The US National Institute of Standards and Technology (NIST) just released an updated draft of its Cybersecurity Framework (CSF), which expands on the original’s mission to provide critical infrastructure operators with much-needed cybersecurity guidance. While still emphasizing critical infrastructure, the latest edition is more encompassing of all sectors and organizations and offers a greater focus on including executives and C-suite in cybersecurity planning. Although it is always an important time to revisit and enhance cybersecurity practices, this update comes at a particularly interesting point in which nation-led and OT threats are escalating. In this month’s insights, we take a look at how best to handle these challenging trends.
Recent Cybersecurity Threats
Leading up to the CSF release, the Biden administration announced a collection of actions – including an executive order – assembled to better protect the cybersecurity of U.S. ports. Not only is this move essential because of the money that flows into the country’s economy from ports, but because there is growing concern over access to the systems that they rely on to function.
According to CNBC, data shows that “80 percent of the cranes moving trade at U.S. ports are made in China and use Chinese software, leading to concern that the cranes could be used in Chinese surveillance.” This adds onto the case already building around Chinese cybersecurity action. A recent intelligence advisory revealed that hackers backed by China have been accessing U.S. critical infrastructure for years. For instance, a group known as Volt Typhoon has been taking advantage of vulnerabilities in routers, firewalls and VPNs to infiltrate operators spanning fields such as water, transportation, and energy. (If you’re interested in learning a bit more on this, read our latest Industry Brief.)
The Questions You Should Ask to Handle the Cybersecurity Landscape
Despite there being new information released on what type of threats and the actors behind them, the knowledge that cyber threats are out there is not new. At this point, everybody knows that there are threats lurking, but what does it really mean for you? And what do you do?
To answer the questions above, you need a risk analysis. As professionals with deep roots in the plant floors and manufacturing, we always recommend to clients that they begin this process by assessing what is the risk you could live with and what is the cost of doing nothing? By establishing this scale, you can identify priorities and what to do first, leading to an efficiency mindset. This is particularly helpful when resources are a challenge. As we deal with clients in the industry, we are always hearing about the pain points that they face, including not having enough personnel, time, effort, and money. In fact, we spoke with Research Collaborator at CyMANII, Matthew Luallen, about this process for an episode of OT Cyber | From the Plant Floor Up. Stay tuned!
Sources:
- “NIST Cybersecurity Framework 2.0: 4 Steps to Get Started” – Robert Lemos, Dark Reading
https://www.darkreading.com/ics-ot-security/nist-cybersecurity-framework-2-0-4-steps-get-started - “Biden to sign executive order on US port cybersecurity targeting Chinese-manufactured shipping cranes” – Lori Ann LaRocco, CNBC
https://www.cnbc.com/2024/02/21/biden-executive-order-on-port-cybersecurity-targets-china-made-cranes.html - “China had “persistent” access to U.S. critical infrastructure” – Sam Sabin, Axios
https://www.axios.com/2024/02/07/china-volt-typhoon-critical-cyberattacks
