:PROPERTIES:
:ID: b9c33bd7-da59-412e-9d25-04e47920d9b6
:END:

#+title: ot-ics-security-ramp/reading-list
#+filetags: :project: :knowledge: :cybersecurity: :reading:

Curated, high-quality cybersecurity resources Aner has found worth reading (and referring others to), surfaced during his [[ot-ics-security-ramp/curriculum]]. Distinct from the daily RSS feed habit — this node is for standalone reports/articles worth keeping, not a recurring feed.

** OT/ICS Security
- [[https://www.sans.org/blog/top-takeaways-from-the-dragos-ot-cybersecurity-report-2026][SANS: Top Takeaways from the Dragos OT Cybersecurity Report 2026]] — free, ungated, substantial summary of Dragos's annual OT threat report. Covers 8 key 2026 OT threat shifts (adversaries staging environments months ahead, targeting HMIs/VFDs/meters/gateways to map process dependencies, initial-access-as-a-service mirroring IT ransomware ecosystems, disruption without ICS-specific payloads, engineering firms/integrators/MSPs as supply-chain targets, hacktivist groups going destructive) and names three threat groups: KAMACITE, SYLVANITE, BAUXITE. Recommended by Aner (2026-09-29) as genuinely good reading — worth recommending to others, not just personal reference. Read 2026-10-06.
- [[https://www.dragos.com/ot-cybersecurity-year-in-review][Dragos 2026 OT Cybersecurity Year in Review]] (full 91-page report + exec summary) — the primary source the SANS writeup above is based on. Gated behind a lead-gen form requiring a phone number; the SANS summary covers the substance without it. Aner decided (2026-10-06) not to read the full report — the SANS summary is sufficient.