Getting Started in OT/ICS Cybersecurity 2026 (Part 6): How to Build a Secure OT Network

Value of the Information & Strength of the Argument

The information value is high for beginners and intermediate practitioners in OT security. The video provides actionable advice, such as using a simple firewall even in small environments and gradually upgrading, and emphasizes that secure networking is the top control. The argumentation is strong: it logically builds from a flat network weakness, to basic firewall, to more sophisticated segmentation, underlining the principle of least privilege. Real-world incidents are used effectively to demonstrate cascading failures and dependencies between IT and OT. The discussion of industrial firewalls (Tofino, MGuard) and modern IT firewalls (Palo Alto) with OT protocol awareness adds technical depth. The section on data diodes and unidirectional gateways clarifies physical enforcement options. Overall, the lecture is coherent, persuasive, and grounded in industry standards and documented events.

Scientific Rigor, Source Quality, Title Accuracy

The speaker demonstrates solid expertise, referencing recognized models (Purdue, ISA/IEC 62443) and real cyber incidents. However, no academic or authoritative sources are explicitly cited in the video or description; the provided links lead to the author’s own course and website. The incidents (JLR, Port of Nagoya, Ukraine) are described without external validation, and while they are widely reported, exact details are not verified. The title accurately reflects content. The video is didactic, respecting a structured curriculum, and avoids sensationalism. The lack of formal citations is typical of practical training, but for a critical evaluation it slightly lowers the scientific rigor score.

Perfectly aligned: the title promises a practical guide to secure OT network design, and the video delivers exactly that covering firewalls, DMZ, ACLs, segmentation, and remote access.

8/10

The video is well-structured, uses real-world incidents (Jaguar Land Rover, Port of Nagoya, 2025 Ukraine substation attack) and references industry standards (ISA/IEC 62443, Purdue Model). The content is practical and aligns with mainstream OT security best practices, though some claims (e.g., specific attack details) lack formal citations.

• 00:00The Escalating Threat to OT: Why industrial attacks are increasing and the danger of flat, unsegmented networks.
• 12:19Cascading Failures: Lessons from the Jaguar Land Rover and Port of Nagoya ransomware incidents.
• 19:15The Expanded Purdue Model: Utilizing Level 3.5 to build an effective IT/OT DMZ.
• 25:03Firewall Fundamentals: Packet filtering, stateful inspection, deep packet inspection, and why network switches are not security appliances.
• 34:00Restrictive ACLs: Walking through standard Cisco Access Control Lists and enforcing the principle of least privilege. 58:54 - Physical Traffic Enforcement: The difference between Data Diodes and Unidirectional Gateways.
• 1:03:28Zones & Conduits: Applying the ISA/IEC 62443 methodology to map out internal plant communications.
• 1:15:48East-West Traffic: Implementing microsegmentation to prevent lateral movement within a single zone.
• 1:20:40The Remote Access Risk: Analyzing the December 2025 Russian attack on Ukrainian substations via internet-facing Fortinet VPNs.
• 1:28:33The 5 Pillars of Secure Remote Access (SRA): How to lock down vendor connections using jump boxes, MFA, just-in-time access, and session recording.

• Getting Started in OT/ICS Cybersecurity (OnDemand) — The author's paid course for deeper practice.
• Mike Holcomb - OT/ICS Cybersecurity Resources — Official website offering free resources and newsletter.
• Mike Holcomb - Higher Ed and Technical Content — Alternative URL pointing to the same site.