An IT-Only Breach Is Not an IT-Only Outage

“OT is segmented from IT, so a ransomware incident on the corporate network cannot stop operations.”

Colonial Pipeline would like a word.

An IT-only breach is not an IT-only outage.

In May 2021, the ransomware that hit Colonial Pipeline never reached the systems that move fuel.

The pipeline stopped anyway.

All 5,500 miles of it.

Roughly 3 million barrels of fuel a day between Texas and New York, halted.

Not by the attacker.

By Colonial.

Because on 7 May 2021 it could not confirm that the ransomware had not reached its operational technology, and it was not going to run a pipeline it could not show was clean.

That is the whole argument, and it is not a complicated one.

Segmentation decides where an attacker can go.

Whether operations continue depends on what the operator can prove.

Those are different properties.

The first one is a network diagram.

The second one is evidence, produced under pressure, in hours, by people who prepared for it before the incident.

A team that has the diagram and not the evidence has a plant that stops whenever IT has a bad week.

1. “But the Ransomware Never Reached the Control Systems.”

Correct.

That is exactly what happened at Colonial, and it did not help.

Walk the sequence.

On 6 May 2021, DarkSide got into Colonial’s IT network with the password of a legacy VPN account.

The account was inactive but not disabled.

It had no multi-factor authentication.

Before deploying anything, the attackers took about 100 gigabytes of data from the corporate network.

On 7 May, ransomware was deployed against IT systems.

Nothing in that chain touched OT.

The intrusion lived entirely on the corporate side of the boundary.

And the same day, Colonial halted all pipeline operations.

“The attacker did not reach OT” is a fact you can establish after the investigation.

During the incident, the only question that matters is whether you can establish it now.

Colonial could not.

So the fact that the ransomware stayed in IT was true, and operationally worthless, for five days.

If your response plan treats “the attacker stayed in IT” as the thing that keeps the plant running, it is relying on a fact that arrives last.

Where the attacker went is a forensic finding. Whether you keep running is a decision you make before you have it.

2. “But We Are Designated Critical Infrastructure, So We Already Meet the Security Requirements.”

Designated by what?

In the United States, Presidential Policy Directive 21, issued in February 2013, sorts facilities into 16 sectors and assigns each a Sector Risk Management Agency.

That is all it does.

It carries no penalty authority.

It imposes no reporting obligation.

It is a taxonomy.

It tells you which federal agency has standing to regulate you, and then that agency’s own regime, if there is one, decides what you owe.

The regimes do not resemble each other.

NERC CIP is the mature one: mandatory standards for the Bulk Electric System, approved by FERC, with a statutory maximum penalty of $1 million per violation per day.

The largest penalty to date is $10 million, publicly attributed to Duke Energy, for roughly 127 to 130 violations between 2015 and 2018.

It is also scoped to the Bulk Electric System, which leaves most distribution utilities, the part of the grid connected to homes and businesses, largely outside it.

Water has the America’s Water Infrastructure Act of 2018, which requires risk assessments only for systems serving more than 3,300 people.

The EPA’s 2023 attempt to mandate cybersecurity practices through state sanitary surveys was blocked by legal challenge.

Oldsmar, Florida, in February 2021, is what that looks like: an attacker raised sodium hydroxide dosing from 100 ppm to 11,100 ppm, and an operator watching the cursor move caught it.

Manufacturing has no sector-specific mandatory cybersecurity rule at all.

It was also the sector Dragos’s 2025 Year in Review identified as the most targeted by industrial ransomware in 2024.

And pipelines, in May 2021, had nothing binding.

TSA had held statutory authority over pipeline security since 2001.

It had never issued a mandatory cybersecurity directive for the sector.

So “we are critical infrastructure” told Colonial which agency would write the rules.

It did not tell Colonial it was compliant with anything, because there was nothing yet to comply with.

A sector designation is a classification. It is not a control, and it is not evidence about OT.

3. “But Shutting Down Was the Operator’s Choice, Not the Attacker’s.”

Yes.

That is the point, not a rebuttal of it.

The shutdown was a self-imposed containment measure.

The ransomware did not disable a pump or close a valve.

