Episode 124

The Phishing Attack That Could Have Shut Down a Plant Floor

· 26:03 · Host: Craig and Dino

A real-world case study shows how a single phishing email led to credential and MFA compromise, creating an urgent question for any industrial organization: Did the attacker reach the OT environment?

Play this episode

Chapters

  1. 00:00:00 — Why continuous manufacturing makes “abundance of caution” shutdowns so costly
  2. 00:01:00 — What “OT continuous monitoring” means and why it matters in real incidents
  3. 00:03:00 — Safety and connected environments: why “it can go boom” changes the stakes
  4. 00:05:00 — Baselines: defining “normal” so abnormal behavior is actionable
  5. 00:07:00 — Incident story: phishing email leads to credential and MFA compromise
  6. 00:09:00 — What the team validated: tracing access and confirming OT was not impacted
  7. 00:10:00 — Lessons from Colonial Pipeline: inability to validate can force shutdowns
  8. 00:11:00 — OT reality check: Windows assets, HMIs, historians, and engineering workstations
  9. 00:13:00 — Secure OT remote access: why VPN-only access is not sufficient
  10. 00:16:00 — The payoff: avoided downtime, avoided product loss, and avoided disruption
  11. 00:19:00 — Executive view: duty of care, liability, compliance, and protecting enterprise value
  12. 00:23:00 — The “air gap” myth and why defense-in-depth is the only practical path

Read the full transcript ↓

Show notes

A real-world case study shows how a single phishing email led to credential and MFA compromise, creating an urgent question for any industrial organization: Did the attacker reach the OT environment?

Dino and Jim walk through how OT visibility, secure remote access controls, and continuous monitoring enabled rapid validation of what happened. They were able to prove the breach did not impact control systems and avoid an expensive, safety-driven shutdown of a continuous manufacturing process.

The episode connects technical controls to executive outcomes, including resilience, duty of care, and the financial reality that “not knowing” can be as costly as an actual compromise.

Chapters:

  • (00:00:00) Why continuous manufacturing makes “abundance of caution” shutdowns so costly
  • (00:01:00) What “OT continuous monitoring” means and why it matters in real incidents
  • (00:03:00) Safety and connected environments: why “it can go boom” changes the stakes
  • (00:05:00) Baselines: defining “normal” so abnormal behavior is actionable
  • (00:07:00) Incident story: phishing email leads to credential and MFA compromise
  • (00:09:00) What the team validated: tracing access and confirming OT was not impacted
  • (00:10:00) Lessons from Colonial Pipeline: inability to validate can force shutdowns
  • (00:11:00) OT reality check: Windows assets, HMIs, historians, and engineering workstations
  • (00:13:00) Secure OT remote access: why VPN-only access is not sufficient
  • (00:16:00) The payoff: avoided downtime, avoided product loss, and avoided disruption
  • (00:19:00) Executive view: duty of care, liability, compliance, and protecting enterprise value
  • (00:23:00) The “air gap” myth and why defense-in-depth is the only practical path

Links And Resources:


Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!

Industrial Cybersecurity Insider is produced by Amplafy Media. Podcast production services · Client results

Full transcript

The complete conversation, in order. 1,237 words.

[00:00:00] Amplafy Media: easy little prompt that will allow you to make really cool and branded email newsletters and, uh, allow you to just drop them right into your.

[00:00:06] Amplafy Media: E email service provider. You've ever had to send email newsletters. I wanted you to watch this video because this has been something that I've had to do for a long time, but has really been the bane of my sort of marketing career. Sometimes when I think about it is just my unwillingness to send, uh, email. Campaigns and email, uh, broadcast.

[00:00:21] Amplafy Media: But sometimes people like to talk and sometimes people like to write. But another big reason was that there was just so much friction in actually getting it to look good. And so, um, what I built over the last couple of days was a cool and nice and easy little prompt that will allow you to make really cool and branded email newsletters and, uh, allow you to just drop them right into your.

[00:00:37] Amplafy Media: E email service provider. Now you'll see here that uh, I'm here in go high level, and that's what we use. And almost every single email provider will allow you to drop in HTML code. It's sort of the standard, you know, standard code that a lot of websites and even emails are sort of put into. And a lot of the builders you end up paying for to create these nice and fancy things, but sometimes you don't need all the bells and whistles, but you do want it to look branded and you do want it to look nice.

[00:00:55] Amplafy Media: And so, uh, over here on the right is a just a short little campaign that we put together over. The weekend and, um. You know, it's got a a heading. It's got some text, it's got a couple of links and it's pretty simple, but you'll notice that it is branded. And so as I was doing this, it just sort of got me thinking like, well, hey, I made this for our, um.

