Longforms – Random Bits of Knowledge

Operational Technology in the Crosshairs: What the 2025–2026 Attacks Reveal About Industrial Cyber Risk

From exposed PLCs and composable trust failures to an IEC 62443-aligned architecture for constraining operational authority, bounding compromise, preserving safe operation, and restoring trusted control

cybersecurity

energy

enterprise risk management

essay

regulation and compliance

🇬🇧

An evidence-driven and formal analysis of 2025–2026 OT attacks showing how digital footholds can accumulate into operational authority and physical consequence, and deriving an IEC 62443-aligned architecture for constrained connectivity, least operational authority, controller integrity, detection, safe operation, trusted recovery, supply-chain assurance, lifecycle governance, and bounded consequences of cyber-physical compromise.

Modified	Sep 5, 2026
Keywords	operational technology, OT cybersecurity, industrial control systems, ICS, programmable logic controllers, PLC, SCADA, cyber-physical systems, critical infrastructure, operational authority, capability inference, capability closure, attack surface, defense in depth, authority containment, IEC 62443, zones and conduits, industrial DMZ, zero trust, Zero Trust Network Access, ZTNA, privileged access workstation, PAW, industrial protocols, Modbus Security, CIP Security, DNP3 Secure Authentication, OPC UA, Siemens S7, controller hardening, controller integrity, engineering workstation security, process-aware detection, OT monitoring, functional safety, safety instrumented systems, mission resilience, safe degradation, OT backup, safe reconstitution, supply-chain cybersecurity, secure by design, secure by default, SBOM, lifecycle governability, NIS2, Cyber Resilience Act, NERC CIP, critical-infrastructure regulation, AI in operational technology
Audiences	executive, practitioner, subject-matter expert, technical specialist
Difficulty	intermediate
Series

Modified	Aug 22, 2026
Keywords	SBOM, VEX, Vulnerability Exploitability eXchange, CISA, CSAF, CycloneDX, SPDX, OpenVEX, CVE-2021-44228, Log4Shell, Cyber Resilience Act, CRA, vulnerability management, software supply chain
Audiences	analyst, practitioner, subject-matter-expert, technical specialist
Difficulty	intermediate
Series	Cyber Resilience Act reporting

Modified	Aug 17, 2026
Keywords	homomorphic encryption, fully homomorphic encryption, partially homomorphic encryption, somewhat homomorphic encryption, privacy-preserving computation, computation on encrypted data, data in use, controlled malleability, semantic security, public-key cryptography, RSA, Paillier cryptosystem, modular arithmetic, number theory, group theory, ring theory, arithmetic circuits, Boolean circuits, lattice-based cryptography, bootstrapping, ciphertext noise, noise budget, circuit depth, relinearization, modulus switching, batching, encrypted cloud computing, privacy-preserving machine learning, federated learning, differential privacy, secure multiparty computation, zero-knowledge proofs, trusted execution environments, private information retrieval, private set intersection, blockchain privacy, threshold cryptography, cryptographic key management, post-quantum cryptography
Audiences	practitioner, researcher, subject-matter-expert, technical specialist
Difficulty	advanced
Series

Modified	Aug 12, 2026
Keywords	Poland cyberattack, energy sector cybersecurity, OT security, industrial cybersecurity, distributed energy resources, DER cybersecurity, renewable energy cybersecurity, BESS cybersecurity, grid cybersecurity, CERT Polska, DynoWiper, LazyWiper, Sandworm, ELECTRUM, Dragos, ESET, IEC 62443, NIS2, Cyber Resilience Act, Terna Grid Code, CEI 0-16, remote access security, VPN security, RTU security, HMI security, critical infrastructure protection, cyber physical systems, grid connection point, GCP, SCADA security, wiper malware, operational resilience
Audiences	practitioner, subject-matter-expert, technical specialist
Difficulty	intermediate
Series

Categories

Operational Technology in the Crosshairs: What the 2025–2026 Attacks Reveal About Industrial Cyber Risk

VEX Standards from First Principles

Homomorphic Encryption for Developers

The December 2025 Cyberattack on Poland’s Energy Sector

Cyber Resilience Act: The New Product-Security Baseline

The EU Digital Battery Passport: Who Is Affected, What Must Be Done, and When

From EPC Documentation to System Assurance

AI Adoption, Productivity, and the Missing Middle

Controllo e Monitoraggio della Rete: la Nuova Postura di Sicurezza degli Impianti Connessi

ArchiMate 4 and the Cartography of Complexity

Measuring Cyber Risk in the Italian Corporate Sector

Process Mining in Manufacturing with Purchased Components and Variable Lead Times

Process Mining as Computational Process Intelligence

Introducing Enterprise Architecture in a Multinational Company: A Roadmap for Building the Discipline from Scratch

Encrypted Cloning and the Exact Boundary of the No-Cloning Theorem

When Digital Trust Expires: Quantum Computing and the Collapse of Signature-Based Security

From S&OP to Continuous Orchestration: Envisioning the Hybrid Enterprise of Humans and AI Agents

From Planning to Orchestration: Reimagining the Enterprise Beyond S&OP

Comprehensive Guide to Sales & Operations Planning, Sales & Operations Execution and Master Production Scheduling

The Mathematics Behind a Racing Shell

Sudoku and Satisfiability Modulo Theories

The Relationship Between Category Theory, Lambda Calculus, and Functional Programming in Haskell

Harnessing Focus: Merging AI and Market Dynamics

Python as an Interface Between Human Thought and Machine Execution

Enterprise Architecture Beyond Rational Optimization