Three U.S. Policy Recommendations to Strengthen OT Cybersecurity
A presidential advisory committee report outlined strategies to improve government asset visibility, procurement and information sharing to enhance operational technology (OT) cybersecurity practices.
On Aug. 23, 2022, the U.S. National Security Telecommunications Advisory Committee (NSTAC) approved a Report to the President, and I had the privilege of contributing to its development. The report focuses on the security challenges that arise from the convergence of information technology (IT) and operational technology (OT) for government departments, agencies and industrial or critical infrastructures.
The report identifies three key recommendations the administration can immediately implement for the United States to maintain a reliable, secure and resilient national communications posture.
1.Direct federal civilian agencies to inventory their OT assets
"The Cybersecurity and Infrastructure Security Agency (CISA) should issue a Binding Operational Directive (BOD) to require executive civilian branch departments and agencies to maintain a real-time, continuous inventory of all OT devices, software, systems and assets within their area of responsibility, including an understanding of any interconnectivity to other systems." (Draft NSTAC Report to the President, pp 1-2).
Briefings and discussions held by NSTAC revealed that many organizations lack visibility into their complete OT environments, including environments where IT and OT systems are converged. The BOD requirement will increase organizational visibility and allow federal agencies to make risk-informed decisions about how to prioritize their cybersecurity budgets to best protect the most crucial assets.
Simply put, you can't protect what you can't see. Visibility and understanding of the devices and data flows in your OT networks are imperatives. I can't count how many times I've been asked, "how big is the OT cybersecurity problem?" I have to answer, "we don't know." Once we get visibility into these mission-critical environments we can begin to understand the scale of the cybersecurity challenges and begin to systematically address the serious risk.
CISA has already taken steps to address this obstacle. On Oct. 3, 2022, CISA issued Binding Operational Directive (BOD) 23-01, which calls on federal civilian departments and agencies to "make measurable progress toward enhancing visibility into agency assets and vulnerabilities." The BOD explicitly states that it applies to both IT and OT networked assets. Two core activities to achieve this visibility are to discover which assets are on federal networks and enumerate the vulnerabilities of those assets.
Achieving this visibility is a significant step forward for federal departments and agencies to protect their critical IT and OT assets against evolving cybersecurity threats.
2.Develop enhanced OT-specific cybersecurity procurement language
"CISA should develop guidance on updating and enhancing IT/OT products and services procurement language to incentivize the inclusion of risk-informed cybersecurity capabilities within delivered products and services; this guidance should also help all organizations understand best practices for bolt-on security for OT devices that are much more difficult or expensive to replace."(Draft NSTAC Report to the President, p. 3).
In 2009, when I was the Director of the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the Department of Homeland Security (now part of CISA), the community— including DHS, Department of Energy (DOE) and SysAdmin, Audit, Network and Security (SANS)— worked together to produce procurement language guidance. The guidance helped asset owners specify that cybersecurity be built into products and projects rather than bolted on as an afterthought. The General Services Administration (GSA) and CISA should collaborate to update this language and tailor it specifically for federal procurements. Additionally, the guide can serve as a model for private sector owners and operators, in order to incentivize the inclusion of cybersecurity capabilities in their own OT systems acquisitions. Including cybersecurity in both government and private sector procurement vehicles will significantly enhance the resilience of critical infrastructure systems.
3.Implement standardized, technology-neutral, real-time, interoperable information sharing
"The National Security Council (NSC), CISA, and the Office of the National Cybersecurity Director (ONCD) should prioritize developing and implementing interoperable, technology-neutral, vendor-agnostic information sharing mechanisms to enable the real-time sharing of sensitive collective-defense information between authorized stakeholders involved with securing U.S. critical infrastructure. This should include breaking down the artificial barriers for sharing [controlled, unclassified information] both within the U.S. federal government and between the federal government and other key, cross-sector stakeholders." (Draft NSTAC Report to the President, p. 4).
To break the traditional siloed approach and promote collaboration across agencies, leadership from the ONCD and NSC is crucial to ensure a secure ecosystem.
