Critical infrastructure security depends on OT segmentation and credential control

At a glance

What this is: This article argues that OT and ICS environments are most at risk when weak segmentation and poor credential control let attackers move from IT into critical operational systems.

Why it matters: It matters because identity boundaries and network containment are what stop a compromise in business systems from becoming an outage in production, utilities, or public services.

Context

Operational technology and industrial control systems are increasingly connected to enterprise environments, but the security model in many environments still assumes those networks can be protected as if they were isolated. That assumption breaks when attackers can enter through IT, reuse credentials, and pivot into OT where legacy devices, exposed protocols, and limited patching make containment much harder.

The identity angle is not incidental. When credentials, remote services, or deceptive access paths can be used to maintain persistence or move laterally, OT security becomes an access governance problem as much as a network engineering problem. In critical infrastructure, segmentation and credential control are therefore core controls, not supporting hygiene.

The article's starting position is typical for many critical infrastructure environments: operations depend on systems that were not designed for modern threat velocity, and the result is a persistent gap between availability requirements and security containment.

Key questions

Q: What breaks when IT and OT networks are not segmented?

A: When IT and OT are not segmented, ransomware can move from business systems into production systems, and defenders often cannot prove where compromise stops. That uncertainty turns a containment problem into an outage decision. In manufacturing, the result can be a full shutdown, lost material, delayed shipments, and higher recovery cost than the initial intrusion.

Q: Why do compromised credentials matter so much in OT environments?

A: Compromised credentials matter because they let attackers blend into legitimate operational access instead of forcing noisy exploit behavior. In OT, that can support persistence, reconnaissance, and repeated access to control systems through remote services or shared accounts. The operational risk is not just login theft, but the ability to move through trusted access paths without immediately triggering perimeter alarms.

Q: What are the signs that industrial protocol exposure is becoming a security problem?

A: Warning signs include unexpected MODBUS, DNP3, BACnet, GOOSE, MMS, or IPMI traffic, device discovery outside normal maintenance windows, and command patterns that do not match known operations. If protocol activity is not being monitored for anomalies, attackers can use legitimate-looking industrial communications to map the environment, manipulate assets, or disrupt availability before conventional tools notice.

Q: When should critical infrastructure teams prioritise credential control over more network tooling?

A: They should prioritise credential control when remote services, shared accounts, or vendor access can already reach operational systems. If an attacker can authenticate successfully, more network tooling often only observes the compromise after access has been established. Credential control reduces the chance that legitimate access becomes a persistence mechanism.

Technical breakdown

Why OT segmentation matters in critical infrastructure

OT segmentation separates business IT from industrial control environments so an intrusion does not automatically become an operational incident. In practice, segmentation limits an attacker's ability to pivot from a compromised endpoint, mailbox, or remote service into SCADA, PLC, or HMI systems. The problem is that many industrial environments still contain flat trust zones, shared admin paths, and exceptions that weaken the boundary. Once an attacker reaches OT, protocol exposure and limited maintenance windows make recovery slow and disruptive.

Practical implication: treat IT-to-OT segmentation as an enforceable control boundary, not a network design preference.

How compromised credentials extend attacker persistence

Compromised credentials are especially dangerous in OT because they bypass many of the assumptions used by perimeter controls. A valid remote account, service credential, or reused login can let an attacker look like legitimate operational access while retaining persistence across sessions. In industrial networks, this is more damaging than a one-time exploit because it supports reconnaissance, lateral movement, and repeated access to production systems. Identity control therefore has to cover credential provenance, scope, and revocation, not just authentication at sign-in.

Practical implication: inventory and constrain every credential that can reach OT, including remote access and service accounts.

Why exposed ICS protocols increase lateral movement risk

Industrial protocols such as MODBUS, DNP3, BACnet, GOOSE, MMS, and IPMI were built for control and interoperability, not for hostile environments. When they are exposed, unpatched, or misconfigured, attackers can use them to discover devices, manipulate commands, or trigger denial-of-service conditions. The article's point is that protocol weakness becomes operational risk when it combines with weak segmentation and broad access. In critical infrastructure, security monitoring must understand these protocol behaviors rather than rely only on conventional endpoint signals.

Practical implication: monitor OT protocol activity for unauthorized use, anomalous commands, and movement patterns that indicate pivoting.

