Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Three U.S. Policy Recommendations to Strengthen OT Cybersecurity

Three U.S. Policy Recommendations to Strengthen OT Cybersecurity

A presidential advisory committee report outlined strategies to improve government asset visibility, procurement and information sharing to enhance operational technology (OT) cybersecurity practices.

On Aug. 23, 2022, the U.S. National Security Telecommunications Advisory Committee (NSTAC) approved a Report to the President, and I had the privilege of contributing to its development. The report focuses on the security challenges that arise from the convergence of information technology (IT) and operational technology (OT) for government departments, agencies and industrial or critical infrastructures.

The report identifies three key recommendations the administration can immediately implement for the United States to maintain a reliable, secure and resilient national communications posture.

1. Direct federal civilian agencies to inventory their OT assets

"The Cybersecurity and Infrastructure Security Agency (CISA) should issue a Binding Operational Directive (BOD) to require executive civilian branch departments and agencies to maintain a real-time, continuous inventory of all OT devices, software, systems and assets within their area of responsibility, including an understanding of any interconnectivity to other systems." (Draft NSTAC Report to the President, pp 1-2).

Briefings and discussions held by NSTAC revealed that many organizations lack visibility into their complete OT environments, including environments where IT and OT systems are converged. The BOD requirement will increase organizational visibility and allow federal agencies to make risk-informed decisions about how to prioritize their cybersecurity budgets to best protect the most crucial assets.

Simply put, you can't protect what you can't see. Visibility and understanding of the devices and data flows in your OT networks are imperatives. I can't count how many times I've been asked, "how big is the OT cybersecurity problem?" I have to answer, "we don't know." Once we get visibility into these mission-critical environments we can begin to understand the scale of the cybersecurity challenges and begin to systematically address the serious risk.

CISA has already taken steps to address this obstacle. On Oct. 3, 2022, CISA issued Binding Operational Directive (BOD) 23-01, which calls on federal civilian departments and agencies to "make measurable progress toward enhancing visibility into agency assets and vulnerabilities." The BOD explicitly states that it applies to both IT and OT networked assets. Two core activities to achieve this visibility are to discover which assets are on federal networks and enumerate the vulnerabilities of those assets.

Achieving this visibility is a significant step forward for federal departments and agencies to protect their critical IT and OT assets against evolving cybersecurity threats.

2. Develop enhanced OT-specific cybersecurity procurement language

"CISA should develop guidance on updating and enhancing IT/OT products and services procurement language to incentivize the inclusion of risk-informed cybersecurity capabilities within delivered products and services; this guidance should also help all organizations understand best practices for bolt-on security for OT devices that are much more difficult or expensive to replace."(Draft NSTAC Report to the President, p. 3).

In 2009, when I was the Director of the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the Department of Homeland Security (now part of CISA), the community— including DHS, Department of Energy (DOE) and SysAdmin, Audit, Network and Security (SANS)— worked together to produce procurement language guidance. The guidance helped asset owners specify that cybersecurity be built into products and projects rather than bolted on as an afterthought. The General Services Administration (GSA) and CISA should collaborate to update this language and tailor it specifically for federal procurements. Additionally, the guide can serve as a model for private sector owners and operators, in order to incentivize the inclusion of cybersecurity capabilities in their own OT systems acquisitions. Including cybersecurity in both government and private sector procurement vehicles will significantly enhance the resilience of critical infrastructure systems.

3. Implement standardized, technology-neutral, real-time, interoperable information sharing

"The National Security Council (NSC), CISA, and the Office of the National Cybersecurity Director (ONCD) should prioritize developing and implementing interoperable, technology-neutral, vendor-agnostic information sharing mechanisms to enable the real-time sharing of sensitive collective-defense information between authorized stakeholders involved with securing U.S. critical infrastructure. This should include breaking down the artificial barriers for sharing [controlled, unclassified information] both within the U.S. federal government and between the federal government and other key, cross-sector stakeholders." (Draft NSTAC Report to the President, p. 4).

To break the traditional siloed approach and promote collaboration across agencies, leadership from the ONCD and NSC is crucial to ensure a secure ecosystem.

Cross-agency collaboration is challenging. Each agency protects its sensitive information in different ways. For example, the DOE, CISA and the Transportation Security Agency (TSA) each has its own sensitive information platforms with distinct access requirements, taxonomies and protocols. However, cyberattacks often target multiple critical infrastructure sectors. Therefore, it is critical for these platforms to securely communicate with each other to get the right information to the right person, at the right time, regardless of industry and respective sector risk management agency. It's also vital that these platforms are standards-based and technology neutral, in order to leverage cyberthreat and vulnerability information from the broader critical infrastructure ecosystem.

These systems need to be automated and operate in real time. It is no longer good enough to share PDFs with indicators of compromise over secure email links. Attackers have the ability to move at machine speed to compromise multiple industrial sectors. Our defenses need to match this threat.

Moving Forward

NSTAC's goal is to provide the president recommendations on actions that can be taken at the federal level to help secure government and critical infrastructure networks. However, many of the recommendations included in the report are not exclusive to the U.S. federal government. They can also be applied by state, local, tribal and territorial (SLTT) governments, other global governments and commercial sector infrastructure owners and operators. The broader infrastructure ecosystem benefits when all stakeholders have stronger cyber defenses. Tenable looks forward to working with our government and industry customers and partners to implement these recommendations and help secure our crucial infrastructure.

Learn more:

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web Application Scanning trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.cs Cloud Security.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try Tenable Lumin

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable.io Vulnerability Management, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable.cs

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now.

Your Tenable.cs Cloud Security trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.io Web Application Scanning.

Contact a Sales Rep to Buy Tenable.cs

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Promotional pricing extended until February 28th.
Buy a multi-year license and save more.

Add Support and Training