Are You 'Choice-Paralyzed' About Protecting Your Critical Infrastructure? NSA Wants to Help

Federal agencies issued guidance they hope will help streamline and ease the decision-making process for owners of critical infrastructure to start protecting industrial control systems from an increasing probability of cyberattack.

“The variety of available security solutions can also be intimidating, resulting in choice paralysis,” reads guidance the Cybersecurity and Infrastructure Security Agency released Thursday together with the National Security Agency. “In the midst of so many options, owner/operators may be unable to incorporate simple security and administrative strategies that could mitigate many of the common and realistic threats. Fortunately, owner/operators can apply a few straightforward ICS security best practices to counter adversary [Tactics Techniques and Procedures].” 

The guidance notes the emergence of novel malware for targeting specific Programmable Logic Controllers and Open Platform Communications Unified Architecture. It warns of robust reconnaissance by adversaries who could use those and other tools to cause large-scale physical and psychological consequences for society.

“They could open or close breakers, throttle valves, overfill tanks, set turbines to over-speed, or place plants in unsafe operating conditions,” the agencies wrote of malign cyber actors. “Additionally, cyber actors could manipulate the control environment, obscuring operator awareness and obstructing recovery, by locking interfaces and setting monitors to show normal conditions. Actors can even suspend alarm functionality, allowing the system to operate under unsafe conditions without alerting the operator.”

CISA is soon expected to issue performance goals for critical infrastructure involving industrial control systems. Meeting the goals is voluntary under the national security memo calling on CISA to produce them. But trade associations for some of the largest companies in the economy are wary of how they might be used in potential regulations. In a Sep. 16 letter to Senate leaders responsible for crafting the National Defense Authorization Act, they argue companies should be allowed to voluntarily implement security controls “based on their own assessments of risk.”   

The guidance from NSA and CISA stressed a need for owners and operators to be cognizant of all of the devices in their systems, paying particular attention to those that can be accessed remotely, including by device vendors. NSA and CISA note that the vendors sometimes “require remote access for warranty compliance, service obligations, and financial/billing functionality.” 

“Establish a firewall and a demilitarized zone (DMZ) between the control system and the vendor’s access points and devices,” they say toward the top of their list of recommended mitigation measures. “Do not allow direct access into the system; use an intermediary service to share only necessary data and only when required.”

CISA included a related measure in a list of “Common Baseline” controls it proposed to serve as the performance goals the national security memo tasked the agency with establishing.

“All owner/operators should implement segmentation between [information technology] and [operational technology] networks to prevent initial access by threat actors,” according to a draft of CISA’s common baseline controls referenced by trade associations pushing back against the proposal. “Organizations should verify that devices on either side of segmentation lines/safety zones must not connect to the opposite side with minimal exceptions and only through a correctly configured firewall or comparable alternative.”

The comments were prepared by CTIA—The Wireless Association, NCTA–The Internet and Television Association and USTelecom—The Broadband Association.

“This draft control is overly prescriptive and oversimplifies the tradeoffs in segmentation for varied networks,” the associations wrote, noting a lack of flexibility for facilitating alternative approaches. “Segmentation can be costly and can impede access to business or mission-critical applications. An overly rigid expectation for default segmentation would deprive organizations of the capability to manage their systems and networks. Accordingly, at a minimum, CISA should remove language like ‘must.’”

CISA is expected to release the final performance goals sometime in October to mark Cybersecurity Awareness month.