Two Sides of IT vs. OT Security and ICS Security Operations
Summary: A Dragos blog post argues that OT/ICS security operations require their own people, process, and technology because industrial environments carry a unique mission, unique risks, and unique cyber threats, even as IT and OT converge technically. The author, drawing on Dragos threat work and a SANS ICS515 class that has trained over 1,000 personnel, describes an OT SOC structure that is flipped: Tier 3 staff are decentralized and sit closest to industrial operations rather than centralized as the most senior analysts.
What's compelling: The post notes that enterprise SOC habits like reimaging a host or letting endpoint protection clean an alert without investigation can pose significant risk in ICS, where a known infected system may reasonably wait for a maintenance window. It also states that industrial networks generate more data collection opportunities than enterprise networks once controller events, alarms, and historian data are counted, so the analyst's ability to follow a question across disparate data sets becomes the core skill.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026