**Minnesota Water Cyberattacks: A Reminder That Recovery Readiness Matters**
The cyberattacks reported against more than 30 Minnesota community water systems should concern every organization that operates water, wastewater, building automation, or other operational technology.
The investigation is continuing, and attribution should not be treated as established. However, the operational lesson is already clear:
A cyber incident does not have to contaminate water to become a serious public-service emergency.
When operators lose access to control systems, passwords are changed, communications are disrupted, or automated equipment becomes unavailable, the organization must still be able to operate safely and recover promptly.
Every critical-infrastructure organization should be able to answer:
• What operational technology and control equipment do we have?
• Which systems are remotely accessible or exposed?
• Who—including vendors—can access them?
• Do we have current, offline copies of programs, configurations, and credentials?
• Can personnel operate essential functions manually?
• Have restoration procedures actually been tested?
Cybersecurity is important, but prevention alone is not enough. Resilience also requires preparation for continued operations, controlled recovery, and verified restoration.
This incident is another reminder: if an organization does not know what it has, how it is connected, and how it will be restored, it is not fully prepared.
#OperationalTechnology #WaterSecurity #CriticalInfrastructure #ICS #OTCybersecurity #CyberResilience #RecoveryReadiness
Asset Inventory as the Foundation of Cybersecurity Resilience
Many cybersecurity weaknesses identified in federal oversight reports trace back to a practical but difficult problem: organizations often do not have complete, accurate, current, and usable asset inventories.
This white paper discusses why asset inventory is more than an administrative requirement. It is the foundation for vulnerability management, patch prioritization, incident response, operational risk visibility, and cyber resilience.
It also argues that detailed asset inventories should be protected as sensitive cybersecurity information because, if mishandled, they can become targeting packages.
The full article is included in my blog.
Asset Inventory as the Foundation of Cybersecurity Resilience
Asset Inventory as the Foundation of Cybersecurity Resilience
Lessons from Federal Oversight Reports
Gordon W. Skelton
Security and Analytics, LLC
Organizations cannot effectively protect, prioritize, patch, mitigate, or document what they do not know they have.
Executive Summary
Federal Offices of Inspector General and other oversight organizations have repeatedly identified cybersecurity weaknesses that are tied, directly or indirectly, to incomplete asset visibility, inconsistent inventory management, and difficulty translating cybersecurity requirements into operational action.
Across federal agencies, cybersecurity programs depend on knowing what hardware, software, systems, services, accounts, and technology dependencies exist. Yet recent oversight work continues to show that organizations struggle to maintain complete, accurate, current, and usable inventories. NASA OIG reported that NASA's software asset management capability was at a basic maturity level, and DOT OIG has reported continuing work needed in areas such as mobile device management and continuous monitoring. SBA OIG stated the problem directly: without complete inventories, program officials may not be able to assess and manage cybersecurity threats or reduce vulnerabilities in hardware and software assets. [1], [2], [3], [5]
The issue is not simply whether an organization has an inventory document or database. The more important question is whether the inventory is reliable enough to support cybersecurity decisions. An incomplete or outdated inventory can cause organizations to miss vulnerable systems, underestimate exposure, delay remediation, misprioritize scarce resources, and provide leadership with an inaccurate picture of cyber risk.
In operational environments, including operational technology, industrial control systems, building automation, facilities systems, transportation systems, laboratory systems, and other mission-support systems, the consequences can extend beyond information loss to mission disruption, safety concerns, degraded operations, and loss of public trust.
This paper argues that asset inventory should be treated as a foundational cybersecurity capability, not an administrative afterthought. It should also be protected as sensitive cybersecurity information because a detailed inventory can become a targeting package if mishandled.
Central Thesis
Organizations cannot effectively protect, prioritize, patch, mitigate, or document what they do not know they have.
Federal oversight reports and authoritative cybersecurity guidance demonstrate that weaknesses in asset inventory and system visibility undermine broader cybersecurity outcomes. Asset inventory is therefore not just a compliance artifact. It is the foundation for vulnerability management, operational risk visibility, incident response, and cyber resilience.
