4.2 KiB
4.2 KiB
ot-ics-security-ramp/reading-list
Curated, high-quality cybersecurity resources Aner has found worth reading (and referring others to), surfaced during his ot-ics-security-ramp/curriculum. Distinct from the daily RSS feed habit — this node is for standalone reports/articles worth keeping, not a recurring feed.
OT/ICS Security
- SANS: Top Takeaways from the Dragos OT Cybersecurity Report 2026 — free, ungated, substantial summary of Dragos's annual OT threat report. Covers 8 key 2026 OT threat shifts (adversaries staging environments months ahead, targeting HMIs/VFDs/meters/gateways to map process dependencies, initial-access-as-a-service mirroring IT ransomware ecosystems, disruption without ICS-specific payloads, engineering firms/integrators/MSPs as supply-chain targets, hacktivist groups going destructive) and names three threat groups: KAMACITE, SYLVANITE, BAUXITE. Recommended by Aner (2026-09-29) as genuinely good reading — worth recommending to others, not just personal reference. Read 2026-10-06.
- Dragos 2026 OT Cybersecurity Year in Review (full 91-page report + exec summary) — the primary source the SANS writeup above is based on. Gated behind a lead-gen form requiring a phone number; the SANS summary covers the substance without it. Aner decided (2026-10-06) not to read the full report — the SANS summary is sufficient.
Protocol / Network Deep-Dives
- NSA/CISA CSI: Reducing the Risk of SNMP Abuse (2026-07-09) — joint US government cybersecurity advisory on SNMP abuse specifically in critical-infrastructure contexts. Covers v1/v2c plaintext community-string exposure, GET-based network/device-inventory reconnaissance, SET-based config tampering, and cites the Russian FSB Center 16 campaign that exfiltrated router configs (VPN configs, SCADA-network routing, credentials) from critical-infrastructure perimeter routers via SNMP + Cisco Smart Install — a real-world OT-relevant case study. Read 2026-10-09.
- RedBot Security: Examining the Modbus Protocol Through an Offensive-Security Lens — offensive/pentester-oriented deep-dive on Modbus TCP: function-code abuse, lack of auth/encryption/integrity, replay/MITM/DoS/command-injection patterns. Complements the FrostyGoop (2024) case study — malware that injected Modbus TCP commands to disable heating in Ukrainian apartment buildings, the modern successor to VPNFilter's 2018 Modbus traffic sniffing. Queued for review 2026-10-06.
- Vulnerability and Impact Analysis of the IEC 61850 GOOSE Protocol in the Smart Grid (open-access journal paper) — experimental analysis of GOOSE pub-sub weaknesses, showing an attacker with substation-network familiarity can falsify messages affecting real physical grid operation; covers why many vendor IEDs still ship without IEC 62351-6 encryption/signing since the overhead can exceed the end-to-end latency budget. Queued for review 2026-10-06.
- Claroty Team82: OPC UA Deep Dive — A Complete Guide to the OPC UA Attack Surface — comprehensive attack-surface writeup from an OT security vendor's research team; relevant given current data (2026) showing over half of internet-exposed OPC-UA servers allow unauthenticated access and ~80% transmit in plaintext despite the protocol's built-in security options existing — "Security Policy: None" being valid and widely left set. Read 2026-10-12 — 10-part series covering protocol history, data model, HEL/OPN/MSG/CLO mechanics + SecureChannel/Session security model, supply-chain risk (529 products on a handful of shared SDKs), the ~50-vuln exploit framework, DoS/client-RCE/integration-server case studies, and asset-owner mitigations. See ot-ics-security-ramp/glossary for terms pulled from it.