Threats to industrial control systems change constantly, so we publish short threat briefs in our Insights & blog section and keep this page as a guide to the patterns that repeat and where to find official, current information.
Patterns that keep recurring
- IT first, then OT. Most incidents start with phishing, stolen credentials or an exposed service in the business network, then move into OT through weak segmentation or shared accounts.
- Remote access as the front door. Vendor and engineering remote access, VPNs and remote desktop tools are among the most common routes into control systems.
- Ransomware stopping production. Even when ransomware never reaches the controllers, operators often shut down the process because they can't trust or monitor it.
- Internet-exposed devices. HMIs, PLCs and remote terminal units reachable from the internet, often with default passwords.
- Supply chain. Compromised software updates, engineering tools or contractor laptops bringing malware into the plant.
- Targeting safety and protection systems. Rare but severe, as the TRITON attack on a safety instrumented system showed.
Official sources for current advisories
- International: CISA ICS advisories (United States), widely used for vendor vulnerability notices
- India: CERT-In advisories; CSIRT-Power for the power sector
- Qatar: National Cyber Security Agency (NCSA)
- United Arab Emirates: UAE Cybersecurity Council
- Saudi Arabia: National Cybersecurity Authority (NCA) and its national CERT
- Oman, Kuwait, Bahrain: the national CERT or cybersecurity centre in each country
- United Kingdom: National Cyber Security Centre (NCSC)
- Your vendors: the product security advisories of your control-system suppliers, the most direct source for your installed base
Turning advisories into action
An advisory only matters if you know whether it affects you. That needs an accurate asset inventory, a process to check new advisories against it, and an agreed way to apply patches or compensating controls with your vendor. We help operators set up exactly that process.