Protecting critical infrastructure is the urgent calculus facing city managers, utility chiefs and cybersecurity teams who must defend life‑sustaining systems on shoestring budgets. How do you keep a water‑treatment plant, a power grid or transit control center running when resources are scarce and attackers grow more capable by the month? That dilemma framed a recent conversation on Lock It Down with Security Magazine between Associate Editor Taelor Sutherland and Chetrice Romero, a senior cybersecurity advisor at Ice Miller — and it points to a pragmatic, prioritized path forward for operators and policymakers alike.
Protecting critical infrastructure: what we already know
Over the past decade adversaries have moved from indiscriminate cybercrime to operations that deliberately target operational technology (OT) and industrial control systems (ICS), with the potential for real, physical harm. Incidents against pipelines and water utilities have shown not only capability but intent to inflict disruption on communities and regional economies. At the same time, many owners and operators — municipal utilities, small private firms and regional agencies — confront aging equipment and constrained budgets that make wholesale upgrades unrealistic.
This reality shaped the core message delivered on the Lock It Down episode: when funding is limited, pick the measures that reduce the most risk per dollar and execute them consistently. Romero and other practitioners argue that disciplined execution of a few high‑impact controls beats scattershot compliance or unfocused investments.
High‑impact tactics that cost comparatively little
Across technologists’ and operators’ guidance the same fundamentals keep recurring. These are practical, measurable and—importantly—deliverable even when budgets are tight:
- Maintain an accurate, up‑to‑date asset inventory for IT, OT and IoT devices—“you cannot protect what you do not know you have.”
- Prioritize protections around high‑impact assets and single points of failure.
- Implement basic network segmentation to separate OT from IT and restrict cross‑domain traffic.
- Enforce strong access controls: multifactor authentication for administrators and remote access, and least‑privilege policies for both human and machine identities.
- Where patching is difficult in OT environments, use compensating controls such as network isolation, virtual patching or micro‑segmentation.
- Deploy centralized logging, tuned endpoint detection and response, and targeted threat hunting to improve time‑to‑detect and time‑to‑contain.
- Exercise incident response plans with tabletop scenarios and full‑scale drills that include operational staff, emergency responders and communications teams.
- Leverage managed security services, Information Sharing and Analysis Centers (ISACs), and federal/state grant programs to extend capability affordably.
These approaches emphasize measurability and repeatability: asset baselines, segmentation controls and response‑exercise outcomes can be tracked and used to direct scarce capital where it reduces risk most.
Why prioritization matters to technologists, policymakers and users
Technologists see automation and telemetry as force multipliers. Investing modestly in centralized telemetry and automated workflows lowers ongoing labor costs and shortens detection and containment times — metrics that translate to real resilience rather than certificates on a compliance wall. Policymakers and legal advisers point to grants and incentives as practical levers: federal programs (including those administered through CISA) and state homeland security funding can close capability gaps for smaller utilities, while incentive‑based funding tends to drive smarter, measurable investments. Users and frontline workers raise a common operational concern: security that impedes mission‑critical workflows is often bypassed, creating fresh vulnerabilities. Thus, controls must be usable and tailored to operational realities to be effective in practice.
Tradeoffs and real‑world constraints
Every defensive choice carries tradeoffs. Network segmentation can interrupt operations during rollout; multifactor authentication can complicate access for field engineers; outsourcing to managed security providers introduces supply‑chain and contractual risk. The conversation on Lock It Down stresses that acknowledging these tradeoffs and designing mitigations is part of disciplined execution — not an excuse for inaction. Romero’s framing, echoed across industry guidance, reframes the objective: resilience over perfection.
Operational checklist: stretch every security dollar
- Start with a verified asset inventory and map dependencies and single points of failure.
- Segment networks: separate business IT from OT and strictly log cross‑domain traffic.
- Apply least‑privilege access and multifactor authentication for sensitive accounts.
- Use compensating controls where patching or upgrades are impractical.
- Invest in telemetry and threat hunting to reduce detection gaps.
- Run regular incident exercises that include public‑utility and emergency stakeholders.
- Pursue federal/state grants, ISAC collaboration and managed services to amplify limited staff capacity.
These checklist items are not a panacea, but they are repeatable, measurable, and—crucially—affordable starting places that produce meaningful reductions in risk when implemented consistently.
Different adversaries, one practical response
Adversaries range from ideologically driven actors seeking disruption to state‑aligned teams pursuing geopolitical objectives; regardless of motive, the result is the same: public harm and eroded trust. Practical defenses—asset awareness, segmentation, access control and practiced response—reduce an adversary’s ability to turn compromise into cascade. Information sharing and public‑private cooperation accelerate learning across sectors and enable coordinated responses to emergent threats.
Policy levers that can help
Policymakers can multiply scarce operator dollars by:
- Targeting grants and incentives toward measurable risk‑reducing controls rather than unfunded mandates.
- Supporting ISACs and information‑sharing mechanisms to get tactical intelligence to small operators.
- Encouraging standards adoption (such as NIST CSF) while recognizing operational constraints in OT environments.
Such levers help align incentives without replacing the operational need for fundamentals delivered at scale.
Conclusion
When the ledger of risk is weighed against limited funding, the clearest path is seldom the most glamorous: pick the highest‑impact, lowest‑cost controls, measure results, and practice recovery. As the Security Magazine discussion between Taelor Sutherland and Chetrice Romero underscores, disciplined, pragmatic choices give small operators outsized defensive returns — and buying time is sometimes the most valuable result of all. In the end, the pressing question remains: when attackers succeed against the next vulnerable utility, will we have done enough to limit harm and restore trust?
Source: https://www.securitymagazine.com/articles/101892-protecting-critical-infrastructure-with-limited-funding
