Scoping

Part 1: Comparative Overview

Are there attributes of attacks that can be used to differentiate them into two groups?
Can we come up with two different methodologies with which we can evaluate "all" incidents?

Part 2: One Attack in Detail

Easy to scope: Just make sure that we don't choose the same one
My preferences:
- TRITON
- Blackenergy
- Industroyer/Crashoverride