Claroty – Visibility into Vulnerability

Over the past two years, there have been transformative societal changes influencing demands for safety, environmental responsibility, and fair treatment. Governments, reacting to a surge in cyberattacks, are enacting stringent regulations targeting corporate critical infrastructure, emphasizing a lack of visibility and preparedness in Operational Technology (OT) deployments. Notable incidents, such as the Colonial Pipeline and JBS Foods breaches, highlight vulnerabilities and costly repercussions. Germany leads in legislative measures with the IT Security Act 2.0 (IT-SIG 2.0), mandating extensive data security systems, risk assessments, and incident reporting. Organizations face a choice: resist government overreach or enhance their OT security in alignment with new regulations. Compliance involves companies across key sectors like energy, telecommunications, transport, and food supply to monitor, detect, and react to cyber threats effectively.

BSI's expanding role under IT-SIG 2.0, including consumer protection and IT security labeling, emphasizes real-time attack detection and mandatory incident reporting. The legislation extends log retention to 18 months and mandates biennial cybersecurity reporting for companies of public interest. Companies are advised to adopt comprehensive OT security measures, employing advanced tools and strategies for asset visibility, protection, monitoring, detection, and response. Claroty offers sophisticated solutions tailored to OT environments, integrating detection and response at multiple levels, enhancing overall cybersecurity resilience.

To meet these mandates, organizations should conduct asset discovery, prioritize protection by addressing known vulnerabilities, implement robust monitoring with event logs and secure storage, employ effective detection models leveraging AI, and establish pre-defined incident response plans. This not only ensures compliance but minimizes operational disruptions and enhances overall security. Embracing such measures aligns OT operations with corporate-wide cybersecurity frameworks, optimizing protection against sophisticated cyber threats.

• The IT Security Act 2.0 was adopted by the Bundestag on April 23, 2021, and endorsed by the Bundesrat on May 7, 2021.
• Cyberattacks, such as the Colonial Pipeline breach and JBS Foods compromise, resulted in millions of dollars in ransom payments.
• The BSI can extend log retention periods from 3 to 18 months to counter malicious programs.
• Germany has historically included critical infrastructure regulation and now extends it to supply chain stakeholders.
• The BSI can actively monitor public network interfaces and order telecommunication companies to log activity.
• 250 companies, dubbed ‘Obligated parties,’ must adhere to stringent OT protection measures under IT-SIG 2.0.
• Failures in critical infrastructure can cause significant societal disruption and require urgent legislative attention.
• Threat identification and logging are essential processes mandated by the IT Security Act 2.0.
• The new law prohibits the use of critical infrastructure components from untrusted manufacturers.
• The BSI now has the authority to conduct port scans for companies when necessary.

• "The cybersecurity events that have recently affected society are a case in point."
• "Germany is at the forefront of addressing corporate responsibility for cybersecurity via legislation."
• "IT SIG 2.0 nominates ‘Obligated parties’, over 250 companies that must deploy solutions to protect their OT infrastructure."
• "BSI’s role has been expanded to cover consumer protection and to manage a new IT security label for certain categories of consumer products."
• "Operators of critical infrastructure must deploy real-time attack detection capabilities."
• "The BSI now has the authority to control solutions used in ‘critical components’."
• "It’s never been easier to monitor infrastructure, detect threats, and react to a compromise."
• "The core to monitoring OT infrastructure is an event monitor."
• "Detection will typically use an AI tool to identify anomalous events."
• "A Threat Detect and Response (TDR) plan makes sense for companies with OT operations because it will avoid potentially significant costs associated with rectifying a compromise."