Industry executives and experts share their predictions for 2023. Read them in this 15th annual VMblog.com series exclusive.
Critical Infrastructure Protection (CIP) Cybersecurity 2022 Review & 2023 Predictions
By Christopher Warner, MBA, Senior Security Consultant at GuidePoint Security
Legislation and Rulemaking
The Strengthening American Cybersecurity Act of 2022 requires the Critical Infrastructure (CI) sector to report both covered cyber incidents and ransomware payments to the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Critical Infrastructure (CI) entities that make a ransom payment as a result of a ransomware attack must report the payment to CISA within 24 hours of making the ransom payment. The CI entities include critical manufacturing, transportation and railroad, financial institutions, energy and utilities, oil and gas, communications, defense industrial base, and food and agriculture.
CPGs and other Standards
The Cybersecurity Performance Goals (CPGs) are intended to provide organizations with a priority for risk reduction which can be considered a subset of IT and OT cybersecurity practices such as the NIST CSF. The CPGs address both IT and OT and should help the much needed collaboration between IT and OT security.
Ransomware Attacks
In 2022, ransomware cyberattacks have gained notoriety in the news media. The frequency of ransomware attacks will not abate, as the types of ransomware attacks, such as manipulating data, will continue to evolve. In 2023, ransomware attack vectors are likely to target data integrity rather than encrypting it. This type of attack can be performed faster than a typical ransomware attack which performs full disk encryption. Even if an attack victim organization pays the demanded ransom, their data could be corrupted, possibly requiring the victim to return to the attacker and pay additional ransom. Data integrity is extremely important on OT/ICS/SCADA systems.
Backing up all OT/ICS and IT/Business data is critical as firms face ransomware attacks which will challenge organizations with limited skilled cybersecurity professionals. OT and IT cybersecurity disciplines differ in the solutions they can provide, where most IT cybersecurity teams include Governance, Risk and Compliance (GRC), Security Operation Centers (SOCs), and Network Security groups.
Solutions
It is essential to understand where an organization stands with its security posture as an enterprise. A security assessment or maturity assessment should be performed annually using the CPGs as a starting point and prioritize identified risks. This will position an organization to be able to move to sector-specific frameworks such as the NIST CSF, IEC 62443, and CMMC. using a unified view of risk from IT, OT and the business to justify security budgets.
The Board and C-suite should use incentives for the IT and OT departments to work together, creating security working groups for both IT and OT and identify security champions and conduct security training for IT and OT personnel. Organizations can implement cyber threat identification, detection, and prevention controls by taking steps to increase visibility into OT devices, implementing micro-segmentation enclaves, safe-restart zones, and correlating security information from IT and OT networks into Security Operations Centers (SOCs).
##
ABOUT THE AUTHOR
Mr. Warner has over 25 years of experience in Operational Technology (OT) and Industrial Control Systems (ICS) focused on Safety, Security, Governance, Risk, and Compliance (GRC). He has significant experience in Oil and Gas, Energy and Utilities, Nuclear Power, Critical and Advanced Manufacturing, Healthcare, Resort and Casino (“Gaming”), Critical Communication Infrastructure, and Federal Agencies.
Mr. Warner has earned a Master of Business Administration (MBA), a Master of Arts in Organizational Management, a Bachelor of Science in Business Management, and an Associate in Avionics Engineering.
