IT & OT Cybersecurity Strategy

Table of Contents

• IT & OT Cybersecurity Strategy

  • Background

  • IT & OT/IOT Cybersecurity Strategy Document

    • Next Steps:

  • Reference Strategy Documents

Background

Continuing from one of the previous newsletter edition titled Digital Transformation & Cybersecurity Strategy Premier, a high-level overview on both strategic topics, this edition, will expand further on drafting and writing an IT/OT cybersecurity strategy for any #criticalinfrastructure or given industrial organization.

Cybersecurity Strategy journey begins with discovery process - identifying your business inventory - this includes (but not limited to) - an inventory of IT technology stack, OT/IOT technology stack and Data inventory, across all layers of automation life-cycle + the physical layer (sensors, actuators, machines etc.) for each site along with internal/external connections.

• The discovery or assessment process is explained in OT Security Dozen Series Part# 1 – OT/ICS Cyber security Assessments in helping discover the required business inventory.

• Next step is identifying the individual(s) and respective team that will be leading the execution of strategy; which is a must have before embarking on this journey, in order to have clear ownership and accountability. Therefore, appointing a suitable CISO / and or Cybersecurity Director or Lead (typically under the CISO or CIO organization) for Cybersecurity program is essential.

• Once the business inventory is identified and documented and cybersecurity leader has been appointed, the next logic step is initiating drafting a Cybersecurity strategy document, followed by choosing/selecting a preferred framework to be used as reference to build program elements around.

IT & OT/IOT Cybersecurity Strategy Document

The combined / integrated IT & OT/IOT cybersecurity strategy document takes input from multiple sources (e.g., comprehensive discovery and or assessment exercise) that highlights inventory, associated risks, vulnerabilities and threats and prioritized remediation action plan or road-map.

The strategy document should be reviewed by all stakeholders that are directly responsible, sponsoring and or supporting the execution of the strategy and approved by relevant stakeholders. The content of the document may cover and include the following (an example table of content provided below):

Keep the document concise and simple to understand, the length of the document should be in between 30-55 pages at most. Update the document whenever necessary and or at-least every 2-3 years cycle.

Next Steps:

• Document minimum technical requirements as part of the framework.

• Document required cybersecurity policies (Dos' and Don'ts) - for building such policies (checkout the future post “Part # 2 - OT / ICS Cyber security Policy & Governance” from #OTSecurityDozen series).

• Document 4.0/IIOT ready secure reference network architecture - (for building one checkout future post “Part # 3 - OT / ICS Network Security Architecture & Segmentation” from the #OTSecurityDozen series).

• Next for OT/ICS environment, establish a practice of creating Cybersecurity Requirements Specifications (CRS) (for all greenfield projects and or for brownfield operations upgrades). CRS per #iec62443 standards includes the following:

Reference Strategy Documents

Cybersecurity and Infrastructure Security Agency (CISA) of US have few relevant documents as listed below:

• CISA Global

• CISA Strategic Plan 2023-2025

• CISA Strategic Technology Roadmap Overview 2021-2025

Earlier this week US White House has prescribed a new 69-point National Cybersecurity Strategy Implementation Plan (July 2023) - a new road-map with following 5 pillars:

• Pillar One | Defending Critical Infrastructure - Update the National Cyber Incident Response Plan (1.4.1)

• Pillar Two | Disrupting and Dismantling Threat Actors - Combat Ransomware (2.5.2 and 2.5.4)

• Pillar Three | Shaping Market Forces and Driving Security and Resilience - Software Bill of Materials (3.3.2)

• Pillar Four | Investing in a Resilient Future - Drive Key Cybersecurity Standards (4.1.3, 4.3.3)

• Pillar Five | Forging International Partnerships to Pursue Shared Goals - International Cyberspace and Digital Policy Strategy (5.1.1 and 5.1.2)

More on this topic in future posts.

In case its time for documenting your 1st IT & OT Cybersecurity Strategy or time for an update/re-write - feel free to reach out to me via DM or get in touch at info[@]securingthings[dot]com for any business needs, project support, discussions and or simply information sharing.

Follow @securingthings. It’s a great day to start “Securing:Things”. 

#securingthings #digitaltransformation #ot #ics #otsecurity #otsecuritydozen  #otcybersecurity #icssecurity #isa #icscybersecurity #securedigitaltransformation#operationaltechnology #industry40 #iec62443 #criticalinfrastructure  #criticalinfrastructureprotection  #criticalinformationinfrastructure #sgcii  #securityawareness #otsecurityawareness  #icssecurityawareness #otstrategy  #iiot #icscybersecurityprogram #otcybersecurityprogram #manufacturing  #industrialcontrolsystems  #industrialautomation