Loading story…
Revision 7 of Offshore Norge 104, published in June 2026, updates the recommended cybersecurity baseline for operational-technology environments. The guidance requires segmentation among OT, IT, supplier, third-party, management, and other OT traffic; recognizes logical and physical segmentation; and prefers dedicated OT infrastructure in critical areas. It also aligns with modern network-access-security principles by emphasizing controlled separation of environments rather than broad network connectivity.
The revision allows an exception to OT-DMZ traffic-termination requirements where OT-to-IT communications pass through hardware-enforced unidirectional gateways. Waterfall Security welcomed the recognition of physical isolation and unidirectionality, but urged stronger endorsement of such architectures for island-mode operations and secure remote access. The review also cautioned that requiring interactive remote-access platforms to support malware-scanned file transfers may preserve a significant attack path into OT networks.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Offshore Norge published Revision 7 of Offshore Norge 104, its recommended cybersecurity baseline requirements for operational technology systems. The revision requires segmentation of OT networks from IT, suppliers, third parties, and management traffic, and recognizes hardware-enforced unidirectional gateways as an exception to OT-DMZ traffic-termination requirements.
CISA and partner guidance titled Modern Approaches to Network Access Security was published, highlighting hardware-enforced unidirectional remote-access technologies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Operational technology (OT) environments, such as manufacturing lines, refineries, pipelines, and rail control systems, are increasingly adopting advanced cyber defense strategies to address the unique challenges posed by modern cyber threats. Traditional perimeter-focused security models are being replaced by breach-ready cyber defense approaches that assume compromise is inevitable and prioritize rapid containment and resilience. This shift is driven by the recognition that OT systems often involve long-lived equipment, complex dependencies, and components that cannot be easily patched, making them particularly vulnerable to sophisticated attacks. At the CS4CA Europe conference, industry experts highlighted the growing need for virtual segmentation in OT environments as a practical means to implement zero trust principles and contain threats before they can propagate. Virtual segmentation allows organizations to enforce security boundaries within heterogeneous OT networks, even when physical segmentation is impractical or impossible. The approach emphasizes mapping attack paths, reducing the attack surface, and controlling lateral movement to prevent breaches from escalating. Regulatory bodies like CISA have updated their guidance to encourage dynamic, risk-based segmentation strategies tailored to the operational realities of OT. In these environments, safety and operational continuity are paramount, often taking precedence over traditional IT priorities such as data integrity and comprehensive patching. As OT systems increasingly connect to the cloud and integrate artificial intelligence, the attack surface expands, necessitating more agile and resilient defense mechanisms. Breach-ready strategies also include rapid response measures such as quarantining affected zones, isolating unaffected systems, and ensuring robust recovery and failover capabilities. The ultimate goal is to prevent cyber incidents from resulting in catastrophic outcomes, such as loss of life, environmental disasters, or disruption of critical national infrastructure. Industry practitioners are urged to assess their breach readiness, identify hidden lateral attack risks, and develop visual roadmaps for remediation. The convergence of IT and OT security teams is seen as essential for operationalizing zero trust and maintaining production while managing cyber risk. These evolving practices underscore the critical importance of proactive, layered defenses in safeguarding the foundational systems that underpin modern society.
Jun 29, 2026
CISA, the UK **NCSC**, and multiple international partners released **Secure Connectivity Principles for Operational Technology (OT)** guidance aimed at reducing risk created by increased connectivity into industrial environments (e.g., industrial control systems, sensors, and other critical services). The guidance is positioned for operators of essential services facing business and regulatory pressure to enable remote monitoring and management, and it emphasizes that formerly *air-gapped* OT is now more exposed due to expanded remote access and IT/OT convergence. The guidance highlights that insecure or exposed OT connectivity is being targeted by a broad range of adversaries, including **ransomware groups**, **state-backed actors**, and **pro-Russia hacktivists** conducting opportunistic attacks against global critical infrastructure. Recommended defensive themes include **network segmentation**, **strong authentication**, continuous monitoring, and minimizing remote access paths to prevent disruptive incidents with potential real-world safety and service-delivery impacts; CISA also solicited stakeholder feedback via a product survey. Separate opinion pieces discussing AI in critical infrastructure and power redundancy risks in OT, and an industry roundup of Chinese cybersecurity companies, do not provide additional reporting on this specific guidance release.
Jun 29, 2026
U.S. **operational technology (OT)** security specialists urged **NIST** to make its forthcoming update to *Special Publication 800-82* significantly more practical and granular, arguing that OT owners and operators need actionable guidance rather than high-level frameworks. The feedback was provided as NIST begins its **fourth revision** of SP 800-82 and solicits private-sector input, reflecting growing maturity and urgency in OT cybersecurity governance. Vendors and practitioners emphasized that OT environments require different approaches than conventional IT, particularly for **vulnerability management**, where standard IT practices may be ineffective or counterproductive in industrial settings. Commenters also called for more **sector-specific guidance** for emerging OT verticals such as **smart building management** and **distributed energy systems** (including **EV charging networks**), and broadly supported NIST’s proposal to move several SP 800-82 appendices online—covering OT security organizations, tools and threats, and catalogs of vulnerabilities and incidents—to keep reference material more current.
Jun 29, 2026