Why Asset Inventory Matters
Cybersecurity programs depend on basic but difficult questions: What systems do we have? Where are they located? Who owns them? What software and firmware versions are running? Which systems are exposed? Which systems support critical missions? Which systems are difficult to patch? Which systems are obsolete or unsupported? Which systems are affected by a new vulnerability or advisory?
When these questions cannot be answered quickly and accurately, cybersecurity programs become reactive and incomplete. NIST Cybersecurity Framework 2.0 places asset management under the Identify function and includes outcomes for maintaining inventories of hardware, software, services, and systems. NIST SP 800-53 Rev. 5 control CM-8 requires system component inventories that accurately reflect the system, include all components, avoid duplicate accounting, and provide the level of granularity needed for tracking and reporting. [9], [10]
CISA Binding Operational Directive 23-01 also emphasizes asset visibility and vulnerability detection for federal networks, while CIS Control 1 focuses on actively managing, inventorying, tracking, and correcting enterprise assets so organizations know what must be monitored and protected. [14], [15]
Inventory Is Not Merely a List
A cybersecurity-useful inventory is more than a list of devices. A useful inventory should include enough information to support security decisions.
· Asset name and asset type
· Vendor, product, model, hardware version, firmware version, and software version
· Operating system, protocol, and services
· Location, system, subsystem, and operational relationship
· Owner, criticality, exposure, and network zone
· Lifecycle status, patching constraints, and remote access dependency
· Last reviewed date and verification status
For vulnerability and advisory matching, the most important fields often include vendor, product or model, firmware or software version, asset type, protocol, lifecycle status, and exposure context. Without these fields, an organization may have an inventory that appears complete from an administrative perspective but is still not usable for cybersecurity prioritization.
The Difference Between General Completeness and Security Usefulness
One of the most important lessons is that inventory completeness has multiple levels. An asset record may include a name, location, and owner, but still be missing the fields required to determine whether a vulnerability applies.
Administratively useful field
Cybersecurity matching / prioritization field
Asset name
Vendor and product/model
Location
Firmware or software version
Owner
Protocol and exposed services
Status
Lifecycle status and supportability
Department or facility
Exposure, criticality, and patching constraints
This distinction matters because a record can be useful for facilities management or budgeting while still being incomplete for vulnerability management. The missing fields are often precisely the fields needed to determine whether a new advisory or CVE applies.
Why This Is Difficult for Real Organizations
Maintaining asset inventory is not simple. Many organizations, especially small and medium-sized organizations, state and local agencies, schools, utilities, and facility-heavy organizations, face practical barriers:
· Limited cybersecurity staff and limited OT or BAS security expertise.
· Legacy systems, vendor-managed systems, contractor-maintained equipment, and undocumented changes.
· Incomplete purchase records, old spreadsheets, decentralized ownership, and staff knowledge that has not been captured in a maintained system.
· Operational systems that cannot be easily scanned, systems that are difficult to patch, limited maintenance windows, and safety or mission constraints.
In OT, ICS, BAS, and facilities environments, the problem is even harder because many assets were installed for operational purposes, not cybersecurity manageability. They may have long lifecycles, unusual protocols, limited logging, unclear ownership, and patching constraints.
Vulnerability Management Depends on Inventory Quality
Vulnerability management is often described as a process of identifying, prioritizing, remediating, and documenting vulnerabilities. Each step depends on asset knowledge.
When a new vulnerability is announced, an organization must determine whether it uses the affected vendor, whether it uses the affected product, whether it has the vulnerable version, where the affected technology is installed, whether it is internet-facing or internally exposed, whether it supports a critical mission, whether it can be patched, whether compensating controls are required, who owns remediation, and what evidence shows closure.
