INTRODUCTION
In early 2021, Dragos began conducting a series of assessments to evaluate the overall cybersecurity maturity of the operational technology (OT) environment for several leased datacenters (LDCs). During these assessments, Dragos found recurring trends in the vulnerabilities found in the LDCs. This report discusses some of those trends and how Dragos is using the experience gained during these assessments to improve our processes.
Dragos chose to use the Cybersecurity Maturity Model Certification (CMMC), publishedin 2020, as a foundation for a series of benchmarking assessments.1 While CMMC is wide-ranging and covers a broad view of organizational cybersecurity maturity, it does have its drawbacks. The largest and most difficult drawback is related to interpreting the requirements with an eye towards OT. CMMC’s focus is protecting the confidentiality of information. Confidentiality, although on the list of cybersecurity priorities for OT,
is usually considered a lower priority than safety, integrity, and availability. Dragos reinterpreted many of the requirements in ways that were relevant to OT organizations.
This required Dragos to re-imagine the language and purpose around each of the requirements.
Another drawback to using CMMC for these assessments related to it being a certification standard.2
Auditors use the requirements as pass/fail criteria. Dragos wanted to develop an assessment that provided a variable scale to show areas for improvement. The variable scale needed to provide enough granularity to show incremental improvements over time applied across the entire security program, domain by domain, and even for individual areas within each domain. This level of granularity allows the organization to better understand how they can choose a target score and develop their roadmap. They could then focus their resources on the domains and areas that would have the greatest return
on investment and improvement to their score.
Over the course of 2021 and early 2022, Dragos conducted assessments for 12 different LDCs, covering a total of 16 different regions. Some organizations asked Dragos to evaluate their regions independently due to different organizational structures and recent acquisitions that had not been fully integrated yet.
Because the number of regions included in these assessments is small, Dragos does not purport the information presented here to be a complete and thorough evaluation of all types of datacenters. This report only discusses some broad trends that were visible after looking across the group of LDCs assessed.
Views: 0
