Sign in Subscribe

Brian Weidner

Brian Weidner

Why Govern Matters in NIST CSF 2.0: Risks of Acting — and Not Acting — on Cybersecurity Governance

Why Govern Matters in NIST CSF 2.0: Risks of Acting — and Not Acting — on Cybersecurity Governance

The NIST Cybersecurity Framework 2.0 (CSF 2.0) represents a significant evolution in how organizations think about managing cybersecurity risk. Among the most impactful changes in this latest version is the elevation of Govern to a core function. Previously embedded in other areas of the framework, governance now stands

The Power of “Yes, And”: How CISOs Become Business Enablers Without Compromising Security

The Power of “Yes, And”: How CISOs Become Business Enablers Without Compromising Security

The views expressed are my own and do not represent those of my employer. A business leader walks into your office with a new initiative. She wants to move a critical workflow to a SaaS platform your team has never evaluated. She is excited. Her team is ready. The timeline

Isolation Is Not Failure: Why CISOs Must Plan for OT Disconnect Scenarios

Isolation Is Not Failure: Why CISOs Must Plan for OT Disconnect Scenarios

Isolation is a resilience capability, not a last resort. CISOs must ensure isolation plans exist, are tested, and are integrated into business continuity planning. Executive Scenarios • Vendor compromise • Supply chain incident • National-level threat escalation Well-designed systems can isolate selectively—preserving safety while reducing exposure. Executive Insight Organizations that

Why OT Logging and Monitoring Are Executive-Level Controls

Why OT Logging and Monitoring Are Executive-Level Controls

Detection speed determines impact. OT environments are uniquely well-suited for behavioral monitoring due to their predictable patterns. What CISOs Should Ensure • Full visibility into remote access • Alerting on configuration changes • Monitoring of protocol violations • Immediate alerts on break-glass usage Executive Insight Logs that are not operationalized do not

Hardening the OT Boundary: A Control CISOs Cannot Delegate

Hardening the OT Boundary: A Control CISOs Cannot Delegate

Most OT breaches succeed because boundaries fail. The OT boundary is often the only layer that can be modernized without impacting production systems. Boundary Controls CISOs Should Mandate • Modern, patchable firewalls • MFA for all external human access • Least-privilege enforcement • Removal of default credentials • Secure-by-design boundary devices Executive

Designing OT Networks to Contain Breaches, Not Pretend They Won’t Happen

Designing OT Networks to Contain Breaches, Not Pretend They Won’t Happen

Assuming perfect prevention is not a strategy. This principle focuses on blast-radius reduction, a concept CISOs understand well. Board-Level Risk Controls • Segmentation and micro-segmentation • Separation of duties • Elimination of flat networks • Restrictions on lateral movement Executive Insight Resilience is defined by how much damage an attacker can

Why CISOs Should Centralize OT Connectivity Before It Becomes Unmanageable

Why CISOs Should Centralize OT Connectivity Before It Becomes Unmanageable

Decentralized connectivity results in fragmented controls, inconsistent monitoring, and invisible risk. The guidance strongly favors centralization and standardization as a strategic control mechanism. CISO Benefits • Fewer ingress points to govern • Consistent enforcement of security policy • Centralized logging and auditability • Simplified third-party risk management A single hardened connectivity pattern is