Threat narrative

Attacker objective: The objective is to disrupt critical services, extort the operator, or create broader political or operational impact by compromising mission-critical infrastructure.

1. Entry often begins in IT systems or through vulnerable remote services, then the attacker gains a foothold that can touch operational environments.
2. Credential access or reuse allows the attacker to maintain persistence and appear as legitimate operational traffic while probing OT pathways.
3. Lateral movement into OT enables denial of service, ransomware, or destructive action against industrial processes and services.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT segmentation is the decisive containment control in critical infrastructure. The article makes clear that many attacks become serious because IT compromise is allowed to cross into OT. In environments that depend on legacy hardware and fragile uptime, segmentation is not just network hygiene, it is the control that determines whether an intrusion stays local or becomes an operational incident. Practitioners should treat segmentation policy as an asset protection control with direct impact on resilience.

Credential control is the identity boundary that OT programmes still underweight. The article's discussion of persistence through compromised credentials points to a familiar governance failure: access paths are often broader and longer lived than operators assume. That creates a standing-access problem in systems that were never designed for normal enterprise IAM patterns. Practitioners should re-evaluate remote access, shared accounts, and service credential exposure as OT risk multipliers.

Legacy protocols create a protocol trust gap that attackers can exploit at scale. Industrial protocols are often treated as functional interfaces rather than security-relevant trust surfaces. That assumption fails when an attacker can use legitimate protocol behavior for reconnaissance, command abuse, or denial-of-service effects. Practitioners should align OT monitoring to protocol-specific abnormality, not just generic endpoint detection.

Critical infrastructure security now spans identity, network, and operational continuity as one problem. The article shows why siloed ownership fails: OT uptime, access governance, and incident containment are coupled. This is where NHI governance becomes relevant, because remote services and deceptive credentials can sit inside the same operational pathways attackers exploit. Practitioners should unify identity control and segmentation planning across IT and OT rather than managing them as separate domains.

Credential-controlled OT is a better concept than perimeter-protected OT. The strongest named concept in this article is the credential-to-control-plane gap, where valid access and weak segmentation together turn normal maintenance paths into attacker pathways. That gap is why OT risk persists even when perimeter tooling is present. Practitioners should frame OT assurance around who can reach what, from where, and under which revocation rules.

What this signals

Credential-controlled containment is now the right operating model for OT security. The article shows that industrial environments fail when access paths are broader than operators assume. For practitioners, that means segmentation, remote access governance, and credential lifecycle control have to be designed as one control system rather than separate projects.

The practical test is whether an attacker who compromises IT can still reach a PLC, HMI, or SCADA path without a second barrier. If the answer is yes, the organisation has not solved OT security, it has only redistributed risk across more tools.

For practitioners

• Implement enforced IT-to-OT segmentation Separate enterprise and industrial networks with hard policy boundaries, not just VLANs, and verify that remote paths cannot pivot into OT after an IT compromise.
• Tighten control over OT-reachable credentials Inventory remote access, service accounts, and shared credentials that can reach industrial systems, then remove standing access and require revocation-ready ownership.
• Monitor industrial protocol behaviour Build detections for anomalous MODBUS, DNP3, BACnet, GOOSE, MMS, and IPMI activity so recon, command abuse, and pivoting are visible before impact.
• Test backup isolation and restoration paths Keep OT and IT backups isolated from network paths that malware can reach, and rehearse recovery to confirm backups remain usable after a ransomware event.

Key takeaways

• Critical infrastructure risk is driven by the combination of legacy OT, exposed protocols, and credentials that still bridge IT and industrial systems.
• The article reinforces that segmentation and credential governance are the controls that most directly limit attacker movement into OT environments.
• Operational resilience depends on preventing a business compromise from turning into a production outage.

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Industrial Control Systems: Industrial control systems are the components that directly automate and supervise industrial processes, including controllers, sensors, and supervisory software. They are a subset of operational technology, but they often carry the most sensitive control paths and therefore demand specialised access and monitoring controls.
• Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.
• Credential Persistence: Credential persistence is the ability of an attacker to keep access after the original secret is revoked or the initial malware is removed. In identity terms, it usually means a second credential, key, or token has been added to the account lifecycle and now survives the first response action.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build the control discipline needed for connected environments.