The False Choice of IT Vs. OT
Summary: Dragos argues that the 'IT versus OT' debate, including the position its own Ben Miller took at S4x18, sets up a false choice, because IT-OT convergence means IT-centric attack paths are becoming OT problems. The post cites CRASHOVERRIDE, which blended IT tools with ICS-specific knowledge to target electric transmission equipment, and TRISIS, where a failure to identify attackers led to multiple disruptive events by the same adversary in the same facility.
What's compelling: Dragos states that IT-centric tools tuned to enterprise Windows environments are not only inadequate for diagnosing ICS events but completely lack awareness of their significance and impact, and that applying IT practices such as endpoint agents or IPS to control systems can violate vendor warranties or disrupt safety systems. The TRISIS case shows the cost: missed attacker identification and repeated disruptive events in the same facility.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026