The Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the U.S. Departments of War, Energy, State, and the Federal Bureau of Investigation, have published a guide to applying Zero Trust principals to operational technology systems within organizations.
The guide, Adapting Zero Trust Principals to Operational Technology, gives OT owners and operators practical insights on overcoming unique constraints and potential challenges with integration of Zero Trust into OT environments.
“CISA has observed threat actors like Volt Typhoon targeting OT systems to compromise, escalate, and maintain access within operational environments. Zero Trust architecture is critical to preventing cyber incidents that could cause operators to lose visibility or control of essential systems,” CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said. “This guide equips organizations to methodically navigate the complexities of adopting Zero Trust principles in OT environments. Together with our partners, CISA urges OT owners, operators, and integrators to use this resource to make informed decisions that reduce exposure and strengthen resilience—without jeopardizing mission-critical operations.”
New attack vectors, expanded attack surfaces and magnified cybersecurity risks are growing because OT systems are increasingly interconnected, digitally monitored and remotely operated. Officials said improperly secured pathways can create opportunities for threat actors. Adapting and applying Zero Trust principles to fit the operational realities of the OT environment helps to close those risk gaps, however, it must be done carefully, officials said. The guide helps navigate those Zero Trust strategies.
“The Department of War is driving Zero Trust for operational technology at an accelerated pace,” Kirsten A. Davies, DoW Chief Information Officer, said. “In lockstep with our federal and industry partners, we are fortifying the infrastructure and interconnected weapon systems our Warfighters demand to fight and win. This is how we deliver peace through technical strength.”