Topic

cybersecurity

All articles on cybersecurity.

OT network traffic baseline chart with anomalous deviations highlighted and a maintenance-window calendar

Cybersecurity

Anomaly detection in OT: building the baseline and managing false positives

OT networks are repetitive and predictable, in theory the ideal environment for anomaly detection. In practice, legitimate-but-anomalous behavior generates a false-positive noise that is the main cause of failure for industrial monitoring projects.

5 min read

Industrial OT and IoT devices subject to the obligations of the Cyber Resilience Act

Regulations

Cyber Resilience Act: What Changes for OT and IoT Device Manufacturers

The Cyber Resilience Act introduces security obligations for manufacturers of products with digital elements. For OT and IoT device makers, the compliance scope is broad and the deadlines are approaching.

3 min read

Vulnerability management dashboard showing CVE and EPSS scores on an industrial OT system screen

Cybersecurity

CVE and EPSS in OT Environments: Which Vulnerabilities to Fix When You Can't Patch Everything

Patching everything in an OT environment is impossible. CVSS alone is not enough to set priorities. EPSS adds the missing dimension: the probability that a vulnerability is being actively exploited today.

6 min read

Industrial HMI login screen with the password field highlighted, a manufacturing plant in the background

Cybersecurity

Default credentials in OT systems: a more widespread problem than you might think

Admin/admin, 1234, the vendor's factory credentials: how many OT installations still have access protected by default passwords? More than you would expect. How it happens, how attackers find it, and how to fix it without stopping production.

6 min read

Flat industrial OT network without segmentation, with heterogeneous devices and undocumented connections

Cybersecurity

Flat OT Networks: Why Most Factories Don't Know What's on Their Network

In Italian manufacturing SMEs the OT network is often a flat network with no up-to-date inventory. Unknown devices, undocumented expansions, knowledge held only in the technician's head: any industrial security project starts with understanding what's on the network.

6 min read

Industrial network diagram with colored security zones and conduits between them

Compliance

IEC 62443 zones and conduits: how to apply it to a real plant without a year of consulting

IEC 62443 is often seen as out of reach for SMEs. Yet zones and conduits are practical tools you can apply to real plants, starting from visibility and reaching formal segmentation step by step.

5 min read

Architectural diagram of an Industrial DMZ with a dual-homed firewall, historian replica and jump server between the IT network and the OT network

Cybersecurity

Industrial DMZ: How to Design the Boundary Zone Between IT and OT Networks

The industrial DMZ is the architectural layer that separates IT and OT and manages data flows between the two worlds. Designing it well is the difference between a secure connection and a direct path to the heart of the production network.

5 min read

Network diagram showing an attacker's path from the IT segment to the OT segment through jump servers and industrial networks

Cybersecurity

How Attackers Cross the IT-OT Boundary: Techniques and Detection Signals

The pivot from IT into the OT network is the critical phase of nearly every documented industrial attack. Understanding the techniques used to cross this boundary is the first step to detecting it early.

6 min read

Matrix diagram of the MITRE ATT&CK for ICS framework with techniques highlighted over an industrial SCADA background

Cybersecurity

MITRE ATT&CK for ICS: How to Use It to Build Concrete Detection Rules

MITRE ATT&CK for ICS is not a document to skim once and file away. Turning its techniques into concrete detection rules means knowing what you can really see on your network and what stays out of reach without endpoint visibility.

5 min read

OT network diagram with a passive sensor on a TAP and an out-of-band monitoring architecture

Cybersecurity OT

NDR for OT Environments: Why Passive Monitoring Is the Only Safe Architecture

Placing an inline monitoring system between SCADA and PLC introduces latency that industrial systems cannot tolerate. The right answer is passive out-of-band monitoring, with isolation and network changes as the response tool.

5 min read

Audit document with technical evidence and OT system logs on screen

Compliance

How to Prove NIS2 Compliance in an Audit: The Technical Evidence That Really Counts

NIS2 is not proven with policies: it is proven with technical evidence. What auditors look for in an OT audit, how to prepare evidence before they arrive, and the role of continuous monitoring as documentary proof.

6 min read

NIS2 notification timeline diagram showing the 24-hour and 72-hour windows, evidence documents and CSIRT-IT contacts

Cybersecurity

OT incident notification under NIS2: obligations, timelines and what to have ready before it happens

NIS2 sets tight deadlines for notifying significant incidents: 24 hours for the early warning, 72 hours for the detailed notification. In OT, being ready to meet them takes preparation that starts long before the incident.

6 min read