Protecting CNI from Nation-State attacks

The US’s January invasion of Venezuela was the final military stage of a much longer cyber-campaign. SPACECOM, CYBERCOM, and other interdepartmental agencies laid the groundwork months earlier, including cutting power to Caracas so the attack could proceed under cover of darkness. There were indicators that the attack was imminent; internet routing showed suspicious activity 14 hours before the raid, with data that is publicly available showing that traffic was being redirected: a classic indication of intelligence gathering. But Venezuelans, like critical national infrastructure (CNI) organisations worldwide, were most likely looking for indicators of an attack rather than the compromise itself. 

 

Attacks are not one-and-done activities. Nation-state attackers in particular will lurk for months, or even years, in a target system, performing deep reconnaissance of the infrastructure. This involves mapping OT/IT convergence and business processes and carrying out control dependency analysis to identify which systems need to be shut off or used to create a cascade effect that achieves the end goal, i.e., a regional blackout. In CNI and Operational Technology (OT) environments, there is a concerning gap between the threat and the readiness to meet it. 

 

24/7 Monitoring is key to understanding if there has been unauthorised access to a network, but 32 per cent of IT decision-makers are securing industrial environments with detection platforms built for IT and "adapted" for OT, using tools never designed to understand a production floor. This seriously hampers the ability to accurately detect suspicious activity. While attacks against IT cause business disruption, attacks on physical (OT) systems can cause unsafe physical conditions resulting in downtime, damaged equipment, environmental harm, and risk to people. 

 

When 63 per cent of organisations have experienced a cyber-incident in the past 12 months that caused operational downtime or hit critical OT/ICS systems, it’s never been more important to ensure OT security is prioritised and moved into a holistic monitoring strategy with IT systems, so the first line of defence is not the OT plant operators but a specialised hybrid IT/OT SOC platform provider.

 

OT and IT need a fundamentally different approach

OT environments were designed decades ago, prioritising reliability, safety, and continuous availability, assuming these systems would stay isolated, so security wasn’t considered. IT, by contrast, evolved into a connected, threat-aware world where confidentiality and patching cadence are assumed standards. That’s why OT asset lifecycles run 20 - 30 years with proprietary protocols and vendor lock-in, while IT expects regular patching and refresh cycles. AI further complicates matters as it’s being constrained by legacy architectures that force you to rebuild context after the fact. 28 per cent of organisations still rely on manual or ad hoc coordination between their IT and OT security teams, which slows their ability to react in a fast-paced AI threat landscape. The answer is to continuously build an understanding of how the business can react to any attacker tactics and techniques at any time.

 

Running simulations, using AI to generate real attack scenarios, is a great way to practice response playbooks, but running simulations in an OT production environment is highly risky. OT environments can’t afford for a plant to stop, water to stop flowing, or the power to go off. A "digital twin", a replica of your environment used to simulate attacks safely, solves this problem. It flags risks before they can be exploited, without disrupting production. This is especially useful in OT and CNI environments, where live testing is often too risky or impractical.

 

The “zero day” SOC

Cyber-kinetic attacks like the one in Venezuela are different from traditional attacks. They’re quiet, focus on configuration abuse, IT/OT and identity systems, and are environment-driven, meaning defenders need to look for long-lived dormant access, identity privilege drift, OT telemetry inconsistencies, internet routing anomalies, and config changes. This threat requires a “zero-day” security strategy, meaning that live and new threat intelligence with unknown vulnerability testing and rapid detection engineering for indicators of compromise can be applied immediately to the security operations centre (SOC), effectively eliminating the risk from emerging zero-day threats. 

 

Speed is the ultimate differentiator 

Every stage of an attack, between reconnaissance, initial access, and complete compromise, is a chance to intervene. Catch a threat actor at the initial access stage, and it is a containable incident you can shut down in minutes; no longer does the attack process take weeks with AI; it is now minutes to set up and launch an attack. By the time attackers have shut down a power plant, the window to limit the damage has already closed.

 

How quickly you can act depends on what your detection allows for. Organisations with 24/7 monitoring, AI agentic tooling, and automated containment measures with humans-in-the-loop can provide detection and response in minutes. Those relying on periodic checks or fragmented tooling often do not spot the intrusion for days or weeks, by which point containment is no longer an option.

 

---

 

Rob Demain is CEO of e2e-assure 

 

Main image courtesy of iStockPhoto.com and amgun