Disconnected by design: safeguarding operational technology from growing threats

‍

The systems that power our daily lives - electricity, water, transportation, and more - are facing an evolving digital threat landscape. In response, U.S. security agencies are urging critical infrastructure operators to disconnect their Operational Technology (OT) systems from the public internet. This advisory reflects a growing concern over how exposed our Critical National Infrastructure (CNI) has become.

The vulnerability of Operational Technology

Operational Technology refers to the systems that control physical processes, traditionally designed to be isolated, reliable, and long-lasting. In recent years, digital transformation has led to more of these systems being networked for convenience, efficiency, and remote monitoring.

Many of these legacy systems were never built with cybersecurity in mind. Once they’re online, they become visible and vulnerable to threat actors who scan the internet looking for exposed devices. Automated tools can guess passwords, identify weak authentication, and exploit unsecured interfaces to gain access, manipulate controls, or disable functions entirely.

Real-world risks to critical infrastructure

These aren’t hypothetical scenarios. There have already been reported instances of attackers targeting water treatment facilities, disrupting energy services, and infiltrating transportation control systems. Due to OT governing physical processes, the consequences can be severe: from widespread outages and industrial shutdowns to public safety concerns and environmental hazards.

This is what makes OT security uniquely urgent. An attack on IT systems might result in data theft or ransomware demands. An attack on OT can shut down electricity to a city or contaminate a water supply. The stakes are significantly higher.

Security agencies are not calling for a complete retreat from modernisation. Rather, they’re reinforcing a core cybersecurity principle: minimise unnecessary exposure. If an OT system does not require internet access, it should be physically or logically disconnected.

There are more secure ways to enable remote access or data sharing, such as using VPNs, segmentation, or air-gapped architectures that isolate OT environments from public networks. These approaches allow organisations to retain the benefits of connected systems without incurring the full risk of direct internet exposure.

Understanding the threat landscape

Attackers today don’t need to be highly sophisticated nation-state actors. Many tools used to discover and exploit exposed OT systems are widely available and increasingly automated. Threat actors can scan the internet for vulnerable endpoints, access them with default credentials or weak passwords, and manipulate them, sometimes without even knowing the system’s exact function.

This kind of low-effort, high-impact targeting makes it all the more critical for organisations to proactively secure their assets. Any exposed system can become a target, and in the context of critical infrastructure, the ripple effects can be national in scope.

Effective protection starts with visibility. Organisations must conduct thorough audits to identify which OT systems are internet-facing, intentionally or accidentally. This includes checking for legacy devices, misconfigured remote access points, and unsecured web interfaces.

From there, steps can be taken to segment networks, limit access through strong authentication, apply necessary patches, and adopt zero-trust principles where possible. Importantly, IT and OT teams must collaborate more closely, breaking down silos that have traditionally separated cybersecurity from operational risk management.

Building resilience for the future

Cybersecurity is a business continuity issue. Leaders across industries must recognise that securing OT is critical to maintaining safe, reliable services. This means investing in people, processes, and technologies that prioritise resilience.

Disconnecting OT from the public internet isn’t a cure-all, but it’s a crucial step. In a threat environment where even basic scanning tools can lead to real-world consequences, reducing unnecessary exposure is the fastest way to harden defenses. Critical infrastructure is too important to leave vulnerable. It must be protected by design, before disruption becomes disaster.

‍