Purple Teaming ICS Networks: Part 1 of 3
Summary: A Dragos Threat Operations Center analyst describes ICS Purple Teaming as a grey-box, collaborative assessment between Red and Blue Teams rather than a black-box adversarial test, with the ICS Blue Team including the site Operations, Engineering and IT teams alongside the cybersecurity team. The post notes that activity groups can dwell in ICS networks for years - XENOTIME's dwell time enabled its TRISIS safety-system malware - while these assessments typically run only a week, and that Purple Teaming is not suited to organizations lacking basic collection, detection and response maturity.
What you should know: The gap the post names is time: attackers can hold an ICS network for years while an assessment gets a week, so the defenders who know the plant - Operations and Engineering, not just security - are the ones who have to be in the room.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026