A nation-state threat actor group seeks to sow chaos. Knowing that smaller towns and rural cooperatives rarely have the budget or staff for robust defenses, that's where they focus. They also hope a smaller utility will provide the gateway into an even larger grid where they can do more damage. Their goal is to attack a water treatment plant and raise chemical content to dangerous levels, poisoning the water supply.
But their first target has learned lessons from other attacks. The rural county's security lead put a zero trust strategy in place over the facility's operations technology infrastructure and industrial control systems. Implementing continuous and adaptive authentication throughout the entire organization—from grid to corporate systems—improves protection and limits the opportunity for wide-spread compromise.