Resilience Engineering for Operational Technology: The 2023-2025 Critical-Infrastructure Attack Record and the IEC 62443 Path
Keywords:
operational technology, ICS security, IEC 62443, critical infrastructure, water security, Purdue model, resilience engineering, digital trustAbstract
Background: Operational technology (OT) — the control systems behind water, energy, and manufacturing — became a headline cyber target in 2023-2025, not through novel exploits but through failures of basic hygiene: the November 2023 compromise of a western Pennsylvania water authority's Unitronics PLC by Iran-affiliated "Cyber Av3ngers" (default credentials, Internet-exposed device), the CISA advisory that followed (AA23-335A, updated December 2024), and the EPA's May 2024 enforcement alert reporting that over 70% of inspected drinking-water systems did not fully comply with Safe Drinking Water Act risk-assessment requirements. Objective: We analyze the 2023-2025 OT attack record and construct the resilience-engineering program it implies — one that accepts unpatchable legacy devices as a permanent condition and engineers around them. Methods: Incident-record analysis from government advisories and enforcement documents; architectural analysis using the Purdue hierarchy and IEC 62443's zones-and-conduits model; and a risk-versus-control coverage assessment. Results: The record shows a consistent mechanism: IT-side compromise traveling into flat OT networks to reach exposed, under-credentialed control devices — with real-world impact bounded not by cyber defense but by manual fallback (operators running treatment processes by hand). IEC 62443's zones-and-conduits segmentation, credential hygiene at the OT boundary, and rehearsed manual fallbacks are the highest-leverage controls; exotic threat intelligence ranks last. Conclusions: OT resilience is not IT security transplanted; it is engineered degradation tolerance. The 2023-2025 record tells utilities and industrial operators exactly what to build first.
References
1. WaterISAC, "Water Utility Control System Cyber Incident Advisory: ICS/SCADA Incident at Municipal Water Authority of Aliquippa," Nov. 30, 2023. [Online]. Available: https://www.waterisac.org/tlpclear-water-utility-control-system-cyber-incident-advisory-icsscada-incident-municipal
2. Cybersecurity and Infrastructure Security Agency, "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities" (AA23-335A), Dec. 1, 2023, updated Dec. 18, 2024. [Online]. Available: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a
3. U.S. Environmental Protection Agency, "Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities," May 20, 2024. [Online]. Available: https://www.epa.gov/enforcement/enforcement-alert-drinking-water-systems-address-cybersecurity-vulnerabilities
4. C. Deluzio, "Deluzio Introduces Bill to Help Local Water Authorities Strengthen Cybersecurity Efforts," Dec. 13, 2024. [Online]. Available: https://deluzio.house.gov/media/press-releases/deluzio-introduces-bill-help-local-water-authorities-strengthen-cybersecurity
5. IEC 62443 series, Security for industrial automation and control systems. International Electrotechnical Commission, multiple parts and editions.
6. NIST, "Guide to Operational Technology (OT) Security," NIST SP 800-82 Rev. 3, Apr. 2023. doi: 10.6028/NIST.SP.800-82r3.
7. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), OJ L 333, Dec. 2022.
8. NIST, "The NIST Cybersecurity Framework (CSF) 2.0," NIST CSWP 29, Feb. 2024. doi: 10.6028/NIST.CSWP.29.
9. T. J. Williams, "The Purdue enterprise reference architecture," Computers in Industry, vol. 24, no. 2-3, pp. 141-158, 1994. doi: 10.1016/0166-3615(94)90017-5.
10. European Union Agency for Cybersecurity (ENISA), "ENISA Threat Landscape 2024," Oct. 2024. [Online]. Available: https://www.enisa.europa.eu
Downloads
Published
Issue
Section
License
Copyright (c) 2025 The author(s)
This work is licensed under a Creative Commons Attribution 4.0 International License.
AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.
