The Cybersecurity and Infrastructure Security Agency (CISA) has recognized that Industrial Control Systems (ICS) and Operational Technology (OT) environments represent one of the largest threats to American critical infrastructure. The increasing convergence of IT and OT systems, combined with the rise of ransomware attacks targeting critical infrastructure and the growing sophistication of nation-state threats, has created unprecedented security challenges. 

As federal agencies face these evolving cyber threats, Keeper Security's Privileged Access Management (KeeperPAM) solution delivers robust protection through its FedRAMP Authorized zero-trust platform. By implementing end-to-end encryption using FIPS 140-3 validated modules and advanced cryptographic protocols, KeeperPAM ensures that access to critical systems remains secure while maintaining operational efficiency. This multilayered security approach not only fulfills CISA's stringent requirements for critical infrastructure protection, but also provides federal agencies with the tools they need to defend against emerging cyber threats targeting ICS.

Supporting CISA's goal 1: cross-sector cybersecurity performance

KeeperPAM helps organizations implement CISA's Cross-Sector Cybersecurity Performance Goals (CPGs) through:

• FedRAMP Authorized zero-trust architecture that spans both IT and OT environments
• Comprehensive secrets management for securing critical access credentials
• Advanced encryption protocols that meet federal security standards

Advancing CISA's goal 2: ICS workforce enhancement

KeeperPAM supports ICS workforce development and security through:

• Intuitive interface that reduces training requirements
• Role-Based Access Control (RBAC) to align with organizational structures
• Comprehensive audit trails that support skill development and oversight

Meeting CISA's goal 3: Threat detection and response

KeeperPAM enables collaborative threat response through:

• Real-time session monitoring and threat detection
• Secure remote access capabilities for rapid incident response
• Comprehensive audit trails for threat analysis

Zero-trust security architecture: Protecting ICS

In today's evolving threat landscape, securing ICS requires a modern approach that leaves nothing to chance. A robust zero-trust security architecture serves as the foundation for protecting critical infrastructure from increasingly sophisticated cyber threats.

Advanced encryption and authentication

At the core of this security framework is a FedRAMP Authorized platform that implements comprehensive end-to-end encryption. By utilizing FIPS 140-3 validated cryptographic modules and elliptic curve cryptography, the system ensures that all communications between users and ICS components remain secure and tamper-proof.

Strict access controls

The platform enforces a "never trust, always verify" approach, where:

• Every user must authenticate before accessing any critical infrastructure component
• Each device requires validation before establishing connections
• All sensitive data stored in the vault is protected using AES-256 GCM encryption

This multilayered security approach helps federal agencies maintain complete control over their ICS environments while meeting CISA's stringent requirements for critical infrastructure protection. By implementing these controls, organizations can significantly reduce their attack surface and minimize the risk of unauthorized access to sensitive industrial systems without costly greenfield modernization.

Privileged session management and monitoring: Securing access to critical infrastructure

Maintaining strict oversight of privileged access is paramount to national security concerns for ICS. A robust privileged session management framework serves as a critical defense against unauthorized access and potential cyber threats.

Comprehensive session monitoring

KeeperPAM's privileged session management capabilities provide end-to-end visibility into all privileged access activities across ICS environments. Every session is meticulously tracked and optionally recorded, with audit trails protected by military-grade FIPS 140-3 encryption. This ensures that sensitive operational data remains secure while maintaining complete transparency for security teams and auditors.

Time-based access control

The platform implements a sophisticated time-limited access model, where:

• Privileged users receive Just-in-Time (JIT) access to critical systems
• Access credentials remain securely encrypted and never exposed
• Secure connections are established through Keeper Gateway services using encrypted tunnels

Advanced auditing capabilities

To support compliance requirements and security investigations, KeeperPAM offers:

• Full session recording with screen capture functionality
• Detailed keyboard interaction logging
• Encrypted storage of all session recordings
• Comprehensive playback capabilities for audit review

This multilayered approach to session management helps federal agencies and industry maintain complete control over their ICS environments while meeting CISA's requirements for critical infrastructure protection. By implementing these controls, organizations can significantly reduce their attack surface and maintain detailed accountability for all privileged access to industrial systems.

Secure remote access: Zero-trust protection for critical infrastructure

Secure remote access to Supervisory Control and Data Acquisition (SCADA) systems and ICS components is crucial to defending against nation-state actors and other advanced threats. Legacy security solutions have failed to adequately secure the ICS environment while simultaneously hindering user productivity. Modern security solutions must provide robust protection that accelerate operational efficiency.

