Threat hunting in ICS environments
I often get asked, "isn't threat hunting an IT thing?" It is true that threat hunting stems from the IT side of things, but in my opinion, it is more applicable to Operational Technology (OT) environments. These often neglected industrial (network) environments could be a breeding haven for malware and malicious actors. There could be threats lurking left and right, and there could even be nation-state-backed Advanced Persistent Threat (APT) groups present, exfiltrating data and getting ready to completely take over or take down your industrial process. This can happen on the IT side too, but it occurs far more on the OT side as those networks have long been ignored. This is because they have just been chugging away for years, doing their job without anyone looking into their security. If there is something devious going on, nobody would know. And that is where threat hunting comes in: it can rule out that such malicious activities...
