[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4G2Ud9LuccUry9-rbPe09nDy94GY_Mk4SlOhh1WrIys":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":20,"created_at":21,"published_at":22,"article":23,"tags":27,"podcasts":40,"controls":41},"39da8be1-c103-4a7c-9d93-5e03d4c05b1f","critical-infrastructure-faces-advanced-persistent-threats-through-identity-compromise","833c94cd-94db-4e8c-abbc-438fdd2d21d8","Critical Infrastructure Faces Advanced Persistent Threats Through Identity Compromise","Critical infrastructure organizations are experiencing a fundamental shift in threat tactics, with adversaries now establishing persistent, stealthy access rather than conducting opportunistic attacks. These sophisticated threat actors exploit identity as the central attack vector in hybrid IT-OT environments, using living-off-the-land techniques to maintain long-term presence. The convergence of legacy systems with modern infrastructure creates expanded attack surfaces that nation-state actors are actively positioning within for future operations. This evolution requires organizations to move beyond traditional awareness-based security to verified, continuous readiness postures.","**Immediate actions:**\n- Implement zero-trust identity verification for all IT-OT system access\n- Conduct emergency audit of privileged accounts across hybrid infrastructure\n- Deploy advanced persistent threat detection specifically for living-off-the-land techniques\n\n**Network protection:**\n- Establish strict network segmentation between IT and OT environments\n- Create isolated security zones for legacy systems that cannot be immediately upgraded\n- Implement microsegmentation to limit lateral movement within critical infrastructure networks\n\n**Long-term improvements:**\n- Develop continuous identity governance programs with regular access reviews\n- Establish threat hunting capabilities focused on nation-state TTPs in critical infrastructure\n- Create verified readiness assessment programs aligned with emerging regulatory requirements",[12,13,14,15,16,17,18],"NIST AC-2","NIST AC-6","CIS Control 12","CIS Control 14","NERC CIP-005","IEC 62443","NIS2 Directive",{},"published","2026-03-31T20:08:09.63099+00:00","2026-03-31T20:08:09.447+00:00",{"id":7,"url":24,"slug":25,"title":26},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fsecurity-insider\u002Fthreat-landscape\u002Fthreat-to-critical-infrastructure-has-changed","the-threat-to-critical-infrastructure-has-changed-has-your-readiness","The threat to critical infrastructure has changed. Has your readiness?",[28,34],{"id":29,"name":30,"slug":31,"description":32,"color":33},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":35,"name":36,"slug":37,"description":38,"color":39},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[42,46,50],{"slug":43,"name":44,"problem":45},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":47,"name":48,"problem":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":51,"name":52,"problem":53},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]