If you don’t know what is exposed, you can’t protect it

The National Cyber Security Centre has issued a warning about increased targeting of operational technology across a number of sectors, including here in the UK. In some cases, this activity has already caused limited real-world disruption.

Operational technology, usually referred to as OT, is the technology used to control physical equipment and processes. It can include machinery on a manufacturing floor, building management systems, access controls, environmental monitoring and other connected equipment.

It would be easy to see this as something that only affects critical infrastructure or large industrial organisations, but the warning is wider than that. The NCSC is also seeing disruptive activity targeting internet-facing systems and edge devices across different sectors. These are devices such as routers, firewalls and remote-access appliances which sit at the boundary of a network and can provide a route into the wider organisation.

The NCSC warns that businesses shouldn’t assume their systems are inaccessible from the internet without actually checking.

That sounds obvious, but exposure isn’t always deliberate. It might be caused by an old connection that nobody remembers, a configuration that hasn’t been reviewed, equipment that is no longer supported or an asset that nobody is actively managing.

For leadership teams, the first step is to establish whether the business has an accurate picture of what is connected to its network, what can be reached from the internet and who is responsible for each system. If the answer is based on assumption rather than something that has been checked recently, there may be gaps nobody knows about.

The NCSC’s recommendations are practical. Remove direct internet access where it isn’t needed. Replace default credentials and use multi-factor authentication wherever the technology supports it. Keep boundary devices updated and replace them before they reach end of life.

Business IT, management networks and operational technology should also be properly separated. This reduces the risk of an incident in one part of the organisation spreading freely into another.

Logging and monitoring are equally important. Unexpected connections and configuration changes can otherwise go unnoticed until they start affecting operations.

Businesses also need to think carefully about what recovery would involve. Backups should include the configurations, controller logic and engineering information needed to restore essential systems. Those backups need to be tested, and the people responding need to know how to isolate affected equipment quickly.

It’s possible to have backups and still discover, at the worst possible time, that recovery is much more difficult than expected.

Although much of the work involved is technical, the consequences belong to the whole business. If a key operational system stopped working, leaders would need to understand which services, production lines or processes would be affected, whether the organisation could continue operating safely and how long recovery might realistically take.

There would also be decisions to make about customers, employees, suppliers and regulators, often before the organisation had a complete picture of what had happened.

These are difficult things to work out for the first time while an incident is already unfolding. It’s one of the reasons we have been developing Silent Intercept at Shackleton Technologies. Security tools matter, but resilience also depends on how well people share information and make decisions across the business when the situation is unclear and changing quickly.

The NCSC recommends regularly exercising response and recovery arrangements. A written plan is useful, but testing it with the people who would actually have to use it is usually where the overlooked assumptions and gaps become apparent.

This warning isn’t a reason to panic, but it is a good reason to check. Businesses need to know what operational technology they have, understand how it is connected and confirm whether any of it can be reached from outside the organisation. They also need to be confident that, if something does go wrong, their response and recovery arrangements will work in practice.

The full NCSC warning and recommended actions are available here.