackers don’t follow checklists—they exploit gaps. Staying ahead requires moving beyond compliance and investing in continuous, adaptive security strategies. #cybersecurity #GRC #audits #documentation #threatactors #vulnerabilities #threathunting #riskmanagent #compliance #NIST #CMMC #GDPR #ISO27001 #PCI

603

48 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg

34

1 Comment

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

Cyber Attack Impacting Oregon Environmental Department The Oregon Department of Environmental Quality has reported a cyber attack that is affecting communications and operations including vehicle inspections. Some services will be shuttered through the weekend. #Oregon #cyber #cybersecurity #cyberattack #government https://lnkd.in/exc6as2w

14

3 Comments

New - Investigating Hy-Vee’s massive data breach, Hudson Rock identified critical employees infected by infostealers, compromising Atlassian (Confluence and Jira) credentials. This likely enabled this Stormous group 53GB data heist. (tl;dr below) New Blog (4 minutes read) - https://lnkd.in/dPZYU_-f TL;DR: On June 23, 2025, Stormous breached Hy-Vee’s Atlassian accounts, stealing 53GB of sensitive data, including infrastructure diagrams and operational details. Hudson Rock’s research uncovered an infostealer infections Hy-Vee employee devices, exposing credentials that likely granted attackers access, fueling one of 2025’s boldest retail breaches.

37

Most security teams run on a dozen different tools. Crisis detection systems, notification feeds, GSOC dashboards, case management systems, travel risk management platforms, risk models, and site assessment systems. The list goes on. Each one needs location threat intelligence, but few actually have it. That's the problem we built our API to solve. Customers have been loving our API since it was first released, and the use cases keep expanding. Today we're making it official with a dedicated API page on our site that breaks down exactly how security teams integrate Base Operations into their existing tech stack. Here's what it enables: 𝗚𝗦𝗢𝗖 𝘁𝗵𝗿𝗲𝗮𝘁 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴. Feed BaseScore and detailed threat breakdowns directly into your operations center. Your analysts get standardized risk context for every location they monitor without switching tools. 𝗖𝘂𝘀𝘁𝗼𝗺 𝗿𝗶𝘀𝗸 𝗺𝗼𝗱𝗲𝗹𝗶𝗻𝗴. Our API provides BaseScore and 16 standardized threat categories at sub-mile granularity. So you can build crime and unrest threats directly into your risk model across every location. 𝗧𝗿𝗮𝘃𝗲𝗹 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗱𝘂𝘁𝘆 𝗼𝗳 𝗰𝗮𝗿𝗲. Connect local threat data to your travel management platform so you implement policies effectively and provide recommendations to your people. 𝗦𝗶𝘁𝗲 𝗮𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗽𝗼𝗿𝘁𝗳𝗼𝗹𝗶𝗼 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴. Query and compare threat profiles for any location across 5,000+ cities using the same consistent methodology. Most teams complete integration in 5-30 days. No rebuilding your stack. No 12-month data engineering projects. One REST API that connects once and feeds local intelligence everywhere it's needed. Check out the full API page to explore endpoints, specs, and use cases: https://lnkd.in/endwHPcT

19

2 Comments

The DVMS Institute is honored to partner with Navvia and participate in its NIST Cybersecurity Framework 2.0 Risk Assessment and Process Modeling Platform launch at the ISACA 2025 North American Conference in Orlando, FL, from May 21 to 23rd. Navvia's innovative solution integrates the key security outcomes from its NIST CSF 2.0 assessments with your IT Service Management (ITSM) processes. This practical solution helps you focus on the relevant security practices and the underpinning processes required to maintain and improve your security posture. Navvia is also a training partner of the DVMS Institute, offering its clients the only Accredited (APMG International), Assured (NCSC-GCHQ-UK), and Recognized (DHS-CISA-NICCS) NIST Cybersecurity Framework Digital Value Management System certification training programs that teach Leadership and Frontline Employees the skills to build a Holistic, Adaptive, and Culture-Powered Overlay System designed to enable Cyber Operational Resilience in complex, multi-vendor digital ecosystems. Looking forward to seeing you in Orlando

19

2 Comments

CMMC compliance is a business imperative – not a box to check. With Cybersecurity Maturity Model Certification requirements already appearing in contracts and full enforcement coming fast, defense contractors who delay may face more than high costs. They risk legal exposure, lost revenue and being shut out of future opportunities. With insight from #DoD #CIO Katie Arrington, #cybersecurity #risk and #compliance company CyberRx, and #Tech CEO Emile Sayegh, read my latest Forbes column to learn what leaders need to know about CMMC 2.0, the costs of certification and noncompliance, and why early action is your best competitive advantage. https://lnkd.in/e6t7Rm83 Ola Sage Israel Briggs Greg Smith Matt Grinstead Rachel Bamgbose #CMMC #CMMCCompliance #Cybersecurity #LeadershipStrategy #DefenseContracting #RiskManagement #GovCon

31

2 Comments

🚨 Breaking: HID acquires Intelligent Observation, expanding its RTLS healthcare play Today, they announced they acquired the Miami-based hand hygiene compliance platform using NFMI wearables and real-time SaaS dashboards to help reduce hospital-acquired infections. This move reinforces HID’s position in healthcare by adding granular, room-level hygiene data and infection tracing capabilities to its RTLS portfolio. Super interesting and a super nice, but does complements their tech stack in healthcare RTLS. The Access Control Executive Brief Björn Lidefelt Tim Moxon ASSA ABLOY Group Marc Bielmann Seth Freedman

51