Knowledge Sprint: Protecting Critical OT Networks: Detect, Segment and Control Threats Without Impacting Operations

Critical infrastructure operators are under increasing pressure to improve cyber resilience while maintaining safe and reliable operations. Water utilities, energy providers, manufacturers, and essential service operators face unique OT security challenges: legacy systems, remote access pathways, encrypted device communications, limited maintenance windows, and equipment that cannot safely support traditional endpoint security controls.

Recent coordinated attacks targeting operational technology systems at multiple Minnesota water utilities demonstrate how threat actors are increasingly focusing on critical infrastructure environments where disruption can have real-world consequences. During the incident, multiple utilities reported outages or equipment issues and were forced to implement contingency and manual operations while investigations took place.

This Knowledge Sprint explores a practical approach to protecting Operational Technology (OT) networks using asset visibility, Zero Trust segmentation, passive encryption monitoring, OT-aware threat detection, and operationally safe containment. Using a real-world-inspired critical infrastructure attack scenario, we demonstrate how organisations can identify abnormal behaviour, detect unauthorised control actions, reduce lateral movement, and contain threats before operational impacts occur.

Attendees will gain actionable guidance for improving OT security maturity, supporting CIRMP obligations, aligning with IEC 62443 principles, and protecting critical services without compromising operational availability.