Top Ten ICS/OT Cyber Security Controls Here is my take on the most important aspects of cyber security in control systems environments, based on combining ISA 62443 with the concept of the Critical Security Controls. I have always been a big fan of the CSC as it was written in a simple to understand manner and, more importantly, provided the reader with a prioritized list on where to start. For example, if I only could do one thing for security an ICS/OT environment, it would be complete filtered segmentation between the IT/OT networks that falls under 'Secure Network Architecture' and so on. Not at complete list by any stretch of the imagination, but where I would start and food for thought. As always, I am very curious to get everyone's thoughts and feedback! #1 - Secure Network Architecture As mentioned, if I had to choose one thing to do for securing an ICS/OT environment, it would be to start with creating the IT-OT DMZ with two layers of physical firewalls. From there, we can look at additional filtered segmentation based on the Purdue Model. As we continue to mature network segmentation from there, we can move into leveraging Zones and Conduits as found in ISA 62443. #2 - Inventory and Control of Hardware Assets How can we protect what we don't know we have on the network? Fortunately, asset registers are a core component of most ICS/OT networks. While they might not always be 100% accurate, it is a great place to start. #3 - Inventory and Control of Software Assets Besides our hardware, we also need to maintain an accurate inventory of software in the environment. I also include firmware here as well. Like with hardware, we need to understand what we have in the environment in order to be able to protect it. This understanding provides a solid foundation for #4 - Continuous Vulnerability Management. #4 - Continuous Vulnerability Management Based on the information we have collected in #2 and #3 for our asset registers, we can then not only look for vulnerabilities associated with the known hardware/software/firmware in our environment, but we can continue to look for NEW hardware/software/firmware that appear in the environment and respond accordingly. #5 - Incident Response Management - "It isn't a question of if, but a question of when." It is an expression that is heavily used in IT incident response, but applies equally as well for ICS/OT environments. At a minimum, we need to be prepared to respond in the event of an event or incident that threatens physical safety, environmental safety and the production of our facilities. To be continued... #icssecurity #icscybersecurity #otsecurity #otcybersecurity #cybersecurity #it #ot
Mike Holcomb 100%! I am a fan of the CIS, formerly SANS, Critical Security Controls (CSCs) and #iec62443 as a series of standards to protect #ot / #ics. #1 (proper network segmentation) is a must! #2-4 are really important as well, and untenable at scale without both modern tools and process. #5 needs to be considered in the "operational" or "organizational" context, as in "not just the techies", arguably more so for OT/ICS than IT. Dragos, Inc. and others help with "tabletop exercises" to mature.
Mikko Ala-Jaakkola
11mo
Some great back and forth here. I'd pull Secure Remote Access higher up on the list or maybe nest it inside Secure Network Architecture. Based on the data where attacks originate, there's easy wins in SRA to reduce the likelihood of an incident. Inventory at some level (like asset registers) is a must but doesn't reduce the risk that much by itself so on my list doesn't get a podium place.
Malik Asad
11mo
Sarah Pixley from #ibm is hosting a free webinar on SECURING YOUR OFFSHORE OIL & GAS INFRASTRUCTURE on 20th June 2023 at 2:00 PM EST. Marisol Cruz Cain, CIPP-G, CIPP-US, CISSP Director, Information Technology and Cybersecurity Team at US Government Accountability Office will be sharing threats to the Oil and Gas industry based on the GAO report and strategies and ideas to mitigate them. Nouman S. Abbasi VP-Cyber Security share his view that how #SoftwareProductivityStrategists help offshore companies in overcoming those threats. Please click on following ZOOM link to get registered :- https://us02web.zoom.us/webinar/register/6816844425478/WN_k9vunKF8QvmKi5m63cU0Tw
Frédéric Planchon
11mo
What a very interesting discussion. Thanks guys. I personnaly would agree to move # 10 higher, but #7 as well. Zero Trust approach also means #4 is not that high. And Account Management would be for me in top 3.
Bruce Cave
10mo
Priority lists are very useful although I prefer not to ordered them to much because people usually follow the sequence to closely when creating implementation plans. I prefer planning based on consequences analysis with some “informed guessing” of likelihood, which have used all your priority list items. In summary, start with priority item 6 using IEC62443 (and knowledgeable people). Then create the proposed implementation plans with associated budgets. Easy? I wish it could be!
Janne Kokkaret
11mo
Segmentation between IT/OT as mentioned many of the comments would be desired model, but very rare cases its easy task to complete. There was very good point of asset discovery and gain better visibility of infrastructure. I still would consider how to secure zero day vulnerabilities for legacy systems and looking at how to patching those systems against zero day vulnerabilities.
Runar Brekke
10mo
3rd Party Risk/ Supply Chain Risk is missing !
Chris Furtick
10mo
Being a HUGE fan of the CIS Critical Security Controls I think its interesting to see a similar framework for ICS/OT. I would be interested to hear why Secure Remote Access doesn't fall (by default) into the Secure Network Architecture. The zones prescribed by the Purdue Model are relatively new for me so I appreciate you sharing this Mike Holcomb!
Tim Parker
11mo
Great list, though might consider arguing for Incident Response to be higher up so at least there is a baseline response plan in place as soon as possible
Industrial Cybersecurity Executive - OT Incident Response at Accenture. US Army Veteran, Author, Street Photographer, Biker, Philanthropist.
11moI like your list and priorities - though one thing I often say is that its quicker and easier to put a detection in depth architecture in place than it is for network architecture. So while I totally agree that #1 is isolating the IT and OT, I would say that #10 on your list for detection and monitoring, often is a close second. This assumes of course that your org has the skills and staffing to respond to the events. If not, MSP, MSSP, MxDR, etc is a very helpful stop gap measure.