Process anomalies can be security signals
The operators frequently notice something before security tooling does, because the process behaves oddly.
A valve cycling more than it should, a reading that does not match the physical evidence, a sequence firing at the wrong time. These are security signals as well as engineering ones, and the route for an operator to raise them as a possible security concern usually does not exist.
More on OT and ICS
- A cyber command can have physical consequencesThe keystroke has a lever on the end
- Legacy does not mean unnecessaryOld, and holding the whole line
- Patching OT requires process contextThe patch waits for the plant
- Segmentation protects process zonesBulkheads, not one big hold
- Remote maintenance changes the plant perimeterThe fence now goes round their kitchen table
- Asset discovery must not disrupt fragile systemsListen to it, do not knock on it