Nation-state attacks on critical infrastructure are no longer theoretical. Power grids, water systems, and manufacturing facilities have all been targeted by sophisticated threat actors with the capability and intent to cause physical disruption. What happened in Poland is a case study every OT security practitioner should study.
Featured Episode Deep Dive
This issue centers on Episode 96: Poland's Power Grid Cyberattack: What It Teaches Us About OT Security and Renewable Energy Risks.
Why this episode matters right now: The Poland attack specifically targeted renewable energy infrastructure, a sector that is expanding rapidly while security maturity lags behind. Ep 96 draws out the lessons that apply to any critical infrastructure operator, whether energy, water, or manufacturing.
3 Key Takeaways:
• Renewable energy infrastructure has unique attack surfaces. Distributed generation assets, grid-edge devices, and energy management systems create a much wider attack surface than traditional centralized power infrastructure.
• Nation-state attackers do reconnaissance for months before acting. The dwell time between initial access and disruptive action in OT attacks is often measured in months, meaning detection during the pre-attack phase is the realistic defensive window.
• Physical consequences require physical contingency planning. OT incident response cannot stop at the IT layer; it must include operational continuity plans for when systems need to be taken offline.
• Episode 97: OT Under Siege: How to Defend Critical Infrastructure From Nation-State Cyber Threats - Directly follows up on the critical infrastructure threat landscape, covering nation-state TTPs and what defenders can realistically do against well-resourced adversaries.
• Episode 77: OT Cybersecurity Wake-Up Call: How Airports and Power Grids Expose the Gaps We Cannot Ignore - Uses real incident cases to show common security gaps in power and transportation infrastructure that are still unaddressed at many organizations.
• Episode 66: Powering the Future: The Overlooked Cyber Risks in Our Expanding Electric Grid - Covers the cyber risk implications of grid modernization, distributed energy resources, and the increasing connectivity of electric infrastructure.
Quick Intel Brief
CISA's Shields Up campaign and the joint advisories from the Five Eyes intelligence alliance have repeatedly warned about nation-state pre-positioning in critical infrastructure networks. The advisory released in 2024 specifically called out Volt Typhoon activity in US critical infrastructure, with evidence of access that predated any known disruptive action by years. The implication is sobering: some critical infrastructure networks may already be compromised by actors waiting for the right moment.
Aaron's Take
The question I keep coming back to is: if an attacker has been in your OT network for 18 months, what have they seen? Where have they been? What have they touched? Most organizations cannot answer that question because they do not have the visibility to reconstruct activity over that timeframe. Detection is not enough if you cannot also do forensics. Building both capabilities matters more than ever right now.
What To Do Next
What's your experience assessing your organization's resilience to a nation-state level threat? What gaps keep you up at night? Hit reply and let me know.
Aaron Crow