What I take on
I take on a handful of outside engagements at a time, alongside my day work.
Talks and podcasts
Conference sessions, panels, and podcast appearances on ICS/OT security and control system architecture. I focus each talk on a specific argument.
Technical review boards
I review designs for standing and one-off technical review boards. I raise concerns early, while changes are still cheap to make.
Architecture and design review
I review control system and OT architectures against the consequences the operator needs to prevent.
Standards and normative reference work
I contribute to working groups and help draft or review standards and normative references.
Reviews for public-service organizations
I reserve time for small public-service organizations with limited staffing or older equipment. That can include schools, clinics, small hospitals, small utilities, community facilities, and local infrastructure operators.
When budget is the barrier, I scope nominal-fee or pro bono work case by case.
What a review can include
- →Asset and network review for IT, OT, and vendor-managed systems
- →Remote access, account, and logging review
- →Backup paths and monitoring coverage
- →Segmentation and firewall rule recommendations
- →Vendor coordination questions for controls, facilities, or IT providers
- →A short action list that accounts for operational risk and available staffing
Review scope
Where it helps, I align recommendations with the CISA Cross-Sector Cybersecurity Performance Goals. They provide a published baseline for prioritizing security improvements.
For an active incident, use your emergency, legal, cyber insurance, and incident-response channels. My outside work focuses on architecture review and risk reduction.