New Guidance on Isolating Critical Systems During Cyberattacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Signals Directorate's Australian Cyber Security Centre (ACSC), along with the FBI and international partners, have released new guidance aimed at helping critical infrastructure organizations prepare for cyberattacks. The document, titled "CI Fortify – Advice for isolating vital systems," outlines strategies for disconnecting essential operational technology (OT) systems from corporate and Internet-facing networks to ensure continued service during a crisis.
Operational technology encompasses the hardware and software used to monitor and control processes in sectors such as water treatment, energy, manufacturing, transportation, and telecommunications. The advisory highlights the increasing frequency of cyberattacks targeting these sectors, particularly from state-sponsored threat actors who seek to exploit vulnerabilities for espionage or disruptive purposes.
In February 2024, CISA and other agencies warned that the Chinese Volt Typhoon hacking group had infiltrated organizations across various critical sectors, remaining undetected in some networks for up to five years. This group, along with others like Salt Typhoon, has targeted U.S. telecommunications providers, gaining access to sensitive communications and law enforcement systems. Additionally, water infrastructure has faced repeated attacks, prompting organizations like American Water to deactivate systems following breaches.
The CI Fortify guidance emphasizes proactive preparation rather than reactive measures during an attack. Organizations are advised to identify the minimum systems necessary for delivering critical services and document all connections to corporate networks and external dependencies. This includes assessing where connections can be disabled or physically disconnected, as well as planning for potential operational disruptions that isolation may cause.
While physical isolation is ideal, the guidance acknowledges that it may not be feasible for organizations reliant on Internet-facing services or cloud environments. In such cases, strengthening network boundaries, using encrypted communications, and minimizing dependencies on corporate systems are recommended. Organizations should also establish clear protocols for authorizing isolation steps and maintaining operations without normal network connectivity.
Regular testing of isolation plans is crucial, as partial tests may overlook shared infrastructure that could complicate the isolation process. The guidance also suggests keeping a secure offline copy of the isolation plan to ensure access during network disruptions. After isolating systems, continuous monitoring of network traffic is essential to prevent unauthorized reconnections between critical and non-critical networks.
However, the advisory warns that isolation can introduce risks, such as outdated security updates and increased reliance on removable media for data transfer. Organizations must be prepared to operate and monitor isolated systems manually until they can safely reconnect them to the broader network. This comprehensive approach aims to enhance the resilience of critical infrastructure against the growing threat of cyberattacks.
