In August 2023, a technical failure at NATS, the UK’s primary air traffic control provider, caused widespread disruption to flights across the country, ultimately costing the UK economy an estimated £33 million. While the root cause was identified as a data processing issue rather than a malicious cyber attack, the incident serves as a stark reminder of the fragility of critical infrastructure and the devastating economic impact of IT/OT convergence failures. For SOC analysts and CISOs, this event underscores the absolute necessity of robust availability monitoring, resilient architecture design, and rapid incident response capabilities.
Technical Analysis: When Availability is the Threat
The NATS incident was not the result of a zero-day exploit or a sophisticated nation-state intrusion. Instead, it was caused by a technical glitch in the flight planning system that prevented the automatic processing of flight plans. This forced air traffic controllers to revert to manual input, drastically reducing capacity and causing cascading delays.
From a defensive perspective, the lesson here is that availability is a core security metric. In Operational Technology (OT) and critical infrastructure environments, a simple software bug or data validation failure can have consequences as severe as a ransomware attack. The Cyber Monitoring Centre report highlights that the economic fallout was driven by the inability to maintain service continuity during a technical failure.
Key Technical Factors
- System Complexity: Modern air traffic control relies on complex data processing pipelines. A single point of failure in data ingestion or validation can halt operations.
- Manual Fallback Limitations: While manual processes exist as a backup, they cannot scale to handle the volume of automated systems, leading to immediate capacity constraints.
- Economic Impact Quantification: The £33m figure demonstrates that IT/OT failures must be treated as business-critical risks, not just technical inconveniences.
There are no specific CVEs associated with this event, as it was a system failure rather than a vulnerability exploitation. However, the defensive principles apply directly to preventing and mitigating similar availability crises.
Detection & Response: Monitoring for Availability and Anomalous Behavior
For critical infrastructure, detection must go beyond identifying malware; it must include monitoring for service degradation, unexpected process termination, and anomalous network traffic that could indicate instability or an impending failure. The following detections focus on identifying early warning signs of system stress and potential disruption in OT/IT environments.
SIGMA Rules
---
title: Critical Service Process Termination
id: 8b3f1c92-4a5d-4e6b-9c7d-2e5f8a901234
status: experimental
description: Detects the unexpected termination of critical infrastructure service processes.
references:
- https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.impact
- attack.t1489
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\critical_service.exe'
- '\atc_processor.exe'
CommandLine|contains:
- 'stop'
- 'kill'
falsepositives:
- Legitimate maintenance windows
- Authorized service restarts
level: high
---
title: Anomalous Network Traffic to Critical OT Assets
id: 9c4e2d83-5b6e-4f7a-0d8e-3f6a9b012345
status: experimental
description: Detects unusual network connection patterns to critical operational technology assets.
references:
- https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1071
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationIp|cidr:
- '10.0.0.0/8'
- '192.168.0.0/16'
DestinationPort:
- 102
- 502
- 20000
falsepositives:
- Standard industrial control protocols
- Authorized engineering workstations
level: medium
KQL (Microsoft Sentinel / Defender)
This hunt query identifies devices experiencing sudden service stops or network connectivity loss, which are precursors to availability failures like the NATS incident.
// Hunt for critical service terminations and network drops
let CriticalServices = dynamic(['critical_service', 'atc_processor', 'flight_plan_svc']);
DeviceProcessEvents
| where FileName has_any (CriticalServices)
| where ProcessCommandLine has_any ('stop', 'kill', 'terminate')
| summarize ProcessStops = count() by DeviceName, FileName, bin(TimeGenerated, 1h)
| where ProcessStops > 0
| join kind=inner (
DeviceNetworkEvents
| where RemotePort in (102, 502, 20000)
| summarize NetworkDrops = count() by DeviceName, bin(TimeGenerated, 1h)
) on DeviceName, TimeGenerated
| project TimeGenerated, DeviceName, FileName, ProcessStops, NetworkDrops
| order by TimeGenerated desc
Velociraptor VQL
This artifact hunts for unexpected process termination and checks network connections to critical OT ports.
-- Hunt for critical service termination and OT network anomalies
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'critical_service|atc_processor'
OR CommandLine =~ 'stop|kill'
-- Check network connections to critical OT ports
SELECT Pid, Name, RemoteAddr, RemotePort, State
FROM netstat()
WHERE RemotePort in (102, 502, 20000)
AND State = 'ESTABLISHED'
Remediation Script
This PowerShell script checks the status of critical services and alerts if they are not running, helping to prevent availability failures.
# Check status of critical services and alert if stopped
$CriticalServices = @('critical_service', 'atc_processor', 'flight_plan_svc')
foreach ($Service in $CriticalServices) {
$Status = Get-Service -Name $Service -ErrorAction SilentlyContinue
if ($Status -eq $null) {
Write-Output "Service $Service not found on this host."
} elseif ($Status.Status -ne 'Running') {
Write-Output "ALERT: Service $Service is currently $($Status.Status)."
# Attempt to restart the service
Restart-Service -Name $Service -Force
Write-Output "Attempted to restart $Service."
} else {
Write-Output "Service $Service is running normally."
}
}
Remediation: Building Resilience in Critical Infrastructure
To prevent incidents like the NATS failure, organizations must adopt a defense-in-depth strategy focused on availability and resilience.
- Implement Redundant Architectures: Ensure that critical systems have failover capabilities. Single points of failure in data processing pipelines must be eliminated.
- Enhance Availability Monitoring: Deploy comprehensive monitoring that tracks not just security events, but service health, latency, and data throughput. Use Synthetic Monitoring to simulate user transactions and detect degradation before it impacts operations.
- Regularly Test Manual Fallbacks: Manual processes are a necessary backup, but they must be tested regularly to ensure they can handle the load, even if at reduced capacity. Identify bottlenecks in manual workflows.
- Robust Data Validation: Implement strict data validation and error handling at ingestion points to prevent malformed data from cascading through the system and causing processing halts.
- Incident Response Planning: Develop and rehearse incident response plans specifically for availability crises. Ensure that communication channels between IT, OT, and business stakeholders are clear and rapid.
By treating availability as a critical security metric and implementing these defensive measures, organizations can better protect themselves against the economic and operational devastation of IT/OT failures.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.