Your security program knows about the firewall, but does it know about the elevator?

By early August, attackers had hit water systems in at least seven U.S. states. The FBI and EPA said the intruders remotely accessed internet-facing programmable logic controllers, the small industrial computers that run pumps and valves. Operators lost monitoring or control, and in some cases water operations degraded. Federal investigators are examining possible links to Iran-backed hackers.

Operational technology (OT) security programs were built to protect controllers like those. Chillers, fire panels, badge readers, elevators and cameras sit one layer over. They control physical conditions and access, and a chiller that stops cooling takes down the servers it was keeping alive.

Honeywell Technologies surveyed 603 security, risk and operations leaders in critical infrastructure in May and June. Most of their organizations don’t watch that layer closely, and the ones with weaker asset visibility more often report long outages.

Few programs watch the building layer

Only 16% of respondents continuously monitor more than three-quarters of their building automation systems, the software that runs heating, cooling and lighting across a facility. For connected IoT devices such as cameras and thermostats, the share is 20%. Continuous monitoring means something watches a device’s traffic and behavior all the time, not just during an audit. Across most organizations in the survey, a large part of the building layer sits at least partly outside that view.

Eighty-eight percent describe their programs as planned or design-led. Twenty-one percent report a complete asset inventory, meaning a full list of what is connected to their networks. A program can have a plan, a budget and a working relationship with IT and still miss the chiller controller that keeps an on-site data center cool.

Knowing what you own lines up with faster recovery

Respondents’ most significant incidents averaged 16.2 hours of downtime. Respondents who had been through a significant incident split along the inventory line. Among those with a comprehensive or substantial inventory, 42% were back up within six hours. Among those with a moderate, limited or no formal inventory, 25% were.

Hold that 17-point gap loosely. The weaker group is 91 respondents, a small base next to roughly 350 in the stronger one, and the survey shows an association, not proof that an inventory shortens an outage. Organizations with good inventories may simply do many other things well. Still, the logic is easy to follow. A responder who doesn’t know a device exists can’t isolate it, and one who doesn’t know what depends on it can’t predict what shutting it off will break. If you take one thing away from the numbers, it is that teams that knew what they owned were more likely to get back up fast.

Audit status didn’t predict who got hit

Organizations that passed every compliance audit reported significant incidents at nearly the same rate as those with failures or findings, 74% against 73%. The report is careful here: the result doesn’t show compliance has no preventive value, only that audit status didn’t separate who reported an incident. Clean-audit organizations were more confident they could recover. Tested backups, documented response procedures and clear ownership count as audit evidence, and they also help a team restore systems under pressure.

Few respondents call themselves fully ready. Just 31% say so, and most of the rest describe themselves as mostly ready, meaning some part of the plan hasn’t been put in place or tested. Old equipment is the most-cited barrier. Many legacy controllers were built to run in isolation and use protocols with no authentication or encryption. Patching them can mean planned downtime or a call to the vendor.

Download eBook: Identity-First Threat Intelligence