On December 15, 2021, the U.S. Department of Homeland Security Cybersecurity & Infrastructure Security Agency (“CISA”) announced the publication of a warning for “critical infrastructure owners and operators to take immediate steps to strengthen their computer network defenses against potential malicious cyber attacks” before the upcoming holiday season. CISA’s warning emphasizes that “[s]ophisticated threat actors . . . have demonstrated capabilities to compromise networks and develop long-term persistence mechanisms” and have “demonstrated capability to leverage this access for targeted operations against critical infrastructure with potential to disrupt National Critical Functions.”
CISA’s warning includes recommended actions for executives and senior leaders, additional recommended actions for organizations with operational technology (“OT”) and industrial control systems (“ICS”), recommendations for organizations that have experienced a cybersecurity incident, and a list of resources that organizations confronting cyber threats and evaluating cybersecurity best practices may find helpful.
Actions for Executives and Senior Leaders. Specifically, in light of these “persistent and ongoing cyber threats,” CISA’s warning urges critical infrastructure owners and operators to undertake a series of “immediate actions” to proactively bolster their organizations’ cyber defenses before the upcoming holiday season, including by:
- Increasing Organizational Vigilance: Ensuring that the organization has “no gaps in Information Technology (IT)/Operational Technology (OT) security personnel coverage” and is continually “monitoring for all types of anomalous behavior.” CISA’s warning notes that such coverage is “particularly important during the winter holiday season when organizations typically have lower staffing.”
- Preparing For Rapid Response: Adopting “a state of heightened awareness” by: creating, updating, or reviewing the organization’s “cyber incident response procedures”; ensuring that personnel are familiar with “key steps they need to take during and following an incident”; checking reporting processes and exercising “continuity of operations plans” to test the organization’s ability “to operate key functions in an IT-constrained or otherwise degraded environment”; and considering the potential cross-sector impacts of incidents that may occur, both at the organization and at other organizations across critical infrastructure sectors.
- Implementing Cybersecurity Best Practices: Implementing key best practices, including: enforcing “multi-factor authentication and strong passwords”; installing “software updates” while “prioritizing known exploited vulnerabilities”; and securing “accounts and credentials.”
- Staying Informed: Monitoring the latest updates about cyber threats and malicious techniques, including by subscribing to CISA’s mailing list and feeds.
- Engaging in More Information Sharing: Lowering the threshold for “threat and information sharing,” including by immediately reporting “cybersecurity incidents and anomalous activity to CISA and/or the FBI.”
Organizations with OT/ICS Systems. CISA’s warning also notes that organizations with OT and ICS can “improve their cyber posture and functional resilience” by undertaking a series of additional steps, which include:
- “Identifying and securing” the critical processes that must continue without interruption;
- “Developing and regularly testing workarounds or manual controls” to ensure that such processes “can be isolated and continue operating without access to IT networks, if needed;” and
- “Ensuring backup procedures” are in place and “regularly tested,” and “that backups are isolated from network connections.”
Recommendations for Organizations Impacted by an Incident. CISA’s warning recommends that organizations impacted by an incident:
- Implement the organization’s incident response plan;
- Immediately report “incidents or anomalous activity” to CISA; and
- Consider obtaining support from “a third-party IT organization to provide subject matter expertise.”
Resources. CISA’s warning also includes a list of resources that organizations confronting cyber threats and evaluating cybersecurity best practices may find helpful, including CISA’s Cyber Essentials, Questions Every CEO Should Ask About Cyber Risks, and resources specific for owners and operators of operational technology systems, including Rising Ransomware Threats to Operational Technology Assets, among others.
Potential Implications. CISA’s latest warning follows its earlier Cybersecurity Reminder on November 22, 2021, urging public and private sector organizations to be vigilant and implement precautions leading up to the holiday season, and emphasizes the heightened risks that organizations may face from cyber threats around the holiday season.
Looking Forward. These warnings are consistent with the U.S. Government’s ongoing focus on strengthening critical infrastructure cybersecurity, follow shortly after TSA issued new cybersecurity requirements for the rail and air sectors, and align with the White House’s continued emphasis on U.S. Cybersecurity. All organizations—in the U.S. critical infrastructure sectors and beyond—should expect continued developments in these areas into 2022.