The Cybersecurity and Infrastructure Security Agency (CISA), FBI, the United Kingdom’s National Cyber Security Centre (NCSC-UK), and international partners released joint guidance Wednesday to help organizations combat cyber risks in operational technology (OT).
OT network environments are becoming more interconnected than ever, which makes them increasingly susceptible to cyber intrusions. CISA said the new guide – titled Secure Connectivity Principles for Operational Technology – offers owners and operators a framework with defined goals for building secure connectivity into OT environments.
“By providing OT organizations with practical steps to design, secure, and manage connectivity in OT environments, we help defend critical infrastructure against malicious and state-sponsored cyber threats,” said CISA Executive Assistant Director for Cybersecurity Nick Andersen in a press release.
“Together with our partners, CISA also urges OT device manufacturers and integrators to embrace secure-by-design principles because building security in from the start is the most effective way to reduce risk and safeguard the nation’s vital systems,” Andersen added.
The guidance outlines eight principles organizations can use as a framework to design, secure, and manage connectivity into OT environments.
These principles include: balance the risks and opportunities, limit connectivity exposure, centralize and standardize network connections, use standardized and secure protocols, harden OT boundaries, limit the impact of compromise, ensure all connectivity is logged and monitored, and establish an isolation plan.
The joint guide explains that these are intended as goals for OT systems, rather than minimum requirements.
CISA, along with its U.S. and international partners, is encouraging organizations to review the guidance, assess their OT connectivity, and implement the recommended mitigations to strengthen their cyber postures.
“Co-created with international partners and with extensive industry collaboration, the new NCSC guidance offers a clear, practical framework for designing and maintaining secure connectivity, reducing attack surface and boosting resilience,” said NCSC Chief Technology Officer Ollie Whitehouse. “We strongly recommend OT practitioners worldwide follow the eight key principles to help make confident, security-led decisions that will safeguard critical services and strengthen trust in connected systems.”
In addition to the NCSC-UK and FBI, CISA and its partners developed the joint guide in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre, Canadian Centre for Cyber Security, German Federal Office for Information Security, Netherlands National Cyber Security Centre, and New Zealand National Cyber Security Centre.