EDITOR ’ S QUESTION
MOREY HABER , CHIEF SECURITY OFFICER , BEYONDTRUST
A true cyberwar that includes the exploitation of critical infrastructure could be nearly as devastating as conventional bombs and weapons to infrastructure and human lives . Nations of the world have the technical means to commit to a cyberwar without even firing a single munition .
The results could be equally as devastating even if their physical military ( adversary ) would be no match for the target nation since these weapons are electronic , lowcost and intellectual in nature .
Most US industries are already under regulatory pressure to modernize and safeguard their IT security systems to provide some layer of defense . And , recent presidential executive orders are designed to push modernization and security along to adapt to these modern threats .
We will never be able to stop 100 % of attacks but how we respond or limit their success will be crucial in our ability to survive an attack against critical infrastructure . Therefore , consider these recommendations to protect critical infrastructure from a cyberattack :
• Discover all managed and unmanaged assets across your interconnected corporate and ICS infrastructure across all zones and levels .
• Automatically discover inventory privileged accounts used internally by employees and contractors and externally by all third-party vendors .
• Provide central control by securely storing all credentials and SSH keys in a secure database that is hardened , encrypted and strictly monitored for access .
• Reduce the risk of lost or stolen vendor credentials by systematically rotating passwords for all managed systems based on time and employee retention .
• Implement secure vendor enclaves to isolate industrial control systems and vendor devices to reduce the risks of malware and attack . Consider using Zero Trust architectures for these environments .
• Verify that no default passwords exist on any managed system or device . Full stop !
• Manage all managed devices automatically and store a unique password per each device . Passwords should never be reused .
• Automatically rotate each device ’ s password based on age , after each remote vendor session , or an identified risk .
• Provide a complete workflow for device access , including an approval process for when a remote vendor or employee access is required .
• Record all or select remote sessions with playback to document and review what occurs when a device is accessed and approve appropriate behavior .
• Provide detailed reporting of all privileged credentials used regardless of location .
History has shown us how these attacks could occur and best practices from information security have allowed us to build a resilient strategy for protecting critical infrastructure . Based on recent geopolitical changes , we should all be concerned and take precautions now .
Nations of the world have the technical means to commit to a cyberwar without even firing a single munition .
www . intelligentcio . com INTELLIGENTCIO NORTH AMERICA 33