Primary Mitigations to Reduce Cyber Threats to Operational Technology

Executive Summary

CISA, the FBI, and other U.S. government partners published a fact sheet urging critical infrastructure entities with operational technology (OT) and industrial control systems (ICS) to implement five primary mitigations to improve their cybersecurity posture and reduce risk to unsophisticated cyber threat activity. CISA and partners also published an operational alert warning of unsophisticated cyber actors targeting ICS/SCADA systems within U.S. critical infrastructure sectors, specifically Energy and Transportation Systems. Poor cyber hygiene and exposed public-facing devices can escalate threats, leading to defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.

Municipal Impact

Municipal utilities and public-sector entities with OT/ICS should implement the five primary mitigations and coordinate with third-party managed service providers and system integrators.

SMB Impact

Small critical infrastructure entities with OT/ICS should implement the primary mitigations and communicate with managed service providers, integrators, and manufacturers for configuration guidance.

Recommended Actions

1. Review the fact sheet, Primary Mitigations to Reduce Cyber Threats to Operational Technology.
2. Implement the five primary mitigations to reduce risk to unsophisticated cyber threat activity.
3. Regularly communicate with third-party managed service providers, system integrators, and system manufacturers for system-specific configuration guidance.
4. Review the CISA operational alert on unsophisticated actors targeting OT.

Grey Matter Analysis