Recent oversight reports reinforce the stakes. DOI OIG reported that DOI had a high number of unresolved critical and high-impact vulnerabilities that significantly increased the risk of compromise. GAO reports that it has made more than 4,400 cybersecurity recommendations since 2010 and that more than 730 were not fully implemented as of February 2026. [6], [7]
CISA's current federal vulnerability remediation direction emphasizes risk-based prioritization. Binding Operational Directive 26-04 prioritizes security updates using risk factors including public exposure, known exploitation, exploit automatability, and technical impact. This approach increases the importance of maintaining inventory fields that support prioritization, including vendor, product, version, exposure, criticality, lifecycle status, and remediation constraints. [12], [13]
Patch Management Is Not Always Straightforward
Federal cybersecurity guidance appropriately emphasizes timely patching and remediation. However, real environments include systems that cannot always be patched immediately, including OT controllers, building automation systems, laboratory systems, transportation systems, medical support systems, water and wastewater systems, legacy servers, vendor-managed platforms, and systems requiring scheduled outages.
NIST SP 800-40 Rev. 4 describes enterprise patch management as identifying, prioritizing, acquiring, installing, and verifying patches, updates, and upgrades throughout an organization. It also applies broadly across technology assets, including IT, operational technology, IoT, mobile devices, applications, operating systems, and firmware. [11]
For hard-to-patch systems, risk management may require a mitigation-first workflow: identify affected assets, determine exposure, assess operational consequence, apply compensating controls, document exception rationale, schedule maintenance windows, preserve closure evidence, and track residual risk. This still begins with asset visibility.
Asset Inventory Is Sensitive Information
A detailed inventory can help defenders, but it can also help attackers. A full inventory may reveal system names, vendors, models, firmware versions, software versions, network zones, remote access paths, exposed systems, end-of-life technologies, patching constraints, and operational dependencies.
Because authoritative guidance treats inventory as foundational to cybersecurity management, detailed inventories should also be treated as sensitive cybersecurity information. This is a reasoned conclusion: the same details defenders need for protection can help an attacker understand vendors, versions, locations, exposure, and operational dependencies. [9], [10], [14]
Organizations should protect asset inventory with authentication, role-based access, need-to-know permissions, controlled reporting, redacted reporting, export controls, audit logging, reason-required access, and security event review. Inventory exports should not be treated casually.
Reporting Should Be Controlled
Different audiences need different levels of detail. A cybersecurity engineer may need full technical detail. A manager may need a risk summary. An auditor may need evidence of process and remediation. A vendor may need only limited information about assigned systems.
Organizations should distinguish between full-detail reports and redacted reports. Full-detail reports are intended for authorized internal technical and security use and may include targeting-quality details. Redacted reports are intended for management, audit, oversight, insurance, or limited external discussion and should omit unnecessary targeting-quality details while remaining controlled.
Lessons for Federal Agencies and Other Organizations
· Asset inventory should be treated as a continuous process, not a one-time project.
· Inventory records should be evaluated for cybersecurity usefulness, not merely administrative completeness.
· Vulnerability management should be tied to asset context, including criticality, exposure, lifecycle status, and patching constraints.
· Reporting and export of inventory data should be controlled because the inventory itself is sensitive.
· Leadership should ask whether cybersecurity teams can quickly answer asset-based risk questions, not merely whether an inventory exists.
Practical Recommendations
1. Establish an authoritative asset inventory process.
2. Identify minimum fields needed for vulnerability and advisory matching.
3. Distinguish general inventory fields from cybersecurity matching fields.
4. Track lifecycle status and unsupported technologies.
5. Track ownership and remediation responsibility.
6. Track exposure and remote access context.
7. Include OT, ICS, BAS, facilities, and other nontraditional technology assets.
8. Create workflows for hard-to-patch systems.
9. Document compensating controls and exceptions.
10. Protect the inventory as sensitive cybersecurity information.
11. Use redacted reporting for audiences that do not need full technical detail.
12. Audit sensitive report and export activity.
13. Review inventory completeness regularly.
14. Tie vulnerability remediation evidence back to specific assets.
Conclusion
Federal oversight reports continue to show that cybersecurity programs struggle when they lack complete, accurate, current, and usable asset inventories. The problem is not merely administrative. Asset inventory affects vulnerability management, patching, risk prioritization, incident response, resilience, and leadership visibility.
Organizations cannot protect what they cannot see. They cannot prioritize what they cannot identify. They cannot remediate what they cannot connect to specific assets. And they cannot prove progress without reliable evidence.
