How Identity and Access Management Supports TSA's Proposed Surface Cyber Risk Rule

Protection of Critical Cyber Systems

(1) Identification and authentication requirements designed to prevent unauthorized access to Critical Cyber Systems that include: (i) A policy for memorized secret authenticator resets that includes criteria for passwords and when resets must occur, including procedures to ensure implementation of these requirements, such as password lockouts; and (ii) Documented and defined logical/virtual and physical security controls for components of Critical Cyber Systems that will not be subject to the requirements in paragraph (b)(1)(i) of this section.

In practice: Under the proposed rule, the identity platform owner sets password reset and lockout rules and keeps a documented list of components that cannot follow them, with the controls that protect those.

Protection of Critical Cyber Systems

(2)(i) Except as provided in paragraph (b)(2)(ii), multi-factor authentication, or other logical/virtual and physical security controls to supplement memorized secret authenticators (such as passwords) to provide risk mitigation commensurate to multi-factor authentication. [...] (ii) An owner/operator in compliance with the requirements in 49 CFR 192.631 and 195.446, as applicable, may rely on the physical security measures as applied to the control room in lieu of applying multi-factor authentication to specific industrial control system workstations in the covered control room [...]

In practice: As proposed, users sign in with a second factor, often a phishing-resistant method; where a system cannot take one, a documented compensating control is recorded for it.

Protection of Critical Cyber Systems

(3) Management of access rights based on the principles of least privilege and separation of duties. Where not technically feasible to apply these principles, the policies and procedures must describe compensating controls that the owner/operator applies.

In practice: As proposed, roles are modeled around least privilege, separation-of-duties rules block conflicting access, and requests, approvals and recurring access reviews are recorded.

Protection of Critical Cyber Systems

(4) Policies and procedures limit availability and use of shared accounts to those that are critical for operations, and then only if necessary. When the owner/operator uses shared accounts for operational purposes, the policies and procedures must ensure: (i) Access to shared accounts is limited through account management that uses principles of least privilege and separation of duties; (ii) Any individual who no longer needs access does not have knowledge of the memorized secret authenticator necessary to access the shared account; and (iii) Logs are maintained sufficient to enable positive user identification of access to shared accounts to enable forensic investigation following a cybersecurity incident.

In practice: The proposed rule limits shared accounts to operational need; passwords sit in a vault with checkout, are rotated when someone leaves, and each use is tied to a named person.

Protection of Critical Cyber Systems

(5) Regularly updated schedule for review of existing domain trust relationships to ensure their necessity and established and enforced policies to manage these relationships.

In practice: On a set schedule, as the proposed rule describes, the identity team reviews trust relationships between directories and tenants and removes the ones no longer needed.

Cybersecurity Operational Implementation Plan

(a) Requirement. Each owner/operator required to have a CRM program under this part must adopt a COIP.

In practice: Under the proposed rule, the operational implementation plan belongs to the cybersecurity program owner; identity architecture decisions often supply its access-control section.

Identification of Critical Cyber Systems

(a) