The National Security Agency (NSA) has partnered with cybersecurity agencies in Australia,
\nCanada, Germany, Japan, the Netherlands, New Zealand, South Korea and the United Kingdom to
\nlaunch a guide that presents six fundamental principles. These principles are intended to assist in
\nthe creation and maintenance of a secure and critical environment for operational technology (OT)
\ninfrastructure.
\nIts purpose is to provide organizations that manage critical infrastructures with a framework to
\nprotect their operational technology (OT) environments from cyber threats, ensuring the continuity of
\nessential services such as energy, drinking water and transportation. The increasing dependence on
\noperational technology and the complexity of these environments imply significant challenges in
\nbusiness decision making, especially when introducing new technologies, selecting suppliers or
\ndeveloping continuity plans.
\nThe document details six fundamental principles that should guide organizations in creating and
\nmaintaining secure OT environments:
\n1. Safety is paramount
\n2. Knowing the business is fundamental
\n3. OT data is valuable and must be protected
\n4. Segmenting and segregating OT networks
\n5. Securing the supply chain
\n6. People are essential to cybersecurity OT
\nEach principle is designed to help decision makers identify and mitigate cyber risks associated with
\noperational technology. The document provides clear guidelines for implementing appropriate
\ncontrols, reducing vulnerabilities and promoting business continuity. It also highlights the importance
\nof aligning cybersecurity with organizational culture and collaboration among all levels of the
\norganization, from engineers to executives.<\/p>\n
This framework seeks to ensure that critical systems not only operate efficiently, but also securely,
\nminimizing exposure to cyber threats and maintaining public confidence in essential services.<\/p>\n
Principle 1: Safety is paramount
\nThis principle underlines the critical importance of security in operational environments (OT),
\nhighlighting that, unlike corporate IT systems where rapid innovation may be a priority, in OT it is
\nessential to ensure physical security and avoid threats that could endanger human life and the
\ncontinuity of critical services. Organizations that operate critical infrastructure, such as power plants
\nor water treatment systems, must always consider the physical hazards and the potential
\nrepercussions that a failure, whether due to human error or cyber attack, could have on public safety
\nand social stability.
\nKey Aspects
\n\u25cf Protection of human life and the environment: OT systems operate equipment that, if
\ntampered with or altered, could lead to hazardous incidents such as explosions, chemical
\nleaks, electrical discharges or structural collapse.
\n\u25cf Continuity of service: Security also encompasses the need to maintain the operability of
\nessential services, such as the supply of drinking water or energy, to avoid negative impact
\non society.
\nExamples and Considerations
\n\u25cf Incident response: Organizations must be prepared to respond to incidents on systems that
\nrequire secure operation. In some cases, paying a ransom (as in ransomware attacks) is not
\nfeasible, as there is no guarantee that the system will be returned to a secure state.
\n\u25cf Validity of backups: If an attacker has been present in the OT network, it may be difficult to
\ntrust the available backups, as they could have been compromised.
\n\u25cf Recovery plans: Critical systems must have well-defined recovery procedures that ensure a
\nsafe return to operation, even after major outages.
\nThis principle emphasizes the need for a rigorous and disciplined approach to the operation and
\nmanagement of OT systems. Security in these environments involves not only protecting against
\ncyber-attacks, but also ensuring that any changes or disruptions do not affect the physical integrity of
\nthe system or endanger human lives or essential services. The key is for organizations to adopt a
\npreventative mindset, always prioritizing security over any other objective.<\/p>\n
Principle 2: Knowing the business is fundamental
\nThis principle underscores the importance for organizations to have a thorough understanding of the
\noperational processes and systems that support their critical services. The premise is that, in order
\nto adequately protect operational technology (OT), it is imperative to understand both the essential
\nbusiness needs and the specific characteristics of the systems that enable its operation.
\nKey Aspects
\n\u25cf Identification of vital systems: Organizations must determine which are the essential systems
\nthat enable the continuity of critical services. This includes identifying which parts of the
\noperational process are indispensable for the production and supply of critical services such
\nas energy, water or transportation.
\n\u25cf Understanding the OT process: It is essential to understand each part of the process
\ncontrolled by OT systems, ensuring that dependencies and critical points can be identified.
