cyber.hendryadrian.com
Detection & Defense · bleepingcomputer.com

Closing Identity Gaps in Critical Infrastructure Security

· Original article ↗

Summary

A sponsored article urges critical infrastructure organizations to strengthen zero-trust workforce access by checking device identity and posture alongside user credentials, citing risks illustrated by Colonial Pipeline and Volt Typhoon.

Key points

  • The article cites the 2021 Colonial Pipeline attack as an example of how a compromised account can contribute to wider disruption.
  • It says Volt Typhoon has used stolen administrator credentials, legitimate tools, and compromised edge devices to maintain access and blend into normal activity.
  • CISA guidance for operational technology emphasizes asset visibility, identity and access management, segmentation, monitoring, and supply-chain risk.
  • The article recommends basing access on device trust and health, user context, and resource sensitivity—not credentials or network location alone.
  • It notes that MFA remains essential but may not prevent access through compromised sessions, rogue devices, or trusted remote-access paths.
  • Specops says its Device Trust product checks device posture at access requests and during sessions, and can limit access to authorized devices.

Article Details

Defense Focus
Reduce implicit trust in critical infrastructure access by binding identities to verified devices and evaluating device posture, user context, and resource sensitivity at each access request.
Detection Methods
  • Check device posture at each access request and throughout sessions, including whether the device is known, trusted, healthy, encrypted, updated, and compliant.
  • Identify active threats, disabled security controls, or outdated software on devices accessing protected resources.
  • Maintain visibility into managed and unmanaged devices accessing the network.
Data Sources
  • Identity and access request context
  • Device inventory and device-to-identity bindings
  • Device health, encryption, patch, and compliance posture
  • Endpoint threat and security-control status
  • User context and resource sensitivity
Defensive Actions
  • Require multi-factor authentication for critical infrastructure access.
  • Bind each identity to specific authorized devices and assess device posture before granting access.
  • Apply access policies that adapt to device health, user context, and resource sensitivity rather than relying on network location alone.
  • Use asset visibility, identity and access management, segmentation, monitoring, and supply-chain risk controls in OT environments.
  • Provide device remediation options and update grace periods while maintaining access controls.

MITRE ATT&CK

T1078 · Valid AccountsThe article says attackers use stolen administrator credentials and legitimate accounts to access critical infrastructure networks.T1090 · ProxyThe article says attackers route traffic through compromised devices to make attribution and detection harder.T1566 · PhishingThe article identifies phishing users as a method state-backed actors use to obtain access.

Threat Actors

Volt TyphoonThe article describes Volt Typhoon as targeting critical infrastructure and associates its tactics with blending into normal network activity. Microsoft reportedly observed activity against organizations in Guam and other U.S. locations; the article says the concern included possible future disruption.

Vendors

Specops SoftwareSponsored by Specops Software

Products

Specops Device TrustThe security of identity systems is crucial for resilient critical infrastructure, which is where specialized solutions like Specops Device Trust help.

Countries

United Statessystems including billing infrastructure, and triggered a shutdown that disrupted fuel supply across the U.S.

Industries

communicationslocations, Microsoft reported Volt Typhoon activity against communications, manufacturing, utilities, construction and transportation organizations.Constructionlocations, Microsoft reported Volt Typhoon activity against communications, manufacturing, utilities, construction and transportation organizations.Critical infrastructureClosing the Identity Gaps in Critical Infrastructure SecurityManufacturinglocations, Microsoft reported Volt Typhoon activity against communications, manufacturing, utilities, construction and transportation organizations.Transportationlocations, Microsoft reported Volt Typhoon activity against communications, manufacturing, utilities, construction and transportation organizations.Utilitieslocations, Microsoft reported Volt Typhoon activity against communications, manufacturing, utilities, construction and transportation organizations.

Related Articles