Leargas Critical Infrastructure Alert: Enhancing the Security of Operational Technology and Industrial Control Systems
Critical infrastructure poses a challenge not only in deployment, maintenance, uptime, but also the risk of cyberattacks is significant. We will address some key ways to reduce risk and attack surface for this challenging environment. Also it is worth noting that we see alerts from government agencies, cybersecurity, and threat intelligence vendors often, but a multiagency alert on best practices regarding our critical infrastructure in the current global climate is important. Recognizing this current climate and risk, the Cybersecurity and Infrastructure Security Agency (CISA), in a concerted effort with the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), and the Department of Energy (DOE), has released a crucial fact sheet titled “Primary Mitigations to Reduce Cyber Threats to Operational Technology.” This guidance is for organizations across critical sectors such as energy, water, manufacturing, transportation, and healthcare, aimed at strengthening the security posture of their Operational Technology (OT) and Industrial Control Systems (ICS). The interconnectedness of these systems with our daily lives underscores the urgency and importance of implementing robust cybersecurity measures.
This joint alert stands out due to its timing and the breadth of agencies involved. In today’s environment—where critical infrastructure is increasingly in the crosshairs of nation-state actors and ransomware groups alike—coordinated guidance from CISA, FBI, EPA, and DOE underscores just how urgent and credible the threat is. The fact sheet isn’t just another government bulletin—it’s a wake-up call grounded in real-world incidents and threat intelligence.
The Unique Vulnerabilities of OT and ICS: Why They Are Prime Targets for Attackers
OT encompasses the diverse array of hardware and software that is often legacy, or meant for isolated environments which introduces unique as well as common risks. This realm includes systems like Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), Programmable Logic Controllers (PLCs), and a multitude of other specialized devices integral to the functioning of critical infrastructure. Unlike traditional Information Technology (IT) systems, which have evolved with security considerations at their core, many legacy OT/ICS/SCADA/PLCS devices were originally developed in isolation, with a primary focus on reliability and efficiency rather than robust cybersecurity with little intent on being networked to the internet or shared with standard IT networks.
OT environments have been historically isolated yet have become increasingly interconnected with enterprise IT networks and, in some cases, the public internet, they inherit and are exposed to vulnerabilities. These vulnerabilities stem from a variety of factors, including the use of end of life (EOL) or unpatched operating systems and software, a lack of built-in security features, and the prevalence of default or easily guessable/dictionary based passwords. Attackers are aware of these weaknesses and actively attempt to exploit them. They often leverage readily available tools, techniques, and procedures (TTPs) to identify and compromise exposed OT and ICS systems, potentially leading to an incident, ranging from service disruptions and economic losses to environmental damage and threats to health or public safety. The potential for cascading effects across interconnected infrastructure further amplifies the severity of these risks.
We’ve already seen high-profile incidents like the Colonial Pipeline ransomware attack and the attempted poisoning of a Florida water treatment plant highlight how quickly a cyber event in OT can escalate into a public safety crisis. These events reinforce the need for proactive hardening, not reactive clean-up.
Key Mitigation Strategies for OT and ICS
To effectively mitigate these threats, Léargas, CISA, and its partner agencies have outlined a set of essential mitigation strategies that organizations operating OT and ICS environments should prioritize and implement diligently:
Eliminate Public Internet Exposure:
The most fundamental step in securing OT/ICS environments is to ensure that these systems are not directly accessible via the public internet. Direct connection creates an easily discoverable attack surface, allowing threat actors to utilize search tools, specialized scanning tools (like Shodan), and publicly available exploit frameworks to identify open ports, vulnerable services, and configuration errors. Organizations should conduct thorough and regular assessments of their network infrastructure to identify and remove any public-facing OT and ICS assets. This may involve potentially significant network topology changes, ensuring that direct internet connectivity to OT devices is blocked or strictly limited. Bastion hosts or secure jump servers should be employed for necessary remote administration, ensuring no direct exposure of the OT network to the IT infrastructure or open internet.
Enforce Strict Authentication Practices Across All Systems:
Weak or default passwords represent a significant and frequently exploited vulnerability. Attackers commonly use password spraying, dictionary, and brute-force techniques to gain unauthorized access. It is important that organizations change all default credentials on OT and ICS devices and implement and test a strong policy mandating strong, unique passwords for all accounts, especially those with administrative privileges and those used for remote access. Password complexity requirements, regular password resets, and the use of password management tools should be enforced. Furthermore, the implementation of multi-factor authentication (MFA) is key.
