Topic starter
24/10/2026 8:51 pm
TL;DR: Exposed HMIs, weak passwords, and flat IT and OT networks are driving recent OT incidents, according to Asimily. Operational controls stay reachable when inventory, authentication, and segmentation are not enforced.
Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “Attackers Don’t Need ICS Malware: Lessons from High-Profile OT Security Incidents in 2026”.
Key questions
Q: Why do flat IT and OT networks create such high operational risk?
A: Flat networks let a low-value entry point reach high-value control systems.
Q: What are the signs that OT segmentation is failing in practice?
A: Look for maintenance paths that can reach more than one zone, credentials that remain usable after the job ends, and limited visibility into what the session actually touched.
Q: What breaks when OT remote access still relies on reusable passwords or SSH keys?
A: Reusable secrets create a durable entry path that survives the job they were meant to secure.
Practitioner guidance
- Map every internet-reachable OT and IoT interface Inventory HMIs, remote access tools, PLC-adjacent services, and SCADA-exposed systems, then verify which ones can still be reached from external or poorly separated internal networks.
- Eliminate shared and default credentials Replace any shared login protecting operational interfaces with unique accounts and stronger authentication, and revoke legacy access paths that still depend on password convention rather than governed identity.
- Enforce segmentation from observed traffic Build network policy from actual device communications so billing, portal, and remote access systems cannot laterally reach operational controls without an explicit business requirement.
Bottom line: OT incidents in this article were enabled by exposed interfaces, weak credentials, and poor internal separation rather than by specialised ICS malware.
Glossary terms: Human-Machine Interface, Segmentation, Programmable Logic Controller, Remote Access Exposure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Exposed access is the real OT threat surface: The article shows that many OT incidents begin with remote interfaces and connected assets that should never have been internet reachable. That shifts the governance question away from whether adversaries have custom ICS malware and toward whether the organisation has actually constrained the attack path. For practitioners, the meaningful control is boundary enforcement around every operational access route.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security and operations teams coordinate incident response in OT?
A: They should predefine which systems can be isolated, which manual controls must take over, and which operators are authorised to cut remote access before a compromised session reaches process controls. OT response has to protect safety and continuity together, not just contain the intrusion after impact begins.
👉 Read our full editorial: OT security incidents show why exposed access beats ICS malware
This post was modified 7 days ago by NHI Mgmt Group