che_march-2025 - 33

Concluding remarks
May 2009, www.cisa.gov/sites/default/files/publications/cfatsrbps-guidance_508.pdf
The
convergence of IT and OT is a
double-edged sword. While it offers
transformative benefits, it also
exposes organizations to significant
cybersecurity risks. Protecting these
interconnected systems requires a
holistic approach that bridges the
gap between IT and OT priorities,
technologies and cultures. Cyberattacks
against critical infrastructure will
continue to evolve in their pervasiveness
and sophistication. The examples
here are indicators of what organizations
should bear in mind as they
build resilience in their infrastructure.
Organizations must invest in advanced
security technologies, workforce
development and collaborative
initiatives to navigate this complex
landscape. By adopting proactive cybersecurity
strategies and leveraging
industry standards, they can harness
the potential of IT-OT convergence
while safeguarding their operations,
customers and communities. As industries
continue to evolve, cybersecurity
must remain a cornerstone of
IT-OT integration efforts. The stakes
are high, but so are the rewards for
those who get it right.
n
Edited by Scott Jenkins
References
1. Computer Security Resource Center, Glossary, NIST, csrc.nist.
gov/glossary, term definition.
2. Computer Security Resource Center, Glossary, NIST, csrc.nist.
gov/glossary https://csrc.nist.gov/glossary, term definition.
3. Palo Alto Networks, State of OT Security 2024, report, www.
paloaltonetworks.com/resources/research, 2024.
4. Cybersecurity and Infrastructure Agency (CISA), Critical Infrastructure
Security and Resilience, Guidance, www.cisa.gov/
topics, accessed January 2025.
5. Hay-Newman, L. Under Trump, U.S. Cyberdefense Loses its
head, Wired magazine, Jan. 23, 2025.
6. Greig, J., CISA confirms hackers may have accessed data from
chemical facilities, The Record, fom Recorded Future News,
June 24, 2024.
7. McGinnis, D., What is thte 4th industrial revolution, Salesforce
blog, July 5, 2023.
8. Computer Security Resource Center, Glossary, NIST, csrc.nist.
gov/glossary, term definition.
9. Kushner, D., The Real Story of Stuxnet, IEEE Spectrum, February
2013, www.ieee.org
10. Palo Alto Networks, State of OT Security 2024, report, www.
paloaltonetworks.com/resources/research, 2024.
11. Crowdstrike Inc., Threat Hunting Report, 2024, www.crowdstrike.com,
2024.
12. U.S.
Government Accountability Office (GAO),
Cyberattack demands significant
Solarwinds
federal and private-sector
response, Blog post, April 22, 2021, www.gao.gov/blog.
13. Bleeping Computer LLC, News, Chemical distributor pays 44
million to darkside ransomware, www.bleepingcomputer.com.
14. Fisher, W. and others, Data Confidentiality, National Institute of
Standards and Technology, Special Publication 1800-28, February
2024.
15. CISA, Russian Military Cyber Actors Target U.S. and Global
Critical Infrastructure, Cybersecurity Advisory Notice, Sept. 5,
2024. www.cisa.gov.
16. CISA, Risk-Based Performance Standards Guidance, CFATS,
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
For details visit adlinks.chemengonline.com/88112-12
MARCH 2025
33
17. Idaho State University, Industrial Cybersecurity Engineering
Technology Program, www.isu.edu/industrialcybersecurity/
18. Duke University, Industrial Security Certificate Program, cisoeducation.duke.edu/industrial-security-program/
19.
Matishak, M., DHS asked to consider potentially devastating
impact of hacks on rural water systems, The Record from Recorded
Future News, April 25, 2024.
20. Gallagher, G. and others, Clorox audit flagged systemic flaws in
cybersecurity at manufacturing plants, March 26, 2023.
21. Homeland Security Digital Library (HSDL), Timeline, 2021 Colonial
Pipeline Ransomware Attack, www.hsdl.org.
22. U.S. Federal Bureau of Investigation (FBI) Cyber Division,Private
Industry Notification, March 24, 2022. www.ic3.gov.
23. Zetter, K., Inside the Cunning Hack on Ukraine's Power Grid,
Wired magazine, March 3, 2016.
24. Rose, S. and others, Zero Trust Architecture, NIST Special Publication
800-207, August 2020.
25. IBM, What is the Internet of Things, web post, May 12, 2023,
www.ibm.com/think/.
26. International Electrotechnical Commission (IEC) Standard
62443, www.iec.ch.
27. National Council on ISACs, www.nationalisacs.org.
28. American Chemistry Council, Chemical Information Technology
Center (ChemITC), www.americanchemistry.com.
29. CISA, Cyber Threat Information Sharing, www.cisa.gov.
Authors
Art Ehuan is the executive director
and adjunct professor of the Duke
University Master of Engineering in
Cybersecurity program and the
Duke Chief Information Security Officer
(CISO) Executive Certificate
program (3459 Fitzpatrick Center,
Durham, NC 27708; Email: ehuan.
arturo@duke.edu; Phone:
571331-7763).
Ehuan was previously a vice president of Palo
Alto Networks, Unit 42 Security Consulting practice. He
joined PAN after running the Global Cyber Risk Services
practice at the global professional services firm Alvarez &
Marsal. Ehuan was previously a CISO for a Fortune 200
financial/insurance services firm and has served as an
interim CISO for several organizations. Ehuan served as a
lecturer for the U.S. State Department's Anti-Terrorism
Assistance Cyber Training Program and has worked as a
Supervisory Special Agent with the FBI and a Special
Agent for the U.S. Air Force Office of Special Investigations.
He has been retained as an expert on several
prominent data breaches.
Gurdeep Kaur is the global industry
lead and CXO advisor at DigitalXForce
(578 Kimball
Ave.,
Southlake, TX 76092; Email: gukaur2012@gmail.com).
Previously,
she served as CISO at PSEG, where
she led cybersecurity risk management
and compliance across IT
and OT environments. Before that,
she held leadership roles at Horizon
BCBSNJ and AIG, with a focus on cybersecurity compliance
and security architecture, including spearheading
the development of a comprehensive security framework.
Kaur serves on the Technology and Data Governance
Committee for the Board of Hackensack Meridian Health
and is the Energy Sector Chief for the InfraGard NJ Chapter.
She previously served as co-founder and president of
the ISC2 New Jersey Chapter, co-chair of the ISC2 North
American Advisory Council, and a member of the Cloud
Security Alliance (CSA) Global Enterprise Advisory
Board. She holds a bachelor's degree in electrical engineering
from Delhi College of Engineering (India), along
with multiple security certifications, including CISSPISSAP
and NIST Cybersecurity Practitioner.

http://www.cisa.gov/sites/default/files/publications/cfats-rbps-guidance_508.pdf http://www.isu.edu/industrialcybersecurity/ http://education.duke.edu/industrial-security-program/ http://www.hsdl.org http://www.ic3.gov http://www.ibm.com/think/ http://www.iec.ch http://www.nationalisacs.org http://www.americanchemistry.com http://www.cisa.gov http://ehuan.arturo@duke.edu http://adlinks.chemengonline.com/88112-12 https://csrc.nist.gov/glossary http://www.paloaltonetworks.com/resources/research http://www.cisa.gov/topics http://www.ieee.org http://www.paloaltonetworks.com/resources/research http://www.crowdstrike.com http://www.strike.com http://www.gao.gov/blog http://www.bleepingcomputer.com http://www.cisa.gov http://WWW.CHEMENGONLINE.COM

che_march-2025

Table of Contents for the Digital Edition of che_march-2025