FBI & CISA Warn on Risks of Third-Party ICS Integrators in Critical Infrastructure
The FBI and CISA issued guidance for critical infrastructure operators on managing cybersecurity risks posed by third-party industrial control system integrators, emphasizing access control and risk assessments.
Why it matters
Third-party ICS integrators have access to sensitive operational systems, and their involvement may introduce security vulnerabilities that could disrupt critical infrastructure or compromise sensitive data.
SOC impact
Investigate and monitor access granted to third-party ICS integrators, focusing on adherence to the principle of least privilege. Validate contracts for security clauses and conduct risk assessments to understand potential exposure from integrations.
Recommended actions
- Identify and inventory third-party ICS integrators with system access
- Review and confirm contract security requirements for integrators
- Monitor integrator access logs for anomalous or unauthorized activities
- Conduct risk assessments focused on integrator-related vulnerabilities
- Evaluate segregation of duties and access scopes for integrators
Executive Summary
The FBI and CISA have issued strategic guidance addressing cybersecurity risks originating from third-party industrial control system integrators working within critical infrastructure sectors. Recent security incidents highlight how integrators, when granted broad or poorly controlled access, may inadvertently or otherwise introduce vulnerabilities. Their recommendations underscore the importance of implementing the principle of least privilege, conducting thorough risk assessments, and establishing contractual security provisions to maintain operational integrity. For security professionals, this guidance frames a priority to scrutinize third-party access controls, monitor relevant activities, and incorporate integrator risks into overall security posture evaluations.
SOC Impact
Investigate and monitor access granted to third-party ICS integrators, focusing on adherence to the principle of least privilege. Validate contracts for security clauses and conduct risk assessments to understand potential exposure from integrations.
Access and Risk Assessment Validation
- Identify and inventory third-party ICS integrators with system access
- Review and confirm contract security requirements for integrators
- Monitor integrator access logs for anomalous or unauthorized activities
- Conduct risk assessments focused on integrator-related vulnerabilities
- Evaluate segregation of duties and access scopes for integrators
Why It Matters
Third-party ICS integrators have access to sensitive operational systems, and their involvement may introduce security vulnerabilities that could disrupt critical infrastructure or compromise sensitive data.