Boiler room for steam production of factory industrial,interior industrial gas boiler with a lot of piping,pipelines, pumps and valves. Control systems like this are increasingly under cyber attack. Visoot Uthairam/Getty
Federal agencies issued guidance they hope will help streamline and ease the decision-making process for owners of critical infrastructure to start protecting industrial control systems from an increasing probability of cyberattack.
“The variety of available security solutions can also be intimidating, resulting in choice paralysis,” reads guidance the Cybersecurity and Infrastructure Security Agency released Thursday together with the National Security Agency. “In the midst of so many options, owner/operators may be unable to incorporate simple security and administrative strategies that could mitigate many of the common and realistic threats. Fortunately, owner/operators can apply a few straightforward ICS security best practices to counter adversary [Tactics Techniques and Procedures].”
The guidance notes the emergence of novel malware for targeting specific Programmable Logic Controllers and Open Platform Communications Unified Architecture. It warns of robust reconnaissance by adversaries who could use those and other tools to cause large-scale physical and psychological consequences for society.
“They could open or close breakers, throttle valves, overfill tanks, set turbines to over-speed, or place plants in unsafe operating conditions,” the agencies wrote of malign cyber actors. “Additionally, cyber actors could manipulate the control environment, obscuring operator awareness and obstructing recovery, by locking interfaces and setting monitors to show normal conditions. Actors can even suspend alarm functionality, allowing the system to operate under unsafe conditions without alerting the operator.”
CISA is soon expected to issue performance goals for critical infrastructure involving industrial control systems. Meeting the goals is voluntary under the national security memo calling on CISA to produce them. But trade associations for some of the largest companies in the economy are wary of how they might be used in potential regulations. In a Sep. 16 letter to Senate leaders responsible for crafting the National Defense Authorization Act, they argue companies should be allowed to voluntarily implement security controls “based on their own assessments of risk.”
The guidance from NSA and CISA stressed a need for owners and operators to be cognizant of all of the devices in their systems, paying particular attention to those that can be accessed remotely, including by device vendors. NSA and CISA note that the vendors sometimes “require remote access for warranty compliance, service obligations, and financial/billing functionality.”
“Establish a firewall and a demilitarized zone (DMZ) between the control system and the vendor’s access points and devices,” they say toward the top of their list of recommended mitigation measures. “Do not allow direct access into the system; use an intermediary service to share only necessary data and only when required.”
CISA included a related measure in a list of “Common Baseline” controls it proposed to serve as the performance goals the national security memo tasked the agency with establishing.
“All owner/operators should implement segmentation between [information technology] and [operational technology] networks to prevent initial access by threat actors,” according to a draft of CISA’s common baseline controls referenced by trade associations pushing back against the proposal. “Organizations should verify that devices on either side of segmentation lines/safety zones must not connect to the opposite side with minimal exceptions and only through a correctly configured firewall or comparable alternative.”
The comments were prepared by CTIA—The Wireless Association, NCTA–The Internet and Television Association and USTelecom—The Broadband Association.
“This draft control is overly prescriptive and oversimplifies the tradeoffs in segmentation for varied networks,” the associations wrote, noting a lack of flexibility for facilitating alternative approaches. “Segmentation can be costly and can impede access to business or mission-critical applications. An overly rigid expectation for default segmentation would deprive organizations of the capability to manage their systems and networks. Accordingly, at a minimum, CISA should remove language like ‘must.’”
CISA is expected to release the final performance goals sometime in October to mark Cybersecurity Awareness month.
NEXT STORY: Nuclear Weapon Development and Manufacturing Needs More Cybersecurity, Watchdog Says
Do Not Sell My Personal Information
When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.
Strictly Necessary Cookies - Always Active
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data, Targeting & Social Media Cookies
Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link
If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.
Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.
If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page. Save Settings
A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Help us tailor content specifically for you: