Would your team catch a Colonial Pipeline style attack? A checklist

To test whether your organisation would catch an attack like the 2021 Colonial Pipeline ransomware incident, check remote access with multi-factor authentication, separation between IT and operational technology, tested offline backups and a rehearsed shutdown decision. This list comes from public advisories, not from claims about Colonial's internals.

What is on the public record?

The ransomware attack hit Colonial Pipeline on 7 May 2021, and CISA later noted that it caused fuel shortages and long lines along the US East Coast. In its advisory on DarkSide, CISA and the FBI described an unnamed US pipeline company whose IT network was hit and which proactively disconnected certain operational technology systems for safety. The advisory's references cite a Colonial Pipeline media statement. The advisory said there was no indication that the attackers moved into OT systems.

In June 2021 the Justice Department announced it had seized 63.7 bitcoins, worth about 2.3 million dollars at the time, from a ransom payment made on 8 May. Reporting on the Senate hearing that month says the company's chief executive described the intrusion as coming through a legacy VPN account without multi-factor authentication. Dark Reading's account of that testimony also records him saying the password was complex.

None of this makes the company careless. Many organisations have an old account or a remote access path nobody revisited. The useful question is whether you would find yours first.

What does the advisory recommend?

The CISA and FBI advisory lists preventive and resilience steps. They include multi-factor authentication for remote access to IT and OT networks, restricting Remote Desktop Protocol, prompt patching, user training, segmenting IT and OT with a demilitarized zone, tested offline backups, and least privilege.

It also says affiliates of this ransomware service have gained access through phishing, public-facing applications and external remote services, including virtual desktop infrastructure.

The checklist

Remote access

• Do you have a list of every VPN, VDI and remote access account, including old and vendor ones?
• Does every one require multi-factor authentication?
• When did anyone last disable an account that nobody uses?

Separation

• Can a compromised business laptop reach the control network?
• Are IT and OT linked only through a controlled zone?
• Do you know the IT and OT dependencies, and have you written manual workarounds?

Detection

• Would you see a login to a rarely used account from an unusual place?
• Would you notice large data leaving, since these actors also steal data?
• Who gets the alert at 3 am, and what can they do on their own?

Recovery

• Are backups offline, isolated and restored in a test this year?
• Do you hold gold images and spare hardware for critical systems?
• Are backups scanned before restore?

Decision making

• Who decides to shut down operations, and on what criteria?
• Is the decision written down and rehearsed?
• Do you know whom to call at CISA, the FBI or the Secret Service?

How does software supply chain fit?

Operational networks run software and firmware with dependencies. An inventory of what runs where makes the separation and patching questions answerable. Safeguard can generate software bills of materials and scan them for known vulnerabilities. It does not replace network segmentation or identity controls, which carry most of the weight in this checklist.

What to do

1. Inventory all remote access accounts and paths this week.
2. Enforce multi-factor authentication on all of them, or remove them.
3. Map the paths between IT and OT and close the unplanned ones.
4. Test a restore from offline backups and note how long it took.
5. Write the shutdown decision rule and name the people who own it.
6. Run a tabletop exercise with operations staff in the room.
7. Review the CISA and FBI advisory against your own controls and record gaps.

Quick check

Sources

• CISA and FBI advisory AA21-131A: DarkSide Ransomware
• CISA: The attack on Colonial Pipeline, what we have learned
• Dark Reading: Colonial Pipeline CEO on the legacy VPN account
• Department of Justice: seizure of cryptocurrency paid to DarkSide

Last reviewed: 18 October 2026.