This cyber security advice is for critical infrastructure providers who are deploying business continuity plans for Operational Technology Environments (OTE)/Industrial Control Systems (ICS) during the COVID-19 pandemic.
This guidance is specifically for people working in an OTE. For general COVID-19 contingency planning advice, see Cyber security is essential when preparing for COVID-19.
For COVID-19 cyber security threats, see Threat Update: COVID-19 Malicious Cyber Activity.
Many critical infrastructure providers are moving to remote working arrangements in line with social distancing guidelines.
Modifying cyber security defences to the OTE is not a decision you should take lightly. Physical worksites such as control rooms and operations floors provide inherent security benefits by restricting physical and cyber access to the OTE. Corporate information technology provides an additional defensive layer.
An increase in remote working significantly increases opportunities for adversaries to gain unauthorised access to systems and may cause real world physical harm. Critical infrastructure providers need to balance the risks and opportunities of moving staff offsite and document those considerations for senior managers to make informed risk-based decisions on sustaining business continuity.
Consider this guidance along with your established change management policies and procedures.
Minimise trust in endpoints that connect to your remote access solution, such as home networks and devices. The more your solution trusts the endpoint, the more controls you will need to mitigate those risks. Ideally, you should supply and configure a work laptop and network connection (such as separate mobile wireless hotspots) to remote workers to connect to the OTE. This circumvents the need to use home computing and networks all together.
If your organisation does supply mobile communications, a mobile hotspot is preferable to a device that requires additional drivers, like USB dongles. Ensure all communications are encrypted and that Virtual Private Network split tunnelling is disabled. Insist that remote workers avoid activities like web browsing on devices that access the OTE.
Encourage remote workers to improve their home cyber security. However, as you have little control over endpoints, it is reasonable practice to assume that endpoints are compromised, and user credentials can be stolen. Take steps to minimise the impact and harm that compromised credentials can cause:
Ensure that remote workers lock remote sessions when not in use, and do not share devices with other members of their household. If other members of the household can see work screens, it may be a breach of organisational policy and the Privacy Act 1988. Confirm that remote workers have a private physical space for working with sensitive information.
Given the assumption that your OTE personnel have technical knowledge, suggest they use an isolated Virtual Local Area Network if the home network has such capability. For example, most home networks have a ‘guest wireless network’ which is often left unused. This Virtual Local Area Network can be used to segregate devices from the rest of the household’s internet traffic.
On the corporate side, prioritise remote access system patches. An adversary will attempt to compromise your system as soon as they discover a vulnerability. Prepare for an increase in malicious email and Denial of Service attacks and consider restricting geolocations or source Internet Protocol addresses, noting that this would have a limited effectiveness against a persistent adversary.
Implement remote vulnerability scanning to know which essential services may be exposed to adversaries. Centralise and monitor remote access logs for anomalies, preferably in real time.
Finally, keep records of all changes for when business-as-usual operations resume, particularly changes to remote access services. Follow the remote access advice in the Australian Government Information Security Manual (ISM) and brief key employees of the additional risks inherent in implementing remote access arrangements.
Consider whether alternate physical sites (like control rooms) would provide sufficient business continuity before permitting remote access working arrangements. A secondary (or tertiary) control room with dedicated communication links to the OTE may offer better (cyber and physical) security.
OTE, telecommunications and cyber security specialists are a scarce resource, so ensure your organisation has a human resource plan to manage the increase in workload. Seconding additional personnel during the COVID-19 pandemic may be a practical measure to manage the increased workload.
OTE personnel may have to compete with corporate personnel for network bandwidth when accessing the OTE. In this case, attempts to gain OTE access may receive a denial of service during a critical time, such as when people’s safety is at risk. Ideally, OTE personnel requiring access to the OTE should have a separate logical path than corporate personnel who need access to the corporate environment. If a dedicated path is unavailable, prioritise the remote access sessions OTE personnel will use.
Document all proposed changes and develop a run-sheet to record both planned and unplanned configuration changes, deployment, and rollback decision points.
Backup your device configurations before making changes to interfaces between corporate and the OTE to ensure you can return to business-as-usual operations.
Actively maintain a detailed logical diagram of the network while the business continuity plan is in effect. This allows clear understanding of all remote access pathways and easy removal of paths added to temporarily supplement access to the OTE during business continuity.
Develop a rapid disconnection plan for 24-hour deployment, disconnecting remote access if malicious activity is identified. Incorporate your rapid disconnection plan into incident response planning, and capture communications channels, reporting requirements, and physical and/or logical isolation of the OTE.
Maintain vision of vulnerability alerts and advisories affecting OTE/ICS. Patch vulnerable systems where possible.
Establish and routinely test formal lines of communication between teams (such as between the change management team, Cyber Security Operation Centre, and the real-time control room) to ensure the resilience of your communications pathways.
You should configure a minimum of two jumps for remote access to an OTE.
Preferably, the first jump should be from a device supplied and controlled by your organisation, with a Virtual Private Network connection. If using personal devices, use corporate Virtual Desktop Infrastructure.
The jump should go to a jump host in a demilitarised zone outside the OTE.
The second jump then moves to the second jump host within the OTE.
Each remote worker should have a unique account, strong passphrase and individual MFA for each jump. This means it will take a minimum of two unique account names, two unique passphrases and two MFA tokens to reach the OTE:
For more information see: Essential Eight Explained, Essential Eight in Linux Environments, Guidelines for System Hardening and Guidelines for System Management within the ISM, and Fundamentals of Cross Domain Solutions.
Increase automated monitoring and auditing of account logins, login failures, deviations from baseline traffic and anomalous network access.
Produce daily reports that identify abnormal logins (behaviour that is unusual – for example someone who is not on a nightshift logs in at midnight). Ensure you have the audit trail you need to support incident response and protective monitoring.
Automate potentially hostile abnormalities with priority notifications (such as an email or SMS) to your security operations team. Limit notification fatigue by restricting numbers to only those that require urgent investigation, and write targeted, specific and context-appropriate messages.
Consider full packet capture on key data choke points both inside the OTE and at the boundary. As the OTE network traffic is often unencrypted, it is difficult for an adversary to remain hidden in a full packet capture.
Engage an independent party to ‘blue-team’ your remote access solution. Given the possible impact on physical systems, any penetration testing will typically stop at the OTE boundary.
When you return to business-as-usual operations, remove measures that temporarily increased risks.
As you revert your network to a known secure state, update your baseline documentation and incorporate any changes that enhanced your cyber security.
The Australian Government Information Security Manual (ISM) assists in the protection of information that is processed, stored or communicated by organisations’ systems.
The Strategies to Mitigate Cyber Security Incidents complements the advice in the ISM.
For further information on this topic, see the following publications:
Importance of Efficient Access Controls that every Organisation in Singapore should take note of. Enhancing…
Prioritizing Security Measures When Launching a Webpage That Every Organisation in Singapore should take note…
Importance of Regularly Changing Passwords for Enhance Online Security that every Organisation in Singapore should…
Comprehensive Approach to Data Protection and Operational Integrity that every Organsiation in Singapore should know…
Here's the importance of Pre-Launch Testing in IT Systems Implementation for Organisations in Singapore. The…
Understanding Liability in IT Vendor Relationships that every Organisation in Singapore should look at. Understanding…
This website uses cookies.
