Attackers learned the physics

An intruder inside an industrial network used to be an accident. They had come in through the corporate side, wandered somewhere unexpected, and were generally after data. The current advisories describe something else: people who are there deliberately and want to understand the plant.

American authorities have published detail on that activity, including an advisory on actors exploiting programmable logic controllers across critical infrastructure, the devices that translate a control decision into something physical happening.

The behavioural shift analysts describe is the part worth internalising. Rather than maintaining access and extracting documents, intruders are exfiltrating configuration files and alarm histories, which are the artefacts that explain how a process is supposed to behave.

That is reconnaissance for a physical outcome. Knowing which alarm thresholds exist, which are ignored in practice, and what the safe operating envelope looks like is what separates disruption from a nuisance, and it cannot be inferred from outside.

The defensive problem is that industrial environments were not built to be observed. Devices predate the practice of logging, protocols have no authentication, and adding a monitoring agent to a controller running a live process is frequently not an option.

Patching is similarly constrained by physics rather than policy. An update requires stopping a process that is expensive or unsafe to stop, so maintenance windows are measured in months and the interval is known to anyone paying attention.

Exposure surveys keep finding the same first cause, which is not sophistication. Devices reachable from the internet that were never intended to be, connected during a project years earlier and left because nothing broke.

That makes the highest-value work unfashionable. Inventory, segmentation, removing remote access that nobody uses, and knowing which devices exist are worth more than any detection product bought before those questions are answered.

The regulatory pressure is arriving through reporting obligations rather than security standards, which produces a familiar result: organisations that can describe an incident quickly and are no better at preventing one.

The uncomfortable conclusion in the advisories is about timing. Access is being established well before it is used, which means the relevant question for an operator is not whether they would detect an attack, but whether they would detect someone reading the manual.