CISA and ACSC Release Guidance for Isolating Critical Infrastructure OT Systems During Attacks

New Guidance for Critical Infrastructure

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Cyber Security Centre (ACSC) have published new guidance titled "CI Fortify – Advice for isolating vital systems." This document provides recommendations for critical infrastructure organizations on how to prepare for and execute the isolation of vital operational technology (OT) systems during cyberattacks or other major disruptions.

The guidance was developed in collaboration with the FBI and other international partners. Its primary goal is to help organizations maintain essential services by disconnecting critical OT and associated systems from corporate, internet-facing, and other less-trusted networks.

Understanding Operational Technology

Operational technology encompasses hardware and software used to monitor or control processes in various critical sectors. This includes systems for water treatment, electrical grids, manufacturing machinery, transportation networks, and telecommunications infrastructure.

The guidance emphasizes the importance of being able to operate these systems in isolation for extended periods to ensure continuity of critical services even when other networks are compromised.

Addressing Persistent Threats

The agencies highlight that state-sponsored threat actors routinely target critical infrastructure. These attacks often aim for espionage or to establish access that could be used for disruptive or destructive actions during a crisis or military conflict.

By isolating vital OT systems, organizations can disrupt malicious actors' ability to achieve their objectives, contain active incidents, and safely rebuild compromised systems.

Steps for Preparedness

The guidance advises critical infrastructure organizations to begin by identifying all systems and networks that support their critical services, as well as the customers dependent on this infrastructure. This foundational step is crucial for developing an effective isolation strategy.

The document is designed to assist OT owners, operators, and cybersecurity teams in improving their overall preparedness, response capabilities, and recovery processes in the face of cyber threats.