Most IT operators understand that critical infrastructure should be isolated in crisis situations, but many don’t know how to do it in a way that maximizes security and minimizes disruption.

Several global agencies are now offering a step-by-step action plan called CI Fortify. Released by the US Cybersecurity and Infrastructure Security Agency (CISA) and Five Eyes security agencies across the US, UK, Australia, Canada, and New Zealand, the guide is intended to help organizations isolate and separate their vital systems to prevent malicious actors from wreaking havoc in case of attack, and to allow for safe rebuild post-attack.

“The end state must be to enable the continued operation of critical services in a state of isolation,” the guide emphasized.

A Six-Step Guide for Locking Down Systems

Cyber actors, particularly state-sponsored ones, are increasingly targeting operational technology (OT) systems to perform espionage or disrupt critical infrastructure such as power and water distribution.

As a result, some organizations have been forced to take their systems completely offline. CAF Bank recently suspended its online services due to a third-party software vulnerability, preventing the charities it serves from paying staff. Similarly, Minnesota Water Utilities’ OT services were disrupted in a coordinated cyberattack.

To help organizations that may suffer similar fates, the new guide outlines what it calls a “critical path to isolation,” with six actionable steps:

  • Identify vital systems and networks
  • Identify critical customers
  • Identify common levels of criticality and trust for networks and hosts
  • Identify potential isolation points and map connections to vital systems
  • Build effective separation and isolation points
  • Create and test an isolation plan

The first two steps are relatively straightforward: understand the minimum set of systems required to support critical services, then set delivery targets based on top customers’ needs, such as the number of megawatts of power or gallons of water required to keep them up and running.

Assigning different degrees of criticality means segmenting networks, hosts, and systems into different zones based on their nature and threat exposure. Risk management processes will help in this area.

Once systems have been classified, the next step is to map — and continuously update — interconnection points between those critical networks and other systems. Connections to account for include those to vendors with remote access such as consultants, contractors, or managed service providers; cloud environments including private cloud; untrusted networks; and peer-critical networks like utilities or dispatch.

It’s also important to identify connections that might lower trust or increase network vulnerability, such as those to carrier-provided networks, or Wi-Fi, satellite, radio point-to-point, or mobile connections. Operators should identify any protection mechanisms, like encryption, that may be in place in these areas.

Operators should also understand the business context of each connection, including the type of information that flows through it and how critical it is to operations and to the system owner or third-party provider. Technical information around these interconnections should be documented as well — for instance, internet gateway information, architectural diagrams, firewall, router, and virtual private network (VPN) configurations, as well as emergency contact details.

“This critical technical information will be necessary for building isolation controls,” the guide notes.

Establishing Separation and Isolation Points

The assumption is that zero-trust networks reduce the need for isolation because devices are designed to inherently distrust one another. But the guide emphasizes that isolation points between networks and services are necessary and “highly effective” at containing attacks, limiting overall impact on operations and on attackers’ ability to pivot, and shortening time to restore services in the event of an incident.

“Organizations must build physical isolation points into their vital systems to enable the capability to operate in a state of isolation,” the guide states.

This means zero connectivity or shared infrastructure with non-OT networks via switching, routing, compute, repeaters, or multiplexers. Additionally, vital resources like power, cooling, backup generation, and physical security systems should not be controllable from non-critical networks.

Enterprises should harden OT boundaries, fully segregate management and admin systems, and secure network control planes. They can also implement admin network controls like virtual local area networks (VLANs), multiprotocol label switching (MPLS), IP access lists, route blocking, and blackhole routing — in which malicious packets are dropped before they can impact servers.

However, the agencies acknowledge that complete physical isolation may not be operationally feasible for some enterprise operating systems with large disparate footprints.

In distributed critical infrastructure environments where third-party communication is unavoidable, OT boundaries should be secured with strong encryption. Dedicated communication paths such as wavelengths or fiber pairing can also help prevent data sharing with non-vital systems.

Layer 2 and Layer 3 services should be encrypted, with remote access prevented or at least limited, and unnecessary services disabled. Enterprises should not rely on encryption built into OT devices; rather, a dedicated device should be used for encryption over a carrier’s links.

Ultimately, operators should treat any carrier-provided service as “untrusted and potentially hostile,” the guide warns.

Understand Dependencies and Risks, Isolate in Phases

Operators should understand dependencies between OT and non-OT systems and build dedicated OT capabilities. Dependencies might occur in shared routing, virtualization, switching, storage, document management, Active Directory, and certificate and authentication services. These must be understood to prevent unforeseen performance issues or degradation of service quality in the case of physical isolation.

Enterprises also need to understand how they will operate during any extended periods of separation, given that isolation can result in operational and security risks. Systems may fall out of patching compliance, removable media may not receive updates — increasing the risk of infection — and external visibility can be reduced.

Isolating systems may seem an overwhelming task at first, so the agencies suggest a graduated plan that can “progressively isolate pathways” to vital OT and supportive systems while maintaining continuity of business processes.

To protect themselves, organizations should implement these steps in order:

  • Disable remote workers’ ability to access OT systems through intermediaries like jump hosts on non-OT environments
  • Disable on-premises remote access to OT systems from corporate systems
  • Isolate all connections between non-OT and OT environments
  • Isolate lower-priority connections between decentralized OT and OT systems
  • Completely isolate OT environments and vital systems

“Progressively removing access to OT systems as the cyber threat environment deteriorates may be effective in halting or hindering attacks on vital OT and enabling systems,” the guide notes. By following this phased approach, organizations can reduce their exposure incrementally while preserving the operational continuity that critical infrastructure demands.