Most IT operators understand that critical infrastructure should be isolated in crisis situations, but many don’t know how to do it in a way that maximizes security and minimizes disruption.
Now, several global agencies are offering a step-by-step action plan, . Also this week, Minnesota Water Utilities’ OT services were disrupted in a processes will help in this area.
Once systems have been classified, the next step is to map, and continuously update, interconnection points between those critical networks and other systems, the guide advises. Some connections to take into account include those to vendors with remote access, such as consultants, contractors, or managed service providers; those to cloud environments, including private cloud; to untrusted networks; and to peer-critical networks like utilities or dispatch.
It’s also important to identify connections that might lower trust or increase network vulnerability, such as those to carrier-provided networks, or Wi-Fi, satellite, radio point-to-point, or mobile connections. Operators should identify any protection mechanisms, like encryption, that may be in place in these areas, according to the agencies.
Further, operators should understand the business context of each connection, including the type of information that flows through it and how critical it is to operations and to the system owner or third-party provider. Technical information around these interconnections should also be documented, for instance, internet gateway information, architectural diagrams, firewall, router, and virtual private network (VPN) configurations, as well as emergency contact details.
“This critical technical information will be necessary for building isolation controls,” the guide notes.
Establishing separation and isolation points
The assumption is that zero-trust networks reduce the need for isolation because devices are designed to inherently distrust one another. But the guide emphasizes that isolation points between networks and services are necessary and “highly effective” at .
SOCIAL SHARE CARD GENERATOR