CISA roasts unnamed critical national infrastructure body for shoddy security hygiene

CISA and the US Coast Guard published findings from a probe of an unnamed critical infrastructure organization that uncovered severe security deficiencies—shared plaintext local admin credentials, non-unique/non-expiring passwords, insufficient logging, unrestricted remote admin access, poor IT/OT segmentation, and device misconfigurations—that could enable lateral movement and pose real-world safety risks to SCADA/HVAC systems; investigators found no evidence of active malicious activity but recommended remediation.