Safeguarding Critical Infrastructure in the IoT and Edge Era

Critical infrastructure comprising physical assets, digital networks, and human elements forms the foundation of our global society and economy. These interconnected systems come with complex dependencies, and any disruption can pose serious risk to public health, safety, and security. The US Department of Homeland Security (DHS) has identified four sectors¹ of critical infrastructure—water and wastewater systems, energy, transportation systems, and communications—as lifelines, since they enable the operations of all other sectors.

Consumerization of IT, along with the rise of advanced technologies such as virtualization, edge computing, Internet of Things (IoT), artificial intelligence (AI), and 5G, is driving efficiency and transforming critical infrastructure sectors. In real-world critical infrastructure environments, IoT and edge computing typically operate in tandem with other digital technologies to ensure speed, reliability, and effective oversight (figure 1).

Figure 1—IoT and Edge Computing Applications in Critical Infrastructure Sectors

According to the 2024 Verizon Mobile Security Index Report, nearly 95% of critical infrastructure organizations now deploy IoT devices.² These devices are used for physical security (61%), monitoring system efficiency (52%), and delivering digital services (52%). Many critical infrastructure sectors have made great strides in digital growth; however, this growth is directly linked to a surge in cyberrisk. A report by Check Point Research revealed that cyberattacks on US utilities surged nearly 70% in 2024 compared to the same period in 2023.³ Given the scale and increasing frequency of threats, sweeping changes to the way critical infrastructure organizations approach IoT and edge computing risk are in order.

Understanding the Threat Landscape in Critical Infrastructure Sectors

The rapid adoption of IoT and edge computing has led to complacency in how organizations manage critical infrastructure systems. As IT infrastructure converges with industrial control systems (ICS) and operational technology (OT), it significantly and uniquely expands the attack surface.

Traditional cybersecurity measures often struggle to keep pace with the speed and complexity of today’s evolving threat landscape. This undermines the perceived benefits of emerging technologies in critical infrastructure. There are several ways the use of IoT and edge computing in critical infrastructure increases risk exposure:

• IoT plays a fundamental role in modern ICS and OT environments by facilitating real-time data collection, automation, and remote control in critical infrastructure. These capabilities have revolutionized industries, from live-monitoring structural integrity in bridges to controlling pipeline pressure in energy systems and improving water treatment processes and manufacturing operations. However, this transformation has also precipitated increased supply chain risk. Many IoT components that were not originally designed with security in mind are now directly connected to the internet without adequate protection. When deployed in remote environments with internet connectivity, these devices often lack baseline controls, such as strong passwords, multifactor authentication (MFA), encrypted communication, and timely patching of firmware. The resulting security gaps enable a variety of threats, including botnet attacks, unauthorized remote control, lateral movement within networks, and data exfiltration. The impact upon exploitation affects all three pillars of security—confidentiality, integrity, and availability—through data leaks, sensor spoofing, and distributed denial of service (DDoS) attacks using ephemeral botnets. As IoT deployments scale, maintaining consistent security becomes increasingly difficult and requires organizations to enforce guidance such as the US National Institute of Standards and Technology (NIST) Special Publication (SP) 800-213 and the International Electrotechnical Commission (IEC) 62443 series.⁴ Given the scale and increasing frequency of threats, sweeping changes to the way critical infrastructure organizations approach IoT and edge computing risk are in order.

