The notoriety of recent attacks on the industrial sector, and industrial control systems specifically, has led to a surge in security-related investments. However, while these investments reflect positives steps in the right direction, these tools and resources obviously need the right strategies to accompany their implementation.
I recently sat down with Matt Hayden, vice president of Cyber and Emerging Threats at GDIT to discuss the concerns he sees as more attackers, armed with AI, are turning their attention to the legacy soft spots found in so many operational technology environments.
Jeff Reinke, editorial director: The industrial sector continues to struggle with securing an increasing number of connections, as the recent attacks on water treatment facilities demonstrated. What do you feel these organizations might be lacking in better securing these connection points?
Matt Hayden, Vice President of Cyber and Emerging Threats at GDIT: The central challenge is the exposure created by the connections themselves. Industrial systems that were once isolated are increasingly connected to business networks, remote operations, equipment manufacturers, and outside service providers.
Every connection may serve a legitimate operational purpose, but it also creates another path into that environment that can be compromised. Most organizations don’t have a current picture of what every connection actually is, and you can’t protect what you can’t see.
Water treatment plants have an open door problem. It’s very hard to keep firewalls from being popped in today’s AI threat environment, and a lot of OT systems were never built for user-defined roles. It’s access or no access. And with OT being refreshed every 30 years as opposed to every four, there’s not a lot of new equipment coming in.
The solution we’re seeing is to leverage AI to map those connected devices, interpret how they’re most vulnerable, and calculate risk that is dynamic and customized for that environment. The goal is not to make every industrial device independently secure. That’s just not realistic.
The goal is to build layers of protection so a weakness in one component doesn’t cascade into a critical function. At the end of the day, resilience is what they’re after, not an impenetrable fortress.
JR: Strategies involving the use of Zero Trust access and patching against vulnerabilities run up against the same obstacle - these actions slow things down on the plant floor. What advice would you offer when it comes to implementing such strategies without hindering productivity?
MH: This is a risk and reward calculation. If you take down one vulnerable product on a plant floor, patch it, and put it back in place, its new software may cause other interactions to break. There are a lot of dominoes that fall with any one patch. So you have to think of it as an environment, not just an object, and those operational realities have to be built into any security plan.
Zero Trust doesn’t mean repeatedly challenging every employee or every transaction. It means making sure every transaction follows expected behavior patterns, based on a validated identity, an approved device, and a legitimate operational need.
There’s not a cyber person out there who doesn’t say patch your systems. But in OT, the emphasis is less on immediate patching and more on segmenting networks by design and understanding how resilient you’d be if a device went offline. It’s not as simple as lifting and shifting what was built for IT into OT.
We’ll eventually reach a point where more industrial systems can be updated in live environments with less disruption. That’s the secure by design model. Until then, the responsible approach is to reduce exposure and restrict access from the internet until a vulnerability can be corrected or mitigated.
JR: Segmentation is seen as a critical strategy in guarding against OT attacks that might start in IT. What are some best practices you can share in implementing and maintaining a segmentation strategy?
MH: Segmentation is still an objective rather than a completed capability for many of these organizations. A lot of them brought technology online by just adding it to their IT network. Even if you carve out your OT networks, remote access is still the principal vulnerability you have to guard against.
The priority is to cut unnecessary external connections, establish distance between ordinary users and any system capable of changing, stopping, or damaging critical processes, and make sure an authenticated IT user can’t get into the OT environment without discrete roles and permissions. We really love single sign-on, but we don’t want single sign-on to extend access into our OT environment.
Legacy equipment should not be a reason to postpone segmentation. Older devices can be placed behind modern gateways, monitored for unusual activity, and limited to a narrow set of approved destinations. Operations that are working fine don’t have to be thrown out, so long as they don’t have bare metal access to the internet.
Segmentation also can’t be treated as a one-time network project. Every new sensor, software platform, or remote management agreement can change that environment overnight. It has to be reviewed every time a change is made to the system, not a couple of months out of the year.
JR: What do you see as some of the most concerning threat actors or tactics currently targeting the industrial sector?
MH: The most serious concern is nation-state actors going after operational technology that provides systemic function for the United States. We’ve seen this with Volt Typhoon, where nation-state actors put persistent access into areas with no intelligence value whatsoever, like systems that control power.
We need to be able to detect and take down that persistence so they don’t have a stranglehold over our critical functions in a time of conflict.
That nation-state activity has also become almost a demonstration of what you can do in OT, and it’s trickling down to criminals, lone wolves, and what we used to call script kiddies trying things out from their basement. We’ve seen double-digit incidents across the water sector involving exploited remote access tools.
We’ve also seen people across Europe and the U.S. logging into refrigeration systems, turning on the defrost, and destroying food. We’ve been lucky not to see those harms scale into human impacts, but I wouldn’t say that’s by choice.
Organizations should plan knowing they are a contested network that will be scanned for vulnerabilities at any time, whether for skill, national intent, or criminal pursuits like ransomware that disables your operational technology until a ransom is paid. The same protections still work. It’s just that threat actors are becoming bolder as techniques become cheaper to implement.
JR: What role do you see AI playing in cybersecurity - for both the good guys and the black hats?
MH: This question changes almost weekly for us. On offense, AI lets an actor who knew nothing about an enterprise quickly discern all its elements and automate living off the land techniques. One operator isn’t managing a campaign one-to-one anymore. They can manage campaigns one-to-many.
On defense, AI can detect vulnerabilities in code and remove them much faster than we could in the past. One example we heard from several partners is doing two years’ worth of vulnerability disclosure in two weeks. But then you have two years’ worth of vulnerabilities to deal with, and every CISO in America has to patch rapidly because they don’t know which one someone will use to lily pad into their environment.
We probably have about a two-year sprint to get ahead of the vulnerable software problem, after which we expect more AI-centric secured code and a more manageable baseline. Defenders can also run automated red team pen tests that simulate attackers and show which mitigations to put in place. If we keep red teaming our networks in cycles, we take out the low-hanging fruit AI-driven attacks look for first.
