Zero Trust Architecture and the NIST Cybersecurity Framework

By now, we know that information technology (IT) and operational technology (OT) are different, and the controls we apply to IT may not apply to OT. Though technological obstacles could make it difficult to adopt specific controls from Zero Trust Architecture (ZTA), innovative thinking can assist businesses in applying ZTA concepts, even in delicate industrial settings.

In this chapter, we will cover the following topics:

• How MDIoT helps in implementing the NIST Cybersecurity Framework
• How MDIoT helps in ZTA implementation in an OT environment
• Validating ZTA with attack vectors

How MDIoT helps in implementing the NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) and ZTA are both frameworks aimed at improving cybersecurity, but they approach the problem from different angles.

The NIST CSF provides a set of guidelines and best practices for organizations to manage and reduce their cybersecurity risks. It covers the entire process of cybersecurity risk management, from understanding and reducing risks to responding to and recovering from incidents.

ZTA, on the other hand, is a security approach that assumes that no user, device, or service inside or outside an organization’s network can be trusted by default and must be verified and authenticated before access is granted to resources. ZTA focuses on the trust aspect of security, while the NIST Framework provides a comprehensive approach to cybersecurity risk management.

The NIST CSF provides guidance for organizations to effectively manage their cybersecurity risks. It is a...

How MDIoT helps in ZTA implementations in an OT environment

ZTA is not a one-size-fits-all framework. Instead, organizations need to create a tailored approach suitable for their business-specific needs that includes the people, processes, and technology needed to meet the objective. MDIoT is well-placed to help organizations to implement ZTA in the OT network. Starting with visibility, device health, vulnerability, and security, monitoring helps organizations start their journey toward ZTA confidently.

MDIoT is a non-intrusive and non-disruptive solution for existing networks, which is an essential requirement for critical OT systems and processes. This approach extends to ZTA services by monitoring network traffic and comparing observed behavior against specific baselines. It does not block unintended legitimate traffic. The organization can decide to flag identified ZTA access policy violations for further investigation or, with partner integration, can quarantine and block suspect...

Validating ZTA with attack vectors

ZTA implementations can be validated by creating attack vector reports. These reports give you a visual simulation of the attack vector and path to the specific asset. The following screenshot shows how a PLC may be attacked by navigating connected devices in the path:

Figure 10.8 – An attack vector report

The preceding figure shows the attack vector simulation on an important device, PLC1.

The path from the internet to the PLC can be achieved in three easy steps:

1. Workstation 1 has an internet connection.
2. There are known vulnerabilities on the device that the attacker may leverage to compromise the device.
3. There is network connectivity between two subnets, meaning the attacker may enter another network. Also, there are known vulnerabilities on the PLC device, which may be used to compromise the PLC.

Simulation is an integral part of any cybersecurity program. However, given the sensitivity...

Summary

In conclusion, we learned about the ZTA narrative with respect to the IoT/OT industry. We also looked into connecting the OT or IoT environment to further monitoring through a Microsoft SIEM solution – that is, Microsoft Sentinel. While we learned about the application and features of MDIoT with regard to OT and IoT in earlier chapters, we touched upon enterprise IoT in this one. A corporate environment consists of many IoT devices requiring visibility and monitoring, which we can cover with enterprise IoT.

We then moved on to learn more about MDIoT and how it helps in addressing the challenges of cybersecurity in Industry 4.0. We delved deeper into understanding the core features of MDIoT, such as asset inventory, continuous monitoring and vulnerability management, and threat monitoring. Finally, we completed by aligning IoT/OT security with ZTA and NIST and connecting MDIoT with a SIEM solution for better insights, visibility, and risk mitigation. Throughout this...