Chapter 20 — Critical infrastructure and sector security: foundational cases

Chapter 20 — Critical infrastructure and sector security: foundational cases

Lesson map

Lesson 20 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["20.1 Reading a case"]
  N2["20.2 Six cases"]
  N3["20.3 Comparing the cases"]
  N4["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["20.1 Reading a case"]
  N2["20.2 Six cases"]
  N3["20.3 Comparing the cases"]
  N4["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX039"]

[Learning outcomes and connection]
    |
    v
[20.1 Reading a case]
    |
    v
[20.2 Six cases]
    |
    v
[20.3 Comparing the cases]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes and connection

After this chapter you can (1) summarise six public cases that shaped the field from their primary or authoritative sources; (2) separate what the sources establish from what is commonly repeated; (3) extract transferable lessons and compare them across sectors; and (4) handle revised accounts honestly. It builds on Chapter 19 and prepares Chapter 31 (advanced cases) and the capstone. All descriptions stay at the level of the cited sources; no case is taught as a technique.

20.1 Reading a case

For each case, record: date and sector; what happened to the service (scope, duration, people affected); initial access and spread only as the source describes; response; source type (government advisory, audit report, peer-reviewed analysis, company statement, journalism); and what remains uncertain. Early reports are often wrong; later reports often correct them. A good analyst cites both.

For Oldsmar this record has two dates: the 2021 advisory and the 2023 statement that revised it. Both belong in the record, with the advisory's account labelled as superseded rather than deleted.

20.2 Six cases

Ukraine power distribution, December 2015. CISA's alert describes coordinated attacks on three regional distribution companies that caused outages affecting approximately 225,000 customers, with remote operation of breakers, destruction of some systems and disruption of call centres; power was restored by switching to manual operation (CISA IR-ALERT-H-16-056-01; see also the E-ISAC/SANS analysis). Lesson: manual fallback and staff who can operate without automation were decisive.

WannaCry and the NHS, May 2017. The UK National Audit Office found that the ransomware disrupted at least a third of NHS trusts in England, led to cancelled appointments and diverted ambulances, and that the affected organisations had unpatched or unsupported Windows systems; the NHS had not rehearsed a national response (NAO, 2017). Lesson: untargeted malware can cause clinical harm; basic hygiene and rehearsed coordination matter.

TRITON/HatMan, 2017. CISA's malware analysis report describes malware designed to interact with a specific safety instrumented system controller, the layer meant to prevent physical harm (CISA MAR-17-352-01). Lesson: safety systems are targets, and their independence from control networks must be real.

Oldsmar water treatment, February 2021. CISA's advisory reported that unidentified actors accessed a water-treatment plant's control system through remote-access software and increased the sodium hydroxide setpoint, which an operator noticed and reversed (CISA AA21-042A). In 2023 a former city manager said the event was likely an employee error rather than an intrusion (WUSF, 2023). Lesson: whatever the cause, unmanaged remote access and reliance on one attentive operator were weaknesses — and public narratives can be revised.

Colonial Pipeline, May 2021. The joint CISA–FBI advisory on DarkSide ransomware reports that the actors deployed ransomware against a pipeline company's IT network, that there was no indication its OT networks had been directly affected, and that the company proactively disconnected certain OT systems to ensure their safety (CISA AA21-131A). CISA's two-year retrospective names the company and recalls the fuel queues along the eastern seaboard that followed (CISA, 2023). Lesson: an IT compromise can stop OT operations through business dependencies and precautionary decisions, without touching the control system.

CrowdStrike update, July 2024. A faulty security-software update crashed Windows machines worldwide; Microsoft estimated about 8.5 million devices were affected, disrupting airlines, hospitals and banks (Microsoft, 2024). Lesson: no adversary is needed; a shared software dependency is a single point of failure across sectors.

20.3 Comparing the cases

The table compresses each case into one lesson so they can be compared; it is not a summary of what happened. Read across the "Cause" column: two of the six involve no targeted attack on the control system at all.

20.4 Worked example: lessons for CVH (synthetic application)

The application is synthetic; the cases are cited above. For Calder Valley Hospital the transferable lessons are: (1) rehearse operation without IT (paper processes, as Ukraine's operators did without automation); (2) inventory and isolate unsupported devices (WannaCry); (3) confirm that a BMS compromise cannot stop theatre ventilation's local safety controls (TRITON's lesson about independent layers); (4) govern remote access to the BMS (Oldsmar); (5) map which clinical processes depend on business IT such as patient administration (Colonial); and (6) plan for mass failure of a shared endpoint product (CrowdStrike).

20.5 Common errors and limits

• Repeating vivid details that no primary source supports.
• Citing the first account and ignoring the correction.
• Treating every case as an attack.
• Turning a case study into an attack recipe.

Common examples: claiming Oldsmar was "a hack" without the 2023 revision; repeating outage durations not in the cited source; calling CrowdStrike an attack; or describing Stuxnet's techniques when the lesson is the failed assumption. Each of the six summaries here stays at the level its source supports, and EX039 asks you to check one.

Exercises — chapter 20

EX039 — Primary source check. Objective: separate source from repetition. Inputs: one of the six cases in this chapter. Steps: read the cited source and list three facts it states, one commonly repeated claim it does not state (find one in a news article or blog), and how you would phrase the case for a report. Expected evidence: list and phrasing. Rubric: 3 = accurate facts with locations in the source, an unsupported claim identified, careful phrasing; 2 = facts only; 1 = facts from secondary sources; 0 = none.

EX040 — Cross-sector lesson. Objective: transfer a lesson. Inputs: Colonial Pipeline. Steps: apply its lesson to Calder Transit: which business IT systems could force a precautionary stop of rail operations, and what could prevent that? Expected evidence: two dependencies and two measures. Rubric: 3 = e.g. ticketing/revenue, crew scheduling, passenger information; measures such as pre-agreed degraded-operation rules and separating operational from business dependencies; 2 = one each; 1 = generic; 0 = none.

Chapter synthesis

The field's foundational cases teach through comparison: manual fallback, hygiene, safety-system independence, remote-access governance, IT–OT business dependency and shared-dependency concentration. Read the primary sources, keep revisions in view and transfer lessons, not techniques.

Continue studying — chapter 20 of 40

← Chapter 19 · Course chapter index · Chapter 21 →

Continue to the next authored lesson.