Outcreating Critical Infrastructure Protection: From Airgaps to Active Resilience

Critical infrastructure, comprising energy, water, transportation, manufacturing, healthcare, telecom, and digital backbone services, keeps economies running and societies functioning. As we see in the current West Asia conflict, disruption has immediate and tangible impacts. The halted production, safety risks, degraded public services, and cascading impacts across dependent sectors. Modern infrastructure is increasingly cyber-physical, i.e., software decisions can alter real-world processes in seconds, especially in Operational Technology (OT) and Industrial Control Systems (ICS).

Unlike traditional IT environments, OT/ICS environments operate physical processes such as pumps, turbines, valves, centrifuges, robots, dosing systems, and protection relays, often under strict safety and uptime requirements. Most assets were built for reliability and predictable control, not for hostile networks. Therefore, security needs to be integrated without affecting availability or safety. Due to environmental challenges in critical infrastructure, OT cybersecurity strategies need to be built on risk-based approaches, taking into account the full operational life cycle and clearly assigning ownership across teams.

Evolving threat landscape

During the decade gone by, real incidents have shown how attackers can enter into the IT infrastructure and then gradually move into critical infrastructure by exploiting weaknesses in architecture and processes:

• Power grid disruption (Ukraine, 2015): Malware and compromised operator credentials were used to disrupt electricity distribution.

• Safety system targeting (TRITON/TRISIS, 2017): Malware designed to interact with safety instrumented systems (SIS) highlighted that adversaries can aim beyond control into safety layers.

• Operational shutdown due to ransomware response (Colonial Pipeline, 2021): Proved that even when ransomware primarily affects IT, operational decisions can lead to pipeline shutdown and widespread supply disruption.

• Water treatment manipulation attempt (Oldsmar, 2021): Reported remote access abuse to alter chemical dosing. This highlights the importance of proper governance and having secure remote access solutions while accessing critical infrastructure.

The common pattern across these incidents is not only advanced malware, but also weak remote access, poor network segmentation, identity gaps, limited monitoring, and insufficient incident response readiness. Most of these issues can be solved with proper design, processes, and end-user training. To create new ways of working, organizations must treat each incident not just as a breach to contain, but as a signal to rethink how security is designed into operations from the ground up.

Why is critical infrastructure hard to defend

We keep facing many challenges while protecting critical infrastructure. Some of the key challenges are: 

• Legacy technology and fragile change windows: Many OT assets have been in use for decades. Patching and upgrades require planned outages, vendor sign off, and extensive testing.

• Converged IT/OT and expanding connectivity: Disappearing old “air gap” due to digital transformation, remote operations, centralized operation, and cloud analytics. Convergence of systems improves efficiency but also increases the number of attack paths.

• Safety, availability, and deterministic performance: Introduction of OT cybersecurity solutions requires proper validation, vendor coordination, and staged deployment. Introduction of security controls may introduce latency, packet loss, or unexpected device behavior, which operations cannot tolerate.

• Visibility gaps: Lack of comprehensive inventories. Without it, baselining, segmentation, and monitoring initiatives will take a hit.

• Supply chain and third party risk dependency on integrators: OEMs and service providers increase risks via privileged access, shared tooling, and software/firmware update dependencies.

Building critical infrastructure resilience: What actually works

What we have seen, working with numerous customers across the globe, is that each customer uses different tools and technologies to manage their critical infrastructure. Despite these investments, they still do not have 100% visibility into their environment. The high cost of tools imposes budget constraints, limiting the organization's capacity to deploy effective solutions. Current security tools like Intrusion Prevention Systems (IPS), Firewalls, Network Access Control (NAC), and vulnerability scanners provide only partial visibility, making thorough asset detection difficult and incomplete. Without having comprehensive visibility, it is almost impossible to protect critical infrastructure.

The good news is we already know what works. We have proven frameworks, practical baselines, and OT-specific standards that provide a reliable path to building critical infrastructure resilience. These open new productivity paradigms, moving teams away from reactive firefighting toward structured, intelligence-led operations. We need to apply these standards with an OT/ICS mindset and bring collaboration across the ecosystem.

