In our first post, “OT Attack Surface Management: It’s Turtles All the Way Down”, we established that an attacker’s view of your OT attack surface is a complex environment where any point can be an entry point. It truly is “turtles all the way down.”
Now we look past the top turtle. Some of the most devastating attacks don’t come from a direct assault on your perimeter, but from exploiting the trust you place within the stack in your vendors, your software, and even your own staff. In this second part of our series based on Ray Blasko’s recent presentation at OT.SEC.CON, we’ll explore how to manage OT supply chain security and insider threats. You can watch the full presentation on the BreakPoint Labs video hub.
The Vendor Risk: When OT Supply Chain Security Fails
A supply chain attack is one of the most difficult threats to defend against. It can be a piece of hardware, a software application, or even a routine update that arrives with a malicious payload hidden inside. When a vendor is compromised, attackers can exploit that trusted relationship as a pathway into your network. They effectively inherit the same trust and privileges you’ve granted to that vendor.
So what can you do?
- Enforce the Principle of Least Privilege: When you give a vendor access, are you giving them the keys to the kingdom? Too often, vendors are granted administrative privileges when they don’t need them. Restrict vendor access to only what is absolutely necessary for them to do their job, and nothing more.
- Conduct Asset Inventories: You can’t defend what you don’t know you have. During one physical walkthrough for a critical infrastructure client, our team found a small, unknown device with antennas sticking out of a server rack. It turned out that a vendor, tired of driving to the remote site, had installed it themselves two years prior to creating their own remote access. The client was exposed to a significant, unknown risk for years, not out of malice, but laziness. Regular asset inventories and physical walkthroughs are essential for uncovering these hidden liabilities.
The Insider Threat in Operational Technology
No one wants to believe their coworker is a spy. We want to trust the people we work with. But an insider threat isn’t always malicious. It could be an employee, a contractor, or anyone with insider knowledge who is unintentionally tricked or, worse, is being blackmailed or threatened.
The danger is that this person may already have administrative privileges, allowing them to bypass many of your defenses from the start.
The defense against this begins with a simple acknowledgment that the threat is real. From there, your strategy relies on two core principles:
- Defense-in-Depth: If a trusted user’s account is compromised, what prevents it from being used to move laterally across your network? You need monitoring, controls, and incident response plans at every level to contain the blast radius.
- Effective Security Training: Awareness is infinitely more valuable than ignorance. Train your people on what suspicious activity looks like and give them a clear, safe process for reporting it.
Trust is a relationship, not a security control. Every layer of your operation, from the software you install to the people you grant access, must be secured and validated.
Up Next: In our next post, we get physical. We’ll explore how attackers can walk right past your digital defenses in “OT Physical Security Assessment: A Guide to Compromising Remote Sites.”
Are you effectively managing the risk from your third-party vendors and internal systems? The experts at BreakPoint Labs can help you build a more resilient security posture. Contact us to start the conversation.
About the Author
Ray Blasko is the Technical Director for offensive operations at BreakPoint Labs and a Red Team Operator for a DoD-certified Red Team, responsible for assessing and securing critical ICS/SCADA assets. He is recognized as a subject matter expert in both attacking and defending IT and OT environments, and he excels at resolving the technical and strategic issues that arise in protecting critical infrastructure. Ray holds numerous professional certifications and regularly presents at DoD Red Team conferences, trade conventions, and information security events.