Cross-agency collaboration is challenging. Each agency protects its sensitive information in different ways. For example, the DOE, CISA and the Transportation Security Agency (TSA) each has its own sensitive information platforms with distinct access requirements, taxonomies and protocols. However, cyberattacks often target multiple critical infrastructure sectors. Therefore, it is critical for these platforms to securely communicate with each other to get the right information to the right person, at the right time, regardless of industry and respective sector risk management agency. It's also vital that these platforms are standards-based and technology neutral, in order to leverage cyberthreat and vulnerability information from the broader critical infrastructure ecosystem.
These systems need to be automated and operate in real time. It is no longer good enough to share PDFs with indicators of compromise over secure email links. Attackers have the ability to move at machine speed to compromise multiple industrial sectors. Our defenses need to match this threat.
Moving Forward
NSTAC's goal is to provide the president recommendations on actions that can be taken at the federal level to help secure government and critical infrastructure networks. However, many of the recommendations included in the report are not exclusive to the U.S. federal government. They can also be applied by state, local, tribal and territorial (SLTT) governments, other global governments and commercial sector infrastructure owners and operators. The broader infrastructure ecosystem benefits when all stakeholders have stronger cyber defenses. Tenable looks forward to working with our government and industry customers and partners to implement these recommendations and help secure our crucial infrastructure.
En savoir plus
- Download the complete: NSTAC report
- Read the blogs:
- Download the white paper: Comment éviter les angles morts : une feuille de route pour l'alignement IT/OT
Articles connexes
Cybersecurity Snapshot: Find MITRE ATT&CK Complex? Need Help Mapping to It? There’s an App for That!
March 10, 2023Learn about a new tool that streamlines MITRE ATT&CK mapping. Plus, known vulnerabilities remain a major cyber risk – just ask LastPass. Also, discover why SaaS data protection remains difficult. Plus, a look at the U.S. National Cybersecurity Strategy. And much more!
Cybersecurity Snapshot: Check Out Our No-Holds-Barred Interview with ChatGPT
February 10, 2023We pulled no punches in our question-and-answer session with ChatGPT: Find out what the world’s most famous AI chatbot had to say. Plus, CISA and the FBI offer help in dealing with a massive ransomware campaign. Also, are CIOs becoming de-facto CISOs? And cyber attackers are aiming at finance and accounting data. And much more!
Cybersecurity Snapshot: As ChatGPT Fire Rages, NIST Issues AI Security Guidance
February 3, 2023Learn all about NIST’s new framework for artificial intelligence risk management. Plus, how organizations are balancing AI and data privacy. Also, check out our ad-hoc poll on cloud security. Then read about how employee money-transfer scams are on the upswing. And much more!
Tenable Cyber Watch: A Look at the U.S. National Cybersecurity Strategy, A Powerful AI Tech Gears Up for Prime Time, and more
March 20, 2023This week’s edition of the Tenable Cyber Watch unpacks the White House’s National Cybersecurity Strategy and explores how artificial intelligence will help cyber teams with complex attacks. Also covered: Why software vendors should prepare to submit letters of attestation to the GSA.
OpenAI’s ChatGPT and GPT-4 Used as Lure in Phishing Email, Twitter Scams to Promote Fake OpenAI Tokens
March 17, 2023Hoping to cash in on the massive interest around OpenAI’s GPT-4 – ChatGPT’s new multimodal model – scammers have launched phishing campaigns via email and Twitter designed to steal cryptocurrency. Check out how they’re carrying out the scams and how you can avoid becoming a victim.
Cybersecurity Snapshot: CISA Pinpoints Vulnerabilities in Critical Infrastructure Orgs that Ransomware Groups Could Exploit
March 17, 2023Learn about CISA’s new program to help critical infrastructure organizations stamp out vulnerabilities associated with ransomware attacks. Plus, a U.S. government advisory with the latest on LockBit 3.0. Also, find out why the U.K.’s cyber agency is warning users about ChatGPT. And much more!
- Fédéral
- Administration publique
- Sécurité OT
- Politique publique
