Zero trust (ZT) offers a modern, adaptive approach to cybersecurity by eliminating implicit trust and continuously validating access based on identity, context, and risk. ZT principles assume a breach has already occurred and are designed to limit threat actor movement and potential damage.
For operational technology (OT), applying ZT requires careful consideration because OT systems interact with the physical environment and are constrained by availability and safety requirements, as well as legacy technology with long lifespans. The blanket application of traditional information technology (IT)-focused ZT capabilities to OT is neither reasonable nor feasible and requires continuous collaboration between OT engineers, IT architects, and cybersecurity professionals. This collaboration should include clear communication channels, joint development of policies and controls, and a shared understanding of both mission objectives and technical limitations.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- CISA Releases Three Industrial Control Systems Advisories
August 17, 2023
CISA released three Industrial Control Systems (ICS) advisories on August 17, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-229-01 ICONICS and Mitsubishi Electric Products Read more… Source: U.S. Cybersecurity and Infrastructure Security Agency
- Atlassian Releases Security Update for Confluence Server and Data Center
August 17, 2023
Atlassian has released its security bulletin for August 2023 to address a vulnerability in Confluence Server and Data Center, CVE-2023-28709. A remote attacker can exploit this vulnerability to cause a denial-of-service condition. CISA encourages users and administrators to review Atlassian’s August 2003 Security Bulletin and apply the necessary update. Read more… Source: U.S. Cybersecurity and Infrastructure Security Agency
- CISA Releases JCDC Remote Monitoring and Management (RMM) Cyber Defense Plan
August 16, 2023
Today, CISA released the Remote Monitoring and Management (RMM) Cyber Defense Plan, the first proactive Plan developed by industry and government partners through the Joint Cyber Defense Collaborative (JCDC). This plan addresses systemic risks facing the exploitation of RMM software. Cyber threat actors can gain footholds via RMM software into managed service providers (MSPs) or manage ...
- CISA Releases Two Industrial Control Systems Advisories
August 15, 2023
CISA released two Industrial Control Systems (ICS) advisories on August 15, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-227-01 Schneider Electric EcoStruxure Control Expert, Process Expert, Modicon Read more… Source: U.S. Cybersecurity and Infrastructure Security Agency
- Bangladesh Bank warns banks and financial institutions against cyber attacks
August 12, 2023
The Bangladesh Bank has issued out a comprehensive 11-point instruction in a situational alert, urging all banks and financial institutions to bolster their cyber defences. This move comes on the heels of a recent cyber threat targeting the country’s cyber sphere, with potential implications for critical state information infrastructure (CII), including banking, healthcare, and government operations. Read ...
- Multiple high severity vulnerabilities in CODESYS V3 SDK could lead to RCE or DoS
August 10, 2023
Microsoft’s cyberphysical system researchers recently identified multiple high-severity vulnerabilities in the CODESYS V3 software development kit (SDK), a software development environment widely used to program and engineer programmable logic controllers (PLCs). Exploitation of the discovered vulnerabilities, which affect all versions of CODESYS V3 prior to version 3.5.19.0, could put operational technology (OT) infrastructure at risk ...