5 Priorities for Securing Critical Infrastructure
Critical infrastructure operators can strengthen cyber resilience by focusing on five areas: tightening remote access, controlling outbound traffic, eliminating outdated security exceptions, maintaining an accurate OT asset inventory, and preparing defenders against the tactics real adversaries use.
November is Critical Infrastructure Security and Resilience Month, an annual effort led by CISA to highlight the importance of protecting the systems and services society depends on every day. It’s also an opportunity for critical infrastructure organizations to take a closer look at where they can reduce cyber risk and strengthen resilience against disruption.
For organizations responsible for energy, water, manufacturing, transportation, and other essential services, that means looking beyond individual security controls to the practices that reduce exposure and strengthen the resilience of cyber-physical systems (CPS) and the people responsible for defending them.
Key Takeaways
Remote access in critical infrastructure should be limited to the systems and resources each user actually requires, with VPN use reserved for cases that require network-level connectivity.
Outbound traffic controls can disrupt the command-and-control, tool delivery, and data exfiltration that allow an initial compromise to become a sustained attack.
Temporary access, firewall, and connectivity exceptions can become long-term exposure when they remain in place after their original purpose ends.
Effective OT asset inventories capture operational context, including criticality, connectivity, ownership, protocols, and compensating controls.
Cyber readiness improves when teams prepare against the tactics and techniques adversaries actually use and validate their response under realistic conditions.
1. How Can Critical Infrastructure Operators Reduce Remote Access Risk?
Critical infrastructure operators can reduce remote access risk by limiting users to the systems and resources they require and applying strong identity and access controls. For many organizations, that also means reducing reliance on broad network-level VPN access where more targeted alternatives are practical.
Engineers, vendors, contractors, and third-party maintenance providers all need secure connectivity into the kinds of environments used for operating critical infrastructure. Sometimes this access comes from geographically dispersed locations. For many organizations, that access has traditionally been provided through VPNs.
Several attacks in recent years show why remote access infrastructure can become a weak point. During the coordinated cyberattack against Poland's energy sector in December 2025, threat actors gained initial access by exploiting internet-facing FortiGate VPN and perimeter devices that lacked adequate authentication controls, including multi-factor authentication. From there, attackers were able to establish a foothold before moving deeper into operational environments.
These risks extend beyond any single attack. As explored in Cloud Range's analysis of securing remote access in industrial environments, VPNs, firewalls, remote desktop services, vendor portals, and other gateways can become high-value targets when they provide pathways between outside users and industrial environments.
Zero Trust Network Access (ZTNA) offers a different approach. ZTNA gives users access to specific applications or services based on identity, device posture, and policy rather than giving them broad access to a network.
Users only see the resources they are explicitly authorized to access, which can reduce both the attack surface and opportunities for lateral movement if an account is compromised. That distinction is particularly valuable in converged IT/OT environments, where a compromise starting on the enterprise IT side can ultimately have operational consequences if remote access is overly permissive.
There will still be operational cases where VPNs are necessary:
Engineering workstations may require Layer 3 connectivity to PLCs, RTUs, or HMIs.
Many industrial protocols, including Modbus/TCP, DNP3, PROFINET, EtherNet/IP, and OPC DA, were not designed to be proxied through a ZTNA broker.
Legacy OT systems may not support modern identity-aware access models such as SAML, OIDC, or even TLS.
The goal is to limit VPN access to operational scenarios where network-level connectivity is genuinely required while moving other users toward identity-aware, application-specific access.
2. Why Should Critical Infrastructure Operators Control Outbound Traffic?
Outbound traffic controls can limit an attacker's ability to maintain command-and-control communications, download additional tools, or exfiltrate stolen information after gaining initial access.
One of the easiest mistakes to make when designing network security is to think primarily about how attackers get in. In reality, an intrusion often becomes far more dangerous once malware establishes stable communication with its operator. Ransomware affiliates don't work in isolation, and data isn't exfiltrated into thin air.
