Supply Chain Threats to Cyber Physical Systems: The Case for Process-Oriented OT Cybersecurity

The story of the Trojan Horse is one of history’s most famous cautionary tales. Unable to breach Troy’s towering walls, the Greeks resorted to deception. They left a giant wooden horse as an offering, hiding soldiers inside. Believing they had won, the Trojans brought the horse into their city. Under the cover of night, the hidden soldiers emerged, and Troy fell. Not because its walls were weak, but because the real danger came from within.

In today’s world of cybersecurity, the supply chain is the Trojan Horse. Trusted hardware, software, or vendor systems often carry hidden risks: compromised updates, counterfeit components, or malicious access. These vulnerabilities bypass traditional defenses and strike at the heart of critical infrastructure, putting industries like power utilities, oil and gas, and water systems at risk.

This article unpacks how supply chain threats exploit these vulnerabilities and explains why Process-Oriented OT Cybersecurity is the key to detecting and neutralizing them before they cause harm.

The Anatomy of an Attack: A Trojan Horse in OT

Cyberattacks targeting operational technology (OT) environments often follow a deliberate, multi-stage path. Here’s how supply chain threats infiltrate and disrupt critical systems:

1. Entry Through the Supply Chain
   Attackers exploit trusted third parties—vendors, contractors, or suppliers. For example, malicious USB drives introduced via contractors, as seen in the infamous Stuxnet attack, can inject malware directly into critical systems​.
2. Initial Compromise
   Once inside, attackers exploit vulnerabilities like outdated software or weak credentials to gain unauthorized access to the Industrial Control System (ICS) network​.
3. Manipulation of Control Systems
   The attack moves deeper, targeting Programmable Logic Controllers (PLCs) and Human-Machine Interfaces (HMIs). Malicious code alters equipment behavior, forcing machines to operate beyond safe parameters. For instance:
   • Gas turbines may experience unsafe gas overflows, leading to explosions.
   • Substation circuit breakers may trip unnecessarily, causing large-scale blackouts​.
4. Concealment and Disruption
   Attackers mask their actions by manipulating HMIs or generating false data, making it appear as though systems are functioning normally. Operators, unaware of the danger, are left powerless to stop the attack before physical and operational damage occurs​.

The Need for Process-Oriented OT Cybersecurity

Traditional cybersecurity methods focus primarily on IT systems: firewalls, endpoint security, and patch management. While effective in protecting digital assets, they fail to account for the unique challenges of OT environments, where the consequences of an attack are not just data breaches but physical disasters​.

Process-Oriented OT Cybersecurity bridges this gap by focusing on the processes themselves—the physical operations that define industrial systems. 

Here’s how it works:

Multi-Level Monitoring (Purdue Model): This approach monitors all levels of the ICS, from the physical processes at Level 0 (e.g., turbine operations) to the supervisory controls at Levels 1-4. Here is why it matters:  higher levels of the ICS can be manipulated to hide attacks, but Level 0 data (directly from physical level) remains unfiltered and reliable. By comparing Level 0 data with higher-level systems, process-oriented security can detect inconsistencies that signal an attack​.

Machine Learning for Anomaly Detection: Advanced machine learning models analyze vast amounts of data to detect deviations from normal operation.  For instance, if a gas turbine valves are forced open while the turbine is offline, Machine Learning models can flag this anomaly even if the HMI shows normal conditions​.

Real-Time Decision Support: During an attack, Process-Oriented OT Cybersecurity provides operators with actionable insights, such as recommending whether to isolate compromised systems, shut down operations, or continue cautiously to minimize disruption​.

Regulatory Pressures on Supply Chain Security

Governments and industry bodies around the world are increasingly recognizing the critical importance of securing the supply chain for OT. Regulations and standards are evolving to address these vulnerabilities, particularly in critical infrastructure sectors like power utilities:

• NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection):
  In North America, utilities are required to comply with NERC CIP standards, which mandate controls for vendor access, software updates, and supply chain risk management​.
• EU Cyber Resilience Act:
  In Europe, the Cyber Resilience Act introduces strict guidelines for ensuring secure supply chains for critical infrastructure, with penalties for non-compliance​.
• ISA/IEC 62443 and ISO/IEC 27019:
  These global standards provide a framework for managing cybersecurity risks across industrial control systems, emphasizing supply chain security​.

By aligning their cybersecurity strategies with these regulations, organizations can not only meet compliance requirements but also build stronger defenses against supply chain threats​.

The Role of Collaboration in Supply Chain Security

No organization operates in isolation—especially when it comes to securing the supply chain. Collaboration is essential to mitigate risks that span multiple vendors, contractors, and suppliers.

1. Establishing Shared Standards
   Utilities should work with their vendors to ensure consistent security standards are in place across the supply chain. This includes enforcing secure coding practices, regular vulnerability assessments, and adherence to frameworks like ISA/IEC 62443​.
2. Vendor Risk Management
   Beyond one-time assessments, utilities need ongoing monitoring of vendor practices. This includes verifying third-party access, auditing supply chain components, and ensuring that vendors implement proper patch management protocols​.
3. Shared Threat Intelligence
   Collaboration can also involve sharing threat intelligence among utilities, vendors, and industry groups. By pooling information about known vulnerabilities, organizations can proactively defend against emerging threats​.
4. Training and Awareness Programs
   Vendors and contractors are often the weakest links in supply chain security. Collaborative training programs that educate these stakeholders about OT-specific risks can significantly reduce vulnerabilities​.

Conclusion

Supply chain threats to cyber-physical systems are growing in scale and sophistication. The lessons from attacks like Stuxnet highlight the urgent need for new approaches to cybersecurity… ones that focus on the unique challenges of OT environments.

Process-Oriented OT Cybersecurity is that approach. By monitoring physical processes, leveraging machine learning, and applying multi-level strategies, it provides the visibility and resilience needed to defend against modern threats. In a world where Trojan Horses are no longer just stories but real risks, this method ensures that critical infrastructure remains secure, reliable, and ready for the future.