When a Cyberattack Turns Off the Lights

A bank can restore its systems from a backup after an incident. In an electrical substation, the same mistake has consequences in the physical world. Penetration tests of industrial systems expose an area where security was addressed for years in just one way: by putting a fence around the facility.

OT (operational technology) covers almost all of a country's critical infrastructure, from railways and traffic lights to electrical substations and water treatment facilities. What these systems have in common is their cyber-physical impact: they control something in the physical world. They receive an input and deliver electricity, release water or open a dam.
There are two types of testing: infrastructure at a specific site or the device controlling a physical process, typically a programmable logic controller (PLC). At Citadelo, we have tested electricity meters and substations, solar power plants, dams, gas facilities, mixing stations and other technologies. In other words, the entire chain from electricity generation and distribution to the end device.

Testing in Live Environments

The biggest difference compared to traditional IT is not the technology itself, but the severity of the consequences. Sending an unexpected input to a device that has been operating in a substation for ten years can permanently damage it. The company may then spend weeks trying to restore it to working order, putting the operation of the entire substation at risk.
Another complication is that testing almost always takes place in a live environment. These systems operate continuously, and some devices are only scheduled for shutdown once every few years. Customers therefore manage testing through strict procedures: operators know a test is underway, and personnel are on site to disconnect equipment immediately if necessary. During one substation test, the operator proactively rerouted electricity away from the node being tested.

Windows XP and Ten Different Suppliers

The most common weakness is not an exotic vulnerability, but age. Industrial systems are deployed once and then left untouched unless intervention is absolutely necessary. Encountering Windows XP is not unusual. A vulnerability may have existed in the system for twenty years without being fixed because an update would mean interfering with a functioning operation.
Another common problem is fragmented responsibility. A single site may rely on technology from as many as ten suppliers, each seeking to avoid responsibility. A camera system is handed over with a default password on the assumption that the operator will take care of security. The operator assumes the opposite. The result is an environment where nobody takes responsibility for security.
An anonymized example from our testing illustrates the problem. The protection mechanism of a system receiving control commands could be easily bypassed. All it took was placing a device in the right location to gain control over the entire site. Anyone with physical access, such as a cleaner, could have planted it.

Change Is Coming, but Slowly

OT operates on a different timescale than IT. While IT typically works in cycles of two to three years, industrial environments operate on a five-to-ten-year horizon. Nevertheless, progress is visible. Companies are moving away from the belief that nothing can happen to them and beginning to recognize the need to address security. Real-world incidents have contributed to this shift, along with growing awareness that disrupting energy infrastructure has become a tool of hybrid warfare. The experience in Ukraine has shown that cutting off electricity can be an objective of a foreign state.
If we had to recommend just one thing, it would not be technology, but competent people. Organizations deploy numerous products and often focus on meeting the formal requirements of regulations. But if nobody configures the systems properly or knows how to interpret alerts from detection tools, even four intrusion detection systems working simultaneously will not help. Specialists in industrial cybersecurity remain scarce. Compared to IT, it is still largely unexplored territory.

Is Your Industrial Infrastructure Really Secure?

Vulnerabilities in industrial systems can threaten not only data but also physical operations. Penetration testing helps identify security weaknesses in OT environments before attackers can exploit them.