Securing OT / ICS Environments Does Not Have to Be Hard

Securing OT / ICS Environments Does Not Have to Be Hard

by Mike Holcomb

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Mike Holcomb 👥 27K 📅 November 12, 2025 ⏱ 24 min 👁 2K 📄 tutorial 🧭 2026-08-16
Available in: English (current) Français

Keywords

OT securityICSSCADAB.A.S.I.C.cybersecurity

Summary

In this video, Mike Holcomb presents a practical framework for securing Operational Technology (OT) and Industrial Control Systems (ICS) environments, emphasizing that effective security does not require complex solutions. He introduces the B.A.S.I.C. acronym, which stands for Backup and Recovery, Asset Management, Secure Network Architecture, Incident Response Planning, and Continuous Vulnerability Management. Each step is explained with real-world examples, such as the Ukraine power grid attacks, the Jaguar Land Rover ransomware incident, and the Port of Nagoya disruption, illustrating the consequences of neglecting these fundamentals. Holcomb stresses the importance of backing up critical assets, maintaining an accurate asset inventory, segmenting networks to limit attacker movement, having a well-defined incident response plan, and continuously managing vulnerabilities with input from engineers and operators. He also mentions additional controls like secure remote access and training, and provides resources for further learning. The video is sponsored by Asimily, and the sponsor segment is clearly indicated.

151 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video offers valuable, actionable advice for OT/ICS security, grounded in the author’s extensive experience. The B.A.S.I.C. framework is practical and accessible, making it useful for both small and large organizations. The argumentation is strengthened by referencing well-known cyber incidents, which serve as cautionary tales and illustrate the real-world impact of security failures. However, the presentation is largely anecdotal, and the author does not provide formal citations or data to support the effectiveness of the proposed controls. The reasoning is logical and aligns with industry best practices, but it lacks the depth of a systematic review or empirical evidence.

Scientific Rigor, Source Quality, Title Accuracy

The video demonstrates a good understanding of OT/ICS security, and the author references recognized frameworks like SANS ICS and IEC 62443, which adds credibility. However, the sources cited are primarily anecdotal incidents and the author’s own experience, with no formal references or links to academic or industry publications. The title accurately reflects the content, which focuses on simplifying OT/ICS security. The video includes a clear sponsorship segment for Asimily, which is disclosed but does not detract from the educational value. Overall, the rigor is moderate, suitable for a practitioner-oriented audience, but it would benefit from more formal citations and references.

214 words

Title / Content Match

The title accurately reflects the content, which focuses on simplifying OT/ICS security through a practical framework.

Quality & Reliability

8/10

The video provides practical, experience-based guidance on OT/ICS security, referencing real-world incidents and aligning with recognized frameworks like SANS ICS and IEC 62443. The author demonstrates expertise, but the content is largely anecdotal and lacks formal citations or peer-reviewed sources.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Concurring Sources

  • IEC 62443 — International standard for industrial automation and control systems security, supporting the network segmentation advice.
  • SANS ICS Five Critical Controls — Framework referenced by the author, providing a basis for OT security controls.
  • NIST SP 800-82 — Guide to Industrial Control Systems (ICS) Security, offering comprehensive guidance.

Contribution & Novelties

The video provides a practical, easy-to-remember framework (B.A.S.I.C.) for OT/ICS security, which is particularly useful for small and medium-sized organizations that may lack resources. It emphasizes that security does not have to be complex and focuses on fundamental controls. The author’s experience in both large and small environments adds credibility, and the real-world examples illustrate the consequences of neglecting these basics. The video also highlights the importance of involving engineers and operators in vulnerability management decisions, which is a nuanced point often overlooked.

Pour aller plus loin :

  • IEC 62443 — International standard for industrial automation and control systems security, relevant to network segmentation and zones.
  • SANS ICS Five Critical Controls — Framework referenced by the author, providing a basis for OT security controls.
  • NIST SP 800-82 — Guide to Industrial Control Systems (ICS) Security, offering comprehensive guidance.
  • Ukraine Power Grid Cyberattack — Real-world example of OT cyberattack, illustrating the impact of network segmentation failures.
  • Port of Nagoya Ransomware Attack — Example of IT/OT convergence risk, relevant to incident response planning.

171 words

Radar Profile

The radar profile shows high scores in information quantity, quality, and reliability, with a slightly lower technical level, indicating a practical, accessible tutorial rather than a deep technical dive. The overall balance suggests a valuable resource for practitioners seeking foundational OT security guidance.

Reliability 8/10

💬 No comments were provided for analysis.