ICS Defense Use Cases (DUC)

SANS ICS Defense Use Cases are white papers developed by experienced industrial cybersecurity practitioners to examine significant incidents, reported attacks, and claims of attacks involving industrial environments—including activity attributed to or associated with nation-state actors. Each paper draws upon publicly available reporting, threat intelligence, and observed or potential cyber-to-physical or process effects. Because publicly available information is often incomplete, the authors may explore technically plausible scenarios to address gaps in reporting. These scenarios help defenders understand what may be possible, identify lessons that extend beyond a single event, and consider how similar activity could be detected, mitigated, or prevented. Use these case studies to evaluate your critical systems and identify opportunities to strengthen their defenses.