Account security gaps turn orphaned access into operational risk

At a glance

What this is: This is Dragos's analysis of MTSA account security requirements, using the Colonial Pipeline incident to show how reused passwords, orphaned accounts, and missing MFA compound into operational risk.

Why it matters: It matters because IAM, PAM, and OT security teams have to govern account lifecycle, not just authentication, when IT and OT access gaps can trigger real-world disruption.

By the numbers:

• The Colonial Pipeline system spans roughly 5,500 miles and carries about 45% of the East Coast's gasoline, diesel, and jet fuel.

Context

Account security is the part of identity governance that decides who can authenticate, what credentials they use, and when access must be removed. In IT and OT environments, weak account controls become operational issues because a password, an orphaned account, or a missing MFA requirement can open a path into systems that support critical services.

Dragos frames MTSA's account security requirement as a lifecycle problem, not a one-time hardening exercise. The article ties that lifecycle directly to the broader inventory, segmentation, and device-security sequence already covered in the series, which is a typical way to approach regulated OT governance rather than an isolated compliance task.

The central issue is that account security failures accumulate. Reused credentials, standing access, shared accounts, and delayed deprovisioning are ordinary control gaps on their own, but together they create the kind of compound exposure that turns a compromised password into operational disruption.

Key questions

Q: What breaks when account deprovisioning is delayed in OT environments?

A: Delayed deprovisioning leaves credentials active after the business need has ended, which turns normal staff movement or offboarding into standing risk. In OT environments that can mean vendor, contractor, or former employee access remains usable long after ownership has shifted. The practical failure is not just policy noncompliance. It is an orphaned path into systems that should no longer trust the identity.

Q: Why do reused passwords create such high operational risk for critical infrastructure?

A: Reused passwords become dangerous when a separate breach exposes the same secret and remote access still accepts it. In critical infrastructure, that creates a low-friction entry path into a system where the operator may not immediately know whether operational systems are affected. The risk grows because a simple credential hit can force precautionary shutdowns, even before any OT compromise is confirmed.

Q: How should teams decide when to use compensating controls instead of direct MFA enforcement?

A: Use compensating controls only when the system genuinely cannot support the required control, not as a convenience workaround. For OT, that usually means documented network isolation, physical access restriction, or a jump host with its own MFA, plus a named approver and review date. The key decision is whether the exception is temporary, auditable, and tightly bounded.

Q: Should organisations separate IT and OT credentials or federate identity across both?

A: Either model can work, but only if credential separation remains enforceable and exceptions are tightly governed. Separate stores reduce blast radius, while federation can improve administration if it does not collapse IT and OT trust boundaries into one large account domain. The right choice is the one that preserves traceability, revocation, and least privilege across both environments.

Technical breakdown

Why reused passwords become an identity path into OT environments

A reused password is dangerous because it breaks the assumption that an account credential is unique to one system and one context. Once a password appears in a breach or on a credential market, attackers can test it against remote access, VPN, or administrative surfaces that still accept password-only authentication. In OT-adjacent environments, that matters because the initial access path often lands in IT first, then creates uncertainty about whether operational systems are exposed. The problem is not sophistication. It is credential reusability plus insufficient authentication depth.

Practical implication: treat password reuse as an identity exposure event and prioritise MFA and password policy enforcement on remote access paths.

How orphaned accounts and shared credentials widen the attack surface

Orphaned accounts persist after a user changes roles or leaves, while shared or generic credentials remove accountability altogether. Both conditions make access hard to inventory and harder to revoke, which is why the article emphasizes cataloguing administrative, vendor, service, and shared accounts before layering controls. In regulated IT and OT environments, these credentials often survive because no single team owns the full lifecycle. That creates standing access that remains usable long after the original business need has expired.

Practical implication: inventory every privileged, vendor, service, and shared account before you try to enforce least privilege or deprovisioning.

How MFA and deprovisioning change account risk over time

MFA and deprovisioning do different jobs in the account lifecycle. MFA raises the cost of credential theft at authentication time, while deprovisioning removes the identity's ability to authenticate at all once the user no longer needs access. The article also distinguishes between role changes and final offboarding, which is important because access can be excessive well before employment ends. For OT, the same logic extends to contractor and third-party access, where revocation often falls outside standard HR triggers.

Practical implication: tie MFA enforcement to remote access now, and connect revocation to HR and contractor offboarding workflows so stale access does not linger.

