Unsubstantiated Claim About OT Attack Forensics
The piece "You Need Cyber Deception for OT" argues that after an OT cyber‑attack there is "no data, no trail, and no history." No source, log excerpt, or forensic study is cited to back that statement.
When a claim like this appears without evidence, the safest stance is skepticism. Security teams should treat it as an opinion, not a proven fact, and continue to assume that any intrusion can generate artifacts—whether in PLC logs, network traffic, or system timestamps.
What to Do Next
Even if an attacker tries to erase footprints, you can improve your odds of detection by:
- Enforcing immutable logging on critical OT devices.
- Deploying passive network sensors that capture raw traffic for later analysis.
- Running regular integrity checks on configuration files and firmware.
- Integrating OT telemetry into a centralized SIEM or XDR platform.
Until a credible, verifiable study shows otherwise, assume that evidence can exist and design your defenses accordingly.