Lock down your critical infrastructure, CISA begs admins – Source: go.theregister.com

CISA is urging companies with operational technology environments to set a better cybersecurity posture, and not just by adopting some new best practices and purchasing some new software.

Operational technology (OT) refers to any technology that deals with physical processes, be it manufacturing equipment, energy distribution, oil and gas production, or some other industrial duty. Long isolated from the public internet but more frequently connected in our modern era, OT systems remain an afterthought for many security teams.

OT attacks have been on the rise of late, with Security Firm Dragos noting an 87 percent year-over-year increase in cyberattacks targeting industrial companies in the US in 2024. Malefactors have hit manufacturing hard, because its OT cybersecurity is particularly immature. 

The FBI has also noticed a spike in attacks targeting critical infrastructure, where OT systems often reside. In 2024, researchers also discovered two malware variants designed to target OT – an incredible rarity. 

On Wednesday, CISA published some new foundational guidance for OT cybersecurity that starts with the absolute basics: Assume nothing, and start entirely fresh with a new taxonomy-based OT asset inventory. 

“OT systems are essential to the daily lives of all Americans and to national security,” Acting CISA Director Madhu Gottumukkala said in a statement. “They power everything from water systems and energy grids to manufacturing and transportation networks.” 

The US Environmental Protection Agency, National Security Agency, and FBI as well as cybersecurity agencies from Australia, Canada, Germany, The Netherlands, and New Zealand joined CISA in creating the document. 

The taxonomy of an OT environment

Baking an apple pie from scratch may require creating a whole universe, but thankfully secure-by-default OT environments don’t demand quite that much initial work. That said, CISA’s guide will still take time to implement. 

OT environments can be incredibly complicated: Tons of different industrial machines can exist on a single OT network, each with its own proprietary interfaces, levels of criticality, and support complications. Endpoints can be numerous – especially as more and more OT assets connect to systems outside the network – and vulnerabilities outside OT can impact the security of operational systems. 

To best manage OT assets, CISA recommends a living inventory of OT technology based on a taxonomic structure, by which the agency means “a categorization system that organizes and prioritizes OT assets, aids in risk identification, vulnerability management, and incident response by classifying assets based on function and criticality.” 

• Critical infrastructure security will stay poor until everyone pulls together
• Security pros are drowning in threat-intel data and it’s making everything more dangerous
• Despite Russia warnings, Western critical infrastructure remains unprepared
• CISA roasts unnamed critical national infrastructure body for shoddy security hygiene

What that looks like can vary from industry to industry, and CISA includes examples in the document from oil and gas, energy, and water orgs to help explain things. Examples of suggested asset fields for an inventory are also included, with standard suggestions like hostnames and IPs, as well as verifying more particular things about an asset, like where baseline OS images are stored and whether they’re up to date. It also recommends keeping a full list of a device’s supported communication protocols in order to best track potential exploit pathways. 

A full breakdown of steps to create a proper OT taxonomy is included in the document, which CISA is practically begging vulnerable organizations to use. 

“The joint asset inventory guide… is a valuable resource that helps organizations effectively identify and secure their most vital assets, reduce the risk of cybersecurity incidents, and ensure the continuity of their mission and services,” CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said in the agency’s statement, adding that “operational technology is foundational to the operations of the nation’s critical infrastructure.” ®