Zero trust (ZT) offers a modern, adaptive approach to cybersecurity by eliminating implicit trust and continuously validating access based on identity, context, and risk. ZT principles assume a breach has already occurred and are designed to limit threat actor movement and potential damage.
For operational technology (OT), applying ZT requires careful consideration because OT systems interact with the physical environment and are constrained by availability and safety requirements, as well as legacy technology with long lifespans. The blanket application of traditional information technology (IT)-focused ZT capabilities to OT is neither reasonable nor feasible and requires continuous collaboration between OT engineers, IT architects, and cybersecurity professionals. This collaboration should include clear communication channels, joint development of policies and controls, and a shared understanding of both mission objectives and technical limitations.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Microsoft releases Windows Server update fix to fix its April update fixes
April 20, 2026
Microsoft has pushed out an out-of-band update to address the restart loop that hit some Windows Server devices after its April update. The fix will spare administrators the headache of forced server restarts after installing the April 2026 update. (A reminder that deploying any Microsoft update directly to production without thorough testing is, to put it ...
- UK: Military reviews Army’s use of Chinese technology to make weapons
April 18, 2026
The Defence Secretary has ordered an investigation after The Telegraph revealed that the British Army was using Chinese 3D printers to build weapons. Last year, it was revealed that British troops were taking the technology with them into the field and using it to make “suicide drones” for attack missions, despite national security concerns. Army officers said ...
- Personal data held by NHS Shetland is breached more than 160 times in three years
April 17, 2026
Personal and sensitive data held by NHS Shetland was breached more than 160 times over the last three years, it can be revealed. Information given to The Shetland Times through a Freedom of Information (FoI) request showed there was 161 occassions where confidential data was leaked. Data was shown to be lost, stolen or left insecure ...
- Cisco tells Webex users to patch critical security flaws immediately
April 17, 2026
Cisco has pushed a new patch to address four critical-severity vulnerabilities plaguing its cloud-based Webex Services platform – and has also warned Wi-Fi access points users of a bug in certain versions of IOS XE that could result in a device bootloop. Webex Services is a platform for communication and collaboration, letting people hold video meetings, ...
- Patient medical data stolen in Chipsoft ransomware attack
April 17, 2026
Medical software company Chipsoft has confirmed that patient data was stolen in a ransomware attack last week, after initially telling clients that personal data was “probably” safe. The attack hit family doctors, rehabilitation clinics and the Rotterdam Eye Hospital, which all use Chipsoft’s cloud-hosted HiX 365 platform. Other hospitals that use the company’s technology on their ...
- Patch these critical Fortinet sandbox bugs that let attackers bypass login, run commands over HTTP
April 15, 2026
Watch out for more Fortinet vulns! Two critical bugs in Fortinet’s sandbox could allow unauthenticated attackers to bypass authentication or execute unauthorized code on vulnerable systems. Luckily, the security vendor has issued fixes – so patch now – and so far, there are no reports of active exploitation. But considering that the vulnerabilities are now public, ...