• Edge computing has made critical infrastructure sectors more agile by processing data closer to the source. This helps those in industries such as manufacturing, transportation, and energy make faster, more responsive decisions, and reduce dependency on cloud servers. However, edge computing also presents unique security concerns due to the distributed and physically exposed nature of edge environments. Simply put, edge devices sit between trusted internal networks, and many such devices are exposed via public IP addresses, thus serving as entry points for cyberattacks. This is no longer a mere matter of protecting internal data and systems. Edge devices themselves need strong safeguards to prevent exploitation. To this end, a 2017 proof-of-concept ransomware developed by researchers at Georgia Tech demonstrated how malware could potentially spread and disrupt ICS by targeting programmable logic controllers (PLCs), which are widely used in critical infrastructure.⁵ Edge devices are prime targets for threat actors because they are prone to misconfigurations, inconsistent software updates, default settings, insecure protocols, open ports, and poor network segmentation. If breached, these devices can be used to intercept sensitive data, manipulate communications, or launch large scale DDoS attacks, ultimately disrupting essential systems and services that depend on timely edge processing. Managing a large number of edge devices spread across multiple locations is complex, particularly when security standards and practices are inconsistent. Thus, relying solely on vendors and manufacturers for baseline configuration and secure by design devices is overly simplistic and insufficient; instead, administrators must take responsibility for making sure edge devices are properly set up and maintained.
• Emerging technologies such as AI, cloud computing, and 5G play a crucial role in making IoT and edge computing viable in critical infrastructure. AI enables real-time threat detection at the edge and supports cloud analytics by handling large volumes of data, coordinating device operations, and maintaining visibility across distributed systems.⁶ Meanwhile, 5G provides the fast, stable connectivity needed for seamless communication between devices. Together with sensors, embedded systems, and industrial communication protocols, these technologies form a complex ecosystem that supports the current scale and speed of critical infrastructure operations. However, what makes risk management particularly challenging is the interconnected nature of these technologies. AI, cloud, and 5G each introduce their own set of vulnerabilities, resulting in a fragmented landscape that is difficult to protect uniformly. Misconfigured cloud services, AI systems exposed to manipulated data, and insecure 5G architectures create viable paths for attack. These weaknesses can allow unauthorized access, lateral movement, application programming interface (API) abuse, and compromise of not only edge systems but also ICS and OT. If exploited, gaps can lead to data leaks, manipulation of operational commands, or widespread service outages, ultimately threatening the security and reliability of critical infrastructure.

The True Cost of Disruption in Critical Infrastructure

Sophisticated digital exploits and malicious actors target essential services, government facilities, and public infrastructure—all of which have no tolerance for downtime. There are four consequences of cyberattacks that underscore the gravity of threats to critical infrastructure:

• Human safety—Cyberattacks on systems such as hospitals, water treatment facilities, or transportation networks are not just about data or downtime; they can cause real-world physical harm or loss of life. For example, in 2024, a ransomware attack targeted a pathology services provider supporting National Health Service (NHS) hospitals in London.⁷ The threat actors infiltrated IT systems and disrupted critical diagnostic operations including blood tests for surgical decisions. As a result, hospitals were forced to postpone critical procedures and appointments and at least one patient’s death was linked to the delayed test results caused by the attack. While the attackers were motivated by financial gain, the consequences extended beyond just data loss, demonstrating how attacks on healthcare systems can lead to physical harm and even loss of life. Similarly, cyberattacks on transportation infrastructure, such as air traffic control networks and rail signal systems, could trigger fatal crashes or derailments if signaling data or systems are adversely manipulated or taken offline, even briefly. In August 2024, Germany’s air traffic control agency was targeted by a cyberattack linked to the Russian group APT28.⁸ The attackers used spear phishing and exploited unpatched software vulnerabilities to infiltrate the agency’s administrative IT network. While in this case the safety of flight control systems remained unaffected, the breach highlighted serious risk to critical aviation infrastructure.
• Cross-sector cascading impact—Critical infrastructure sectors are often fragile and deeply interconnected, meaning an attack on one sector can cascade into disruptions across others—sometimes impacting entire regions or countries. The ripple effects can cause serious harm and disrupt daily life for entire communities. These interdependencies are often underestimated in critical infrastructure risk planning. For example, the Canadian and US energy grids are closely interconnected, so a cyberattack affecting power supply in the United States could cripple essential services in Canada, such as hospitals, telecommunications, transportation systems, and water treatment plants—all of which depend on stable power to function. Such disruptions can snowball and easily overwhelm response capabilities well beyond the initial target.
• National security and geopolitical implications—Critical infrastructure attacks can severely impair national sovereignty, global standing, and defensive readiness. In December 2023, a multivector cyberattack targeted Kyivstar, Ukraine's largest telecommunications provider.⁹ The attack, widely attributed to Russian-backed hacker groups, deployed destructive malware that compromised and disrupted critical telecommunications infrastructure including servers and cloud systems. It was carried out using a combination of spear phishing, stolen credentials, and remote exploitation tools to infiltrate the network. The disruption affected mobile and internet services for millions of users across Ukraine, including critical systems such as air raid warning alerts, illustrating how state-sponsored cyberattacks can be used to assert regional influence. Thus, strengthening a nation’s commitment to baseline protection and cyberresilience requires focused effort, especially in countries with limited state capacity.
• Long-term operational and recovery costs—Recovery from a cyberattack on critical infrastructure often includes system forensics, software patching, regulatory compliance reviews, and infrastructure overhauls. However, recovery efforts do not end once systems are back up and running. Recovery can be a lengthy, resource-intensive, and expensive process. In 2021, a major US-based fuel supplier suffered a cyberattack that began with a compromised virtual private network(VPN)-connected device and led to ransomware deployment, forcing a shutdown of its OT systems and pipelines.¹⁰ The attack disrupted fuel supply chains across several states, leading to shortages, public panic, and price spikes in the airline and transportation industries. The fuel supplier made a US$4.4 million ransom payment to restore access. Following the incident, a class action lawsuit was filed against the fuel supplier for negligence, citing harm to more than 10,000 fuel retailers. This case highlights how cyberattacks on critical infrastructure can have lasting impacts. These impacts are not just operational, but also reputational and financial, even for organizations that are otherwise well prepared.