Asset inventory should therefore be treated as a foundational cybersecurity capability and protected as sensitive cybersecurity information. The path to better cyber resilience begins with knowing what exists, understanding why it matters, and maintaining the evidence needed to act.
References
[1] NASA Office of Inspector General, NASA's Software Asset Management, Report No. IG-23-008, January 12, 2023. https://oig.nasa.gov/docs/IG-23-008.pdf
[2] U.S. Department of Transportation Office of Inspector General, DOT Is Taking Steps To Manage and Secure Its Mobile Devices, but Further Actions Are Needed, Report No. IT2025018, February 12, 2025. https://www.oig.dot.gov/sites/default/files/library-items/DOT%20Mobile%20Device%20Security_Final%20Report_Final%202.12.25.pdf
[3] U.S. Department of Transportation Office of Inspector General, DOT Uses Continuous Monitoring Tools To Automate Cybersecurity Monitoring But Needs To More Effectively Detect, Prevent, and Report Cybersecurity Threats, September 30, 2024. https://www.oig.dot.gov/sites/default/files/library-items/DOT%20Continuous%20Monitoring%20Tools%20for%20Cybersecurity%20Final%20Report%209-30-24_Redacted_1.pdf
[4] U.S. Department of Transportation Office of Inspector General, Quality Control Review of the Independent Auditor's Report on the Assessment of DOT's Information Security Program and Practices, September 30, 2025. https://www.oig.dot.gov/sites/default/files/library-items/Quality%20Control%20Review%20of%20the%20Independent%20Auditor%27s%20Report%20on%20the%20Assessment%20of%20DOT%27s%20Information%20Security%20Program%20and%20Practices_9.30.25.pdf
[5] Small Business Administration Office of Inspector General, Evaluation of Fiscal Year 2025 Federal Information Security Modernization Act, Report No. 26-10, May 19, 2026. https://www.sba.gov/document/report-26-10-fiscal-year-2025-federal-information-security-modernization-act-fisma
[6] U.S. Department of the Interior Office of Inspector General, The U.S. Department of the Interior Information Systems at Increased Risk Due to Unmitigated Known Vulnerabilities, Report No. 2023-ITA-007, September 17, 2025. https://www.oversight.gov/reports/dois-software-vulnerability-identification-and-remediation-practices-svirp
[7] U.S. Government Accountability Office, Cybersecurity, accessed July 8, 2026. https://www.gao.gov/cybersecurity
[8] U.S. Government Accountability Office, High-Risk Series: Heightened Attention Could Save Billions More and Improve Government Efficiency and Effectiveness, GAO-25-107743, February 25, 2025. https://www.gao.gov/products/gao-25-107743
[9] National Institute of Standards and Technology, The NIST Cybersecurity Framework 2.0, NIST Cybersecurity White Paper 29, February 26, 2024. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
[10] National Institute of Standards and Technology, Security and Privacy Controls for Information Systems and Organizations, NIST Special Publication 800-53 Revision 5. https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-53r5.pdf
[11] National Institute of Standards and Technology, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology, NIST Special Publication 800-40 Revision 4, April 2022. https://csrc.nist.gov/pubs/sp/800/40/r4/final
[12] Cybersecurity and Infrastructure Security Agency, Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
[13] Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog, accessed July 8, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[14] Center for Internet Security, CIS Control 1: Inventory and Control of Enterprise Assets. https://www.cisecurity.org/controls/inventory-and-control-of-enterprise-assets
[15] Cybersecurity and Infrastructure Security Agency, Binding Operational Directive 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022. https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks
Note: This publication avoids discussion of revoked directives and uses CISA Binding Operational Directive 26-04 as the current federal risk-based security update prioritization reference.
Advancing Cybersecurity Through Zero-Trust
Thought I would write a short post encouraging you to begin to investigate Zero-Trust. Many, or almost all security and network professionals will agree that firewalls are not adequate in provide the level of security needed to meet the needs of their businesses. Introduced over 10 years ago by Forrester analyst John Kindervag, the concept of Zero-Trust, is a more layered approach to providing cybersecurity.
