Three months offline: the identity test facing critical infrastructure

Australia’s critical infrastructure operators face a demanding cyber resilience test: keeping essential services running while vital operational systems are disconnected from other networks for up to three months.

The Australian Signals Directorate’s CI Fortify guidance puts prolonged isolation at the centre of contingency planning.

For energy suppliers, utilities, transport operators and resources companies, the challenge goes beyond blocking an attack. They must fully understand whether their operational technology can function safely when normal connections to corporate systems disappear.

That makes identity management an operational concern with consequences for service continuity. A network can be segmented; however, the equipment behind it may still depend on external systems to authenticate users, validate credentials or authorise maintenance.

Disconnecting those services without understanding the dependencies could leave essential personnel locked out, automated processes interrupted, and critical equipment harder to manage. The ability to operate independently therefore depends on knowing who, and what, needs access.

Hidden dependencies behind the firewall

Operational technology (OT) increasingly shares services with the broader enterprise. Active Directory, domain name services, and certificate infrastructure can all support systems that operators might otherwise regard as separate.

ASD’s guidance calls for organisations to identify dependencies between operational and other environments that could undermine effective isolation. Identity belongs in that assessment because access decisions frequently rely on infrastructure outside the systems being protected.

Everyone from employees and engineers to administrators and contractors may all require access to critical assets. Applications and connected devices also communicate across the boundary between corporate IT and operational systems.

Those connections can improve efficiency and simplify maintenance; however, they also create potential routes for attackers and dependencies that become apparent only when connections are removed.

Operators need a clear inventory of these identities and their supporting services. That inventory should distinguish essential access from permissions accumulated over time, including dormant accounts that remain active after work has finished.

The assessment must establish which identities are necessary to maintain the critical service during isolation. Discovering that an essential account relies on an unavailable corporate directory during an incident leaves little room for an orderly response.

ASD recommends a graduated isolation capability, allowing organisations to progressively remove pathways into critical environments as threats increase. Access arrangements should follow the same logic.

A technician’s remote connection might be acceptable during routine operations, restricted during heightened risk, and then withdrawn during full isolation. Essential personnel may still need access; however, their permissions should reflect the tasks required to keep services running safely.

Privileged accounts warrant particular attention as they can change configurations and influence operational processes. Persistent administrative permissions give attackers opportunities even when legitimate users have no immediate need for them.

Moving towards Zero Standing Privilege means granting elevated access for an approved purpose and a limited period. For external specialists, this can preserve necessary maintenance support while reducing exposure from permanently available administrative connections.

However, those controls must be able to work during isolation. An approval process or access platform dependent on disconnected services could obstruct urgent maintenance just when operators need it most.

Machines need an isolation plan too

The identity challenge extends well beyond employees and contractors. Service accounts, industrial devices, applications and APIs can hold credentials that allow them to exchange information and initiate actions.

AI agents add another dimension as organisations explore autonomous and semi-autonomous workflows. An agent interacting with operational systems may analyse data, invoke tools, or initiate actions under authority delegated by a person or another system.

Governance must therefore establish both what the agent can access and what it is authorised to do. Operators need to know whose authority it exercises, who owns it and how its permissions can be constrained or revoked during an incident.

An agent dependent on external models or services also introduces continuity questions. Its availability and permitted role during isolation need to be understood before it becomes embedded in an essential workflow.

These issues make identity governance part of critical infrastructure architecture. Least privilege and accountable ownership help operators determine which connections can be removed without disrupting services.

Testing is the decisive step. ASD recommends periodically testing isolation because checks of individual components may miss dependencies revealed when the entire environment is disconnected.

Exercises should establish whether essential staff can authenticate, privileged access remains available, and unnecessary external access can be withdrawn promptly. They should also test whether access decisions can still be governed and audited.

The commercial stakes are substantial. An access failure during a prolonged outage can complicate recovery and threaten continuity of essential services.

For executives, the benchmark is clear in that an isolation plan must preserve safe operations for an extended period. Knowing exactly which identities retain access, and why, is central to meeting that obligation.

James Ross was appointed Regional Vice President for Australia and New Zealand at Saviynt, a leading provider of identity security, in 2024 and has three decades of experience working in the IT industry. He was previously Regional Vice President ANZ at ForgeRock, ANZ Country Manager – Security at CA Technologies and, earlier on in his career, held various sales positions with IBM.

Top image credit: iStock.com/Kaikoro