There's a somewhat related article from the UK NCSC here, for anyone interested: https://www.ncsc.gov.uk/paper/security-architecture-anti-pat...