The concept behind Zero-Trust is trust no one, no device, and no connection. Essentially this means that all connections must meet the requirements for cybersecurity. An example could be that the connecting end-device does not have the latest security updates. In addition, an user who is authenticated could be unauthorized to access a particular dataset.
As you can see, to employ Zero-Trust there is a lot of work to perform to set it up, and potentially, even more work monitoring and managing the system as move forward in time.
Some of the concepts included in Zero-Trust are:
automation of processes for security
encryption
identity access management
mobile device management
multi-factor authentication
additional concepts and requirements
As you can see, this is not a one step implementation of a software package. Furthermore, a number of the Zero-Trust model rely heavily on the use of cloud computing and cloud services.
I recommend that you conduct a web search and read some of the available articles on the web. Be aware of solutions and arguments that are vendor specific, there may well be multiple vendors and multiple ways in which you can implement Zero-Trust in your organization.
SSCET Presentation New Orleans Sept 13, 2019
I will be making a presentation Friday at the annual SSCET conference held at the University of New Orleans. That presentation focuses on the issue of cybersecurity for SCADA, ICS, and IIoT. I have posted my slides here for you review. Please let me know if you have any comments or would like to further discuss enhancing your cybersecurity.
Thanks,
Gordon
Ransomware Checklist
The attached checklist was created to assist you in determining how well you are prepared to handle ransomware. The primary idea is to make certain that you have well managed backups and that they are both tested and isolated. If you are interested in having training for your employees regarding ransomware and cybersecurity in general, please contact me.
Cyber Range
Laptop Cyber Range - new addition and photo.
Well, my cyber range is up and running. I thought you might to see a photo. It is composed of its own router, a couple of 5 post switches, and a set of laptops. The laptops are System 76 and Lenovo laptops running different versions of Linux (Ubuntu) and Window 8. I can add additional laptops as needed for exercises and testing. The main node for testing is the EC-Council's Storm which is running on a Raspberry PI and a version of Debian. Overall the cyber range is very responsible. I will give more information about the different software packages I have installed in the next blog.
Helpful Information and Websites I have found.
I have been working to expand my knowledge of Linux, networking, cyber security, ethical hacking, and network information gathering. I know there is a lot to learn and realistically one cannot keep all of this information in their brain. For that reason, I will working on gathering information, Websites, blogs, and resources that will help organize that information for myself. Since I am working on that information I am willing to share what I find with you. I am looking for the detail information that will help when scanning, sniffing, interpreting, gathering, and understanding all of the aspects of cyber security, along with how to test for, identify vulnerabilities, and weaknesses in networks, firewalls, routers, applications, Websites, and the rest of the world. (just kidding about the rest of the world!).
Hopefully, this information and resources will assist new and experienced cyber security persons find information that is critical. I find that I spend a lot of time trying to find the answers but in many cases only find others looking for the same answer. I hope that I can assist in reducing the amount of time.
Furthermore, I find that many of the practical guides and books (many used for passing certification exams) don't give enough practical examples with the output of the different commands and software. I will try to include links to examples that I run and explain the detail. This exercise will be just as much of a learning experience for me as it will to aid you.
I will try to post on a regular basis so you can see all that I am learning and you can learn along with me.
Thanks for reading,
Gordon
Cyber Breaches - Human Errors
Recently there have been a number of highly publicized losses of data to hackers. When first presented in the news it appears that hackers have been able to find their way into business data stores by cracking passwords, finding flaws in payment systems, and producing creative attacks. After closer evaluation most of the breaches are a result of human-beings who work for the affected company. Again, no matter how much a company spends on cyber security tools and systems, the true weakness is in the employees who are easily fooled by emails. I received an email the other day from my email provider (at least it said it was from my email provider!). They indicated that a request had been received to terminate my email account. To resolve the issue, I just needed to send in my password to prove that I did not want to close my account. Amazing that anyone would fall for that but apparently, there are senior and junior employees who respond quickly, often with the help of IT. Until we are able to get employees to think and not respond then we will continue to hear about breaches and the failure of cyber security when in reality it is a human error.