Air Gaps Exhausted – Indian Security Policy
Share this:
India has announced a new security policy for its power sector and specified a grade of isolation it says exceeds that offered by air gaps.
The much hyped air gap myth between IT and OT systems now stands shattered. the policy states, before going on to offer a slightly odd definition of an air gap.The artificial air gap created by deploying firewalls between any IT and OT system can jumped by any insider or an outsider through social engineering.
Power sector players generators, transmission utilities and distributors have a requirement of only one of their IT systems with internet facing at any of their sites/locations, if required, which is isolated from all OT zones and kept in separate room under the security and control of CISO.
The policy also requires any activity on the sole internet-connected system to be done through an identifiable whitelisted device followed by scanning of both for any vulnerability/malware. Even that device can only connect to whitelisted IP addresses.
If the OT kit at power player must communicate with the outside world, it should happen over optic fibre and preferably over POWERTEL a carrier operated by government electricity transmission company Power Grid Corporation of India.
The policy also requires all operators of power infrastructure to create an Information Security Division, appoint a CISO to lead it, and ensure compliance with security advisories issued by CERT-IN including prompt application of patches.
Lifecycle management of all kit is also required, with replacements ordered for any out of support products. That new kit must be certified against the Common Criteria standards.
The policy applies to system integrators, equipment manufacturers, and even hardware and software OEMs that serve India’s power supply system. As India has undergone rapid electrification in recent years, under a plan to bring electric power to the entire nation, such suppliers have had huge growth opportunities.
The new policy implies that some of the entities involved in operating the resulting network of generation and transmission infrastructure might not be in the best of shape. Hopefully the document’s debut doesn’t provide an incentive to attackers.