\nThe designed architecture must enable the defense of these vital systems against threats,
\nboth internal and external.
\n\u25cf Integration of cybersecurity into planning: Teams responsible for designing, operating and
\nmaintaining OT systems must be aligned with the business context. This includes
\nunderstanding how physical processes connected to the OT environment bring value to the
\nbusiness and how disruptions can impact service to users.
\n\u25cf Connections and dependencies: Organizations need to know how OT systems interface with
\nother systems and what dependencies exist. This is vital for assessing risks and establishing
\neffective controls.
\n\u25cf Continuity and crisis management plans: The creation of incident response, business
\ncontinuity and crisis management plans should include the participation of both process
\nengineering and cybersecurity experts. In addition, these plans should be continually
\nexercised, reviewed and updated to ensure their effectiveness.
\nExamples and Considerations
\n\u25cf Top-Down vs. Bottom-Up: The "top-down" approach has led to separate OT and IT
\nnetworks, but the "bottom-up" perspective allows identifying the minimum elements
\nnecessary for the operation of critical processes. For example, to generate electricity, you
\nmay only need a generator, a controller and an adequate fuel supply.<\/p>\n
\u25cf Third-party information packs: When involving third parties in the management of OT
\nsystems, it is essential to provide clear documentation that includes contacts, permitted
\ntools, and procedures to ensure effective collaboration without compromising security.
\n\u25cf Visual signals and physical controls: Identifying and physically marking authorized devices in
\nthe OT environment helps reduce the risk of unauthorized interference and enables quick
\ndecision making in case of security events.
\nThis principle emphasizes that understanding the business is crucial not only for implementing
\neffective cybersecurity measures, but also for prioritizing recovery during incidents. It also fosters
\nseamless collaboration between operations and cybersecurity teams, ensuring that the approach to
\ncybersecurity is aligned with business needs and the operational context.<\/p>\n
Principle 3: OT data are extremely valuable and
\nmust be protected
\nFrom an adversary's perspective, knowledge about the configuration of an OT (Operational
\nTechnology) system is highly valuable, as OT environments tend to remain stable and unchanged
\nfrequently. This stability allows malicious actors to develop specific and sophisticated malware to
\nattack such systems with precision.
\nCritical data types in OT:
\n\u25cf Engineering configuration data: This includes network diagrams, sequences of operation,
\nlogical schematics and configuration data such as device addresses. This data does not
\nchange frequently and can be relevant for decades, facilitating the preparation of targeted
\nattacks.
\n\u25cf Ephemeral data: Such as voltage or pressure levels, which provide real-time information on
\nthe status of processes and can reveal details about internal or customer operations.
\n\u25cf Intellectual Property (IP) and Personal Data (PII): Data about customers or processes, such
\nas patient records in healthcare or metering data in the energy or water sectors, require
\nprotection just as much as configuration data.
\nImplications and protection strategies:<\/p>\n
\u25cf Control storage: Organizations must define where and how OT data is stored to avoid
\nexposure. Although OT networks are often segmented, critical data is often stored on
\ncorporate IT systems, which increases exposure.
\n\u25cf Minimize data distribution: Internal processes should avoid unnecessary propagation of OT
\ndata between different systems to reduce risks.
\n\u25cf Detect unauthorized access: Implement tools such as canary tokens that alert if OT data is
\naccessed or extracted in an unauthorized manner.<\/p>\n
Key questions for OT data protection
\n\u25cf Do suppliers or consultants have copies of critical data?
\n\u25cf Is OT information stored in corporate systems or external clouds?
\n\u25cf Are controls in place to prevent security systems, such as EDRs, from leaking OT data out of
\nthe environment?
\n\u25cf Is there a clear process for data destruction when decommissioning OT equipment?
\nThis principle highlights the need to alert and monitor access to OT data, as lack of control can
\nfacilitate sophisticated attacks and the manipulation of critical systems. Therefore, a sound
\ncybersecurity strategy must include controls over data flow and storage, as well as measures to
\ndetect and respond to potential breaches.<\/p>\n
Principle 4: Segment and segregate OT networks
\nfrom all other networks
\nThis principle highlights the importance of segmentation and segregation in environments to protect
\nagainst cyber threats and minimize the risks of compromise. The principle is based on the idea that
\nOT networks should be kept separate not only from corporate IT networks, but also from any other
\nnetworks that may introduce additional risks.
