# The Credential at the Gate: Why Critical Infrastructure Keeps Getting Compromised Before Anyone Fires a Shot
The attacker who took down Colonial Pipeline's fuel supply to the Eastern Seaboard in May 2021 didn't need a zero-day. They needed one password. A single VPN credential — leaked from a prior breach, sitting in a dark web dump — was enough to move laterally into billing systems and force a shutdown that caused gas shortages from Georgia to New Jersey. No sophisticated exploit. No nation-state toolchain. Just an account that said "I am an authorized user" and a network that believed it.
This is the attack pattern that keeps winning: stolen identity, trusted access, disaster.
Three years later, the problem is worse, not better. Volt Typhoon, the Chinese state-sponsored group that CISA publicly flagged in 2024, has spent years embedding inside U.S. critical infrastructure — water utilities, power grids, communications providers — using almost exclusively legitimate credentials and built-in OS tools. They aren't triggering antivirus. They're logging in. Living off the land. Waiting.
The identity problem in critical infrastructure isn't a technology gap. It's a philosophy gap.
## The Two Gaps Nobody Wants to Talk About
When security teams discuss identity in critical infrastructure, they tend to frame it as an authentication problem. Get MFA everywhere, rotate credentials, audit privileged accounts. That's not wrong, but it addresses only half the exposure.
The two gaps that actually enable most critical infrastructure compromises are:
Gap one: User identity without device context. An authenticated user on an unmanaged, unpatched, malware-infected laptop gets the same network access as an authenticated user on a hardened, monitored corporate endpoint. The credential passed. The rest doesn't get asked.
Gap two: Trusted accounts that have been silently compromised. Service accounts, vendor accounts, legacy admin accounts inherited through acquisitions — these are the insider-shaped holes in every operational technology environment. They authenticate correctly. They have legitimate access. And nobody has reviewed their privilege level since the Obama administration.
Change Healthcare learned this the hard way in February 2024. The Citrix remote access portal attackers used didn't have MFA. One credential, one entry point, 100 million patient records and weeks of outages for pharmacies across the country. The same pattern Colonial wrote the book on.
## What Zero Trust Actually Means in OT Environments
Zero Trust has become a marketing term bloated past usefulness, but the core principle is operationally precise: never assume that a valid credential equals authorized access. Every access request should answer two questions, not one.
Who is this user? (identity verification — MFA, certificates, behavioral analytics)
What is this device? (device trust — is it managed, patched, free of known malware, compliant with security policy?)
In traditional IT environments, device trust is increasingly table stakes. Corporate endpoint management, certificate-based device authentication, conditional access policies — these exist and are widely deployed.
In operational technology environments, they're nearly absent.
OT runs on industrial control systems, PLCs, historian servers, and engineering workstations that often can't be patched, can't run endpoint agents, and were never designed to participate in modern identity infrastructure. The result is a persistent gap: the network trusts the device because it's on the right VLAN, and it trusts the user because the password matched. Two assumptions, both exploitable.
The Sandworm attacks on Ukraine's power grid in 2015 and 2016 moved through exactly this architecture. Spearphishing delivered credentials. Those credentials unlocked remote access tools. The OT devices themselves had no idea they were being operated by adversaries.
## What Defenders Actually Need to Do Right Now
The gap between IT and OT security maturity is real, but it's not an excuse for inaction. There are concrete steps that move the needle without requiring a full rip-and-replace of legacy infrastructure:
Segment ruthlessly, then audit the segments. Most critical infrastructure environments have segmentation on paper that doesn't match what's actually connected. Run a network discovery sweep. Find out what's actually talking to your historian server from the IT side. You will be surprised.
Treat every vendor account as a standing threat. Third-party remote access is the single biggest uncontrolled identity surface in OT environments. Every HVAC vendor, every integrator, every equipment manufacturer with standing VPN credentials is an attack vector. Implement just-in-time access that spins up for a maintenance window and expires automatically.
Deploy device certificates where you can, compensating controls where you can't. Modern conditional access can require that a device hold a valid certificate issued by your PKI before granting access. Legacy systems that can't participate in certificate enrollment should be behind jump servers with session recording — not directly accessible via VPN.
Audit service accounts and legacy admin credentials quarterly. This sounds tedious. It is tedious. But Volt Typhoon spent years inside American infrastructure using credentials that nobody noticed were being used from odd locations at odd hours. Behavioral baselines on service account activity cost almost nothing and catch almost everything.
The perimeter model — authenticate once, trust forever — was already inadequate for enterprise IT. For critical infrastructure, where a successful intrusion can heat homes, pump water, or move oil, it was always indefensible. The sector is still running on it.
---
## HackWire Analysis
The framing of "Zero Trust for critical infrastructure" usually lands as a compliance conversation — NIST frameworks, CISA advisories, checkbox requirements for regulated sectors. That framing is burying the operational urgency.
What's actually happening right now is a strategic pre-positioning campaign by multiple nation-state actors — most publicly documented is Volt Typhoon — whose explicit goal, per CISA and FBI joint advisories, is not espionage but disruption. They want to be inside water utilities and power grids so that, in a conflict scenario, they can flip a switch. They are doing this primarily through legitimate credentials. The identity gap isn't an academic risk — it's the specific attack surface being actively exploited for strategic leverage.
This makes the device trust gap more urgent than it appears. A credential stolen via phishing or purchased from an infostealer marketplace can be used from any device, anywhere. But if access requires a device-bound certificate that only lives on a managed endpoint, the credential alone becomes useless. That single control — certificate-based device authentication before network access — would have blocked Colonial Pipeline. It would block most of the Volt Typhoon TTPs currently documented.
What other coverage is missing: the risk isn't just power and oil. Water treatment is arguably more exposed because it's smaller utilities with no security staff, ancient SCADA, and vendor accounts that haven't been audited in a decade. The sector-wide attention goes to the headline targets. The realistic attack surface is the 50,000 community water systems most people have never heard of.
Defenders in critical infrastructure shouldn't wait for a compliance deadline. The adversaries aren't.
— HackWire Editorial
---
## Related Coverage