Correcting Prevention Bias in Your OT Cyber Incident Response
Summary: Dragos analyzed dozens of cybersecurity standards across ten verticals and found every one biased toward prevention: NIST CSF allocates 60% of controls to Identify and Protect, NIST 800-53 is 95% preventative, and the ISA/IEC 62443 series is 75% prevention. Dragos says this bias explains why OT/ICS asset owners lack detection and response capability, citing an oil and gas architecture review where a 'Permit Any Any' firewall rule named 'temp' had negated segmentation for some time.
Key Takeaway: The standards many OT programs were built on leave roughly a quarter or less of their controls for detection, response, and recovery, so the gap shows up only when preventative controls fail and an operational impact is already visible.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026