For years, the cybersecurity conversation around critical infrastructure has largely been focused on one goal: keep the attackers out. And that absolutely remains important. However, it’s no longer enough.
The new CI Fortify initiative from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Signals Directorate’s Australian Cyber Security Centre, and international partners underscores a harder reality: critical infrastructure operators must be prepared not only to prevent attacks, but also to keep essential services running if an attacker gains access.
Remember the attacks on the U.S. water systems in 12 states this summer? Hackers linked to Iran were deemed responsible, and while many of the outages just caused mild disruptions, one county in Georgia suffered a pump failure which put water contamination at risk.
To prevent more of these occurrences, the CI Fortify initiative recommends that organizations identify their most critical operational technology (OT) and supporting systems, understand the connections between them and prepare to isolate those systems during a major cyber incident. The objective is straightforward: contain an attack while keeping the services people depend on running.
That is an important shift in thinking.
The attackers have changed. The weaknesses often haven’t
Campaigns such as Volt Typhoon and Salt Typhoon demonstrated the sustained interest of state-sponsored actors in the infrastructure underpinning electricity, water, communications and other essential services. CI Fortify goes further than traditional prevention guidance, telling operators to plan for isolation and recovery and to assume that a threat actor may already have access to the environment.
Yet many of the weaknesses that attackers exploit are surprisingly familiar.
In my role, I continue to see advanced persistent threat groups targeting internet-facing network equipment that either has not been effectively controlled and monitored or was never designed to be connected to the internet in the first place.
That is what is frustrating about some of these attacks. We are still talking about many of the same misconfigurations, vulnerabilities and poorly controlled access points we have been discussing for years.
The danger is what happens next.
Compromising an internet-facing router or other network device may only give an attacker an initial foothold. Once inside, they can begin investigating: what is connected to this device? Where can I go from here? Which systems trust it? Which credentials work elsewhere? That is when a vulnerability becomes an operational resilience problem.
The real question is how far an attacker can go
Imagine an attacker compromises a public-facing router and gains administrator access. If that router is properly segmented from more sensitive parts of the environment, the attacker’s options should be limited. If the router only serves an administrative area, that router should not have access to another router which is protecting OT.
Of course that sounds obvious, but in practice, networks evolve, so it doesn’t stay that way for long. Devices are added, firewall rules change and temporary exceptions become permanent. You also have to consider people. Roles change, credentials expand privileges and keeping track of it all gets messy.
The result can be a network in which compromising one device or account gives an attacker far more freedom than anyone intended. This is why segmentation and least privilege need to be viewed as more than cybersecurity hygiene. For critical infrastructure, they are resilience controls.
If an administrator only needs access to one part of a network, they should not automatically have access to everything else. And if they must have admin access, make sure to provide them with tiered admin-level accounts for specific actions e.g. one tier for day-to-day and another to perform exceptional actions, not expected day-to-day.
The same principle applies to systems. Connectivity should exist because it is required, not simply because it is technically possible.
Containment matters as much as prevention
No organization can guarantee that an attacker will never get in. The more useful question is: if they do get in, how much can they reach?
Good segmentation can help contain an attacker around the point of breach. Strong access controls can prevent stolen credentials from opening doors across the entire environment. Understanding how devices are actually configured can reveal unintended pathways before an attacker finds them. And those controls need to be continually validated. You can have all the blueprints and policies in the world that say who can and can’t access what systems, but what matters is whether the real configurations across routers, switches and firewalls actually enforce those policies today.
That distinction becomes especially important during an incident. In the rush to restore operations, there can be enormous pressure to reopen access quickly. Companies are then in danger of falling back on broad firewall rules simply to get systems working again, because doing so can effectively create a completely flat network.
For a normal business, the consequences can be severe. For critical infrastructure, the consequences can move quickly from digital disruption into the physical world: water stops flowing, power goes down or essential services become unavailable.
That is why CI Fortify matters. It acknowledges that resilience cannot be measured solely by whether an attacker gets through the front door. It must also be measured by what happens after they do.
Critical infrastructure needs to be designed so that one compromised device, account or connection does not automatically become a route to the systems society depends on.
Because for critical infrastructure, resilience is not simply keeping attackers out. It is keeping essential services running when they get in.