Remote operators need command-and-control channels, compromised hosts may need to download additional tooling, and stolen credentials or data need somewhere to be sent. Those outbound connections are what allow an initial compromise to develop into a sustained campaign.
Restricting outbound destinations to appropriate geographic areas, monitoring DNS requests for suspicious domains, inspecting encrypted traffic where operationally appropriate, and maintaining tightly controlled allowlists for systems that genuinely require internet connectivity can make it harder for attackers to maintain persistence or exfiltrate data. If an adversary loses reliable communication with compromised systems, the intrusion becomes considerably harder to sustain.
Operators of critical infrastructure spend enormous effort controlling the movement of physical assets. Water, electricity, and fuel only flow where they're intended to. Digital traffic deserves the same discipline. Every unnecessary outbound connection is another pathway through which an attacker can receive instructions, download tools, or extract sensitive information.
3. Why Should Security Exceptions Be Treated as Technical Debt?
Security exceptions can become technical debt when temporary access, connectivity, or configuration changes remain in place long after their original purpose ends.
Every exception is usually made for a good reason. A vendor urgently needs remote access, an engineer requires unrestricted connectivity to troubleshoot a PLC, or a firewall rule is opened during commissioning. The problem is that few of these exceptions come with an expiration date. What begins as a temporary necessity can become part of the production environment long after everyone has forgotten why it was approved.
In operational environments where systems often remain in service for decades, these forgotten exceptions can easily outlive the projects, contractors, and personnel that created them. Attackers don't distinguish between infrastructure that was intentionally exposed and infrastructure that was forgotten. They exploit the opportunities available to them.
Critical infrastructure operators can regularly review exceptions such as:
Vendor access that was originally intended to be temporary.
Engineering workstations with unrestricted internet connectivity.
Firewall rules created for commissioning, maintenance, or troubleshooting.
Accounts, services, or connections associated with former contractors or completed projects.
Questions such as "Does this vendor still require permanent access?" or "Why is this engineering workstation still permitted to reach the internet?" can reveal exposure that has become part of the environment through inertia rather than deliberate security decisions.
If the purpose of an exception is no longer clear, it deserves review before it becomes a forgotten pathway into the environment.
4. What Should an OT Asset Inventory Include?
An effective OT asset inventory should show not only what devices exist but where they sit in the environment, how they communicate, who owns them, how critical they are, and what protections are in place.
Operational technology networks often contain decades' worth of equipment from multiple vendors, running proprietary operating systems, obsolete firmware, and industrial protocols that predate modern cybersecurity practices. Some assets cannot be patched without interrupting essential services. Others are so operationally critical that taking them offline for routine maintenance may not be practical.
An effective OT asset inventory should identify:
The asset and its location within the environment.
Firmware and software versions.
Industrial protocols and communications.
Asset ownership and responsibility.
Operational criticality.
Connectivity to other IT and OT systems.
Compensating controls protecting systems that cannot easily be updated.
Without that context, vulnerability management becomes guesswork.
Security teams can't effectively prioritize risks if they don't understand which assets are internet-facing, which communicate across IT and OT boundaries, or how vulnerabilities in connected cyber-physical systems could affect physical operations. Legacy systems may also require additional segmentation, monitoring, or access controls.
Recent attacks against U.S. water systems offer a useful example of why visibility and understanding of operational environments matter. Cloud Range's analysis of three lessons from the 2026 U.S. water system cyberattacks looks at the implications for OT security and critical infrastructure readiness.
It's worth treating the asset inventory as a living operational map rather than a spreadsheet produced for compliance purposes. As environments evolve through maintenance projects, contractor work, and equipment replacement, that map should evolve with them.
5. How Should Critical Infrastructure Teams Prepare for Real Adversary Tradecraft?
Critical infrastructure teams can make cyber preparation more relevant by building simulations around the tactics, techniques, and attack paths adversaries are actually using against their sector.
The purpose of cybersecurity simulations is to build confidence that people, processes, and technology will perform under the conditions of a real attack. That objective becomes much harder to achieve if the situation is purely hypothetical and bears little resemblance to the techniques adversaries are actually using.
