Purple Teaming ICS Networks: Part 2 of 3
Summary: In the second part of a three-part series on ICS purple teaming, Dragos describes how assessments of operating ICS networks differ from IT assessments because safety and reliability take precedence, with many sites barring any packets on Purdue Level 1 or Level 2 networks and passive collection used instead. The post also covers identifying Crown Jewel assets, such as custody transfer metering systems at an oil and gas site, and notes that communication overhead and resource coordination can consume up to a third of time on site.
Why it matters: At an oil and gas site, losing a custody transfer meter can halt the entire facility while losing a few disposal wells may not matter in the short term, so an assessment that treats every asset the same misdirects scarce attention. And with coordination eating up to a third of on-site time, the schedule a security leader approves is not the schedule the team will work.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026