Cyberpractitioners must clearly understand which threats will have the greatest impact and how to address them effectively. To achieve this, they often lean on established industry frameworks as a starting point—but this is where challenges may begin.

Bridging Frameworks and Operations in Critical Infrastructure

In theory, there are security frameworks that can be adapted for critical infrastructure risk. The zero trus¹¹ paradigm for industrial infrastructure and Secure Access Service Edge (SASE)¹² guide organizations in integrating security and networking functions into a unified cloud platform, regardless of location. The US DHS developed the National Infrastructure Protection Plan (NIPP) along with a coordinated risk management framework to minimize the impact of attacks on critical infrastructure by leveraging federal resources (figure 2).¹³

Source: US Department of Homeland Security, “National Infrastructure Protection Plan,” USA

Furthermore, the Network and Information Security (NIS2) Directive¹⁴ requires organizations in the European Union to put safeguards in place and demonstrate that they work. While interest in such frameworks and regulations is growing, many organizations in critical infrastructure sectors continue to neglect their valuable guidance due to resource limitations, operational constraints, and industrial contexts.

Moreover, it is impossible to overlook the proverbial weakest link in cybersecurity—people. After all, the onus of implementing frameworks is a shared responsibility for the critical infrastructure community, which is comprised of public and private owners and operators, among other stakeholders. Tackling these challenges means rethinking how risk is understood, managed, and shared. To achieve this, a layered approach with strategic, operational, and tactical dimensions (figure 3) must first complement any frameworks. This approach can be integrated with regulatory compliance requirements, domain expertise, industry best practices and adjusted over time to address sector-specific needs.

Key Considerations for Implementing Critical Infrastructure Risk Management

The question that all organizations must answer is how to close the gap between frameworks and effective execution. Adopting a responsive management approach helps align risk efforts with real-world needs and operational realities. There are five considerations to be addressed when mitigating emerging threats in critical infrastructure:

