Purple Teaming ICS Networks: Part 3 of 3
Summary: This final part of Dragos's three-part ICS purple teaming series describes how a purple team assessment is run: constant, transparent communication with operations reduces the risk of operational disturbance and limits blame for unrelated site outages, while close real-time work with the Blue Team lets the team validate event collection and detection by running enumerations, attacks, network pivots and privilege escalations multiple times and capturing PCAPs. The author notes that operations teams spend years learning their plant's process rhythm, PLC and HMI code, and network and serial connections, while an assessment team has only a one-week or multi-week window, and recommends documenting a clear objective statement, each tactic and its detection outcome, and a final report of Blue Team gaps and ICS vulnerabilities.
What's compelling: An assessment team gets a one-week or multi-week window into a system that operators spend years learning, so the findings depend on how much of that operational knowledge is actually shared - and the report's value rests on documenting each tactic's detection success or failure rather than assuming the controls worked.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026