Skip to content

Topic

Critical Infrastructure Protection

The practice of protecting essential systems—power, water, finance, communications, and industrial controls—from cyber and physical threats.

Current stories

securityOne report1 publisher

EPA links rising attacks on water utilities to unchanged passwords and exposed controls

EPA water chief Jess Kramer says attacks on US water utilities have risen several fold, citing unchanged passwords and system details left online. EPA keeps finding basic weak points, and officials say many utilities lack the staff and investment to close them.

Publishers:foxnews.com

Reality

Evidence38
Adoption
Not scored
Hype gap+30
Incentives
Not scored
Confidence42
securityOne report1 publisher

Bipartisan bills would put biomanufacturing and genomic data inside CISA's infrastructure planning

Five lawmakers announced two bills putting biotech and genomic data under CISA's infrastructure planning, with no new sector. If enacted, DHS would contact key biotech firms and fold their input into the National Infrastructure Protection Plan this year.

Publishers:cyberscoop.com

Reality

Evidence55
Adoption
Not scored
Hype gap+10
Incentives40
Confidence55
securityOne report1 publisher

Honeywell's survey finds the chillers and badge readers outside most OT monitoring programs

Honeywell asked 603 critical infrastructure leaders what they actually watch. The chillers, elevators and badge readers that keep the controllers alive mostly sit outside continuous view, and teams with thinner inventories reported longer outages.

Reality

Evidence45
Adoption20
Hype gap+8
Incentives72
Confidence52
securityOne report1 publisher

Pakistan schedules its Federal CERT to be 40 percent operational a year from now

The 90-day action plan drafted by Pakistan's Cyber Security Working Committee dates guidance for provincial CERTs, a critical infrastructure declaration framework and a cyber warfare escalation matrix. The federal CERT itself gets three years.

Reality

Evidence38
Adoption8
Hype gap+30
Incentives62
Confidence45
securityOne report1 publisher

Schneider tells SCADAPack operators to migrate off Secure Lock after a credential exposure finding

Abhinav Agarwal's report of insufficiently protected credentials covers every version of seven SCADAPack families. Schneider's answer is role-based access control on the 47x line plus network segmentation and the RTU firewall service.

Publishers:cisa.gov

Reality

Evidence74
Adoption
Not scored
Hype gap−12
Incentives62
Confidence66
securityOne report1 publisher

CISA tells OT owners to classify every asset by function and criticality

The new Foundations for OT Cybersecurity guidance treats an asset inventory plus a taxonomy as the precondition for everything else in a defensible architecture. It sets no deadline and names no auditor.

Publishers:cisa.gov

Reality

Evidence72
Adoption
Not scored
Hype gap+10
Incentives45
Confidence70
securityOne report1 publisher

UK bill would let ministers bar named technology suppliers from critical infrastructure

Amendments tabled two days after a reported four-day outage at a UK energy generator would let ministers block specific suppliers, which turns vendor provenance into something a critical-sector buyer has to prove.

Publishers:securityweek.com

Reality

Evidence46
Adoption22
Hype gap+32
Incentives74
Confidence44
securityOne report1 publisher

A low-privilege login reaches code execution on Rockwell's FactoryTalk Historian ME

CISA's advisory covers Series B 5.202 and Series C 7.101 across five critical infrastructure sectors, but the published text carries no CVSS vectors and no corrected version numbers for an asset owner to upgrade to.

Publishers:cisa.gov

Reality

Evidence64
Adoption
Not scored
Hype gap−12
Incentives55
Confidence58
securityOne report1 publisher

Helsinki appeals court restores Finnish jurisdiction over the Eagle S officers

The court accepted that the anchor drop may have been an accident, then held that the three hours of dragging after Finnish authorities radioed the ship were not, and that distinction is where the jurisdiction comes from.

Publishers:therecord.media

Reality

Evidence74
Adoption
Not scored
Hype gap0
Incentives62
Confidence66
productOne report1 publisher

A $22.3m counter-drone contract that buys warning time, not shootdowns

Powerus has been commissioned to wire sensors around Middle East oil and gas fields. The deal detects and classifies; it does not intercept, and nobody has said how many sites it covers.

Reality

Evidence26
Adoption17
Hype gap+18
Incentives78
Confidence33
securityOne report1 publisher

Counter-drone authority grew in Washington. The risk still sits with the operator.

AUVSI's chief executive told a critical-infrastructure institute that expanded counter-drone powers are progress and not enough. The interval belongs to operators.

Publishers:scworld.com

Reality

Evidence20
Adoption
Not scored
Hype gap+32
Incentives70
Confidence30
securityOne report1 publisher

Congress asks GAO to price CISA's missing third, before the next 900 cuts land

House Democrats want the watchdog to measure what the loss of nearly 1,000 CISA staff did to the mission. The fiscal 2027 request would remove about 900 more, and GAO has not yet agreed to take the job.

Publishers:therecord.media

Reality

Evidence62
Adoption30
Hype gap+10
Incentives58
Confidence55
securityOne report1 publisher

California's AI security push is really a hiring order: one AI cyber officer per agency

Newsom's initiative pairs a per-agency AI cybersecurity officer mandate with an AI defense program housed in the state's Cybersecurity Integration Center.

Publishers:scworld.com

Reality

Evidence26
Adoption
Not scored
Hype gap+32
Incentives58
Confidence34