In our first post, “OT Attack Surface Management: It’s Turtles All the Way Down”, we established that an attacker’s view of your OT attack surface is a complex environment where any point can be an entry point. It truly is “turtles all the way down.”

Now we look past the top turtle. Some of the most devastating attacks don’t come from a direct assault on your perimeter, but from exploiting the trust you place within the stack in your vendors, your software, and even your own staff. In this second part of our series based on Ray Blasko’s recent presentation at OT.SEC.CON, we’ll explore how to manage OT supply chain security and insider threats. You can watch the full presentation on the BreakPoint Labs video hub.

The Vendor Risk: When OT Supply Chain Security Fails

A supply chain attack is one of the most difficult threats to defend against. It can be a piece of hardware, a software application, or even a routine update that arrives with a malicious payload hidden inside. When a vendor is compromised, attackers can exploit that trusted relationship as a pathway into your network. They effectively inherit the same trust and privileges you’ve granted to that vendor.

So what can you do?

• Enforce the Principle of Least Privilege: When you give a vendor access, are you giving them the keys to the kingdom? Too often, vendors are granted administrative privileges when they don’t need them. Restrict vendor access to only what is absolutely necessary for them to do their job, and nothing more.
• Conduct Asset Inventories: You can’t defend what you don’t know you have. During one physical walkthrough for a critical infrastructure client, our team found a small, unknown device with antennas sticking out of a server rack. It turned out that a vendor, tired of driving to the remote site, had installed it themselves two years prior to creating their own remote access. The client was exposed to a significant, unknown risk for years, not out of malice, but laziness. Regular asset inventories and physical walkthroughs are essential for uncovering these hidden liabilities.

The Insider Threat in Operational Technology

No one wants to believe their coworker is a spy. We want to trust the people we work with. But an insider threat isn’t always malicious. It could be an employee, a contractor, or anyone with insider knowledge who is unintentionally tricked or, worse, is being blackmailed or threatened.

The danger is that this person may already have administrative privileges, allowing them to bypass many of your defenses from the start.

The defense against this begins with a simple acknowledgment that the threat is real. From there, your strategy relies on two core principles:

1. Defense-in-Depth: If a trusted user’s account is compromised, what prevents it from being used to move laterally across your network? You need monitoring, controls, and incident response plans at every level to contain the blast radius.
2. Effective Security Training: Awareness is infinitely more valuable than ignorance. Train your people on what suspicious activity looks like and give them a clear, safe process for reporting it.

Trust is a relationship, not a security control. Every layer of your operation, from the software you install to the people you grant access, must be secured and validated.

---

Up Next: In our next post, we get physical. We’ll explore how attackers can walk right past your digital defenses in “OT Physical Security Assessment: A Guide to Compromising Remote Sites.”

Are you effectively managing the risk from your third-party vendors and internal systems? The experts at BreakPoint Labs can help you build a more resilient security posture. Contact us to start the conversation.

Managing an Operational Technology (OT) attack surface is one of the most critical challenges facing industrial and critical infrastructure organizations today. You invest heavily in building strong walls, robust firewalls, secure remote access, and clear segmentation between IT and OT networks. These are essential, but they primarily defend a well-understood perimeter.

But what if the biggest threat isn’t trying to break down the front gate, but is already slipping through an unlocked window? The reality is that your true attack surface is far larger and more complex than any network diagram. It includes your people, your physical sites, and your entire supply chain. To effectively defend it, you must first see it as an attacker does: a dynamic environment full of opportunities.

This complex, layered reality is perfectly captured by an old story. When asked what holds up the world, a wise woman replies, “It rests on the back of a giant turtle.” But what does that turtle stand on? “A bigger turtle.” And that one? You guessed it: it’s turtles all the way down.

This was the focus of a recent talk our own Ray Blasko gave at OT.SEC.CON. (You can watch the full presentation here.) In this four-part blog series, we’ll use this idea to help you visualize your own security stack and understand the risks. For this first post, we’ll introduce the stack and explain why a vulnerability in just one turtle can threaten the entire tower and your operations along with it.

OT Attack Surface Management: A Neat Stack Of Defensive Layers.

Imagine your Operational Technology (OT) environment in a similar way: a neat, orderly stack.

• External Assets
• IT Network
• OT Network
• SCADA Assets (like PLCs and RTUs)
• Physical Assets

Defenses like perimeter firewalls and IT/OT segmentation are built around these layers. While essential, this view is dangerously incomplete because attackers don’t follow your blueprint.

The Traditional vs. True Attack Surface in OT Security

As defenders, you’re trained to build and maintain your organization’s strengths. An attacker, however, has a completely different mindset. They are trained to look for a single weakness they can exploit. While you see a fortress, they see a collection of potential entry points.

This is the true OT attack surface. It’s not just your external-facing assets. It’s everything. An attacker’s view of your environment includes vectors you might not actively monitor or defend against:

• Supply Chain Attacks: A compromised piece of hardware, software, or a backdoored update can give an attacker a foothold anywhere in your environment.

• Physical Compromise: An unmanned remote site or a simple unlocked door can give an attacker direct access to your OT network, bypassing all digital defenses.

• Insider Threats: A coerced or unintentional action by an employee can open the gates from the inside. This could be anyone—from an executive to a vendor to a janitor.

• Nation-State Sophistication: Advanced adversaries can chain together multiple small vulnerabilities or use zero-day exploits to get in, even if you’ve done everything right.

The scary part? These attacks don’t start at the top. They can give an attacker initial access to any layer, with any level of privilege.

Adopting an “Assumed Breach” Mindset

So, what do you do? You start thinking like an attacker.

In offensive security, we have a concept called “assumed breach”. Assume the attacker is already in. What happens next? Is it game over, or do you have defenses, monitoring, and response plans at every level to stop them from reaching their goal? This is the essence of a true defense-in-depth strategy.

Nothing is ever 100% secure, unless you’re willing to turn off all your machines, and we know that’s not an option for your customers. The only way to truly defend your organization is to understand your attack surface from an attacker’s perspective and build defenses accordingly. It’s time to look past the first turtle and ask what lies beneath.

---

Up Next: In our next post, we’ll dive deeper into the unseen risks that can compromise your network from within: Managing OT Supply Chain Security and Insider Threats.

Is your organization prepared to face the real attack surface? The offensive security experts at BreakPoint Labs can help you identify the weaknesses attackers see. Contact us today to learn more.