domains / families / security / detecting-attacks-on-scada-systems

detecting-attacks-on-scada-systems

separate

'This skill covers detecting cyber attacks targeting Supervisory Control

When to use

• When deploying intrusion detection capabilities in a SCADA environment for the first time
• When investigating suspected cyber attacks against industrial control systems
• When building detection rules for OT-specific attack patterns (Stuxnet, TRITON, Industroyer)
• When integrating OT network monitoring with an enterprise SOC for unified threat visibility
• When responding to alerts from OT security monitoring tools (Dragos, Nozomi, Claroty)

When not to use

• detecting attacks on IT-only networks without SCADA/ICS components
• building generic network IDS rules
• incident response procedures after an attack is confirmed

Skill page

Source