MFA for critical infrastructure networks that can't reach the internet

Power grids, pipelines, water treatment facilities, and defense production systems keep essential services running. The people who manage these systems, including IT administrators, engineers, and operators, need secure access to do their jobs.

But protecting that access comes with a challenge.

Many critical infrastructure environments operate on isolated networks with limited or no internet connectivity. Cloud-based authentication isn't always an option, yet organizations still need strong multi-factor authentication to protect against unauthorized access.

A compromised account could give an attacker access to systems that support essential operations, potentially disrupting services, affecting safety, or exposing sensitive infrastructure.

So how do you enforce strong MFA when your critical systems can't connect to the internet?

SecureAuth IdP addresses this challenge by delivering authentication and access controls entirely within the customer's environment, without depending on cloud connectivity.

Why critical infrastructure needs MFA that works offline

Critical systems are isolated for good reason. Keeping them off the internet shrinks the attack surface and keeps operations running when outside connections fail. But isolation doesn't remove the need to control who gets in. Administrators and engineers still need reliable access to maintain these systems, and every one of those privileged sign-ins has to be verified.

For many operators, both the MFA requirement and the isolation come from outside:

• Utilities work under NERC CIP, which requires an electronic security perimeter and multi-factor authentication for interactive remote access into protected systems.
• Federal contractors work under NIST SP 800-53 controls, enforced through an Authority to Operate (ATO). For some programs, isolation is a condition of the contract itself.
• Pipeline operators follow security directives from the Transportation Security Administration (TSA).

What's at stake is accreditation, the right to bid, and in federal programs, the contract itself.

Others choose isolation on their own, so their operations keep running when the internet doesn't. Either way, the result is the same: strong authentication for critical systems has to work entirely inside the perimeter, with no dependency on anything outside it.

How organizations are protecting critical systems today

This isn't just a theoretical challenge. Organizations in energy, defense, and other critical industries are already using SecureAuth to protect access to systems that operate without internet connectivity.

For some, isolation is driven by regulatory or contractual requirements. For others, it's a deliberate security and operational decision. Regardless of the reason, they face the same challenge: keeping critical systems accessible to authorized users while preventing unauthorized access. Current deployments include:

• Electric and gas utility. SecureAuth is the VPN gate into a NERC CIP protected domain with no internet egress, where not even security updates leave the network. Engineers sign in through their VPN client with their directory username, password and MFA through RADIUS, and use self-service password reset. The utility goes beyond what NERC CIP requires, with no cloud dependency to explain to an auditor.
• Federal defense manufacturer. Two of the manufacturer's three networks are air-gapped as a contractual condition under NIST SP 800-53, enforced through an ATO. SecureAuth runs inside the isolation, with MFA through Login for Endpoints on Windows workstations and RADIUS on Linux. Two-factor authentication is a requirement of the federal customers they build for, and the air gap is a condition of winning that business.
• Interstate pipeline operator. No regulator requires isolation here; the operator chose it to stay running when the internet doesn't. Administrators sign in to jump servers with Login for Endpoints to manage hypervisors, routers, switches, firewalls, and Active Directory, so privileged access to that equipment goes through MFA. Being fully on-premises and working offline is why they chose SecureAuth.

Across these customers, isolation is rarely a single network. Each of them runs more than one isolated environment, and SecureAuth secures each one on the same platform.

How SecureAuth protects access inside your environment

SecureAuth brings strong, phishing-resistant authentication to isolated networks. It deploys fully on-premises, with every service it needs running inside the isolated network: MFA, RADIUS and endpoint login, directory integration and local audit logging. And it does that with:

• No phone-home. Nothing reports back to SecureAuth.
• No cloud callback. No authentication decision depends on an outside service.
• No license check. The platform doesn't need to reach the internet to keep working.
• Strong MFA built in. Isolated deployments include phishing-resistant FIDO2 and passkeys, TOTP, hardware tokens and CAC/PIV, all running on-premises.

MFA only protects critical systems if it sits where people actually sign in. SecureAuth delivers it in two places:

Strong MFA methods that run without a cloud dependency

Isolated networks don't have to settle for weaker factors. Every method below runs entirely inside the air gap, and the strongest of them are phishing-resistant:

• FIDO2 and passkeys. Phishing-resistant, passwordless sign-in with Windows Hello, Touch ID or a security key. The private key never leaves the device, and there is no password to steal.
• TOTP. Rotating 6- or 8-digit codes from SecureAuth Authenticate or any standard authenticator app. Seeds are generated and held on-premises.
• Hardware tokens. YubiKey HOTP with self-service enrollment, plus OATH TOTP and HOTP tokens bulk-loaded from CSV for large rollouts.
• CAC and PIV. Certificate-based authentication with smart cards, for accredited federal environments that require it.

Phishing-resistant MFA is the control regulators now point to, and it's the one thing many buyers assume an isolated network can't have. In their joint advisory on Scattered Spider, CISA and the FBI recommend FIDO/WebAuthn or PKI-based MFA specifically because it resists phishing, push bombing and SIM swapping, the techniques attackers use to get past MFA that's already in place. CISA's phishing-resistant MFA fact sheet makes the same point.

FIDO2 works inside the air gap because the FIDO Service runs on-premises, right beside the identity platform. Enrollment and authentication never leave the isolated network.

Administrators keep tight control over which authenticators are allowed. They can approve devices by AAGUID, require WebAuthn PIN verification, and restrict which authenticators may register.

The AAGUID (Authenticator Attestation GUID) identifies an authenticator's make (manufacturer) and model, but not the specific device. The authenticator returns it when the relying party requests attestation, and the relying party uses it to check whether that make and model meets its policies.

For technical details, see the air-gapped deployment overview in the SecureAuth documentation, or watch our air-gapped deployment webinar.

The business case for MFA inside your isolated networks

For organizations running critical infrastructure, secure access is about more than protecting user accounts. It's about protecting the systems that keep operations running.

With SecureAuth IdP, organizations can:

• Protect critical operations. Reduce the risk of unauthorized access to infrastructure management systems.
• Maintain control in isolated environments. Enforce authentication policies without relying on cloud services or internet connectivity.
• Support regulatory and contractual requirements. Apply MFA controls and maintain local authentication records to support security reviews and audits.
• Protect privileged access. Add authentication controls at VPN gateways, workstations, and jump servers used by administrators and engineers.
• Keep security capabilities current. Use supported on-premises releases without sacrificing essential MFA functionality because of network isolation.

The result is stronger control over who can access critical infrastructure, without introducing a dependency on external authentication services.

Modern Authentication for Isolated Environments

Organizations operating isolated networks shouldn't have to choose between maintaining their security boundaries and keeping their identity platform current.

SecureAuth has continued investing in its on-premises capabilities, bringing services such as FIDO2, mobile authentication, and supporting infrastructure into the customer's environment.

This allows organizations to use supported SecureAuth IdP releases while maintaining the network isolation their operations require.

For existing customers, it also provides a path to newer authentication capabilities, security improvements, and platform updates without introducing a cloud dependency.

How to assess MFA for your isolated environments

The systems that keep power flowing, fuel moving, water clean and defense production running can't afford weaker authentication just because they can't reach the internet. A good first conversation covers three questions:

1. Is your isolation imposed or chosen? A regulator or customer contract sets different requirements than a resilience decision.
2. How many isolated environments do you run? Most organizations run more than one, and each needs its own identity boundary.
3. What happens to authentication if your cloud connection goes dark? If the answer is "users can't sign in," your critical access depends on something outside your control.

Learn more about MFA, passkeys, and Workforce Authority, or tell us about your environment below.

FAQ