Threat intelligence and attacker frameworks can shape how critical infrastructure operators prepare for cyberattacks. If you understand which adversaries target your sector and what tactics they use, you already possess a blueprint for more relevant cyber simulations.
Rather than asking, "How would we respond to a ransomware attack?", a better starting point is, "How would the threat groups most likely to target our organization actually gain access?"
Consider questions such as:
Which remote access technologies are adversaries exploiting?
Which MITRE ATT&CK techniques appear repeatedly in campaigns against energy, water, or manufacturing?
Do the relevant threat actors rely on stolen VPN credentials, exposed perimeter devices, phishing, or valid accounts?
Once inside, how do they establish persistence, move between enterprise IT and OT, and communicate with command-and-control infrastructure?
Those questions can determine what gets simulated. Security teams need to understand whether they would detect the initial access techniques, recognize early indicators of compromise, investigate the attacker's activity, and contain the intrusion before it reaches operational systems.
Threat intelligence becomes more useful for readiness when teams can put it into practice. Live-fire cyber simulations allow defenders to encounter adversary techniques in realistic IT/OT environments, evaluate how well they detect and investigate them, and identify gaps before a real incident. Cloud Range's critical infrastructure environments, for example, support IT and OT responders practicing detection, response, and remediation against attack scenarios mapped to the MITRE ATT&CK Framework for ICS.
Securing Critical Infrastructure for the Long Term
Critical Infrastructure Security and Resilience Month puts a timely focus on the resilience of the systems Americans rely on every day. For critical infrastructure operators, long-term resilience comes from reducing unnecessary exposure, understanding what exists across IT and OT environments, and proving that defenses will work against the threats most likely to target them.
The five priorities above address different parts of that challenge, but they share a common goal: reducing the gap between assumed readiness and demonstrated performance.
Realistic cyber simulation provides one way to test that readiness before an incident affects production or essential services. Cloud Range for Critical Infrastructure provides integrated IT/OT environments where security and incident response teams can practice against live-fire attacks without putting production systems at risk. Environments can incorporate industrial technologies and systems including SCADA, HMIs, PLCs, engineering workstations, OT security tools, and other components relevant to the organization's operations.
Securing critical infrastructure is ultimately about more than having the right controls in place. It is about knowing that people, processes, and technology can perform when those controls are tested by a real attack.
Learn more about Cloud Range for Critical Infrastructure.
Frequently Asked Questions
What are the biggest cybersecurity risks to critical infrastructure?
Critical infrastructure faces risks including compromised remote access, exposed or legacy systems, weak IT/OT segmentation, excessive permissions, unmanaged security exceptions, incomplete asset visibility, and attacks targeting industrial processes or essential services. The specific risk varies by sector, architecture, technology, and operational requirements.
Why is OT cybersecurity different from traditional IT security?
OT environments often include specialized industrial equipment, legacy systems, proprietary protocols, and operational requirements that differ from traditional IT environments. Availability, safety, and continuity of operations can also limit practices such as frequent patching or taking systems offline for maintenance.
What are cyber-physical systems (CPS)?
Cyber-physical systems (CPS) integrate computing, networking, and physical processes. In critical infrastructure, CPS can include industrial control systems and connected technologies used to monitor or control physical operations across sectors such as energy, water, manufacturing, and transportation.
What is zero trust in an OT environment?
Zero trust uses identity, device, policy, and least-privilege principles to control access to specific resources rather than assuming that a user or system can be trusted based on network location. In OT environments, the approach also has to account for legacy technologies and operational use cases that may still require network-level connectivity.
How can critical infrastructure operators test cyber readiness?
Critical infrastructure operators can use realistic IT/OT cyber simulations to evaluate how effectively teams detect, investigate, contain, and respond to attacks without putting production systems at risk. Simulations based on real adversary techniques can expose gaps in tools, processes, coordination, and response before those gaps affect operational systems.