Threat narrative

Attacker objective: The objective was to gain access through reused credentials and use that foothold to disrupt a critical operational environment for financial leverage.

1. Entry occurred when the reused VPN password appeared in a leaked credential set and was then usable against the remote access environment.
2. Credential abuse followed because the account still existed and had no MFA, so password-only authentication was enough to get in.
3. Impact came when the compromise forced precautionary shutdown of the pipeline environment, which triggered fuel shortages, panic buying, and a costly ransom decision.

Breaches seen in the wild

• CI/CD pipeline exploitation case study: Credentials in an exposed .git/config let a researcher edit a Bitbucket pipeline so it planted their SSH key on the server. No victim was named.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Orphaned access is the control failure that turns a password issue into a governance issue. The article's Colonial Pipeline example is not really about a single bad credential, but about an account that remained active after it should have been removed. That is a lifecycle failure, not just an authentication failure, and it is exactly why account inventories and revocation workflows matter in regulated environments. The practitioner takeaway is that deprovisioning is an operational control, not an HR afterthought.

Account security in OT is fundamentally a trust-boundary problem. MTSA's account security requirements force organisations to decide where IT controls stop and OT controls begin, then document compensating controls where password or MFA enforcement is not technically feasible. That boundary becomes the real governance object, because the same credential behaves differently across remote access, vendor access, and safety-adjacent systems. Practitioners should expect auditors to look for written exceptions, ownership, and review dates, not informal assumptions.

Least privilege only works when privileged access is continually revalidated. The article correctly ties privileged account governance to recurring review, anomaly monitoring, and just-in-time access rather than standing administrative rights. Standing privilege in a mixed IT and OT estate creates unnecessary exposure windows and makes every leaked credential more dangerous. The practical implication is that privilege should be time-bound and role-bound, not simply documented once and forgotten.

Credential separation is a named concept here because shared identities erase both attribution and containment. A shared or cross-domain account makes it harder to know who used access, when it was used, and how to revoke it cleanly. That is why the article's emphasis on separate IT and OT credentials is more than hygiene, it is governance over blast radius. Practitioners should treat any shared credential as a structural exception that needs a retirement plan.

Account security programs fail when they stop at policy text and do not build a measurable control narrative. The article's sequence from inventory to monitoring to recertification shows the difference between compliance language and operational ownership. That gap matters because account controls only reduce risk when someone can evidence current inventory, review stale access, and prove deprovisioning actually happened. The practitioner conclusion is simple: if you cannot measure account state, you do not control it.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Credential separation is a blast-radius control, not just an access-control preference. When IT and OT identities are allowed to overlap, a single compromise can travel farther than the original password should ever permit. Programmes should treat separate credentials, separate revocation paths, and separate ownership as a single governance decision rather than three unrelated controls.

Account security now has to be measured by revocation speed as much as by authentication strength. If a mover or leaver can keep access for days or weeks, the environment still contains active trust that no longer matches the business relationship. That is why identity lifecycle controls and compensating-control governance matter as much as MFA in OT programmes.

For practitioners

• Inventory every account class Catalog administrative, vendor, service, shared, and other non-human accounts across all in-scope IT and OT systems before you try to enforce stronger controls.
• Eliminate password-only remote access Require MFA on password-protected IT systems and any remotely accessible OT access path, then document compensating controls where MFA is not technically feasible.
• Build deprovisioning into joiner-mover-leaver flow Link credential revocation to role changes and offboarding, including contractors and third-party users, so access does not linger after the business need ends.

Key takeaways

• The article shows that a compromised password became an operational incident because account lifecycle controls failed around it.
• The Colonial Pipeline example illustrates how reused credentials, missing MFA, and orphaned access can combine into severe disruption across critical services.
• The practical answer is to govern account inventory, revocation, and privileged access as a single lifecycle, not as disconnected controls.

Key terms

• Account Deprovisioning: Account deprovisioning is the process of removing a user or service account’s access when it is no longer needed. It is a core identity control because stale accounts can outlive jobs, projects, or vendors, leaving open paths that attackers can abuse if the account is forgotten or left active.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.
• Credential Separation: Credential separation keeps sensitive tokens, session data and cryptographic keys from living in the same place as the application or its logs. That reduces blast radius when a gateway, server or developer environment is exposed.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or operational access governance, it is worth exploring.