Colonial made a decision on the evidence it had, and the evidence it had was: IT is compromised, and we cannot confirm OT is not.

On that evidence, stopping is a reasonable call.

Running a physical system you cannot verify is clean is not a risk most operators will take, and should not.

Which means the outage was caused by the absence of evidence, not by the malware.

That is good news, in a narrow way.

The attacker’s reach is not something you control during an incident.

The evidence you can produce about OT is something you can prepare.

Whether prepared OT evidence would actually have kept Colonial’s pipeline running is an inference, not a documented fact.

What is documented is that Colonial could not confirm OT was clean, and stopped.

The decision also needs an owner, and most organisations have not settled who that is.

OT security ownership is moving toward the CISO’s office.

OT engineering leadership argues that decisions touching the process need process-safety context a general security team does not have.

The common resolution is a hybrid: CISO for governance and reporting, OT engineering for what gets changed and when.

The line between those two is still a live negotiation at most organisations.

Four hours into an IT incident is a bad time to finish it.

If nobody agreed in advance who decides an operational shutdown and on what evidence, the default decision is the one Colonial made.

4. “But the Regulator Will Tell Us What to Report.”

Eventually.

Usually after the incident that prompted the rule.

TSA’s first binding cybersecurity rules for pipelines came after Colonial, not before.

Security Directive Pipeline-2021-01, issued 28 May 2021, required TSA-designated critical pipeline owners to report cybersecurity incidents to CISA and to designate a cybersecurity coordinator reachable 24/7.

Security Directive Pipeline-2021-02, issued 26 July 2021, added mandatory mitigation measures, a Cybersecurity Contingency and Response Plan, and a Cybersecurity Vulnerability Assessment.

It has been revised in place repeatedly.

The version in force through May 2026, SD Pipeline-2021-02F, is the sixth iteration of the second directive.

An incident that never touched OT produced, within three months, the first binding federal cybersecurity rule for an entire sector.

The broader federal reporting mandate is slower still.

CIRCIA, enacted in March 2022, requires covered entities to report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours.

CISA’s proposed rule, published April 2024, projected roughly 300,000 covered entities and an 11-year cost of about $2.6 billion: $1.4 billion to industry, $1.2 billion to the federal government.

The statute required a final rule within 18 months of that proposal, roughly October 2025.

CISA missed it.

The next anticipated date was September 2026.

So the 72-hour and 24-hour figures come from the statute and the proposed rule, and you have to check whether a rule is in force before treating them as current law.

Colonial is not a CIRCIA case, either. It predates the Act by nearly a year.

A reporting rule tells you what to send and when.

It does not tell you, at hour three, whether OT is clean.

The regulator defines the report. It does not supply the evidence the report and the shutdown decision both depend on.

5. “But We Can Simply Restart Once IT Is Clean.”

Restarting a pipeline is not rebooting a laptop.

Colonial restarted at about 5 p.m. on 12 May 2021.

Full normal delivery returned by 15 May.

Five days from halt to restart, going by the dates, and three more to normal service.

In the meantime the White House declared a regional emergency on 9 May covering 17 states and the District of Columbia to ease fuel transport by road.

By 14 May, an estimated 87% of gas stations in the Washington, D.C. area had run out, driven substantially by panic buying rather than the physical shortfall alone.

That is what an IT incident looks like once the operator has stopped operations.

And the restart itself is not free.

In a continuous process, a refinery or chemical reactor running for months between planned turnarounds, an unplanned stop is a safety event in its own right.

Restarting brings the process back through transient states that are higher-risk than steady operation.

It is the same reason safety-system environments are typically excluded from standard IT vulnerability-scanning programmes.

A scan that crashes a controller can cause the very stop the scan was supposed to make less likely.

So “stop, clean IT, restart” is not a neutral loop.

Every stop and every restart is operational risk you chose to take because you lacked evidence.

And the restart needs the same evidence the stop was missing.

“IT is clean” does not say OT is clean.

If you could not show OT was unaffected on day one, you have to be able to show it before you run again.

A restart is a decision about OT. Cleaning IT does not make it.

6. “But Patching the OT Network Would Fix the Exposure.”

Which exposure?

The installed base in most OT environments runs on protocols designed before authentication was a design question.

Modbus, published in 1979, has no built-in authentication or encryption.

DNP3, developed in 1993 and dominant in North American electric and water SCADA, shipped with the same gap.

Either will accept a command from any device that can reach it on the wire.

DNP3 gained a Secure Authentication extension in 2012.

It works only where both ends of a link support it.

A large share of fielded outstations, installed a decade or two before it existed, cannot be upgraded to speak it.

So a segment can hold a modern authenticated controller next to an old remote terminal unit that has no concept of authentication.

The segment’s posture is set by the weaker device.

There is no patch for “the protocol trusts whoever is on the wire.”

And the patches that do exist compete with the process.

A plant running a continuous process treats every change needing a controller offline as a scheduling problem first, deferred to the next planned turnaround, which can be a year or more away.

Nor is there a forcing mechanism coming from the vendors.

CISA’s Secure by Design initiative is a voluntary pledge, not a requirement, and it does not retroactively secure fielded Modbus and DNP3 devices.

This matters to the Colonial question in a specific way.

On a segment that trusts anything that can reach it, “no unauthorised commands were accepted” is not something the devices can tell you.

The evidence has to come from somewhere else: OT-side monitoring, a known list of what can reach that segment, and records of what did.

Patching changes a device. It does not give you evidence about what an unauthenticated segment has already done.

7. No, This Does Not Mean Colonial Was Wrong to Shut Down.

It wasn’t.

An operator that cannot verify OT is right to be cautious.

Stopping a physical system whose state you cannot confirm is a defensible call, and nothing here says otherwise.

Nor does it mean segmentation is worthless.

At Colonial, segmentation did its job: the intrusion stayed in IT.

That is a real result, and it is the one the rest of the argument depends on.

For the design side of IT/OT boundaries, see IT Network Segmentation Is Not OT Security.

The claim here is narrower.

Segmentation kept the attacker out.

It did not produce the evidence that would let anyone say so in time.

The decision to keep running depends on evidence about OT that has to exist before the incident, not on the segmentation diagram.

8. What You Should Actually Do

Decide in advance what evidence lets you declare OT unaffected during an IT incident. OT-side monitoring that records what happened in the control environment. A verified inventory of every IT/OT conduit, not the one on the architecture slide. Then test that you can produce both within hours, not within the week the forensic firm needs.

Disable dormant remote-access accounts, do not merely deactivate them. Colonial’s entry point was a legacy VPN account that was inactive but not disabled. Require multi-factor authentication on every VPN account, including the ones nobody thinks are used.

Agree who decides an operational shutdown, and on what evidence, before you need to. Write down the evidence threshold for “keep running,” “stop,” and “restart,” and who signs each one. If that is a CISO-and-OT-engineering negotiation at your organisation, finish it now.

Treat stop and restart as operational risk, not as free containment. If your process passes through higher-risk transient states on restart, your incident plan should count that cost when it chooses to stop.

Map which regime, if any, actually binds each asset. In the United States: NERC CIP for Bulk Electric System assets, TSA directives for designated pipelines, AWIA assessments for larger water systems, CIRCIA once a final rule is in force. In the EU, NIS2 applies horizontally across energy, transport and manufacturing, covering an estimated 160,000-plus entities, with fines up to €10 million or 2% of global annual turnover, whichever is higher. A US operator with an EU plant can face a harder mandatory bar there than at home.

Treat unauthenticated fieldbus segments as trusting anything that can reach them. Know every path that reaches them, and log it, because the devices will not.

9. The Actual Model Is Not Complicated.

Segmentation answers: where can the attacker go?

Incident response in OT has to answer a different question: what can we prove about OT right now?

The first is a design property.

The second is an evidence property.

A sector designation answers neither.

A reporting rule answers neither.

A patch answers neither.

Colonial had a boundary that held and no way to show it was holding.

So a ransomware incident that stayed on the corporate network became a stopped pipeline, a regional emergency and a new federal rule for an entire sector.

The attacker decided where the malware went.

The operator decided whether the fuel moved.

Build the evidence before the incident, or the incident will make that decision for you.