Six Principles of Operational Technology Cybersecurity Released
The National Security Agency (NSA), along with the Australian Signals Directorate’s Australian Cyber Security Centre, CISA, and other government organizations, have released six general Principles of Operational Technology Cyber Security.
The principles, which are aimed at securing operational technology (OT) environments in critical infrastructure, are as follows:
- 1. Safety is paramount.
- 2. Knowledge of the business is crucial.
- 3. OT data is extremely valuable and needs to be protected.
- 4. Segment and segregate OT from all other networks.
- 5. The supply chain must be secure.
- 6. People are essential for OT cybersecurity.
The document includes examples and explores implications related to each of these principles to help OT professionals effectively develop processes and prioritize actions.
For example, in regard to supply chain security, the guidelines note that:
Some control systems protocols communicate via multicast or broadcast messages, which are sent to all devices on the network. As such, almost any device on the network may be able to view critical control messages and could create and inject messages to cause an undesirable action, making the supply chain of all devices critical.
Read more at NSA.
Related content
- NSA Offers Best Practices for OSS in Operational Technology
- NSA Issues Zero Trust Guidelines for Network Security
-
News for Admins
In the news: US Agencies Issue Quantum-Readiness Recommendations; Bitwarden Secrets Manager; IBM X-Force Releases Detection and Response Framework for Managed File Transfers; National Strategy to Expand US Cyber Workforce; SEC Adopts New Rules for Disclosure of Cybersecurity Incidents; Canonical Announces Real-Time Ubuntu for Intel Core; EU-US Data Privacy Framework Ensures Safe Data Transfers; IEEE Releases New Standard for LiFi Communications; EU Health Sector Security Risks; and JupyterLab 4.0.
- How to Use an SBOM
-
Understanding Cybersecurity Maturity Model Certification
United States Cybersecurity Maturity Model Certification will be required by mid-2023 to handle controlled unclassified information and win federal contracts, but it can also help minimize business risk and keep information out of the hands of adversaries.