Software and Supply Chain Security Can't Be an Afterthought in xOT Anymore
Summary: Dragos argues that software and supply chain risk has sat at the bottom of xOT security priorities while the firmware and code beneath every networked asset became the attack surface attackers understand best. It cites three shifts: AI-assisted development shipping more compiled code with less human review, a 2024 attempt to slip a backdoor into widely used infrastructure software via a compromised open-source maintainer (caught by one engineer noticing a login taking 500 milliseconds too long), and regulators including NERC CIP, NIS2, and TSA pipeline directives now asking what is inside a device rather than only where it sits.
What you should know: A vulnerable dependency in a web app is fixed with a deploy, but one baked into a decade-old PLC firmware image waits for the next planned outage, if there is one - and a device can be fully inventoried and monitored while still running a hardcoded credential or an abandoned library that no scan or detection rule will surface until it is used against you.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026