"Digital Transformation & Cybersecurity Strategy Premier,"—a high-level overview on both strategic topics—will expand further on drafting and writing an IT/OT cybersecurity strategy for any #criticalinfrastructure or given industrial organization.
Cybersecurity Strategy journey begins with discovery process—identifying your business inventory— this includes (but is not limited to) an inventory of IT technology stack, OT/IOT technology stack and data inventory, across all layers of automation lifecycle plus the physical layer (sensors, actuators, machines etc.) for each site along with internal/external connections.
Execution Steps - Discovery / Assessment / Business Inventory
- The discovery or assessment process is explained in OT Security Dozen Series Part# 1 – OT/ICS Cyber security Assessments in helping discover the required business inventory.
- Next step is identifying the individual(s) and respective team that will be leading the execution of strategy—which is a must have before embarking on this journey, in order to have clear ownership and accountability. Therefore, appointing a suitable CISO/and or Cybersecurity Director or Lead (typically under the CISO or CIO organization) for Cybersecurity program is essential.
- Once the business inventory is identified and documented and cybersecurity leader has been appointed, the next logic step is initiating drafting a cybersecurity strategy document, followed by choosing/selecting a preferred framework to be used as reference to build program elements around.
IT & OT/IOT Cybersecurity Strategy Document
The combined / integrated IT & OT/IOT cybersecurity strategy document takes input from multiple sources (e.g., comprehensive discovery and or assessment exercise) that highlights inventory, associated risks, vulnerabilities and threats and prioritized remediation action plan or roadmap.
The strategy document should be reviewed by all stakeholders that are directly responsible, sponsoring and/or supporting the execution of the strategy and approved by relevant stakeholders. The content of the document may cover and include the following (an example table of content provided below):
Cybersecurity Strategy Document - Example Table of Content
Keep the document concise and simple to understand, the length of the document should be in between 30-55 pages at most. Update the document whenever necessary and or at least every 2-3 years cycle.
Next Steps:
- Document minimum technical requirements as part of the framework
- Document required cybersecurity policies ("dos and dont's") - for building such policies, checkout Part # 2 - OT / ICS Cyber security Policy & Governance from the #OTSecurityDozen series
- Document 4.0/IIOT ready secure reference network architecture - for building one checkout Part # 3 - OT / ICS Network Security Architecture & Segmentation from the #OTSecurityDozen series
- Next for OT/ICS environment, establish a practice of creating Cybersecurity Requirements Specifications (CRS) for all greenfield projects and or for brownfield operations upgrades). CRS per #iec62443 standards includes the following:
Elements of Cybersecurity Requirements Specification (CRS)
Reference Strategy Documents
Cybersecurity and Infrastructure Security Agency (CISA) of US have few relevant documents as listed below:
Recently, US White House has prescribed a new 69-point National Cybersecurity Strategy Implementation Plan (July 2023) - a new roadmap with following five pillars:
- Pillar One | Defending Critical Infrastructure - Update the National Cyber Incident Response Plan (1.4.1)
- Pillar Two | Disrupting and Dismantling Threat Actors - Combat Ransomware (2.5.2 and 2.5.4)
- Pillar Three | Shaping Market Forces and Driving Security and Resilience - Software Bill of Materials (3.3.2)
- Pillar Four | Investing in a Resilient Future - Drive Key Cybersecurity Standards (4.1.3, 4.3.3)
- Pillar Five | Forging International Partnerships to Pursue Shared Goals - International Cyberspace and Digital Policy Strategy (5.1.1 and 5.1.2)
In case its time for documenting your first IT & OT Cybersecurity Strategy or time for an update/re-write—feel free to reach out to me via DM or get in touch at info@securingthings.com for any business needs, project support, discussions and/or simply information-sharing.
Follow @securingthings. It’s a great day to start “Securing: Things”.
This article was originally published on my Securing:Things newsletter on LinkedIn.