Old Approvals, New Risk: What CISA's 2030 Strategy Says About Blind Trust

The US Cybersecurity and Infrastructure Security Agency (CISA) has released a new strategy called "CISA 2030: Defend, Harden, Prevail". It prioritises the security of operational technology, the integrity of the software supply chain and the continuity of essential services. It also accepts that strong defences cannot guarantee intrusions will stop.

CyberScoop's analysis points to a common weakness: trust that was granted once and never revisited. A controller may stay in service for decades while its firmware, credentials, suppliers and connections change around it. A maintenance contractor leaves, or a remote connection outlives its purpose, yet the hardware stays in place. A compromised contractor credential or an unverified update can then turn an infrastructure problem into a disruption of operations. An attacker holding a working credential may find the system already open to them.

The article argues that a simple inventory is only a starting point. Knowing a device exists does not show whether its software is authentic, who can change its settings or which systems rely on its credentials. Device security, software assurance and identity management often have separate owners, which leaves the gaps between them unowned. The piece calls for clear accountability, verifying software before deployment, protecting signing keys and reassessing access when suppliers or roles change. It also notes that a valid signature confirms where software came from, not whether it is safe for a particular environment.