In our first post, “OT Attack Surface Management: It’s Turtles All the Way Down”, we established that an attacker’s view of your OT attack surface is a complex environment where any point can be an entry point. It truly is “turtles all the way down.”
Now we look past the top turtle. Some of the most devastating attacks don’t come from a direct assault on your perimeter, but from exploiting the trust you place within the stack in your vendors, your software, and even your own staff. In this second part of our series based on Ray Blasko’s recent presentation at OT.SEC.CON, we’ll explore how to manage OT supply chain security and insider threats. You can watch the full presentation on the BreakPoint Labs video hub.
A supply chain attack is one of the most difficult threats to defend against. It can be a piece of hardware, a software application, or even a routine update that arrives with a malicious payload hidden inside. When a vendor is compromised, attackers can exploit that trusted relationship as a pathway into your network. They effectively inherit the same trust and privileges you’ve granted to that vendor.
So what can you do?
No one wants to believe their coworker is a spy. We want to trust the people we work with. But an insider threat isn’t always malicious. It could be an employee, a contractor, or anyone with insider knowledge who is unintentionally tricked or, worse, is being blackmailed or threatened.
The danger is that this person may already have administrative privileges, allowing them to bypass many of your defenses from the start.
The defense against this begins with a simple acknowledgment that the threat is real. From there, your strategy relies on two core principles:
Trust is a relationship, not a security control. Every layer of your operation, from the software you install to the people you grant access, must be secured and validated.
Up Next: In our next post, we get physical. We’ll explore how attackers can walk right past your digital defenses in “OT Physical Security Assessment: A Guide to Compromising Remote Sites.”
Are you effectively managing the risk from your third-party vendors and internal systems? The experts at BreakPoint Labs can help you build a more resilient security posture. Contact us to start the conversation.
Ray Blasko is the Technical Director for offensive operations at BreakPoint Labs and a Red Team Operator for a DoD-certified Red Team, responsible for assessing and securing critical ICS/SCADA assets. He is recognized as a subject matter expert in both attacking and defending IT and OT environments, and he excels at resolving the technical and strategic issues that arise in protecting critical infrastructure. Ray holds numerous professional certifications and regularly presents at DoD Red Team conferences, trade conventions, and information security events.
In the first part of this series, we introduced the ‘turtles all the way down’ concept of the OT attack surface. Then, we dove into the layers of trust within that stack, exploring supply chain and insider threats in Part 2. Now, we move from the digital and trusted to the tangible and physical. In this third installment, based on Ray Blasko’s presentation at OT.SEC.CON, we’ll explore the world of physical security assessments. You can watch the full recordings on the BreakPoint Labs video hub.
You’ve spent millions on firewalls, endpoint detection, and sophisticated monitoring tools. Your digital fortress is state-of-the-art. But what if an attacker could bypass all of it in less than 60 seconds with a cheap lockpick and a bit of nerve?
For an offensive security professional, a physical compromise is often the most fun and eye-opening part of an assessment. While you’ve secured the digital front door, attackers are often able to just walk in through the back.
If an attacker needs to gain access to your OT environment as quickly as possible, the easiest path is often direct physical access. In the words of our Technical Director, Ray Blasko, “the first thing I’m going to do is I’m going to go find a remote site that’s unmanned and get in that way.”
These sites are a goldmine of vulnerabilities. Let’s walk through a real-world example from one of our assessments.
A water utility took us to a remote water tower. From their perspective, it was well-defended:
The defender saw strengths. An attacker saw a playground of opportunities:
Inside that unlocked building was a connected router inside an (unlocked) PLC cabinet. We plugged in a laptop and instantly had access not only to that site but to their entire main OT environment. Total time from arrival to full network compromise: under a minute.
Physical threats aren’t just about doors and fences. A wireless HID attack is particularly dangerous. Attackers have gotten creative with weaponized USB devices. This goes far beyond leaving a thumb drive in the parking lot. We’ve seen malicious hardware hidden in charging cables and even vape pens.
One of the most effective attacks uses wireless mice and keyboards. An attacker can use a tiny, cheap RF dongle to send keystrokes to a wireless mouse receiver from up to 50 feet away, telling the computer to execute commands. Even if you block USB drives, you can’t block Human Interface Devices (HID) like a mouse or keyboard, making this a perfect way to bypass controls and attack secure or even air-gapped networks. An attacker can plug one of these tiny receivers into the back of a machine, and it will likely go unnoticed for a long time.
Your digital security is only as strong as the physical security that protects it. Don’t let an unlocked door be the downfall of your entire security program.
Up Next: In our final post, we’ll tie it all together and discuss how to build a proactive defense that can even stand up to advanced, nation-state level threats in “Proactive OT Security: Defending Against Zero-Days & Nation-States”
How resilient is your physical security? BreakPoint Labs conducts comprehensive physical security assessments to uncover the gaps you can’t see. Contact us to learn more.
Ray Blasko is the Technical Director for offensive operations at BreakPoint Labs and a Red Team Operator for a DoD-certified Red Team, responsible for assessing and securing critical ICS/SCADA assets. He is recognized as a subject matter expert in both attacking and defending IT and OT environments, and he excels at resolving the technical and strategic issues that arise in protecting critical infrastructure. Ray holds numerous professional certifications and regularly presents at DoD Red Team conferences, trade conventions, and information security events.
In this series, we’ve explored how an attacker truly sees your attack surface, the hidden dangers within your supply chain and staff, and how easily your defenses can be bypassed through physical compromise. Now, we will tie it all together and tackle the ultimate fear: nation-state attackers and the zero-day exploits they wield. This entire series is based on Ray Blasko’s presentation at OT.SEC.CON, and we highly recommend you watch the full recordings on the BreakPoint Labs video hub to see the complete picture.
What is the key to proactive OT security? How do you defend against the most advanced threats, like nation-state OT attacks and zero-day exploits? The answer lies not in stressing over the unknown, but in relentlessly mastering the fundamentals.
Nation-state actors have incredible resources, but they don’t use their most valuable tools unless they have to. A zero-day exploit is a precious asset; every time it’s used, there’s a risk it will be discovered and patched, rendering it useless.
Why burn a million-dollar exploit when they can get in through an unpatched server, a misconfigured firewall, or by walking through the unlocked back door of a remote site you forgot about?
They will always look for the easiest path in first. This is why mastering the fundamentals is your single greatest defense against even the most advanced adversaries. The stronger your basic security posture, the more likely they are to pass you over for an easier target.
Becoming proactive means building a security culture rooted in a few key principles. Here is your playbook, based on an attacker’s mindset.
Your true attack surface isn’t just a line on a network diagram; it’s everything. It’s your technology, your people, your processes, and your physical locations. The only way to defend it is to understand it, prioritize the risks, and actively work to shrink it every day.
You have a choice. Be proactive or you’ll end up being reactive. We know which side of that equation is better for business.
Ready to build a truly proactive security posture? The experts at BreakPoint Labs combine deep offensive expertise with a collaborative approach to help you see your environment through the eyes of an attacker and build a more resilient defense. Contact us today to learn how we can help.
Ray Blasko is the Technical Director for offensive operations at BreakPoint Labs and a Red Team Operator for a DoD-certified Red Team, responsible for assessing and securing critical ICS/SCADA assets. He is recognized as a subject matter expert in both attacking and defending IT and OT environments, and he excels at resolving the technical and strategic issues that arise in protecting critical infrastructure. Ray holds numerous professional certifications and regularly presents at DoD Red Team conferences, trade conventions, and information security events.