\nImportance of segmentation and segregation
\n\u25cf Risk reduction: OT networks are more critical than IT networks because they control
\nessential physical processes (e.g. electricity, water and transportation). These networks
\nshould not be directly connected to IT networks, which tend to be more vulnerable because
\nof their exposure to the Internet and services such as email or web browsing.<\/p>\n
\u25cf Security between OT and other networks: It is essential to protect not only the
\ncommunication between OT and IT networks, but also the connections between different OT
\nnetworks of third parties (such as suppliers, customers or partners). These connections can
\nbecome an attack vector if not properly managed.
\nExamples and implications of the principle
\n\u25cf Security in connections between OT and third parties: Connections to OT networks of
\nother players, such as energy providers or transmission companies, can open security gaps
\nif not properly managed.
\n\u25cf Physical and logical separation: It is recommended that critical functions be separated
\nphysically and logically, to ensure that even if a less critical network is compromised, the
\nmore critical networks remain protected.
\n\u25cf Security in systems administration: Administrative accounts and systems must be properly
\nsegregated. For example, critical OT systems should not rely on services administered from
\nIT networks with lower levels of security, as compromising these accounts could put the OT
\nnetwork at risk.
\n\u25cf Privilege escalation risks: An attacker accessing the IT network could escalate privileges
\nand compromise the firewall or OT network control devices if these infrastructures are not
\nadequately separated.
\nThis principle emphasizes that any existing connection in an OT network must be considered a
\npotential point of vulnerability and treated with the highest level of security. Segmentation should not
\nonly apply between OT and IT, but also between different zones within OT, according to their levels
\nof criticality. In addition, organizations should continuously evaluate administrative configurations to
\nensure that the management of OT networks does not rely on less secure external systems.<\/p>\n
Principle 5: The supply chain must be secure
\nSupply chain security has been a focus of attention for several years, and many previous
\npublications have already covered this area. However, in operational technology (OT) environments,
\nthis principle highlights some additional specific considerations, as it is not sufficient to apply generic
\ncontrols.<\/p>\n
Examples and considerations:
\n\u25cf Changing the perspective on supplier risk: Traditionally, only large or operationally critical
\nsuppliers were rigorously evaluated. However, from a cybersecurity perspective, the size or<\/p>\n
importance of the vendor is not determinative. A seemingly minor device or service can open
\ncritical doors for attackers if it is not secure.
\n\u25cf Exposure in open OT environments: In OT systems, critical control messages are often
\nsent unencrypted, via multicast or broadcast messages that any device on the network can
\nreceive and interpret. This makes any component in the environment – such as printers,
\nrouters, or engineers' workstations – a potential access point for threats.
\n\u25cf Know the origin and path of devices: It is essential to track the origin and previous use of
\ndevices connected to the OT network, including consultant or vendor laptops. These may
\nhave previously connected to less secure networks, introducing a potential risk when
\ntransferred to the OT environment.
\n\u25cf Evaluate hidden capabilities of devices: Not only is it important what devices can do in their
\ncurrent configuration, but also what they could do if their firmware or configuration is altered.
\nIf vendors have remote access to perform updates, organizations should ensure that the
\nfirmware is cryptographically signed and its integrity verified prior to installation.
\n\u25cf Rigorous evaluation of vendor behavior: Organizations should consider vendor practices that
\nrequire exceptions to security policies as negative indicators. For example, if a vendor
\nrequests direct connections from the OT network to the Internet for support or firmware
\nupgrades, the vendor's suitability should be questioned and more secure alternatives should
\nbe sought.
\n\u25cf Traffic control and security analysis: A good control consists of connecting a device to the
\nnetwork while capturing the traffic with a packet analyzer to verify that they are not
\ncommunicating without authorization with remote addresses.
