A new guide from CISA and allied cybersecurity agencies says organizations should build dedicated isolation points into operational technology to contain attacks and continue delivering essential services.
Most IT operators understand that critical infrastructure should be isolated in crisis situations, but many don’t know how to do it in a way that maximizes security and minimizes disruption.
Now, several global agencies are offering a step-by-step action plan, CI Fortify. Released by the US Cybersecurity and Infrastructure Security Agency (CISA) and several Five Eyes security agencies across the US, UK, Australia, Canada, and New Zealand, the guide is intended to help organizations isolate and separate their vital systems to prevent malicious actors from wreaking havoc in case of attack, and to allow for safe rebuild post-attack.
“The end state must be to enable the continued operation of critical services in a state of isolation,” the guide emphasized.
A six-step guide for locking down systems
Cyber actors, particularly state-sponsored ones, are increasingly targeting operational technology (OT) systems to perform espionage or disrupt critical infrastructure such as power and water distribution.
As a result, some organizations have been forced to take their systems completely offline; for instance, this week CAF Bank suspended its online services due to a third-party software vulnerability, thus preventing the charities it serves from paying staff. Also this week, Minnesota Water Utilities’ OT services were disrupted in a coordinated cyberattack.
To help organizations that may suffer similar fates, the new guide outlines what it calls a “critical path to isolation,” with six actionable steps:
- Identify vital systems and networks
- Identify critical customers
- Identify common levels of criticality and trust for networks and hosts
- Identify potential isolation points and map connections to vital systems
- Build effective separation and isolation points
- Create and test an isolation plan
The first two steps are relatively straightforward: Understand the minimum set of systems required to support critical services, then set delivery targets based on top customers’ needs, such as the number of megawatts of power or gallons of water required to keep them up and running.
Assigning different degrees of criticality means segmenting networks, hosts, and systems into different zones based on their nature and threat exposure. Risk management processes will help in this area.
Once systems have been classified, the next step is to map, and continuously update, interconnection points between those critical networks and other systems, the guide advises. Some connections to take into account include those to vendors with remote access, such as consultants, contractors, or managed service providers; those to cloud environments, including private cloud; to untrusted networks; and to peer-critical networks like utilities or dispatch.
It’s also important to identify connections that might lower trust or increase network vulnerability, such as those to carrier-provided networks, or Wi-Fi, satellite, radio point-to-point, or mobile connections. Operators should identify any protection mechanisms, like encryption, that may be in place in these areas, according to the agencies.
Further, operators should understand the business context of each connection, including the type of information that flows through it and how critical it is to operations and to the system owner or third-party provider. Technical information around these interconnections should also be documented, for instance, internet gateway information, architectural diagrams, firewall, router, and virtual private network (VPN) configurations, as well as emergency contact details.
“This critical technical information will be necessary for building isolation controls,” the guide notes.
Establishing separation and isolation points
The assumption is that zero-trust networks reduce the need for isolation because devices are designed to inherently distrust one another. But the guide emphasizes that isolation points between networks and services are necessary and “highly effective” at containing attacks, limiting overall impact on operations and on attackers’ ability to pivot, and shortening time to restore services in the event of an incident.
“Organizations must build physical isolation points into their vital systems to enable the capability to operate in a state of isolation,” the guide states.
This means zero connectivity or shared infrastructure with non-OT networks via switching, routing, compute, repeaters, or multiplexers. Additionally, vital resources like power, cooling, backup generation, and physical security systems should not be controllable from non-critical networks.
Enterprises should harden OT boundaries, fully segregate management and admin systems, and secure network control planes, the guide advises. They can also implement admin network controls like virtual local area networks (VLANs), multiprotocol label switching (MPLS), IP access lists, route blocking, and blackhole routing in which malicious packets are dropped before they can impact servers.
However, the agencies acknowledge that complete physical isolation may not be operationally feasible for some enterprise operating systems with large disparate footprints.
In these types of distributed critical infrastructure where third-party communication is unavoidable, OT boundaries should be secured with strong encryption. Additionally, dedicated communication paths such as wavelengths or fiber pairing can help prevent data sharing with non-vital systems.
Meanwhile, Layer 2 and Layer 3 services should be encrypted, with remote access prevented or at least limited, and unnecessary services disabled, the guide says. Enterprises should not rely on encryption built into OT devices; rather, a dedicated device should be used for encryption over a carrier’s links.
Ultimately, operators should treat any carrier-provided service as “untrusted and potentially hostile,” the guide warns.
Understand dependencies and risks, isolate in phases
Given all this, operators should understand dependencies between OT and non-OT systems, and build dedicated OT capabilities, the agencies note. Dependencies might occur in shared routing, virtualization, switching, storage, document management, Active Directory, and certificate and authentication services. These must be understood to prevent unforeseen performance issues or degradation of service quality in the case of physical isolation.
Enterprises also need to understand how they will operate during any extended periods of separation, given that could result in operational and security risks. For instance, systems may fall out of patching compliance, removable media may not receive updates, resulting in increased risk of infection, and external visibility can be reduced.
Isolating systems may seem an overwhelming task at first, so the agencies suggest a graduated plan. This can help “progressively isolate pathways” to vital OT and supportive systems while maintaining continuity of business processes.
To protect themselves, companies should consider these steps, in order:
- Disable remote workers’ ability to access OT systems through intermediaries like jump hosts on non-OT environments;
- Disable on-premises remote access to OT systems from corporate systems;
- Isolate all connections between non-OT and OT environments;
- Isolate lower-priority connections between decentralized OT and OT systems;
- Completely isolate OT environments and vital systems.
“Progressively removing access to OT systems as the cyber threat environment deteriorates may be effective in halting or hindering attacks on vital OT and enabling systems,” the guide notes.