[00:01:12] Amplafy Media: Show, you know, that we're, that we're doing this for, uh, it would be really easy to create one extra, you know, a prompt that does this as well. And so that's what we've got here. Um, for you, it'll be in the description or somewhere, um, wherever you got this video, but here is a, a prompt and it's called the, uh, you know, content Injection Agent, I think is a really funny name for it.

[00:01:27] Amplafy Media: But we will, uh, we'll put this into a new, Conversation here and we'll get that running.. So while it's loading, let's take a look at what we put in here in the prompt. And you'll see here that the role that we gave it is a master email strategist and a full stack developer who knows how to create E-H-T-M-L email newsletters, high conversion, mobile responsive, right?

[00:01:44] Amplafy Media: , They have all of the knowledge and experience that we're looking for with regards to, uh, putting together , this email. , We're gonna create. This template, based that we're gonna, you know, create this brand based on this template. , It's gonna ask us questions. You'll notice here that it's gonna figure out what the layout that we want to use it for.

[00:01:59] Amplafy Media: Um, you know, whether it's a digest or, you know, a longer, uh, just a longer email. It's gonna ask for some branding, some visuals, you know, colors, what kind of fonts, logos and, and assets, things like that. And you'll want to put in a public u image, URL, you know, something that's hosted on the internet that it can grab from, um, you know, the internet and your, you can do that on your, your website oftentimes, um, on your hosting provider.

[00:02:22] Amplafy Media: A lot of times you can host the images directly there. You just need a specific link that the, you know, that the AI can grab off of the internet. Um, it'll ask for what you want to put in there and then obviously all the assets and links in here. And so you'll see, um, first thing that's asking for is what do we want?

[00:02:34] Amplafy Media: Uh, let's do, let's see what it says when we do a weekly digest. Um, I'm not sure what that's gonna look like, but we'll see and we'll figure that out together. We also put in our, our logo, um, URL here, so that way it can, um, do that so, so that way it can have that. I'll put in here the brand is AI success solution and our website is.

[00:02:55] Amplafy Media: So now we're gonna ship that off.

[00:02:57] Amplafy Media: Next it's gonna ask me for the email, the, the body, the copy, and I'm gonna say, Hey, I just put Okay. So I gave it a little bit more and it asked for some, you know, some images. And what's cool is that I, I actually, I really enjoyed that the prompt made sure that it, it asked for, and.

[00:03:10] Amplafy Media: Uh, the thumbnails, you know, different links or, you know, extra stuff that I could add in. Um, specifically like a LinkedIn URL, it saw that there was, um, some things that I had offered in the email. So it asked for it there, and I'm, I'm curious how it's gonna format this, uh, as well. So here we've got our code.

[00:03:23] Amplafy Media: Okay, so now what's nice about this is that we should be able to just throw this right into a, um. You throw it into our email service provider and be able to ship this off. So I'm gonna pull up that email sort of preview and let's see what it looks like. Okay. So that's pretty funny. Um, okay. I kind of like that, right?

[00:03:41] Amplafy Media: It's like it's got like a little thing. It's got, I don't know how it made this, this. This gif, but I'm with it. you can see here it's got the text here and if we wanna, if we wanna edit this stuff, it's really sort, it's really sort of simple because all that text is just right here and so we just gotta go in there and find it.

[00:03:55] Amplafy Media: And so you see here, um, we've got mastering your email newsletters. This one is actually, uh, probably not about mastering, but um. Make it easier to send. How about that? That's probably more accurate. And you'll see there that it says it there on the right. Um, so everything is editable, right? It's just this is, it gave us a cool template.

[00:04:13] Amplafy Media: Here's the prompt. We've got the tutorial, which I'll list out there. Um, so anyways, thought that was a, just a fun use case for you If you wanna get this prompt, make sure you check the description, and then if you want to get notified and you want to have these sent directly to your email inbox, make sure you're on our email list as well. But, uh, appreciate you hanging out and, uh, we'll see you on the next one.

About Industrial Cyber Security Insider

Industrial Cybersecurity Insider brings clarity to one of the most urgent gaps in manufacturing and critical infrastructure: the divide between IT and OT. Hosts Craig and Dino talk with plant leaders, engineers, and security practitioners about protecting industrial operations in the real world — practical conversations for the people responsible for keeping production running and secure.

See all 147 episodes of Industrial Cyber Security Insider →

Book a 30-minute strategy call