Topic
All articles on cybersecurity.
Cybersecurity
OT networks are repetitive and predictable, in theory the ideal environment for anomaly detection. In practice, legitimate-but-anomalous behavior generates a false-positive noise that is the main cause of failure for industrial monitoring projects.
Regulations
The Cyber Resilience Act introduces security obligations for manufacturers of products with digital elements. For OT and IoT device makers, the compliance scope is broad and the deadlines are approaching.
Cybersecurity
Patching everything in an OT environment is impossible. CVSS alone is not enough to set priorities. EPSS adds the missing dimension: the probability that a vulnerability is being actively exploited today.
Cybersecurity
Admin/admin, 1234, the vendor's factory credentials: how many OT installations still have access protected by default passwords? More than you would expect. How it happens, how attackers find it, and how to fix it without stopping production.
Cybersecurity
In Italian manufacturing SMEs the OT network is often a flat network with no up-to-date inventory. Unknown devices, undocumented expansions, knowledge held only in the technician's head: any industrial security project starts with understanding what's on the network.
Compliance
IEC 62443 is often seen as out of reach for SMEs. Yet zones and conduits are practical tools you can apply to real plants, starting from visibility and reaching formal segmentation step by step.
Cybersecurity
The pivot from IT into the OT network is the critical phase of nearly every documented industrial attack. Understanding the techniques used to cross this boundary is the first step to detecting it early.
Cybersecurity
MITRE ATT&CK for ICS is not a document to skim once and file away. Turning its techniques into concrete detection rules means knowing what you can really see on your network and what stays out of reach without endpoint visibility.
Cybersecurity OT
Placing an inline monitoring system between SCADA and PLC introduces latency that industrial systems cannot tolerate. The right answer is passive out-of-band monitoring, with isolation and network changes as the response tool.
Compliance
NIS2 is not proven with policies: it is proven with technical evidence. What auditors look for in an OT audit, how to prepare evidence before they arrive, and the role of continuous monitoring as documentary proof.
Cybersecurity
NIS2 sets tight deadlines for notifying significant incidents: 24 hours for the early warning, 72 hours for the detailed notification. In OT, being ready to meet them takes preparation that starts long before the incident.
Compliance
NIS2 is not just for large companies. Manufacturing SMEs within scope have concrete obligations: OT asset inventory, vulnerability management, detection, incident notification. A practical checklist.
Compliance
NIST CSF 2.0 adds the Govern function to the original five. How to map OT capabilities onto the framework's six functions and use it as a self-assessment tool and roadmap to prioritize industrial security investments.
Cybersecurity
OPC-UA is the de facto standard for communication in modern SCADA systems, but it is often deployed with degraded security settings for legacy client compatibility. Here is what shows up in the traffic and what an attacker can exploit.
Business Continuity
Operational resilience and cybersecurity are not separate programs: one without the other is incomplete. How to integrate ISO 22301 and IEC 62443 into a coherent approach for critical infrastructure.
Cybersecurity
Before launching an attack, threat actors look for publicly available information about their targets. Shodan, Censys and other OSINT tools can find OT systems exposed on the internet in seconds. Understanding what they see is the first step to reducing your own exposure.
Cybersecurity
An OT network assessment is not a vulnerability scan run on corporate IT. Different methodology, different risks, and often surprising results: here is what to expect from a properly conducted industrial assessment.
Cybersecurity
Management wants numbers. But which OT metrics communicate real risk instead of mere compliance? How to build a dashboard of KPIs and KRIs that speaks of potential downtime, not checklists.
Cybersecurity
Automotive is among the sectors most exposed to OT attacks: robotic lines with proprietary protocols, MES/ERP integration and vendor remote access create a wide, hard-to-control attack surface.
Risk Management
The OT cybersecurity budget is often an afterthought next to IT, even when operational risk is far higher. How to build a convincing business case and measure the ROI of industrial security investments.
Cybersecurity
In the chemical industry a cyber incident can cause the release of hazardous substances, explosions and harm to people. Safety/security convergence is no abstraction: the Triton attack on Safety Instrumented Systems proved the last physical line of defense can be compromised.
Cybersecurity
Italian food & beverage has a wide, poorly protected OT attack surface: dosing lines, digital HACCP systems, connected cold rooms for traceability. An OT attack here can compromise food safety and brand reputation.
Cybersecurity
Modern automated warehouses run complex OT networks: a WMS wired to the automation, heterogeneous PLCs from many vendors, AGVs and mixed protocols. High turnover and frequent vendor work break segmentation, and downtime hits the supply chain instantly.
Cybersecurity
IT incident response playbooks do not work in OT. Isolating a compromised system can halt production; powering off a device can cause physical damage. How to build OT IR that actually works.
Cybersecurity
Local utilities (water operators, power distributors, waste treatment plants) are NIS2-regulated entities with security resources close to zero. SCADA systems 15 to 20 years old connected to the internet, run by a single technician: how to set up OT security from this starting point.
Cybersecurity
PLCs with 2008 firmware, HMIs running embedded Windows XP, systems that cannot be touched by contract: the reality of Italian plants. How to manage risk when patching is not an option.
Cybersecurity
OT network topology often lives only in a technician's head, or in a 2014 diagram that was never updated. Rebuilding it from scratch with passive traffic monitoring: why it is necessary and how it is done in practice.
Cybersecurity
A practical four-level framework to assess OT security maturity and build a concrete roadmap. Each level has clear prerequisites, measurable goals and a defined next step.
Cybersecurity
Many companies already run a SIEM or a managed SOC, but these systems are blind to OT. How to feed OT monitoring events into the SOC, which formats to use and which alerts to escalate.
Cybersecurity
An IT SOC cannot see OT environments. Building monitoring capabilities for industrial networks requires different sensors, different skills, and playbooks specific to OT protocols and threats.
Cybersecurity
In OT environments, traditional patch management is often impossible. Legacy systems, certifications to maintain, very rare maintenance windows: how to build a VM program that actually works.
Cybersecurity
Sandworm is known for shutting off the lights in Ukraine and launching NotPetya. But its techniques are being replicated against European manufacturing, often as collateral damage. How an APT attack on an industrial OT network works and why SMEs are within range too.
Cybersecurity
Industrial process historians collect data from PLCs and expose it to business systems. This makes them a natural bridge between IT and OT, and a prime vector for lateral movement.
Cybersecurity
Maintenance laptops left connected, 4G modems installed by vendors, uncatalogued switches: shadow devices in OT networks are more common than you think and represent concrete blind spots for security.
Cybersecurity
Supply chain attacks are among the hardest to detect and prevent. In industrial OT, the supplier chain is often long, poorly monitored, and holds privileged access to control systems.
Cybersecurity
Passive OT traffic monitoring depends on where and how traffic is captured. Hardware TAPs and SPAN ports have very different characteristics in industrial environments: a wrong choice means incomplete data or operational risks.
Cybersecurity
Triton/TRISIS is the first documented malware designed to disable Safety Instrumented Systems — the systems that prevent physical industrial accidents. Its impact goes beyond the targeted plant: it changes the perimeter of what must be monitored.
Cybersecurity
The industrial DMZ is the architectural layer that separates IT and OT and manages data flows between the two worlds. Designing it well is the difference between a secure connection and a direct path to the heart of the production network.
Regulations
The NIS2 directive has been transposed: what matters now is what to do in practice. From entity classification to OT asset visibility, an operational checklist.
Risk Management
How to translate cyber risk on industrial systems into business language and bring it to the boardroom table.
