Topic starter
21/10/2026 2:45 pm
TL;DR: Reused VPN passwords, missing MFA, and orphaned accounts helped turn the Colonial Pipeline shutdown into an operational event, according to Dragos. Account inventory and revocation now need to be governed together with privileged access.
Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “One Password, One Pipeline: MTSA’s Account Security Requirement”.
Key questions
Q: Why do reused passwords create such high operational risk for critical infrastructure?
A: Reused passwords become dangerous when a separate breach exposes the same secret and remote access still accepts it.
Q: How should teams decide when to use compensating controls instead of direct MFA enforcement?
A: Use compensating controls only when the system genuinely cannot support the required control, not as a convenience workaround.
Q: What breaks when account deprovisioning is delayed in OT environments?
A: Delayed deprovisioning leaves credentials active after the business need has ended, which turns normal staff movement or offboarding into standing risk.
Practitioner guidance
- Inventory every account class Catalog administrative, vendor, service, shared, and other non-human accounts across all in-scope IT and OT systems before you try to enforce stronger controls.
- Eliminate password-only remote access Require MFA on password-protected IT systems and any remotely accessible OT access path, then document compensating controls where MFA is not technically feasible.
- Build deprovisioning into joiner-mover-leaver flow Link credential revocation to role changes and offboarding, including contractors and third-party users, so access does not linger after the business need ends.
Bottom line: The article shows that a compromised password became an operational incident because account lifecycle controls failed around it.
Glossary terms: Account Deprovisioning, Compensating Control, Credential Separation, Standing Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
23/10/2026 12:48 am
Orphaned access is the control failure that turns a password issue into a governance issue. The article's Colonial Pipeline example is not really about a single bad credential, but about an account that remained active after it should have been removed. That is a lifecycle failure, not just an authentication failure, and it is exactly why account inventories and revocation workflows matter in regulated environments. The practitioner takeaway is that deprovisioning is an operational control, not an HR afterthought.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations separate IT and OT credentials or federate identity across both?
A: Either model can work, but only if credential separation remains enforceable and exceptions are tightly governed. Separate stores reduce blast radius, while federation can improve administration if it does not collapse IT and OT trust boundaries into one large account domain. The right choice is the one that preserves traceability, revocation, and least privilege across both environments.
👉 Read our full editorial: Account security gaps turn orphaned access into operational risk
This post was modified 3 days ago by NHI Mgmt Group