Cybersecurity for critical infrastructure — power, water, hospitals, transport, and other essential services — prevents attacks with layered controls, continuous monitoring, and tested recovery. That means removing exposed systems from the internet, enforcing strong access and patching, segmenting IT from OT, and practicing restoration before an incident. Small utilities and large operators face the same adversary techniques. According to CISA, its voluntary Cybersecurity Performance Goals 2.0 page gives owners of all sizes a baseline of high-impact IT and OT protections to reduce known risks.
Table of Contents
- Which controls stop the most common attacks?
- How should you separate IT from OT?
- How do you detect intrusions early?
- How do you recover and report?
- Frequently Asked Questions
Which controls stop the most common attacks?
Start by removing remote exposure. CISA urges owners, operators, and integrators to take PLCs and other OT devices off the public internet immediately, after actors changed passwords and IP addresses and locked out operators, as reported in SecurityAffairs reporting on the CISA alert. A controller that needs no internet path should never have one. Fix identity next.
CISA red-team findings direct organizations to eliminate default passwords, use unique credentials, and require phishing-resistant multifactor authentication for privileged users by default. Shared vendor passwords, remote-access accounts without MFA, and old service accounts are frequent entry points. Patch what attackers already use. CISA maintains its Known Exploited Vulnerabilities catalog for flaws with significant federal-enterprise risk, and Binding Operational Directive 22-01 sets remediation due dates for federal civilian agencies. Prioritize internet-facing, VPN, firewall, and OT remote-access flaws on that list.
How should you separate IT from OT?
Treat IT and OT as different risk zones. NIST SP 800-82 Rev. 3, summarized by Industrial Cyber, directs operators to segment OT into zones, separate IT from OT with a demilitarized zone, and control conduits to contain intrusions.
A breach in email or billing should not reach process controls. Make each boundary enforce a narrow purpose: Review firewall rules, data diodes, and access lists on a schedule. Stale temporary rules become permanent paths for lateral movement.
- allow only defined traffic between IT, DMZ, and each OT zone
- block direct IT-to-controller connections and require a jump host
- log and inspect transfers across conduits instead of permitting file shares
- disable unused ports, protocols, and wireless paths on OT assets
How do you detect intrusions early?
Organize monitoring around outcomes, not tools. NIST's Cybersecurity Framework 2.0 uses six Functions — Govern, Identify, Protect, Detect, Respond, Recover — adding Govern for risk strategy, oversight, and supply-chain management, as described in the NIST framework document. Assign an owner for each function so gaps get fixed. Watch for OT-specific warning signs: logins outside maintenance windows, engineering-workstation changes, PLC program uploads or downloads, new devices on control networks, and blocked internet-egress attempts from OT.
Pair network detection with asset inventory and configuration baselines. Without a known-good baseline, abnormal commands look normal. Keep monitoring durable during disruption. Forward logs to protected storage, synchronize time across IT and OT, and test alerts with realistic attack paths. A detector that only works when email is up will fail during ransomware.
How do you recover and report?
Keep recovery separate from production. The joint CISA, NSA, FBI, and MS-ISAC StopRansomware Guide directs victims to maintain offline encrypted backups and golden images, then regularly test restoration integrity before recovery. Store at least one copy offline and offsite, protect backup credentials with MFA, and rehearse full rebuilds of domain, backup, and OT supervision systems. Plan reporting at the same time.
HSToday analysis of the 2022 CIRCIA law notes covered entities in 16 critical-infrastructure sectors must report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours. Keep contact details, incident criteria, and evidence-preservation steps in a one-page playbook. Do not reconnect cleaned systems to OT until passwords are reset, vulnerabilities are patched, and monitoring confirms normal behavior. Restore process control in stages and validate safety interlocks first.
Frequently Asked Questions
Does segmentation replace patching and MFA?
No. Segmentation limits movement, while patching and phishing-resistant MFA reduce initial entry. Use them together.
What should a small water or energy operator do first?
Remove OT from the internet, change default credentials, enable MFA on remote access, back up configurations offline, and track CISA's high-impact baseline protections.
You Might Also Like
- Cybersecurity — RaaS Prevention Guide: Controls, Monitoring, and Recovery
- Cybersecurity — Volt Typhoon FAQ: Notifications, Rights, and Protection
- Cybersecurity — Salt Typhoon: What Organizations Should Fix Next