Protecting OT and Critical Infrastructure in an Evolving Threat Landscape
A trusted partner can help boost security and resilience for critical infrastructure and organizations that rely heavily on operational technology.
- THE EVOLVING OT THREAT LANDSCAPE
- A SECURE AND RESILIENT OT NETWORK
- TRUSTED SECURITY PARTNERS
CISA notes that industrial control systems can have lifecycles that extend up to 30 years, and that they are largely “purpose-built, stand-alone systems designed for reliability rather than security.” Historically, CISA points out, risks to these systems primarily arose from human error, accidents, natural disasters and acts of physical sabotage. However, the convergence of OT and IT networks means that physical infrastructure is now vulnerable to the same sorts of cybersecurity threats that have traditionally plagued enterprise IT systems. Often, these attacks are launched by malicious actors who have a specific interest in controlling or sabotaging critical infrastructure.
THE RISE OF RANSOMWARE: According to Fortinet, 56% of OT networks experienced ransomware or wiper intrusions in 2024. (“Wiper” attacks are malware-based attacks that can permanently delete or corrupt data, rendering systems inoperable.) That number represents a steep increase from the year before, when just 32% of organizations reported experiencing ransomware intrusions. In 25% of ransomware attacks against manufacturing companies, Fortinet notes, the ransom demanded is at least $1 million. However, the potential impacts can extend far beyond an initial ransom payment. It has become fairly common for attackers to accept ransom payments and then disappear without granting organizations access to their data and systems. Even when organizations regain this access, hackers sometimes sell their data on the dark web, potentially leading to regulatory infractions, intellectual property leaks or subsequent attacks.
HACKTIVISM AND NATION-STATE ATTACKS: OT and critical infrastructure make particularly attractive targets for both activist hackers (or “hacktivists”) and attacks sponsored by hostile nation-states. Hacktivist groups target industrial organizations to draw attention to environmental and social causes, while nation-states may infiltrate infrastructure to gather intelligence and prepare for potential future conflicts. Nation-state attacks can be incredibly sophisticated, destructive and wide-ranging due to the vast resources of those launching them. To take one example: From January through April of 2024, the federal government reported, a pro-Russia hacktivist had remotely manipulated industrial control systems inside five water and wastewater systems throughout the U.S. Threat actors were able to gain access via interfaces that had public-facing IP addresses, subsequently causing damage to water pumps at the facilities.
Click Below to Continue Reading
INSIDER THREATS: While external attackers pose significant risks to IT environments, organizations must also guard against threats from within. Occasionally, these threats come from disgruntled current or former employees, but they are more often the result of unwitting internal users being tricked by social engineering attacks. In fact, phishing emails are now the most common intrusion type experienced by organizations’ OT networks, as attackers have grown much more adept at impersonating executives, suppliers and financial institutions. In a 2024 study, Fortinet reported that 76% of organizations had experienced OT intrusions due to phishing. Additionally, half of all OT intrusions in 2024 involved an unintentional insider breach, while 13% involved an internal “bad actor.”
ADVANCED AND EVOLVING ATTACKS: Threat actors are using increasingly sophisticated techniques to breach OT environments. Advanced persistent threats provide long-term access to networks to attackers, who sometimes use fileless “living off the land” attacks that leverage legitimate tools and processes to avoid detection. Because LOTL attacks take advantage of tools that are already present in the target environment (such as PowerShell or Windows Management Instrumentation), they are far more difficult to detect — especially for organizations that still rely on security tools that search for malware scripts or files. The Pipedream malware framework, believed to have been developed by state-level APT actors, is a set of tools that can identify and compromise certain industrial control systems and SCADA devices.
To protect their critical infrastructure and other connected physical assets, organizations need to implement comprehensive strategies that combine proactive assessment, robust security tools and ongoing management. An effective OT security strategy will bolster cyber defenses and make organizations more resilient.
Assessment and Strategic Planning: Prior to implementing new security tools and processes, organizations should take the time to carefully evaluate their existing OT environments. While internal assessments can yield insights, many organizations find they need the fresh eyes of a third-party partner to conduct vulnerability assessments and security audits. These engagements can help uncover security gaps in existing tools and processes, identify opportunities to strengthen defenses, and lead to roadmaps for the adoption and deployment of new security controls. Organizations may also opt for more granular assessments (such as OT transformation workshops, IoT device assessments or network segmentation workshops) depending on their specific environments and cybersecurity needs. While organizations often have difficulty finding the budget for proactive investments in cybersecurity tools and processes, grants offer a potentially powerful funding mechanism. Depending on the nature of the critical infrastructure they are protecting, organizations may be eligible for grant money distributed by federal programs such as the Transit Security Grant Program or Port Security Grant Program, which each give out nearly $100 million per year.
Infrastructure Protection Tools: The specific mix of appropriate OT protection solutions will vary from one organization to another. However, there are several key security tools that are essential for most industrial environments. A next-generation firewall (NGFW) can help organizations segment their network, control traffic between different segments and prevent attacks from jumping between OT and IT assets. They also can help prevent lateral movement, especially to a control system that could potentially cause physical harm. When it comes to endpoint protection, many organizations struggle because OT environments operate with legacy systems that cannot be patched. For those organizations running on updated operating systems, patching may be possible. But for others, the answer is segmentation and monitoring, which continues to take on greater importance with the growing number of devices (such as industrial sensors, smartphones and laptops) that connect to industrial networks. Email and web security tools are instrumental in preventing the phishing attacks that frequently target OT personnel. And intrusion detection and prevention systems can identify and block potential threats before they are able to compromise critical systems. Successful implementation requires careful planning to ensure that new tools don’t disrupt operations, causing costly downtime for equipment. Depending on their level of internal expertise, organizations may turn to a partner for help architecting, designing and deploying their new OT security controls.
Managed Security and Ongoing Protection: Securing OT and critical infrastructure is not a one-time event. New systems must be maintained, managed and regularly tested over time to ensure that the security environment remains effective against evolving threats. Many organizations lack the internal expertise and resources to effectively manage their OT security programs over time. Managed security services can help fill this gap, with a trusted partner providing continuous monitoring of OT networks and responding to potential threats before they have a chance to disrupt infrastructure. Such managed security engagements typically include management of security tools like NGFWs and endpoint protection solutions, as well as regular vulnerability scanning. A partner can also push out security updates. Although most IT departments long ago recognized the need to continually update security, OT networks have lagged — largely because operators are wary of taking equipment offline for updates. However, an experienced partner can devise and implement patching workflows that keep organizations safe and productive.
Click Below to Continue Reading
Top OT Security Challenges
Asset Discovery and Visibility: Organizations can’t secure operational technology networks when business and technology leaders don’t know what systems are running on those networks. According to Cisco, 55% of organizations have either an inaccurate OT asset inventory or no inventory at all.
Network Segmentation: For OT networks, segmentation and microsegmentation can block attackers and unauthorized users from accessing sensitive data and devices. NGFWs can help organizations deploy these capabilities.
Secure Remote Access: Modern workflows require organizations to provide employees with remote access to connected assets. Identity and access management (IAM) solutions with features such as multifactor authentication can help provide this access securely.
Container Management: As organizations increasingly use containerization for cloud-native applications, more containerized apps are making their way to OT systems at the network edge. Organizations need robust container management platforms to prevent containers from introducing new risks to industrial systems.
Many organizations turn to a trusted third-party partner to help them develop and implement their OT security strategies. CDW’s solution architects have decades of experience helping organizations across industries to design, deploy and manage security solutions for their industrial systems.
Operational Technology Assessments: Often, organizations lack even a simple inventory of all of the connected assets on their networks, let alone a set of baseline expectations for those assets or a standardized list of trigger events that require a response. An initial assessment of an OT environment, conducted by CDW’s experts and partners, can uncover critical vulnerabilities, identify opportunities for improvement and help teams manage the convergence of OT and IT networks.
Vendor-Agnostic Advice: Because CDW works with virtually every significant vendor of OT security solutions, leaders can trust that experts’ recommendations are the very best fit for their organizations. Additionally, CDW’s cross-vendor expertise means that solution architects have the skills and knowledge to help implement and integrate organizations’ new OT security tools, regardless of which vendors supply them.
Implementation and Integration: CDW’s experts help organizations deploy new OT security solutions while ensuring seamless integration with existing systems. This includes careful planning to minimize disruption to critical operations, testing in controlled environments before deployment, and coordinating with multiple teams to maintain both security and operational efficiency. CDW’s implementation specialists work closely with vendors, partners, internal IT teams and OT personnel to ensure that new solutions enhance rather than impede industrial processes.
Configuration: CDW’s highly skilled and certified engineers can configure multivendor network and security devices, ensuring that security tools are set up properly before they are deployed in the field. Before shipment, CDW will configure network and security devices, including firewalls, routers and switches; access points and wireless controllers; and endpoint IP devices such as IP phones and conferencing gear. CDW also offers a VPN service that allows organizations to finalize configurations and ensure quality control.
Click Below to Continue Reading
Physical Security: Preventing physical access is a key component of overall OT security. CDW Amplified™ Physical Security deploys, integrates and manages physical security systems that improve safety and security. These systems may include security cameras, sensors and door controllers, as well as supporting technologies such as video management and access-control platform software.
Monitoring and Response: Organizations need ongoing, real-time visibility into their OT and IT networks. CDW can provide the tools needed to monitor infrastructure, track data analytics on anomalous activity and investigate potentially malicious behavior. Additionally, CDW’s 24/7 incident response and troubleshooting services help to quickly detect, analyze and remediate security events before they can impact operations.
Managed Security Services: As a managed security services provider, CDW can provide ongoing management of virtually all aspects of an organization’s security environment. In addition to OT environments, CDW’s experts can manage NGFW endpoint security tools, security orchestration solutions, security automation and response platforms, security incident and event management tools, and IAM solutions.
Disaster Recovery and Business Continuity: In addition to preventing security incidents, organizations need comprehensive plans for maintaining operations if an attack succeeds. CDW helps organizations develop detailed recovery playbooks, implement robust backup solutions and establish redundant systems to ensure critical infrastructure can continue functioning even during a cybersecurity incident. This includes testing recovery procedures, identifying critical systems that require immediate restoration, and ensuring that backup data remains secure and accessible when needed.
CDW can help secure
operational technology,
Internet of Things devices
and critical infrastructure.
