Full Report
Texas’s critical infrastructure underpins both the state’s economy and U.S. national security. Critical infrastructure isn’t confined to just the electric grid and transportation networks, but also includes energy production and refining facilities, water and wastewater systems, food production and distribution, ports, communications, and financial centers in Dallas and Houston. But these assets, which span the…
Analysis Summary
# Best Practices: Critical Infrastructure Resilience (Texas Context)
**Source note:** The article is a short policy piece by Chuck DeVore (Texas Public Policy Foundation, republished on Threat Beat). Its substantive content is one paragraph. It argues that Texas needs a state-level resilience strategy built on three goals: preventing attacks where possible, hardening assets, and restoring essential systems quickly. It does not provide technical configurations, implementation steps, or specific controls. The recommendations below are therefore drawn from widely used critical infrastructure resilience frameworks, not from the article itself. Treat them as a starting point to verify against your sector's requirements.
## Overview
The article covers resilience of Texas critical infrastructure: the electric grid, energy production and refining, water and wastewater, food supply, ports, communications, and financial centers. Its premise is that a single event, whether a cyberattack, a hostile-state action, a terrorist plot, or a natural disaster such as Winter Storm Uri (2021) or Gulf Coast hurricanes, should not be able to cause catastrophic, mass-casualty failure. The practices below address that goal: reduce attack surface, harden critical systems, and plan for rapid recovery.
## Key Recommendations
### Immediate Actions
1. **Identify and inventory critical assets and dependencies.** List OT, IT, and third-party systems that support essential services. Map which systems depend on power, communications, or vendors you don't control.
2. **Enforce multi-factor authentication** on all remote access, admin accounts, and vendor connections, especially to OT/SCADA and engineering workstations.
3. **Disconnect or segment internet-exposed OT devices.** Use the NIST and CISA guidance to confirm no control systems are directly reachable from the internet. Use a free external scan (for example, CISA's Cyber Hygiene vulnerability scanning service) to find exposed services.
4. **Change default credentials** on all network devices, PLCs, HMIs, cameras, and IoT equipment.
5. **Verify offline, tested backups** of critical configurations and data, with at least one copy isolated from the production network.
6. **Establish a 24/7 incident contact list** and an escalation path that includes utility, state, and federal reporting contacts.
### Short-term Improvements (1-3 months)
1. **Conduct an OT-focused risk assessment** using NIST SP 800-82 Rev. 3 or ISA/IEC 62443 methods, prioritizing systems whose failure would cause physical harm or service outages.
2. **Implement network segmentation** between IT, OT, and safety systems. Define and enforce allowed flows with firewalls and deny-by-default rules.
3. **Write and test a incident response plan** for a cyber event that also disrupts power or communications. Run a tabletop exercise with operations, IT, emergency management, and vendors.
4. **Create manual operating procedures** so critical processes can run safely if automated or networked systems fail.
5. **Patch or compensate** known vulnerabilities in internet-facing and remote-access systems, using a risk-based schedule. Where patching isn't possible, add compensating controls such as monitoring and access restrictions.
6. **Review vendor and supply chain access.** Require documented remote-access procedures, time-limited credentials, and session logging for all third parties.
### Long-term Strategy (3+ months)
1. **Adopt a formal framework** such as the NIST Cybersecurity Framework 2.0 and map controls to your sector's regulations.
2. **Build redundancy and recovery capacity** for essential systems, including backup power, alternate communications, and tested restoration sequences (black-start procedures for power, for example).
3. **Deploy continuous monitoring** of OT networks, using passive asset discovery and anomaly detection tuned to industrial protocols.
4. **Participate in information sharing** through ISACs (such as E-ISAC for electric or WaterISAC for water) and state and federal partners.
5. **Run regular cross-sector exercises** that combine cyber and physical disruption scenarios, including extreme weather.
6. **Align state and local planning** with critical infrastructure owners so that restoration priorities, mutual aid, and fuel or equipment supply chains are pre-arranged.
## Implementation Guidance
### For Small Organizations
- Start with the CISA Cross-Sector Cybersecurity Performance Goals (CPGs), which list a small set of high-impact baseline controls.
