Account security for OT and IT: are your controls keeping up?

TL;DR: A reused VPN password, a revoked account that was never deprovisioned, and no MFA helped drive the Colonial Pipeline shutdown, according to Dragos, showing how ordinary account security gaps can compound into severe operational disruption. Account security in IT and OT now has to be treated as lifecycle governance, not a single control.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “One Password, One Pipeline: MTSA’s Account Security Requirement”.

Key questions

Q: What breaks when account deprovisioning is delayed in OT environments?

A: Delayed deprovisioning leaves credentials active after the business need has ended, which turns normal staff movement or offboarding into standing risk.

Q: Why do reused passwords create such high operational risk for critical infrastructure?

A: Reused passwords become dangerous when a separate breach exposes the same secret and remote access still accepts it.

Q: How should teams decide when to use compensating controls instead of direct MFA enforcement?

A: Use compensating controls only when the system genuinely cannot support the required control, not as a convenience workaround.

Practitioner guidance

• Inventory every account class Catalog administrative, vendor, service, shared, and other non-human accounts across all in-scope IT and OT systems before you try to enforce stronger controls.
• Eliminate password-only remote access Require MFA on password-protected IT systems and any remotely accessible OT access path, then document compensating controls where MFA is not technically feasible.
• Build deprovisioning into joiner-mover-leaver flow Link credential revocation to role changes and offboarding, including contractors and third-party users, so access does not linger after the business need ends.

Bottom line: The article shows that a compromised password became an operational incident because account lifecycle controls failed around it.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →