The same connection can expose equipment designed decades ago, when its manufacturers never contemplated that it would face internet-based attackers.
“The thing that brought the efficiency has made those assets exposed,” Tonkin says. “In smaller organizations, there is no governance to stop an engineer from doing it. Thousands and thousands of very vulnerable devices are connected straight to the internet.”
These smaller systems may individually be inconsequential to a national grid or water supply. Collectively, however, they create opportunities for widespread disruption, particularly if an attacker coordinates operations across numerous sites or exploits dependencies among power, water, manufacturing, transportation, and communications providers.
