Uploaded August 2025 | Updated September 2026, 1 week ago
The OT security community has strong views, and disagreements, on the value of attribution. The question for asset owners is: are you using attribution effectively?
If attribution means simply "Russia" then it's probably not that helpful. If you can go deeper into the threat actor and their tradecraft and TTPs it could make a big difference in the decisions you make in your OT security program. For example, what it means for an attack to be attibuted to APT28 vs APT44 could make a big difference.
Steve dived into what asset owners should look for in attribution and how they should and shouldn't use attribution to guide their OT security actions and cyber risk management.
Subscribe to Dale’s ICS Security: Friday News & Notes email here:
friday.dale-peterson.com/signup
Check out S4x26. Feb 23 - 26 in Miami South Beach:
s4xevents.com
The OT security community has strong views, and disagreements, on the value of attribution. The question for asset owners is: are you using attribution effectively?
If attribution means simply "Russia" then it's probably not that helpful. If you can go deeper into the threat actor and their tradecraft and TTPs it could make a big difference in the decisions you make in your OT security program. For example, what it means for an attack to be attibuted to APT28 vs APT44 could make a big difference.
Steve dived into what asset owners should look for in attribution and how they should and shouldn't use attribution to guide their OT security actions and cyber risk management.
Subscribe to Dale’s ICS Security: Friday News & Notes email here:
friday.dale-peterson.com/signup
Check out S4x26. Feb 23 - 26 in Miami South Beach:
s4xevents.com