1. Map technological complexities with system dependencies. From an attack surface perspective, grasping how technologies integrate and interact within each sector is paramount. It may not be obvious that physical service interruptions are often caused by upstream and downstream risk in critical infrastructure, much of which originates in IT. For example, smart meters in the energy sector rely on third-party mobile networks and data collectors to send data to utility providers, which usually store and manage the data in cloud environments. If the in-scope telecom network goes down or the cloud infrastructure is compromised, power delivery to homes is affected. Assessing how systems, technologies, and data operate within each sector’s environment can reveal potential attack vectors, single points of failure, data exfiltration risk, and cross-domain vulnerabilities. This mapping exercise clarifies how cyberrisk becomes physical risk via IT–OT architecture diagrams, data flow maps, and asset inventories. A blueprint for threat modeling and analyzing the attack surface can be created by looking at several factors:
   • What are the mission-critical functions and what technologies enable them?
   • What devices, platforms, network interfaces, and protocols are in use to connect legacy operational technology with modern IT systems?
   • What types of data are collected, and how is data stored, processed, or transmitted?
   • What external vendors, cloud services, or third-party APIs are integral to operations?
   • Which physical processes rely on digital inputs (e.g., power shutoff, automated brake systems, opening or closing valves)?
   • How can system failures trigger failures in other systems or sectors?
2. Define contextualized risk profiles. Often in critical infrastructure, cross-sector differences persist not only in operations, technologies, or data flows, but also in cyberthreat exposure and the potential impact on society. For instance, some industries are targeted by threat actors more than others. Data from the European Repository of Cyber Incidents (ERCI) showed that out of 450 attacks on critical infrastructure sectors, healthcare was the most affected, accounting for 14.2% of incidents.¹⁵ Financial services followed at 8.3%, with telecom, transportation, and energy sectors also targeted. If one considers impact, the same technical threat can have different consequences depending on the sector. For example, a ransomware event in the financial sector can encrypt core banking systems and disrupt transaction processing and payment platforms, while in healthcare, it can shut down access to electronic health records (EHRs) or disable hospital systems. A threat that causes financial inconvenience in one sector can cause catastrophic safety failure in another. Hence, maintaining granular risk visibility is key. Risk assessments of varying depths must be conducted for each critical infrastructure sector to identify cyberrisk specific to the operational and technological environment.
3. Adapt to point-in-time risk prioritization. The issue with sector-specific risk profiles is that they often treat risk as snapshots in time—while threats in critical infrastructure evolve rapidly—resulting in a diminished view that overlooks the broader risk landscape. To stay focused on what matters most, a dynamic risk matrix to assess and reprioritize risk in real time should be incorporated. Taking this idea further, live threat intelligence should be integrated into risk models. This may include feeds covering new ransomware strains, zero-day vulnerabilities, patch status, or known exploits. Tapping into sector-specific advisories must be encouraged including from information sharing and analysis centers (ISACs), and alerts from the US Computer Emergency Readiness Team (US-CERT) and the US Cybersecurity and Infrastructure Security Agency. This allows risk scores to be dynamically adjusted (usually elevated) as the threat changes, even if the baseline risk was previously considered low. In addition, when calculating risk impact, it is important to move away from viewing an attack as strictly a technical compromise or failure. What matters most is maintaining safety and determining how essential each system or asset is to the delivery of critical services. The true impact is not just about what fails, but also about when, where, and how long it takes to recover. Finally, interdependency risk should be factored into risk scoring to prioritize risk that can quickly escalate or cascade into other sectors.
4. Deploy safeguards that fit operations. Implementing effective controls in critical infrastructure environments means aligning security measures with the realities of the attack surface without getting in the way of operations. Fit-for-purpose safeguards must be engineered by considering the technical architecture and physical constraints of the sector. One piece of this puzzle is ensuring that resources are not wasted on the wrong controls. For instance, applying encryption to all data in transit could be best practice, but when applied in an industrial control loop or emergency dispatch network, this may interfere with system behavior or delay safety-critical responses. Similarly, blanket audit logging across all endpoints does not add value unless logs are aligned with key operational events, such as medication administration in healthcare or control room overrides in a power plant. The other piece of the puzzle is making sure that the vulnerabilities that matter the most are not missed, while also remembering that not all threats carry the same weight in every sector. For example, a bank might focus on protecting transactions from DDoS attacks, while a power utility service may want to isolate SCADA systems from the internet using network segmentation and strict access controls.
5. Establish agile governance models. Both the COBIT^® framework and the NIST Cybersecurity Framework (CSF) 2.0 recognize governance as a key driver of risk management.¹⁶ In the context of critical infrastructure, resilience cannot be built in the absence of ongoing monitoring and flexible governance. Similar to continuous threat monitoring, cyclical risk assessments and control effectiveness checks should be performed to stay on top of new system changes and evolving threats. Governance models should support the rollout of periodic policy updates without disruption and also facilitate workforce training—both technical role-based training and scenario-based social engineering testing to reinforce retention. Reinforcement through simulation testing, tabletop exercises, and post-incident lessons learned is critical for validating readiness and continuous improvement. Last, sharing threat intelligence with federal, state, local, tribal, territorial, and private sector partners across sectors is essential for a stronger response to potential attacks. The last thing that organizations and agencies want is a siloed structure that impedes communication and alignment between stakeholders. Teamwork and coordination between sectors and partners can localize damage and prevent regional or nationwide impact.

