GAO Reports – Week of 3-2-24 – CISA and OT Cybersecurity

This week the Government Accountability Office (GAO) published a report on “Cybersecurity: Improvements Needed in Addressing Risks to Operational Technology”. This report outlines actions taken by CISA to support critical infrastructure organizations and sector risk management agencies in securing operational technology.

The 70-page report concludes by making four recommendations for CISA:

• Measure customer service for its OT products and services,

• Perform effective workforce planning for OT staff,

• Issue guidance to the sector risk management agencies on how to update their plans for coordinating on critical infrastructure issues, and

• Develop a policy on agreements with sector risk management agencies with respect to collaboration.

Review - CISA-NSA Publish OT Security Alert – 9-22-22

Today CISA and the NSA jointly released a Cybersecurity Advisory on Control System Defense. The document [labeled Alert (AA22-265A)] provides an overview (with footnotes) of how adversaries plan and carry out cyberattacks on industrial control systems and then outlines steps that owner/operators can take to prevent, or at least mitigate, such attacks.

Commentary

There is a great deal of valuable information in this document, but it is mostly derivative. That is adequately documented in the 16 footnotes. Given the scope of the topics being covered, the 12-page document is only able to hit the high-points of the discussion. This is fine if an organization has an inhouse process control engineering team, they will be able to digest the provided information and apply it to their unique control system needs.

This document will be less helpful to smaller organizations that have had to rely on contract integrators for the installation and maintenance of their control systems. Unless those earlier contracts included cybersecurity support, many of these smaller system owners are going to find it difficult to find the necessary support to add the discussed mitigation measures to existing systems. And the add-ons are likely to be expensive if qualified personnel can be found.

What is seriously missing from this discussion about what to do when the attack occurs. Smaller organizations may have an advantage if they can continue limited operations in the manual mode. This would allow them continue operations while they work through the process of restoring operations from backups. Interestingly, this is another topic that is strangely missing from the discussion in the CISA/NSA alert. This is a primary response tool for ransomware attacks, arguably the most common cyberattack seen by most organizations.

For a more detailed look at the CISA-NSA alert, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/cisa-nsa-publish-ot-security-alert - subscription required.