Three U.S. Policy Recommendations to Strengthen OT Cybersecurity
A presidential advisory committee report outlined strategies to improve government asset visibility, procurement and information sharing to enhance operational technology (OT) cybersecurity practices.
On Aug. 23, 2022, the U.S. National Security Telecommunications Advisory Committee (NSTAC) approved a Report to the President, and I had the privilege of contributing to its development. The report focuses on the security challenges that arise from the convergence of information technology (IT) and operational technology (OT) for government departments, agencies and industrial or critical infrastructures.
The report identifies three key recommendations the administration can immediately implement for the United States to maintain a reliable, secure and resilient national communications posture.
1.Direct federal civilian agencies to inventory their OT assets
"The Cybersecurity and Infrastructure Security Agency (CISA) should issue a Binding Operational Directive (BOD) to require executive civilian branch departments and agencies to maintain a real-time, continuous inventory of all OT devices, software, systems and assets within their area of responsibility, including an understanding of any interconnectivity to other systems." (Draft NSTAC Report to the President, pp 1-2).
Briefings and discussions held by NSTAC revealed that many organizations lack visibility into their complete OT environments, including environments where IT and OT systems are converged. The BOD requirement will increase organizational visibility and allow federal agencies to make risk-informed decisions about how to prioritize their cybersecurity budgets to best protect the most crucial assets.
Simply put, you can't protect what you can't see. Visibility and understanding of the devices and data flows in your OT networks are imperatives. I can't count how many times I've been asked, "how big is the OT cybersecurity problem?" I have to answer, "we don't know." Once we get visibility into these mission-critical environments we can begin to understand the scale of the cybersecurity challenges and begin to systematically address the serious risk.
CISA has already taken steps to address this obstacle. On Oct. 3, 2022, CISA issued Binding Operational Directive (BOD) 23-01, which calls on federal civilian departments and agencies to "make measurable progress toward enhancing visibility into agency assets and vulnerabilities." The BOD explicitly states that it applies to both IT and OT networked assets. Two core activities to achieve this visibility are to discover which assets are on federal networks and enumerate the vulnerabilities of those assets.
Achieving this visibility is a significant step forward for federal departments and agencies to protect their critical IT and OT assets against evolving cybersecurity threats.
2.Develop enhanced OT-specific cybersecurity procurement language
"CISA should develop guidance on updating and enhancing IT/OT products and services procurement language to incentivize the inclusion of risk-informed cybersecurity capabilities within delivered products and services; this guidance should also help all organizations understand best practices for bolt-on security for OT devices that are much more difficult or expensive to replace."(Draft NSTAC Report to the President, p. 3).
In 2009, when I was the Director of the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the Department of Homeland Security (now part of CISA), the community— including DHS, Department of Energy (DOE) and SysAdmin, Audit, Network and Security (SANS)— worked together to produce procurement language guidance. The guidance helped asset owners specify that cybersecurity be built into products and projects rather than bolted on as an afterthought. The General Services Administration (GSA) and CISA should collaborate to update this language and tailor it specifically for federal procurements. Additionally, the guide can serve as a model for private sector owners and operators, in order to incentivize the inclusion of cybersecurity capabilities in their own OT systems acquisitions. Including cybersecurity in both government and private sector procurement vehicles will significantly enhance the resilience of critical infrastructure systems.
3.Implement standardized, technology-neutral, real-time, interoperable information sharing
"The National Security Council (NSC), CISA, and the Office of the National Cybersecurity Director (ONCD) should prioritize developing and implementing interoperable, technology-neutral, vendor-agnostic information sharing mechanisms to enable the real-time sharing of sensitive collective-defense information between authorized stakeholders involved with securing U.S. critical infrastructure. This should include breaking down the artificial barriers for sharing [controlled, unclassified information] both within the U.S. federal government and between the federal government and other key, cross-sector stakeholders." (Draft NSTAC Report to the President, p. 4).
To break the traditional siloed approach and promote collaboration across agencies, leadership from the ONCD and NSC is crucial to ensure a secure ecosystem.
Cross-agency collaboration is challenging. Each agency protects its sensitive information in different ways. For example, the DOE, CISA and the Transportation Security Agency (TSA) each has its own sensitive information platforms with distinct access requirements, taxonomies and protocols. However, cyberattacks often target multiple critical infrastructure sectors. Therefore, it is critical for these platforms to securely communicate with each other to get the right information to the right person, at the right time, regardless of industry and respective sector risk management agency. It's also vital that these platforms are standards-based and technology neutral, in order to leverage cyberthreat and vulnerability information from the broader critical infrastructure ecosystem.
These systems need to be automated and operate in real time. It is no longer good enough to share PDFs with indicators of compromise over secure email links. Attackers have the ability to move at machine speed to compromise multiple industrial sectors. Our defenses need to match this threat.
Moving Forward
NSTAC's goal is to provide the president recommendations on actions that can be taken at the federal level to help secure government and critical infrastructure networks. However, many of the recommendations included in the report are not exclusive to the U.S. federal government. They can also be applied by state, local, tribal and territorial (SLTT) governments, other global governments and commercial sector infrastructure owners and operators. The broader infrastructure ecosystem benefits when all stakeholders have stronger cyber defenses. Tenable looks forward to working with our government and industry customers and partners to implement these recommendations and help secure our crucial infrastructure.
了解详情：
- Download the complete: NSTAC report
- Read the blogs:
- Download the white paper: 注意差距：IT/OT 共处路线图
相关文章
Cybersecurity Snapshot: New Guide Explains How To Assess if Software Is Secure by Design, While NIST Publishes GenAI Risk Framework
May 10, 2024Is the software your company wants to buy securely designed? A new guide outlines how you can find out. Meanwhile, a new NIST framework can help you assess your GenAI systems’ risks. Plus, a survey shows a big disconnect between AI usage (high) and AI governance (low). And MITRE’s breach post-mortem brims with insights and actionable tips. And much more!
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
As Pro-Russia Hactivists Target OT Systems, Here’s What You Need To Know
May 2, 2024U.S. and international cybersecurity and law enforcement agencies this week issued a joint fact sheet to highlight and safeguard against the continued malicious cyber activity conducted by pro-Russia hacktivists against operational technology (OT) devices in North America and Europe. Read on to get all the details and learn what actions to take today.
Microsoft’s May 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-30051, CVE-2024-30040)
May 14, 2024Microsoft addresses 59 CVEs in its May 2024 Patch Tuesday release with one critical vulnerability and three zero-day vulnerabilities, two of which were exploited in the wild.
Tenable Cloud Security Study Reveals a Whopping 95% of Surveyed Organizations Suffered a Cloud-Related Breach Over an 18-Month Period
May 14, 2024The finding from the Tenable 2024 Cloud Security Outlook study is a clear sign of the need for proactive and robust cloud security. Read on to learn more about the study’s findings, including the main challenges cloud security teams face, their strategies for better protecting their cloud infrastructure and the tools they use to measure success.
Shifting the Paradigm: Why the Cyber Insurance Industry Should Focus on Preventive Security
May 13, 2024As claims and losses climb, it’s clear that preventive security should be prioritized more when designing a cyber insurance policy. Here’s why preventive security investments are cost effective and can lead to lower premiums.
- Federal
- Government
- OT Security
- Public Policy