CISA unveils a six-step blueprint for isolating critical infrastructure during cyberattacks

Most IT operators understand that critical infrastructure should be isolated in crisis situations, but many don’t know how to do it in a way that maximizes security and minimizes disruption.

Now, several global agencies are offering a step-by-step action plan, CI Fortify. Released by the US Cybersecurity and Infrastructure Security Agency (CISA) and several Five Eyes security agencies across the US, UK, Australia, Canada, and New Zealand, the guide is intended to help organizations isolate and separate their vital systems to prevent malicious actors from wreaking havoc in case of attack, and to allow for safe rebuild post-attack.

“The end state must be to enable the continued operation of critical services in a state of isolation,” the guide emphasized.

A six-step guide for locking down systems

Cyber actors, particularly state-sponsored ones, are increasingly targeting operational technology (OT) systems to perform espionage or disrupt critical infrastructure such as power and water distribution.

As a result, some organizations have been forced to take their systems completely offline; for instance, this week CAF Bank suspended its online services due to a third-party software vulnerability, thus preventing the charities it serves from paying staff. Also this week, Minnesota Water Utilities’ OT services were disrupted in a coordinated cyberattack.

To help organizations that may suffer similar fates, the new guide outlines what it calls a “critical path to isolation,” with six actionable steps:

• Identify vital systems and networks
• Identify critical customers
• Identify common levels of criticality and trust for networks and hosts
• Identify potential isolation points and map connections to vital systems
• Build effective separation and isolation points
• Create and test an isolation plan

The first two steps are relatively straightforward: Understand the minimum set of systems required to support critical services, then set delivery targets based on top customers’ needs,…