A number of international government organizations have come together to publish the “Principles of operational technology cyber security,” which features six principles to follow.
The guide was created by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), and co-sealed by government security offices from the U.S, U.K, Canada, New Zealand, Germany, the Netherlands, Japan, and South Korea. Within the U.S. this was a multi-department effort, with participation from CISA, NSA, and FBI.
According to the report authors, this guide was needed because providers of critical infrastructure like clean water, energy, and transportation rely on operational technology (OT) to control and manage the systems that provide these services.
“Due to the extensive integration of OT in the technical environments of critical infrastructure organisations, and the complex structure of these environments, it can be difficult to identify how business decisions may affect the cyber security of OT, including the specific risks attributed to a decision. Decisions may include introducing new systems, processes, or services to the environment; choosing vendors or products to support the technical environment; and developing business continuity and security-related plans and playbooks. This document is designed to assist organisations make decisions for designing, implementing, and managing OT environments to ensure they are both safe and secure, as well as enable business continuity for critical services,” the guide states.
Principle 1: Safety is paramount
Critical infrastructure provides essential services required for life, and the systems that run it can also come with hazards like high voltages, pressure releases or flammable explosions, kinetic impacts, and chemical or biological hazards.
“Safety of human life, safety of the plant equipment, safety of the environment, and the need to maintain reliability and uptime, are necessary systemic ways of thinking that need to permeate all tasks,” the report authors wrote.
Even common IT tasks can have an impact on safety, including how backups are conducted (i.e. is there a risk to doing backups on the same network that time-critical safety alerts are sent?), how assets are discovered, and how to patch systems.
Principle 2: Knowledge of the business is crucial
This principle is based on the idea that the more knowledge a business has about itself, the better equipped it is to prepare and respond to cyber incidents.
The guide recommends businesses do the following:
- Identify crucial systems
- Understand the OT system’s processes and every component that’s a part of it
- Have an architecture that allows crucial systems to be defended from other networks, both internal and external
- Ensure that personnel responsible for these systems understand the business context in which the system is operating
- Understand the dependencies between crucial systems
Principle 3: OT data is extremely valuable and needs to be protected
The data on how a critical system is set up is unlikely to change very often, and thus would be very valuable in the wrong hands. Therefore, companies should seek to protect that data.
Changing data, like voltage or pressure levels, is also important in understanding how a system is being used. OT data might also contain intellectual property (IP), like metering data, or personally identifiable information (PII), like patient records in health.
“Organisations should seek to do more than protect the confidentiality, integrity and availability of OT data. Ideally they are alerted when OT data is viewed or exfiltrated – potentially via implementing canary tokens, which may include responses on certain files if they are touched. Further, they should consider what data adversaries already have access to, and if that data can be changed. This includes default passwords. If default passwords are changed, ideally ensure there is a way to capture failed login attempts, and investigate them,” the guide recommends.
Principle 4: Segment and segregate OT from all other networks
Crucial systems should run on a separate network from the rest of the business, because the business’ IT network typically has a higher risk since it is connected to the internet. If they are on the same network, there is the potential for the less secure business network to provide a backdoor to the critical system.
Additionally, the running of these systems should be separated from the business’ regular IT operations to prevent risk of administration or management being compromised. “Critical OT systems should not be reliant on IT systems to operate,” the authors said.
Principle 5: The supply chain must be secure
Avoid connecting unnecessary third-party services to the OT network because often these networks are fairly open, with critical control messages being sent with no encryption, for example. Devices to be wary of may include printers, networking or telecommunications equipment, remote terminal units (RTUs), human machine interfaces (HMIs), engineering workstations, historians, relays, intelligent electronic devices (IEDs), and controllers.
Operators should know the source and provenance of any device connected to the OT network, including what other networks the device may have connected to previously, such as another customer of the vendor. Ideally, any other network the device has connected to has the same level of trust as the OT network. This can be tested using a packet analyzer to check if the device tries to connect to a remote address.
Another consideration is what the device could do if its firmware or configuration is changed. Operators should confirm that firmware is only received from a trusted location and its cryptographic signature is checked.
Vendors can also increase risk if they require actions that may break these OT principles, such as requiring connection to the internet to do license renewals. “Other examples include direct connections between OT and the internet, bypassing remote access security architecture, as a means to allow the vendor to collect data, perform firmware updates, make configuration changes, or to perform any other form of remote servicing or support,” the authors wrote.
Principle 6: People are essential for OT cyber security
Properly trained operators are needed for creating and implementing the proper defenses for these systems, as well as looking for possible incidents.
Some recommendations include:
- Integrating security into safety assessments, factory acceptance testing, site acceptance testing, and the engineering change management process
- Creating an environment where staff are able to easily identify and report suspicious behavior
- Training operators to consider compromise as a possibility when faults are identified
“Staff, particularly field technicians and all other members of operating staff, are often the front line of defence and detection for an organisation,” the guide concludes.
