מאמרים  מאת יוסי שביט #CYBER OT

THE DEFENDER CAN BECOME THE ATTACKER

Cybersecurity incident response in traditional IT environments is generally built around a clear objective: detect the threat, contain it, eradicate it, and restore normal operations. Actions such as disconnecting a compromised computer, blocking malicious communication, disabling an account, or shutting down a suspicious process are often considered standard defensive measures. In Operational Technology (OT) environments, however, the situation is fundamentally different. An OT network does not exist only to process information. It controls and monitors physical processes. Behind every PLC, SCADA server, HMI, engineering workstation, sensor and communication link there may be pumps, motors, valves, heaters, compressors, chemical processes and other physical equipment. As a result, a cybersecurity response that is technically correct from an IT perspective may create an unexpected and potentially dangerous consequence in the physical environment. This leads to a critical principle: In OT, stopping the cyber threat must not create a greater operational or safety threat. The challenge is therefore not simply to stop the attacker, but to stop the attacker without destabilizing the process being protected. Yosi