The Complex World of Offensive ICS Operations
Summary: Dragos argues that offensive ICS operations are not the simple "bad guy gets in, lights go off" scenario many assume, but complex efforts taking years, money, research, and usually several teams or individuals. The company separates access operations, which exploit a target network, from effects operations, which manipulate industrial devices to deny, degrade, disrupt, or destroy visibility or control of an industrial process, and notes these may not be the same individual, group, or government.
Bottom line: Dragos states that offensive ICS operations are currently limited to states and similarly resourced entities, and that prepositioned access for future contingencies is a clear and present danger even when no disruption is intended. The international legal community has left unanswered whether such effects reach the threshold of "armed force" under the Law of Armed Conflict, which Dragos says could put innocent civilian lives at risk.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026