Trust But Verify: Why Every Air-Gap Claim Deserves Scrutiny

In this episode of Industrial Cybersecurity Insider, hosts Dino Busalachi and James Cook dismantle the common assumption that operational technology (OT) networks are air-gapped and therefore secure. They argue that in practice, OT systems are often connected to the internet or enterprise networks through various means, such as cellular modems, VPN concentrators, or guest Wi-Fi, often without IT’s knowledge. The hosts share real-world examples from plant floors, including third-party technicians plugging into networks and plant managers bypassing IT security to ensure remote support. They highlight the organizational gap between IT and OT, where responsibility for security is unclear, and the pressure on plant managers to minimize downtime leads to risky practices. The discussion covers the challenges of implementing zero trust in OT environments, the importance of continuous visibility, and the value of bringing in external experts to uncover hidden connections. They also touch on supply chain risks and the need for better collaboration with equipment vendors. The episode concludes with a call to ’trust but verify’ and to monitor continuously, rather than relying on one-time assessments.