Advanced encrypted tunneling

KeeperPAM implements a sophisticated encrypted tunneling architecture that enables secure remote connections without traditional Virtual Private Network (VPN) dependencies. This approach provides:

• Direct, encrypted access to critical infrastructure systems
• Reduced attack surface by eliminating VPN vulnerabilities
• Streamlined access for authorized personnel

Military-grade encryption

The platform leverages advanced cryptographic protocols to ensure maximum security:

• WebRTC connections protected by ECDH symmetric keys
• Keys securely stored within encrypted Keeper records
• End-to-end encryption for all remote sessions

Comprehensive data protection

To prevent unauthorized data exposure, KeeperPAM enforces strict policy controls:

• Granular restrictions on file downloads
• Controls over clipboard operations (copy/paste)
• Print function limitations for sensitive content
• Session monitoring and recording capabilities

This multilayered approach to secure remote access helps federal agencies maintain complete control over their ICS environments while meeting CISA's stringent requirements for critical infrastructure protection. By implementing these controls, organizations can significantly reduce their attack surface while ensuring that authorized personnel maintain efficient access to essential systems.

Advanced authentication controls: Modernizing ICS access security

In today's threat landscape, robust authentication is crucial for protecting ICS from unauthorized access. Modern authentication controls must adapt to both new and legacy systems while maintaining the highest security standards.

Universal Multi-Factor Authentication (MFA)

KeeperPAM implements comprehensive MFA protection across the entire ICS environment:

• Enforces strong authentication even on legacy systems that lack built-in MFA capabilities
• Provides consistent security controls across both modern and traditional industrial systems
• Creates a unified authentication layer that meets federal security requirements

Advanced authentication methods

The platform supports multiple modern authentication technologies:

• FIDO2 WebAuthn hardware security keys for physical authentication
• Biometric verification, including fingerprint and facial recognition
• Various authenticator applications for flexible, yet secure access

Federal integration and zero-knowledge security

KeeperPAM maintains security while enabling seamless integration:

• Connects with existing federal identity providers
• Preserves zero-knowledge architecture throughout the authentication process
• Ensures credentials never leave the encrypted environment

This comprehensive approach to authentication helps federal agencies maintain complete control over their ICS environments while integrating with their existing systems. This approach allows for the shortest time to protection in the industry. By implementing these advanced controls, organizations can significantly reduce their risk of unauthorized access to critical systems.

Compliance and audit support: Meeting federal security standards

In today's highly regulated environment, maintaining compliance while securing industrial control systems is paramount. KeeperPAM provides robust compliance and audit capabilities that meet the stringent requirements of federal agencies and critical infrastructure operators.

Comprehensive federal authorization

KeeperPAM maintains the highest levels of federal security compliance:

• FedRAMP Moderate authorization for secure federal deployments
• StateRAMP certification for state and local government use
• Full alignment with NIST 800-53 security controls

Advanced audit capabilities

The platform delivers extensive auditing features that help organizations maintain complete visibility:

• Encrypted session recordings for all privileged access
• Comprehensive audit trails of all user activities
• Secure storage of audit data using FIPS 140-3 encryption

Automated compliance controls

KeeperPAM streamlines compliance management through:

• RBAC for granular permission management
• Automated policy enforcement across all users and systems
• Detailed compliance reporting for audit requirements

This multilayered approach to compliance and auditing helps federal agencies, contractors, critical infrastructure, etc. maintain complete control over their ICS environments while meeting CISA's requirements for critical infrastructure protection. By implementing these controls, organizations can significantly reduce their audit complexity while maintaining detailed accountability for all privileged access to industrial systems.

Secrets management for ICS/OT systems: Securing critical infrastructure access

In ICS and OT environments, protecting sensitive credentials and access keys is paramount to maintaining critical infrastructure security. Modern adversaries use this attack path to gain access to sensitive systems and move laterally - establishing command-and-control environments and providing a platform for re-entering the environment after being discovered.

Advanced secrets protection

KeeperPAM implements comprehensive secrets management capabilities that safeguard critical access credentials:

• Automated rotation of sensitive credentials and API keys
• Secure certificate management for OT environments
• Protection of machine-to-machine authentication tokens

Zero-knowledge security architecture

The platform employs a sophisticated zero-knowledge encryption model:

• All secrets are encrypted before leaving the client device
• Credentials are never stored or transmitted in plaintext
• Advanced encryption protects all stored secrets

Secure collaboration features

KeeperPAM enables safe credential sharing while maintaining security:

• RBAC for credential distribution
• Complete audit trails of all credential access and usage
• Encrypted sharing between authorized team members

This approach to secrets management helps federal agencies maintain complete control over their ICS environments. By implementing these controls, organizations can significantly reduce their risk of credential compromise while improving the user experience.

Book a demo today to see how KeeperPAM can help secure your agency's critical infrastructure.

##

ABOUT THE AUTHOR

 

James Scobey, CISO, Keeper Security

James Scobey is the Chief Information Security Officer (CISO) of Keeper Security, Inc. He previously worked at the US Securities and Exchange Commission (SEC) as a Chief Information Security Officer. Prior to his position as CISO at the SEC, Scobey served as President and Chief Executive Officer (CEO) of SigmaCyber, Chief Technology Officer (CTO) and Assistant Director of Cybersecurity Operations at the SEC, as well as Principal Systems Engineer and Cyber Performance Systems Engineer at the federally funded research and development organization MITRE. Scobey has also served in leadership and engineering roles at S2i2, Federal Data Systems, USmax Corporation, By Light Professional IT Services and SMS Data Products Group.