CISA and Five Eyes release six-step blueprint for isolating critical infrastructure during cyberattacks

A new joint guide from CISA and allied security agencies provides a structured approach for critical infrastructure operators to isolate vital systems from cyber threats while maintaining essential services.

Key Points:

• CISA and Five Eyes agencies released the CI Fortify guide to help organizations isolate critical systems during attacks.
• The six-step plan includes identifying vital systems, mapping connections, and building physical or logical isolation points.
• Recent incidents at CAF Bank and Minnesota Water Utilities highlight the urgent need for such isolation strategies.
• The guide recommends progressive isolation, starting with disabling remote access and ending with complete OT separation.
• Organizations must account for operational dependencies and risks like patching compliance when systems are isolated.

The US Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with security agencies from the UK, Australia, Canada, and New Zealand, has published a comprehensive guide titled CI Fortify. This document addresses the growing threat of state-sponsored actors targeting operational technology (OT) systems in critical sectors like power and water. The guide aims to help organizations maintain critical services by isolating vital systems from malicious actors, thereby limiting the impact of an attack and facilitating a safer rebuild process.

The blueprint outlines six actionable steps, beginning with the identification of vital systems and critical customers, followed by mapping interconnections and establishing separation points. It emphasizes that while zero-trust architectures are valuable, physical or logical isolation points are necessary to contain attacks effectively. The guide advises hardening OT boundaries, segregating management systems, and treating carrier-provided services as untrusted. It also acknowledges that complete isolation may not always be feasible, suggesting strong encryption and dedicated communication paths as alternatives for distributed infrastructure.

Finally, the agencies recommend a phased approach to isolation to manage operational risks. This includes progressively disabling remote access, isolating lower-priority connections, and eventually completely separating OT environments. The guide warns that isolation can lead to challenges such as falling out of patching compliance or reduced external visibility, urging operators to understand dependencies and plan for extended periods of separation to ensure business continuity and security.

How can organizations balance the need for complete system isolation with the operational risks of losing patching and monitoring capabilities?

Learn More: CSO Online

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)