Understanding how automation incidents differ from network cybersecurity incidents helps organizations avoid treating every automation failure as a cyberattack — preserving the right evidence and assigning the right experts.
A replacement network switch installed with Rapid Spanning Tree Protocol disabled created a network loop and data storm that closed the turbine control valves at 100% power — scramming Hatch Unit 1 with no cyberattack involved.
Read article
Not every control system event involving computers, controllers, or digital instruments is a network cybersecurity incident. Understanding the difference helps organizations investigate the right causes and involve the right teams.
Read article
Many people feel an incident must be malicious to count as a cyber incident. As Colonel Herman Haupt understood on the railroads of the Civil War, it isn't the intention that matters — it's the outcome.
Read article
IT and OT networks are about the data. Control systems are about the process — where safety, reliability, and availability must be considered. Cyber security alone is not enough.
The word itself adds to the confusion: “cyber” originally meant “under the control of and communication with computers.” More recently it implies cyberattacks — and that shift is why so many control system incidents are mislabeled.
ACS research highlights the scale of the problem — much of it originating at Level 0 and Level 1, below the IP network layer.
In a 2022 survey of 200 executives, respondents reported that control system incidents had caused:
The book by Joe Weiss, alongside numerous articles, papers, and presentations that have helped shape the field.
Insight drawn from Joe Weiss's long-term tracking of control system incidents — patterns, consequences, and lessons for critical infrastructure organizations.
Learn to recognize, classify, and communicate control system automation safety incidents that may not look like conventional cybersecurity events.
Practical insight from Joe Weiss into real-world incidents at Level 0 and Level 1 — below the IP network layer. No spam, unsubscribe anytime.