The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have jointly published a new guide to help system administrators secure their identity and access management (IAM) infrastructure.
This document is part of the Agency Persistent Security Framework (ESF). It includes recommended best practices for combating IAM threats related to identity governance, environment hardening, identity federation/single sign-on, multi-factor authentication (MFA), and IAM auditing and monitoring. increase.
In this guide, CISA and NSA refer to recent attacks that exploit vulnerabilities in IAM products and implementations to target critical infrastructure.
“In 2021, a colonial-era national gas pipeline in the United States was attacked and shut down using compromised credentials,” the document reads. “[Months earlier], an unknown attacker manipulated the computer system of a water treatment plant in Florida to increase the concentration of sodium hydroxide in the water supply. ”
The report also mentions an attack targeting a water treatment plant in South Staffordshire, UK in 2022.
Learn more about recent critical infrastructure attacks here: NCSC issued 34 million cyber alerts in the past year
“Critical infrastructure organizations have a special responsibility to implement, maintain, and monitor secure IAM solutions and processes to protect not only their own business functions and information, but also the organizations and individuals they interact with,” said the guide. To read.
To help these companies achieve higher levels of security, the guide provides a framework that allows them to assess their current IAM capabilities and risk posture. It highlights techniques for improving areas such as secure solution selection, layering, integration, and proper configuration.
System administrators must also manage risk while maintaining an appropriate level of security to continue operations and raise awareness of correct IAM usage and risks.
The CISA advisory comes two months after a SecurityScorecards report suggested that nearly half of critical manufacturing organizations are now vulnerable to breach.
