Industrial Talk/BCC is talking to Cesar Tascon, Cybersecurity Partner with EY about "OT / ICS - cyber physical and critical infrastructure security".
Overview
The discussion focused on adapting cybersecurity to connected operational technology while protecting safe, continuous operations.
OT Risk and Approach
OT security prioritizes availability and safety; outages can disrupt essential services or cause physical harm.
Security must fit each organization’s assets, structure, and risk tolerance. Prioritize critical scenarios, contain incidents, and scale controls to asset criticality.
Treat cybersecurity as an ongoing business process, with asset inventories, consistent practices, and rapid detection and response.
People and Emerging Risks
Introduce changes incrementally with operators, integrating security into existing workflows rather than imposing disruptive processes.
OT security ownership depends on the organization; IT and OT responsibilities should align with its operating model.
Regulations can overlap and differ in terminology. AI may strengthen attacks but also help analysts review alerts and respond faster.
How should each organization assign OT security responsibilities? The transcript identifies no universal model.
Outline
OT Cybersecurity Context
Connected devices and remote operations create significant business benefits, but expand cyber exposure.
OT security differs from IT: availability and safety are central concerns, alongside confidentiality.
Risk Assessment and Controls
Assess assets, organizational structure, operational constraints, threats, and potential impacts before choosing controls.
Prioritize critical facilities and prevent incidents from spreading across sites.
Maintain asset and software information, responsibilities, backups, and restoration processes; use standards such as NIST and IEC 62443 as applicable.
Operating Model and Change
Assign security responsibilities according to the organization’s structure; there is no one-size-fits-all IT/OT ownership model.
Involve operators and add security requirements to existing workflows to reduce resistance and preserve operations.
Regulation and Shared Threats
EU regulation promotes protection but may create complexity through overlapping requirements and inconsistent terminology.
Coordinate across vendors, peers, sectors, and governments to address supply-chain and shared infrastructure risks.
AI in Cybersecurity
AI can make attacks and social engineering more convincing and scalable.
Defensive uses include helping analysts process alerts and freeing time for incident response.
If interested in being on the Industrial Talk show, simply contact us and let's have a quick conversation.
Finally, get your exclusive free access to the Industrial Academy and a series on “Why You Need To Podcast” for Greater Success in 2026. All links designed for keeping you current in this rapidly changing Industrial Market. Learn! Grow! Enjoy!
CESAR TASCON'S CONTACT INFORMATION:
Personal LinkedIn: https://www.linkedin.com/in/c%C3%A9sar-tasc%C3%B3n-1198973/
Company LinkedIn: https://www.linkedin.com/company/ernstandyoung/
Company Website: https://www.ey.com/en_gl
1
