COMMENTARY: The DOJ and FBI takedown of QScan and QTRouter, platforms used by Chinese state-sponsored hackers, was an important disruption. It removed infrastructure adversaries were using to hide activity and probe targets, including critical infrastructure.But taking down the infrastructure does not fix the underlying weaknesses in the targeted environments.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]Attackers were able to hijack large numbers of routers, gateways, and other connected edge devices and turn them into anonymous relays. Law enforcement can disrupt one network. If those devices remain poorly protected, adversaries can build another.That’s the larger problem.In OT, cyber risk can become physical riskWhen enterprise IT gets breached, the consequences are usually financial: lost data, downtime, disruption and recovery costs.In operational technology, the consequences can include physical damage and risk to human life.Airports, hospitals, water systems, power infrastructure and industrial plants depend on connected devices that directly influence real-world operations. A compromised edge device can become a stepping stone into environments where a cyber incident can affect safety, essential services or physical processes.That’s why state-sponsored operators value unmanaged edge infrastructure. These devices are widely deployed, often long-lived and difficult to inventory, authenticate, patch or replace.A low-cost router can become the first link in an attack chain with consequences far beyond the router itself.The trust problem starts before the device reaches the networkTraditional enterprise security often begins when a user or device requests access.For critical OT systems, trust has to begin much earlier.It starts during product design, component provisioning, manufacturing, software integration, and enrollment. It must then persist through deployment, software updates, field service and retirement.Legacy PKI and enterprise identity systems remain important, but they were not designed by themselves to govern that entire embedded device lifecycle. A certificate can establish identity, but it does not by itself prove that firmware is authentic, that a device was provisioned correctly, that keys remain protected or that the system is still trustworthy years later.That’s the gap critical infrastructure has to close.Build trust into the device lifecycleThe answer is not another isolated security control: it’s a lifecycle model that establishes trust early and continuously enforces it.Three capabilities matter most:
This has become the role of device lifecycle management (DLM). It’s not simply about issuing credentials: it’s about preserving trust from manufacturing through field operation.A comprehensive DLM approach gets built around exactly this lifecycle model: defining product trust requirements, governing manufacturing, and provisioning, tracking lifecycle state, managing secure updates, and maintaining evidence across the life of the device.The takedown buys time: use it.The FBI and DOJ did what law enforcement should do: disrupt adversary infrastructure and make existiing operations harder.Critical infrastructure leaders should use that time to reduce the conditions that make the next network possible.Because the next proxy network will come. We have to foucs on whether attackers will find the same pool of weakly-governed devices waiting for them.Law enforcement can dismantle infrastructure after it gets discovered. It cannot redesign the devices already operating inside factories, hospitals, airports. and utilities.That responsibility belongs to manufacturers and operators.Take down the hackers when we can: but use the time those takedowns buy to fix the trust architecture they depend on.David Sequino, co-founder and CEO, OmniTrustSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
- Product blueprints: Define the trust model for each device, including authorized identities, keys, software layers, manufacturing environments and expected lifecycle events.
- Supply-chain provenance: Use SBOMs and CBOMs to understand software dependencies, cryptographic choices, supplier relationships and unauthorized changes before they become operational risk.
- Hardware-backed enforcement: Use secure boot, signed software, hardware-backed identity and authenticated updates so devices can reject untrusted code and unauthorized changes.
