Episode #15
Billion Dollar Pilots and Boil Water Notices: Securing OT Environments
“The only thing that isn't digital in the Department of War is the bayonet.” That line from DoW CISO Aaron Bishop set the tone for a standing-room panel Brian moderated in Washington, DC, with partners at Armis. In Episode 15 of The GIST of Govt IT, Brian and Sean bring listeners the lessons learned from that breakfast briefing on securing the converged IT, IoT, and OT enterprise — featuring Bishop, Department of Transportation CISO Dr. Justin Ubert, and Armis’ Director of Civilian Strategy Matthew Shelbetter. The conversation digs into the central insight all three panelists shared: the hardest part of convergence isn't the technology, it's the culture. IT security teams and OT operators speak different languages, hold different priorities (availability and safety first), and have to learn to meet in the middle — often starting with nothing more sophisticated than a room, a tabletop exercise, and a lot of pizza and Mountain Dew. Brian and Sean also unpack Bishop's concept of mission-relevant terrain for cybersecurity, why attack path mapping and asset discovery are the foundation, how to pay for OT security when the funding is scattered (identity-for-agents riding on AI budgets, consensus-building at HHS, and Bishop's $1B OT security pilot anchored to a zero trust framework), and why the community — local utilities, mayors, volunteer responders, partners like Dominion Energy — has to be in the room before the house is on fire. Plus, three Monday-morning takeaways straight from the panelists. The Panel & Blog • When the Perimeter Disappears Breakfast Briefing Recap Blog • Aaron Bishop, CISO, Department of War • Dr. Justin Ubert, CISO, Department of Transportation • Matthew Shelbetter, Director of Civilian Strategy, Armis • Armis Federal Policy & Frameworks Referenced • OMB M-26-14 and the CISA Logging Reference Architecture : https://www.whitehouse.gov/omb/memoranda/ • DoD OT Zero Trust Reference Architecture • CISA Zero Trust Maturity Model • GSA “Eliminate, Automate, and Optimize” playbook for AI/agents • NIST SP 800-82 — Guide to Operational Technology Security The Threat Backdrop • CISA advisory on Iranian-affiliated actors targeting water and critical infrastructure • CISA Industrial Control Systems resources • EPA Water and Wastewater cybersecurity resources The Three Monday-Morning Takeaways • Dr. Justin Ubert: Get the disparate teams — red, blue, OT, leadership — in the same room • Matthew Shelbetter: Talk to the operators; educate leadership and frontline managers, then get the right platforms and partners • Aaron Bishop: Start with asset discovery — know what you have, where it is, and who owns it Related Episodes • Episode 14: A Pause, Not a Pass on CMMC • Episode 13: Fed Christmas in July? The OMB M-26-14 Holiday Rush Begins! • Episode 7: Iran Came for the Dams and We Got Lucky: Frontline Insights into the OT Fight Upcoming Events • Upcoming GIST 360 webinars and fall breakfast briefings The Hosts & Show • Swish • GIST 360 CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.
