Cyber-Resilience on microsegment.io

OT Integrator Access Needs An Expiry Date

Tue, 29 Sep 2026 00:00:00 +0000

A supplier finishes a commissioning project. The plant accepts the work. What expires?

The purchase order is not the security boundary. The useful questions are whether the support route still works, which assets it reaches, and what engineering material remains outside the plant.

Those are separate problems. A network rule can close a connection. It cannot recall a copied drawing.

The Evidence: Engineering Knowledge Outside The Plant

The September 23 FBI/CISA fact sheet on third-party ICS integrators describes a March-April 2025 intrusion into a U.S. industrial automation company. Attackers searched for customer and SCADA material and assembled archives containing device information and schematics for presumed exfiltration.

The Email Security Gateway Is Now An Attack Origin

Tue, 15 Sep 2026 00:00:00 +0000

The system designed to inspect hostile email can itself become the first compromised workload.

That is the uncomfortable lesson from Cisco Secure Email Gateway CVE-2026-76461. Cisco says insufficient validation in AsyncOS email parsing allows an unauthenticated remote attacker to send a crafted message, execute arbitrary SQL statements, and reach command execution with root privileges on the underlying operating system.

Cisco published the critical advisory on September 14, 2026, assigned a CVSS score of 9.8, confirmed active exploitation, and provided fixed releases. There is no workaround. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, according to the Canadian Centre for Cyber Security advisory.

Your Microsegmentation Policy Is Not Proven Until You Test The Deny

Tue, 08 Sep 2026 00:00:00 +0000

Most segmentation reviews prove that allowed traffic still works.

The application opens. The database responds. Monitoring is green. The change ticket closes.

None of that proves containment.

Containment depends on the traffic that must not work: the workstation that cannot reach the database, the web tier that cannot administer the hypervisor, the compromised build runner that cannot query production secrets, and the ransomware process that cannot discover every file server.

The 2026 Forrester Wave For Microsegmentation: Why Illumio Stands Out

Sat, 22 Aug 2026 00:00:00 +0000

Forrester has published The Forrester Wave™: Microsegmentation Solutions, Q3 2026, evaluating 10 vendors against 25 criteria.

The headline for Illumio is strong: Forrester named it a Leader, Illumio received the highest overall scores of any evaluated vendor in both the Current Offering and Strategy categories, and it was designated a Customer Favorite based on customer feedback in the evaluation.

That combination matters more than a Leader badge on its own.

Your CI/CD Runner Is A Privileged Workload. Contain It.

Tue, 18 Aug 2026 00:00:00 +0000

A CI/CD runner is not just a machine that builds software.

It is a workload that routinely sits between untrusted input and high-trust systems: source repositories, package registries, artifact stores, cloud APIs, deployment platforms, ticketing systems, and production environments.

That makes it privileged infrastructure, even when the workflow looks administrative rather than security-critical.

Wiz’s disclosure about a GitHub Actions vulnerability in a public Snowflake repository is a clean example. An unauthenticated user could place crafted content in a GitHub issue title. A workflow inserted that title directly into a shell script. Wiz’s autonomous Red Agent used the resulting script injection to execute commands on the runner, extract a Jira credential, and validate read access to internal Snowflake Jira projects.

OT Segmentation Must Survive Edge Compromise

Tue, 11 Aug 2026 00:00:00 +0000

An OT network can contain multiple VLANs and still have no meaningful containment.

The test is simple: if an attacker compromises the edge device, remote-access account, or management plane, can that attacker reach every controller, HMI, engineering workstation, and protection device behind it?

If the answer is yes, the architecture has internal organization. It does not have a durable security boundary.

CERT Polska’s report on the coordinated attacks against Poland’s energy sector on 29 December 2025 is a useful case study. The report covers attacks against at least 30 wind and solar facilities, a large combined heat and power plant, and a manufacturing company. The destructive actions affected both IT systems and physical industrial devices.

Microsegmentation Fails Quietly When Policy Drifts

Tue, 04 Aug 2026 00:00:00 +0000

The first microsegmentation policy is usually the easy one.

The application owner explains the expected flows. The security team observes traffic. Rules are tested, approved, and enforced. The result looks clean: web talks to application, application talks to database, administrators enter through a controlled path, and everything else is denied.

Then the environment changes.

A new monitoring collector appears. A migration needs temporary access. A workload moves to another cloud account. A certificate service changes. A developer opens an emergency path during an incident. The old application is retired, but its rules remain. Six months later, the policy still exists, but it no longer describes the system it was meant to protect.

Backup Infrastructure Needs Its Own Containment Boundary

Tue, 28 Jul 2026 00:00:00 +0000

Most backup strategies start with copies, retention, and restore speed.

Attackers start with reachability.

Can a compromised production administrator reach the backup console? Does the backup platform trust the production identity provider? Can ordinary server networks connect to repositories or storage management interfaces? Can a shared virtualization manager delete both workloads and their recovery points?

If the answer is yes, the backup environment is not outside the blast radius. It is simply another management plane inside it.