Conclusion

The critical infrastructure ecosystem has become more complex and interconnected through the increasing adoption of digital technologies such as IoT and edge computing. There is a growing need to move beyond traditional approaches to risk management, and that move begins with context. Risk—and risk management—in critical infrastructure cannot be generalized. There is a need to evaluate risk in context and employ tailored tactics and safeguards proportional to sector-specific vulnerabilities. A continuously evolving risk management approach that adapts to the shifting threat landscape will be the key to building resilient critical infrastructure.

Endnotes

¹ US Cybersecurity and Infrastructure Security Agency, “Critical Infrastructure Sectors,” USA
² Verizon, 2024 Mobile Security Index, 2024
³ Dareen, S.; Srivastava, V.; “Cyberattacks on US Utilities Surged 70%This Year, Says Check Point,” Reuters, 11 September 2024
⁴ National Institute of Standards andTechnology (NIST), Special Publication 800-213, IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoTDevice Cybersecurity Requirements, USA, November 2021, ; International Society of Automation (ISA), International Electrotechnical Commission (IEC), “ISA/IEC 62443 Series of Standards,”
⁵ Derbyshire, R.; Green, B.; et al.; “Dead Man’s PLC: Towards Viable Cyber Extortion for Operational Technology,” DigitalThreats: Research and Practice, vol. 5, iss. 3, 2024, p. 1–24
⁶ Deloitte, Tech Trends 2023, 2023
⁷ Synnovis, “Update on Cyber Incident: 01 July 2024,” 1 July 2024
⁸ Kostina, I.;Tyshchenko, K.; “German AirTraffic Control Suffered Cyberattack, Likely by Pro-Russian Group of Hackers,” Ukrainska Pravda, 1 September 2024
⁹ Greenberg, A.; “Hacker Group Linked to Russian Military Claims Credit for Cyberattack on UkrainianTelecom,” Wired, 13 December 2023
¹⁰ Bussewitz, C.; “Colonial Pipeline Confirms it Paid $4.4M to Hackers,” AP News, 19 May 2021
¹¹ National Institute of Standards andTechnology (NIST), Special Publication 800-207, Zero Trust Architecture, USA, August 2020
¹² Fortinet, “What Is SASE (Secure Access Service Edge)?”
¹³ US Department of Homeland Security, “National Infrastructure Protection Plan,” USA
¹⁴ European Commission, NIS2 Directive: New Rules on Cybersecurity of Network and Information Systems, European Union, 2024
¹⁵ Joshi, A.; “These Sectors AreTopTargets for Cybercrime, and Other Cybersecurity News to KnowThis Month,” World Economic Forum, 22 April 2024
¹⁶ ISACA^®, COBIT^®, USA, 2018; National Institute of Standards and Technology (NIST), The NIST Cybersecurity Framework (CSF) 2.0, USA, 26 February 2024

SURAJ RAGHUPATHY ISWARAN

Is a senior cyber and strategic risk consultant at Deloitte with more than six years of experience in cyberrisk consulting and management. He specializes in designing and executing third-party risk assessments, conducting vendor due diligence, and supporting enterprise compliance and threat monitoring efforts for clients across the financial services, healthcare, and technology industries.