Organizations should also enforce regular password resets and the use of password management tools to reduce credential reuse and administrative overhead.
Establish Secure and Controlled Remote Access Mechanisms:
While remote access can and many times is essential for legitimate operational and maintenance purposes, it also presents a significant attack vector if not properly secured. When remote access to OT networks is necessary, it must be strictly controlled and secured using private connections, VPNs, MFA, bastion hosts, or jump servers for all remote users. Access should be granted based on the principle of least privilege, ensuring that users only have the necessary permissions to perform their assigned tasks. Regular reviews of remote access accounts are critical, and dormant or unused accounts should be promptly disabled to prevent potential misuse. Comprehensive logging and monitoring of all remote access activity are also essential for detecting and responding to any suspicious behavior.
Implement Robust Network Segmentation and Zoning:
A fundamental security principle is to segment the OT network from the enterprise IT network. This logical and physical separation helps to reduce the attack surface area and prevent the lateral movement of cyber threats from the IT environment to the OT/ICS/SCADA environment. Implementing a demilitarized zone (DMZ) to mediate data transfer between these distinct networks adds another crucial layer of security. The DMZ acts as a controlled and inspected data exchange while preventing direct communication between the less secure IT network and the sensitive OT network. Well-defined security policies and access control lists (ACLs) should govern the traffic flow between network segments.
Maintain and Regularly Test Manual Operation Capabilities:
Despite the increasing automation of OT and ICS, organizations must retain and regularly practice the ability to operate critical systems manually in the event of an incident or system failure. This ensures business continuity and minimizes the impact of disruptions. Regular testing of manual controls, fail-safe mechanisms, and backup systems is paramount to verify their functionality and ensures that personnel are proficient in their use during emergency situations. These manual procedures should be well-documented, readily accessible, and regularly reviewed and updated. They must be incorporated into your IRP (Incident Response Plan), BCP (Business Continuity Plan), and DRP (Disaster Recovery Plan) to ensure organizational resilience.
The Critical Role of Collaboration with Third-Party Providers:
Misconfigurations, vulnerabilities, and security oversights can frequently occur during standard maintenance operations, system upgrades, or be inadvertently introduced by third-party system integrators, service providers, and vendors who have access to OT/ICS environments. Establishing clear communication channels and well-defined security requirements for all third-party providers is essential. Regular communication, security assessments of third-party practices, and contractual obligations regarding cybersecurity ensure that system-specific configurations remain secure and up-to-date throughout the lifecycle of the OT/ICS environment. Organizations should also have incident response plans that explicitly address the involvement and responsibilities of third-party providers.
At Léargas Security, we understand the critical nature of these environments and the difficulty of balancing security with uptime, safety, and operational efficiency. Our team works directly with ICS/OT operators to assess exposure, design segmentation strategies, and deploy monitoring solutions like Zeek, Suricata, and proprietary tools to detect anomalies before they become incidents. Proactive defense is no longer optional—it’s the only path to resilience.
Accessing Valuable Resources for Enhanced OT/ICS Cybersecurity:
Léargas, CISA and its partner agencies offer a wealth of resources to assist organizations in strengthening their OT and ICS cybersecurity posture:
CISA’s Stuff Off Search
(https://www.cisa.gov/resources-tools/resources/stuff-search): This valuable tool enables organizations to identify and reduce the internet exposure of their assets, helping to eliminate easily discoverable attack vectors.
Implementing Phishing-Resistant MFA
(https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf): This fact sheet provides detailed guidance and best practices for implementing robust, phishing-resistant multi-factor authentication to protect against credential compromise. Layering Network
Security Through Segmentation
(https://www.cisa.gov/sites/default/files/2023-01/layering-network-security-segmentation_infographic_508_0.pdf): This infographic visually illustrates strategies and best practices for implementing effective network segmentation to enhance the security and resilience of OT and ICS environments.
Implementing these primary mitigation strategies and leveraging the resources provided by Léargas Security, Critical Path Security, CISA and its partners, organizations operating critical infrastructure can significantly reduce their risk and attack surface, safeguarding essential services and mitigating the potentially severe consequences of attacks.
For a deeper conversation about securing your OT and ICS infrastructure, or to schedule a no-cost assessment, contact Léargas Security today. We’re committed to protecting the infrastructure that powers the world.
