CISO Action Plan: Responding to Geopolitical Tensions in Iran
Summary: A former Rockwell Automation CISO recounts building a playbook in January 2020, after a US drone strike killed Iranian Major General Qassem Soleimani, Iranian leaders vowed revenge, DHS warned of potential cyber attacks, and CISA issued alerts urging US businesses and agencies to watch for intrusions. He describes pressing OT security vendors on how they handled the Iran threat, finding one relying only on anomaly detection and doing nothing specific, while Dragos tracked Iran-tied adversary groups and integrated their TTPs and IOCs into its platform.
What's compelling: The author's own conclusion from 2020 was that his plants faced a high risk of already being compromised, and he now advises CISOs to audit defenses and close gaps rather than wait on an OT security platform. If a prior Iran escalation already warranted that posture, the question is which of your OT gaps are still open today.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026