OT Cybersecurity Best Practices for Small & Medium Organizations: How to Respond to a Ransomware Attack
Summary: Dragos OT-CERT's monthly guidance for under-resourced organizations recommends that ransomware victims make recovery without paying the ransom their first objective, and that leadership and legal counsel hold a tabletop exercise before an incident to settle questions such as sanctions risk flagged by OFAC, whether to contact law enforcement, and how to purchase cryptocurrency. The guidance notes that OT environments are harder to recover from than IT, that many threat groups avoid attacking a paying victim twice, and that an unremediated vulnerability may still be exploited by a different group. It also recommends exercising scenarios that take out ICS/OT devices such as HMIs and testing the call chain to internal or external IT support.
Bottom line: The decision to pay a ransom is being made under pressure, in an OT environment the guidance describes as harder to recover from than IT, and it carries sanctions exposure that must be checked against OFAC. The call chain and emergency operating procedures are only proven if they are exercised before the HMI goes dark.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026