- Use managed security or utility-sector services if in-house staff are limited.
- Focus on MFA, backups, remote-access control, and vendor access reviews first.
- Join your sector ISAC or the relevant state or regional information-sharing group for free advisories.
### For Medium Organizations
- Adopt NIST CSF 2.0 as the organizing framework and perform a gap assessment against it.
- Assign ownership of OT security, separate from general IT where possible, with a documented RACI.
- Begin network segmentation of OT with a phased plan; start with the most critical zones.
- Contract an OT-experienced assessor for an independent review once every one to two years.
### For Large Enterprises
- Establish a formal OT security program aligned to IEC 62443 and, where applicable, sector rules such as NERC CIP for bulk electric systems.
- Maintain a continuously updated asset inventory and vulnerability management program specific to OT, with safety-aware patch testing.
- Run enterprise-wide exercises that include recovery of degraded or manual operations, and track time-to-restore metrics.
- Integrate threat intelligence and third-party risk management into procurement and access decisions.
## Configuration Examples
The article provides no technical configurations. Examples below are generic and should be validated against vendor documentation and your change-control process.
- **Deny-by-default firewall rule between OT and IT zones:**
allow tcp from IT-jump-host to OT-historian-zone port 443 (logged)
deny all other traffic from IT zone to OT zone (logged)
- **Remote access:** require MFA, use a jump host in a DMZ, session recording enabled, and access windows that expire automatically.
- **Account hygiene:** disable unused accounts, enforce unique admin credentials per device, and rotate service account passwords on a fixed schedule.
## Compliance Alignment
- **NIST Cybersecurity Framework 2.0:** governance and risk management across the Identify, Protect, Detect, Respond, and Recover functions
- **NIST SP 800-82 Rev. 3:** guide to operational technology (OT) security
- **ISA/IEC 62443:** industrial automation and control system security standards
- **CISA Cross-Sector Cybersecurity Performance Goals:** baseline practices for critical infrastructure owners
- **NERC CIP:** mandatory requirements for bulk electric system operators
- **Texas Cybersecurity Framework (Texas DIR):** applicable to Texas state agencies and some local entities
- **CIS Controls v8:** prioritized safeguards that map to many of the above
## Common Pitfalls to Avoid
- **Treating OT like IT.** Patching, scanning, and authentication tools can crash fragile control devices. Test before deploying.
- **Assuming air-gaps exist.** Many "isolated" networks have remote access, vendor laptops, or USB paths. Verify actual connectivity.
- **Planning only for prevention.** Restoration capability (backups, manual procedures, spare parts) often determines how severe an outage becomes.
- **Ignoring interdependencies.** A water utility that depends on grid power, or a communications provider that depends on a single fiber route, can fail for reasons outside its own security program.
- **Skipping exercises.** Untested recovery plans rarely work under real conditions.
- **Weak vendor oversight.** Third-party remote access is a frequent entry point.
## Resources
- CISA Cross-Sector Cybersecurity Performance Goals: hxxps://www[.]cisa[.]gov/cross-sector-cybersecurity-performance-goals
- CISA Cyber Hygiene services (free external vulnerability scanning): hxxps://www[.]cisa[.]gov/cyber-hygiene-services
- NIST Cybersecurity Framework 2.0: hxxps://www[.]nist[.]gov/cyberframework
- NIST SP 800-82 Rev. 3 (OT Security): hxxps://csrc[.]nist[.]gov/pubs/sp/800/82/r3/final
- ISA/IEC 62443 overview: hxxps://www[.]isa[.]org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
- E-ISAC (electric sector): hxxps://www[.]eisac[.]com
- WaterISAC: hxxps://www[.]waterisac[.]org
- Texas Department of Information Resources, Texas Cybersecurity Framework: hxxps://dir[.]texas[.]gov
- Source article (for policy context): hxxps://threatbeat[.]com/critical-infrastructure/protecting-texas-critical-infrastructure-prevention-mitigation-and-recovery-from-natural-disasters-and-state-actor-and-terrorist-attacks/