The National Security Agency has released new guidance urging operators of critical infrastructure to adopt zero-trust security principles in operational technology systems. In its October 8 announcement, the agency identifies risks affecting industrial systems that support energy, water, agriculture, public health and government operations. Unlike conventional corporate networks, operational technology frequently controls physical equipment and processes, making service disruption a potential public-safety issue. The guidance recommends continuous verification of users, devices and communications rather than assuming that activity inside a network is trustworthy. Although primarily directed toward national-security and defense-related systems, the recommendations have broader relevance for infrastructure operators. The release reflects growing concern that cybersecurity failures can extend beyond stolen information to interruptions in services communities depend upon.

Cisco has released security updates addressing 35 vulnerabilities across multiple networking and enterprise products, including more than a dozen classified as critical. According to SecurityWeek's October 8 report, affected products include Meraki, NX-OS, License On-Prem and Application Policy Infrastructure Controller systems. Several vulnerabilities could allow unauthorized access, denial-of-service attacks, privilege escalation or remote code execution, depending on the product and configuration. Some of the most serious weaknesses could be exploited without authentication. Cisco says it is not aware of exploitation of the newly disclosed vulnerabilities in the wild. The disclosures underscore the continuing importance of maintaining enterprise network infrastructure, where a security weakness in a foundational system can create exposure across multiple connected services.