Ireland Makes OT Security Top Priority

The NCSC Securing Operational Technology guide is essentially a network risk assessment checklist; simple, concise, but at the same time impressively thorough.  With a lengthy introduction, the substantive part of the document covers 5 pages, but the authors manage to include 61 sensible, valuable, and clearly articulated recommendations into those few pages, a rare feat!

The guidance applies to the following sectors: electricity, drinking water and waste, oil and gas, transportation, chemical, pharmaceutical, pulp and paper, food and beverage and manufacturing industries. The guide details 10 essential areas with subtasks to address and manage the range of associated risks. The first six sections worthy of particular attention as they reinforce a sound engineering-based approach to securing OT networks from cyber threats. The sections are: risk-based approach, know your infrastructure, segment and isolate, control access, network & system hardening, and change control and configuration management. This type of approach to risk closely aligns with the discipline of “cyber-informed engineering” (CIE) which applies constant evaluation, consequence-driven risk analysis, and early design lifecycle engineering for OT cybersecurity mitigation.

• Risk-based approach: this section lays the foundation for effective cyber defense implementation: prioritization of critical systems. Mitigating or eliminating risk is only successful if you understand the severity of consequences of a particular asset or system. As the consequences of network compromise differ from asset to asset within an organization, it is important that groups of assets are prioritized according to criticality. And criticality can effectively be applied as per varying degrees of impact: financial, physical, social-economic, public, etc.
  
  
• Know your infrastructure: Understanding, documenting, and actively managing an accurate asset inventory is a must for cyber-physical systems which pose potential grave consequences if compromised.
  
  
• Segment and isolate: A golden rule of OT security: segment your OT network and protect it from your corporate network using strong network perimeter controls. Segmenting networks involves grouping assets, classifying their criticality and protecting that group of assets (or entire network) appropriately:

“divide network into zones organized by groups of systems with similar operational function and risk profile. Consider traffic flows between end points.”

Early lifecycle network planning with built-in controls reinforces digital perimeters and prevents the need to bolt-on protections after the fact. Operating with the assumption that the corporate network is compromised at all times will encourage disciplined information flows and appropriate protections from the start.

• Control External Access to the Network: this can be accomplished with clearly defined system and network boundaries and implementing protections accordingly. Remote access is very risky when implemented in OT environments, so it is critical to follow this guidance to include implementing a defense-in-depth strategy and/or enforcing disciplined traffic flows especially for the most highly critical assets and systems.
  
  
• Network & System Hardening: this step is very important from a network engineering perspective. There are simple steps that can be taken from design through execution to keep networks safer such as restricting internet connectivity for specific hosts, or better yet for the entire OT network, disabling ports, turning off non-essential services, removing IT assets and dependencies from OT networks, etc.