In May 2021, the Colonial Pipeline ransomware attack showed how quickly a compromised account can become a national issue. The attackers reportedly achieved initial access through an inactive VPN account without multi-factor authentication (MFA), hit business systems including billing infrastructure, and triggered a shutdown that disrupted fuel supply across the U.S. East Coast.
Five years later, the lessons learned from Colonial Pipeline have more relevance than ever. Critical infrastructure is attractive because disruption creates pressure far beyond the breached organization.
Today, that pressure is rising as state-backed actors look for persistence inside critical infrastructure networks, not just to steal data, but to hold access that could be used in a crisis.
The initial attack path is familiar, with threat actors exploiting stolen credentials, unmanaged devices, compromised laptops, remote access tools and weak access controls. Zero trust offers a security model that is quickly becoming an operational necessity for organizations that deliver essential services.
Advancements in technology mean that systems are increasingly interconnected. Reflecting this change and new challenge, CISA recently published guidance in the paper Adapting Zero Trust Principles to Operational Technology.
While the paper focuses on operational technology (OT) environments, its central warning applies across critical infrastructure: implicit trust creates unacceptable risk.
OT deserves careful, tailored treatment. Safety, uptime, legacy systems and physical processes make it trickier to apply typical IT security models in control environments. CISA’s guidance reflects that reality, with emphasis on asset visibility, identity and access management, segmentation, monitoring and supply chain risk.
But OT is not the only place where critical infrastructure is exposed. Essential services also depend on IT systems, cloud platforms, and SaaS applications. As the Colonial Pipeline attack demonstrated, compromising business-critical systems can cause just as much damage as breaching OT.
The tactics of threat actors like Volt Typhoon show why critical infrastructure leaders need to rethink trust. The group specifically targets critical infrastructure, using techniques designed to blend into normal network activity rather than trigger obvious alerts.
U.S. agencies have warned that PRC state-sponsored actors have compromised and maintained access to critical infrastructure networks, in some cases for years.
The tactics are familiar, but effective. Attackers exploit vulnerable edge devices such as routers, firewalls, and VPN appliances.
They use stolen administrator credentials and legitimate accounts and rely on “living off the land” techniques, using built-in tools instead of malware, so their activity appears routine.
They also route traffic through compromised devices to make attribution and detection harder.
In Guam and other U.S. locations, Microsoft reported Volt Typhoon activity against communications, manufacturing, utilities, construction and transportation organizations. The concern was not only espionage, but the possibility that persistent access could support disruption during a future geopolitical crisis.
Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches.
Effortlessly secure Active Directory with compliant password policies, blocking 6+ billion compromised passwords, boosting security, and slashing support hassles!
Zero trust delivers a key defense against these types of attacks. However, while identity is central to zero trust, it cannot carry the full burden on its own.
State-backed actors are skilled at stealing credentials, phishing users, hijacking sessions, and using legitimate tools to move quietly through networks.
Multi-factor authentication (MFA) remains essential, and every critical infrastructure organization should use it. But MFA is not a complete answer if attackers can compromise a session, enroll a rogue device, exploit a trusted remote access path or use a legitimate account from an unmanaged endpoint.
Organizations that provide essential services need stronger access decisions. That means looking beyond the username and password to evaluate other trust signals.
Most critical infrastructure organizations cannot redesign OT overnight. They cannot quickly replace every legacy system, remove every third-party dependency or rework decades of operational complexity without introducing new risks. But they can strengthen how employees access critical applications, data and systems.
Workforce access controls sit at the intersection of identity, endpoint security, and policy enforcement. They help security teams move beyond asking, “Is this the right user?” to also ask, “Is this the right user, on the right device, under the right conditions, for this specific resource?”
Binding each identity to a device is key. It helps ensure access is not granted solely because someone has a password, token, or approved session. Before allowing access, security teams can check whether the device is known, trusted, healthy, encrypted, updated, and compliant.
For critical infrastructure, that is a practical step toward zero trust: reduce implicit trust at the point where people connect to the systems the organization depends on.
The challenge of implementing zero trust is that workforces are no longer confined to a single site or network. Both onsite and remote workers need reliable access to sensitive systems, but the risk is that their devices vary widely in security posture.
For instance, an engineer may work onsite using a managed laptop with encryption, current patches and endpoint protection. An employee in the finance department might work remotely using a personal, unmanaged device. They both need access but have very different risk profiles.
A zero trust workforce access model should enforce that difference, with policies that require a certain level of health for all devices. Access should adapt based on device posture, user context, and the sensitivity of the resource.
This reduces dependence on network location as a trust signal. It also limits the blast radius if a device or account is compromised,
The security of identity systems is crucial for resilient critical infrastructure, which is where specialized solutions like Specops Device Trust help. Attackers may be able to steal credentials, but it is far harder to steal a verified physical device.
By binding identities to specific devices, Specops Device Trust helps organizations enforce zero trust at every access point.
Critical infrastructure organizations need robust security controls to defend against increasingly sophisticated attacks.
If you’re interested in seeing how Specops solutions can help you achieve stronger identity security, contact us today.
Sponsored and written by Specops Software.
Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
Hugging Face warns an autonomous AI agent hacked its network
Critical ServiceNow code execution flaw now exploited in attacks
Overdue a password health-check? Audit your Active Directory for free
See how Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Read the case study.
Privacy by policy or privacy by architecture? See how age checks work when the face never leaves the device.
Calculate what you’d save by replacing your MDR.
Do you have what it takes to challenge DARKROOM? Signup for an exclusive DEFCON CTF!
Pentest your web apps on-demand. Find what humans miss. Scope and launch a pentest in minutes.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
