The National Security Agency (NSA) released new guidance on Oct. 8 for applying zero trust security principles to operational technology (OT) systems supporting defense, national security, and critical infrastructure missions.
The guidance aims to help system owners and operators reduce the risk of unauthorized access, lateral movement, and persistent adversary activity in OT environments, where legacy equipment and mission-specific systems can make traditional cybersecurity protections difficult to implement.
The agency’s new Cybersecurity Information Sheet, Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles, is primarily intended for National Security Systems (NSS), Department of War, and Defense Industrial Base (DIB) network owners and operators, as well as IT and OT managers.
“The adoption of ZT principles is essential for enhancing the security of legacy OT, enabling defense-in-depth across critical infrastructure while ensuring adherence to federal guidance,” NSA said in a press release.
Zero trust assumes a network breach is possible or has already occurred, requiring continuous verification of users, devices, workflows, and communications.
NSA said applying those principles to OT environments presents challenges because legacy and mission-specific equipment may not support the same security controls used in enterprise IT systems.
The agency said the guidance also applies to technical leaders and cybersecurity professionals outside the defense community, including those responsible for protecting critical infrastructure.
NSA identified energy, water, agriculture, public health, and government facilities as sectors that could face significant damage from cyberattacks intended to deny, degrade, disrupt, deceive, or destroy critical infrastructure operations.
The agency did not specify an implementation deadline in its announcement. NSA directed system owners and operators to the full Cybersecurity Information Sheet for technical recommendations on strengthening OT security.