\nSupply chain security is critical because interconnections and dependencies between multiple
\ndevices and systems increase exposure to cyber-attacks. A single compromised or mismanaged
\ndevice can represent a significant vulnerability for the entire OT infrastructure. Therefore, this
\nprinciple calls for maintaining tight control over all elements of the supply chain, ensuring that every
\ncomponent that interacts with critical infrastructure meets the highest security standards.<\/p>\n
Principle 6: People are essential to cybersecurity OT
\nThis principle emphasizes that cyber security in operational technology (OT) cannot be achieved
\nwithout the active and skilled participation of people. Technical tools and processes alone are not
\nsufficient to prevent or detect incidents. Effective incident response depends on people with the right
\ntraining, skills and knowledge to handle these challenges.<\/p>\n
Importance of security-based cybersecurity culture.<\/p>\n
\u25cf It highlights the need to build a strong cybersecurity culture, focused on physical and digital
\nsecurity. The organization must consider cybersecurity principles as an essential aspect of
\nworkplace safety, not only as a technological obligation.
\n\u25cf Field technicians and other operatives are the first line of defense and play a crucial role in
\ndetecting suspicious behavior. Although these employees are not typically cybersecurity
\nexperts, their working knowledge of the OT environment enables them to identify anomalies
\nthat could indicate cyber incidents.<\/p>\n
Key challenges and strategies
\n\u25cf Diversified training: A cross-functional team is needed, consisting of cybersecurity experts,
\ncontrol engineers, operations personnel and asset managers. All of these roles must align on
\ncore OT principles, even if they come from different cultures and priorities.
\n\u25cf Cultural change: For personnel without engineering or critical infrastructure experience, it
\ncan be a challenge to adopt a "safety first" approach. The organization must foster a shared
\nunderstanding among all areas involved.
\n\u25cf Fearless reporting: It is essential to empower operatives to report possible incidents without
\nfear of reprisal or ridicule. There must be clear procedures for observations to be assessed
\nand handled in a timely manner.<\/p>\n
Development of cybersecurity awareness and culture
\n\u25cf Include cybersecurity in key processes: Cybersecurity should be integrated into security
\nassessments, acceptance testing (FAT\/SAT), and engineering change management.
\nMethods such as Cyber-Informed Engineering help strengthen this integration.
\n\u25cf Avoidance of risky behavior: A prime example is remote maintenance without informing on-
\nsite personnel, which can cause operators to ignore abnormal behavior as normal. This
\ndemonstrates the need for transparency in operations.
\n\u25cf Incident reassessment: Operators should be trained to consider the possibility of cyber
\ncompromise in operational problems. Historically, these problems have been attributed only
\nto technical failures, which can result in the loss of key evidence for cyber investigations.
\nThis principle emphasizes that the combination of technology, processes and people is essential to
\nmaintain security in OT environments. Active engagement and preparedness of personnel, along
\nwith a security-focused organizational culture, are fundamental to cyber resilience in critical
\ninfrastructures.<\/p>\n
Conclusion
\nThe approach presented is not limited to establishing technical controls, but promotes a holistic
\nintegration of cybersecurity across all dimensions of the OT environment: processes, people and
\ntechnology. The principles highlight the importance of aligning risk management with physical and
\noperational security, thus ensuring complete resilience. Collaboration between technical and
\noperational experts, along with efficient vendor and data management, is critical to maintaining the
\nintegrity of critical infrastructures.
\nFinally, the adoption of these principles requires not only technological resources, but also a deep
\norganizational commitment that fosters a cybersecurity culture based on security, collaboration and
\ntransparency. With this framework, organizations will be able to meet current and future challenges
\nefficiently, ensuring the continuity of essential services and the protection of their most valuable
\nassets.<\/p>\n","protected":false},"excerpt":{"rendered":"
The National Security Agency (NSA) has partnered with cybersecurity agencies in Australia, Canada, Germany, Japan, the Netherlands, New Zealand, South Korea and the United Kingdom to launch a guide that presents six fundamental principles. These principles are intended to assist in the creation and maintenance of a secure and critical environment for operational technology (OT) […]<\/p>\n","protected":false},"author":5,"featured_media":6681,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_wpcom_ai_launchpad_first_post":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[259],"tags":[],"class_list":["post-6689","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technical-en"],"yoast_head":"\n