NSA Issues 26 Zero-Trust Steps to Secure DoW Legacy OT Systems

The National Security Agency published a cybersecurity information sheet detailing 26 high-impact zero-trust activities designed to strengthen security across Department of War critical operational technology environments. According to Industrial Cyber, the agency released this guidance to address evolving cyber threats and unauthorized access risks within these sensitive systems.

The document, titled Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles, focuses on legacy systems that cannot natively support modern security capabilities. The NSA emphasizes that these measures protect mission-essential functions without requiring extensive hardware modifications, allowing organizations to bridge architectural gaps while maintaining operational continuity.

Strategic Priorities for OT Security

To maintain security in legacy OT environments, the agency states that a comprehensive evaluation of current infrastructure is required before prioritizing high-impact measures. These strategic priorities include securing remote access, protecting OT data, and maintaining accurate inventories of OT assets. The guidance also highlights the importance of enhancing OT environment visibility and utilizing OT cyber threat intelligence to stay ahead of potential attacks.

Additional recommendations involve hardening smart controllers, strengthening networks through segmentation and monitoring, and securing engineering workstations and human-machine interfaces. The NSA advises enforcing security through hardened Active Directory and domain controllers, as well as verifying and assessing zero-trust controls safely. These steps aim to shield legacy hardware within a resilient, verifiable zero-trust environment.

Impact on Defense Infrastructure

The NSA guidance specifically targets the reduction of risks from unauthorized access and malicious activity in OT environments. According to the agency, the document was developed to further its cybersecurity missions, including identifying and disseminating threats to National Security Systems and Department of War information systems. This information may be shared broadly to reach all appropriate stakeholders within the defense industrial base.

A key recommendation involves removing direct internet connections to OT environments where possible. For necessary remote access, the NSA enforces stronger controls, including phishing-resistant multifactor authentication, least-privilege access, and privileged access management. These controls are designed to minimize the attack surface for legacy systems that lack native modern security features.

What should you do?

Security professionals should review the NSA’s 26 activities to identify applicable controls for their own OT environments. Organizations with legacy infrastructure should prioritize asset inventorying and network segmentation to improve visibility. Teams should also evaluate current remote access protocols to ensure they meet the recommended phishing-resistant authentication standards.

What to do and how to stay safe: NSA

• Conduct a comprehensive evaluation of current OT infrastructure to identify legacy systems lacking native security capabilities.
• Remove direct internet connections to OT environments where possible to reduce exposure to external threats.
• Implement phishing-resistant multifactor authentication and least-privilege access for all remote connections to OT systems.
• Develop and maintain accurate inventories of OT assets to enhance visibility and support effective network segmentation.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the main goal of the NSA's new guidance for DoW OT systems?

The goal is to strengthen cybersecurity across Department of War critical operational technology environments by implementing 26 high-impact zero-trust activities that protect legacy systems without extensive hardware changes.

Does this guidance require replacing old hardware in OT environments?

No, the NSA prioritizes measures that protect mission-essential functions without requiring extensive hardware modifications, focusing instead on strategic controls like segmentation and access management.

How should remote access to OT systems be secured according to the NSA?

The NSA recommends removing direct internet connections where possible and enforcing stronger controls for remote access, including phishing-resistant multifactor authentication and privileged access management.