Critical infrastructure security is ultimately about sustaining essential functions under adverse conditions. Prevention matters, but systems that provide energy, water, transportation, healthcare, communications, and industrial production must also detect disruption, operate safely in degraded modes, and recover predictably.
Executive takeaway
Prioritize the small set of functions whose loss would create unacceptable safety, operational, or public consequences. Build defensible boundaries, controlled remote access, trustworthy assets and configurations, monitored pathways, manual contingencies, and tested recovery around those functions.
What makes the environment different
- Safety and availability can outweigh confidentiality.
- Equipment lifecycles are long and patching windows are constrained.
- Legacy protocols may lack authentication and encryption.
- Remote vendors and shared service providers create concentrated access paths.
- IT and operational-technology dependencies are often poorly documented.
Architecture priorities
Start with essential functions. Map the processes, people, facilities, technology, data, communications, and third parties needed to deliver them. Rank dependencies by consequence rather than device count.
Control exposure. Remove unnecessary internet access, route remote connections through managed access points, use phishing-resistant authentication where feasible, and ensure vendor access is time-bound, approved, monitored, and revocable.
Segment for operations. Zones and conduits should reflect process, safety, and recovery requirements. Validate allowed communication and prepare for temporary isolation without creating unsafe conditions.
Make recovery trustworthy. Protect offline configurations, logic, firmware, credentials, and engineering documentation. Test restoration on representative systems and include the operators who will execute it under pressure.
Monitor what matters. Combine passive OT visibility, identity and remote-access logs, network controls, engineering workstation activity, and process anomalies. Detection must account for legitimate operational variation.
Prioritized actions
- Identify the most consequential services and their hidden dependencies.
- Eliminate unmanaged remote access and unnecessary public exposure.
- Verify segmentation against actual communications.
- Protect and test golden configurations and offline recovery material.
- Exercise a scenario requiring degraded operations, vendor coordination, and manual recovery.
Questions leaders should ask
- Which essential function can we least afford to lose?
- Can operators maintain a safe state if IT services are unavailable?
- Which external organizations have privileged access, and can we revoke it immediately?
- When did we last restore a representative control system from trusted material?
Shawn’s perspective
Asset inventories and compliance mappings are necessary, but resilience becomes real only when teams understand operational consequence and rehearse difficult decisions. The architecture should help the organization continue its mission safely, not merely demonstrate that controls exist.