The National Security Agency and CISA have issued guidance on how to secure operational technology and industrial control systems part of U.S. critical infrastructure.
The advisory also “Notes the increasing threats to OT and ICS assets that operate, control, and monitor day-to-day critical infrastructure and industrial processes. OT/ICS designs are publicly available, as are a wealth of tools to exploit IT and OT systems.”
Some defenders may be unable to implement some of the recommended security strategies that could help mitigate many common tactics used to target critical infrastructure control systems.
Limit exposure of system information: Operational and system information and configuration data are crucial elements of critical infrastructure operations.
Today’s advisory builds on previous guidance from 2021 for stopping malicious attacks targeting OT control systems and from 2020 on how to defend Internet-exposed OT assets.
In July 2021, a national security memorandum instructed CISA and NIST to develop cybersecurity performance goals and guidance for critical infrastructure owners and operators to help strengthen the security of U.S. critical infrastructure.
