Topic· 8 essays

Grid, water and OT identity

Operational technology protocols carry no principal at all, so authorisation stops one hop short of the equipment. These essays cover clearances, vendor sessions, lockouts and offline readiness.

Start here Proof of human intent is the reference piece behind this topic.

All 8 essays

Vertical

Locked out of your own plant: what the July 2026 water attacks prove about OT authorization

Attackers reached internet-exposed controllers at water systems across a dozen states, changed passwords and IP addresses, and locked operators out.

Vertical

CIP-003-9 landed on small utilities in April 2026. Nobody sells the evidence part.

From April 2026 vendor remote access controls extended to low-impact BES Cyber Systems — the tier run by the smallest compliance teams.

Vertical

Multi-factor authentication proves the login, not the breaker

NERC's January 2026 roadmap called uniform MFA for interactive remote access the most impactful immediate safeguard.

Vertical

Who told 40,000 inverters to curtail? Authorization in aggregated DER

One API call can curtail tens of megawatts across thousands of privately owned assets, authenticated by a platform credential naming no human.

Definitional

Black start, storm restoration, and the identity provider you cannot reach

Emergency procedures assume degraded conditions everywhere except identity. When SSO is unreachable, utilities fall back to shared break-glass accounts.

Vertical

Switching orders and clearance tags: making the operator's authorization survive the log

Clearances protect human life. They are issued and released through a system whose record names a console session, not a verified human.

Vertical

Pipeline security directives and the operator action nobody can attribute

TSA directives for pipeline owner-operators are audited on documentation: architecture diagrams, policies, monitoring dashboards.

Vertical

Two-person control that software cannot prove

Two-person control is a physical idea: two keys, two humans. Digitised into two approver fields in a workflow, its independence is only assumed.

← All topics · All essays