As a starting point, as per our experience, we recommend the following steps:

• Conducting comprehensive OT plant risk assessments to identify assets, build detailed asset inventories, and establish baselines. Subsequently, change management and asset life cycle management processes are rigorously followed.
• Utilizing various tools to identify OT assets and sync them with the CMDB (e.g., CISCO ISE, NIDS, VM platforms, etc.)
• Utilizing passive and active monitoring techniques, as well as manual methods, to ensure thorough asset identification.
• Maintaining a centralized repository for asset information.
• Implementing strict protocols for asset onboarding and offboarding.
• Establishing a centralized asset management team responsible for multiple sites and plants.
• Ensuring asset life cycle management, change management, vulnerability management, and patch management processes are overseen by a dedicated, centralized team.
• Developing a governance structure with clearly defined roles and responsibilities.
• Periodic Cybersecurity awareness sessions for all relevant stakeholders.

Zero trust architecture: Verify everything, trust nothing

Apart from following the above steps, organizations must move past traditional perimeter-based defenses and adopt approaches that provide robust, continuous protection across all assets, legacy and modern alike. A key solution is to adopt a Zero Trust Architecture, which requires continuous verification of every user, device, and application, regardless of location. In practice, this means each access request is thoroughly authenticated and authorized in real-time, significantly reducing the risk of lateral movement by attackers.

For sectors where service interruptions can have national or global impacts, such as energy or transportation, Zero Trust delivers unified, granular access controls that protect both legacy and modern technologies. This is how forward-thinking organizations Outthink the threat, Outpace the adversary, and begin to truly Outcreate the grid by designing security architectures that do not just respond to attacks but structurally eliminate entire categories of risk.

Five strategic investments every organization must make

• Identity-based Access Controls: Ensure only authorized personnel and devices can access sensitive systems.
• Continuous Monitoring and Threat Detection: Leveraging AI and analytics to identify anomalies in near real time and respond swiftly.
• Centralized Policy Enforcement: Implementing unified security policies across IT and OT environments for continuous protection.
• Secure Remote Access: Helps enable seamless operations and maintain recommended security standards.
• Regulatory Compliance: Following frameworks such as IEC 62443, NERC CIP, TSA directives, NIS2, and the US AI Action Plan helps ensure verifiable access and secure integration.

These measures, when implemented together, open new avenues for value, empowering organizations to achieve greater resilience, meet regulatory requirements, and support digital transformation without sacrificing reliability or productivity.

The road ahead: Resilience as a strategic imperative

Protecting critical infrastructure is no longer a matter of compliance alone; it has become a strategic requirement. To meet this, organizations must demonstrate consistent efforts towards meeting this requirement. As cybersecurity threats grow in frequency and complexity, regulatory bodies are developing new frameworks to address these emerging risks. However, true resilience goes beyond meeting audit requirements. It demands a comprehensive, risk-based approach that embeds security into every facet of operations, encompassing people, processes, and technology.

The future of critical infrastructure protection belongs to those who think disruptively, Outcreate the grid, and own outcomes. Organizations that succeed in this process are those that embrace Zero Trust principles, continuously educate their workforce, and build partnerships. By doing so, they not only safeguard essential assets but also build public trust and ensure the long-term continuity of services that support our daily lives. We urge industry professionals and security leaders to champion this positive approach, prioritize resilience, and lead the way in securing the critical infrastructure that sustains our modern society.

References :

1.      2015 Ukraine Electric Power Attack – Details published by MITRE :

        https://attack.mitre.org/campaigns/C0028/

2.     Attacker Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure, Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer, December 14, 2017 :

        https://cloud.google.com/blog/topics/threat-intelligence/attackers-deploy-new-ics-attack-framework-triton

3.     Colonial Pipeline : The DarkSide Strikes; Congressional Research Service, May 11, 2021:

        https://www.congress.gov/crs_external_products/IN/PDF/IN11667/IN11667.2.pdf

4.      Compromise of U.S Water Treatment Facility; Cybersecurity Advisory released by Cybersecurity & Infrastructure Security  Agency  (CISA), February 12, 2021: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-042a

5.      Cross-Sector Cybersecurity Performance Goals, Guidelines published by CISA, December 2025:

         https://www.naesb.org/pdf4/weq_bps_css121525w4.pdf

6.     ISA/IEC 62443 Series of Standards from International Society of Automation (ISA):

       https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards