In our first post, “OT Attack Surface Management: It’s Turtles All the Way Down”, we established that an attacker’s view of your OT attack surface is a complex environment where any point can be an entry point. It truly is “turtles all the way down.”

Now we look past the top turtle. Some of the most devastating attacks don’t come from a direct assault on your perimeter, but from exploiting the trust you place within the stack in your vendors, your software, and even your own staff. In this second part of our series based on Ray Blasko’s recent presentation at OT.SEC.CON, we’ll explore how to manage OT supply chain security and insider threats. You can watch the full presentation on the BreakPoint Labs video hub.

The Vendor Risk: When OT Supply Chain Security Fails

A supply chain attack is one of the most difficult threats to defend against. It can be a piece of hardware, a software application, or even a routine update that arrives with a malicious payload hidden inside. When a vendor is compromised, attackers can exploit that trusted relationship as a pathway into your network. They effectively inherit the same trust and privileges you’ve granted to that vendor.

So what can you do?

• Enforce the Principle of Least Privilege: When you give a vendor access, are you giving them the keys to the kingdom? Too often, vendors are granted administrative privileges when they don’t need them. Restrict vendor access to only what is absolutely necessary for them to do their job, and nothing more.
• Conduct Asset Inventories: You can’t defend what you don’t know you have. During one physical walkthrough for a critical infrastructure client, our team found a small, unknown device with antennas sticking out of a server rack. It turned out that a vendor, tired of driving to the remote site, had installed it themselves two years prior to creating their own remote access. The client was exposed to a significant, unknown risk for years, not out of malice, but laziness. Regular asset inventories and physical walkthroughs are essential for uncovering these hidden liabilities.

The Insider Threat in Operational Technology

No one wants to believe their coworker is a spy. We want to trust the people we work with. But an insider threat isn’t always malicious. It could be an employee, a contractor, or anyone with insider knowledge who is unintentionally tricked or, worse, is being blackmailed or threatened.

The danger is that this person may already have administrative privileges, allowing them to bypass many of your defenses from the start.

The defense against this begins with a simple acknowledgment that the threat is real. From there, your strategy relies on two core principles:

1. Defense-in-Depth: If a trusted user’s account is compromised, what prevents it from being used to move laterally across your network? You need monitoring, controls, and incident response plans at every level to contain the blast radius.
2. Effective Security Training: Awareness is infinitely more valuable than ignorance. Train your people on what suspicious activity looks like and give them a clear, safe process for reporting it.

Trust is a relationship, not a security control. Every layer of your operation, from the software you install to the people you grant access, must be secured and validated.

---

Up Next: In our next post, we get physical. We’ll explore how attackers can walk right past your digital defenses in “OT Physical Security Assessment: A Guide to Compromising Remote Sites.”

Are you effectively managing the risk from your third-party vendors and internal systems? The experts at BreakPoint Labs can help you build a more resilient security posture. Contact us to start the conversation.

In this series, we’ve explored how an attacker truly sees your attack surface, the hidden dangers within your supply chain and staff, and how easily your defenses can be bypassed through physical compromise. Now, we will tie it all together and tackle the ultimate fear: nation-state attackers and the zero-day exploits they wield. This entire series is based on Ray Blasko’s presentation at OT.SEC.CON, and we highly recommend you watch the full recordings on the BreakPoint Labs video hub to see the complete picture.

What is the key to proactive OT security? How do you defend against the most advanced threats, like nation-state OT attacks and zero-day exploits? The answer lies not in stressing over the unknown, but in relentlessly mastering the fundamentals.

Why Strong Fundamentals Are Your Best Defense

Nation-state actors have incredible resources, but they don’t use their most valuable tools unless they have to. A zero-day exploit is a precious asset; every time it’s used, there’s a risk it will be discovered and patched, rendering it useless.

Why burn a million-dollar exploit when they can get in through an unpatched server, a misconfigured firewall, or by walking through the unlocked back door of a remote site you forgot about?

They will always look for the easiest path in first. This is why mastering the fundamentals is your single greatest defense against even the most advanced adversaries. The stronger your basic security posture, the more likely they are to pass you over for an easier target.

A Checklist for Proactive OT Security

Becoming proactive means building a security culture rooted in a few key principles. Here is your playbook, based on an attacker’s mindset.

• Embrace True Defense-in-Depth. You must operate under the assumption of “assumed breach”. When an attacker gets past your perimeter, your defenses shouldn’t stop. You need defenses, monitoring, and incident response plans at every single level of your environment to stop them from moving laterally and achieving their goals. Having defense-in-depth and practicing assumed breach scenarios is what protects you when a zero-day or nation-state adversary gets in.
• Conduct Meaningful Security Assessments. An assessment is a tool for improvement, not a weapon for punishment.
  • They don’t always have to be external, and you can get creative – test specific attack vectors, technologies, and scenarios that keep you up at night.
  • Cooperative, “white-box” assessments, where defenders and attackers work together, can provide incredible value far more efficiently than a blind test.
  • Most importantly, you must commit to remediating the findings. An assessment is pointless if you don’t fix what’s broken. Implement Effective Training. Nobody likes mandatory security training, but awareness is infinitely more valuable than ignorance. To make training stick:
    • Keep it simple and consistent.
      • Make it a regular habit to keep security top of mind.
      • Make it specific to your organization.
      • Always explain the “why.” Understanding the potential impact is what helps an employee internalize the lesson.
• Validate Everything. Always. Your policies are only paper; validation ensures you are in a truly secure state. Things change constantly, and what was secure yesterday may not be secure today. Remember, the bad guys don’t attack your policies; they attack your implementation. Keep these up-to-date:
  • The principle of least privilege, especially with vendors
  • Vendor access and security standards
  • Port security and network access controls
  • Effective and secure patching processes
  • Physical security

The Choice: Proactive or Reactive?

Your true attack surface isn’t just a line on a network diagram; it’s everything. It’s your technology, your people, your processes, and your physical locations. The only way to defend it is to understand it, prioritize the risks, and actively work to shrink it every day.

You have a choice. Be proactive or you’ll end up being reactive. We know which side of that equation is better for business.

---

Ready to build a truly proactive security posture? The experts at BreakPoint Labs combine deep offensive expertise with a collaborative approach to help you see your environment through the eyes of an attacker and build a more resilient defense. Contact us today to learn how we can help.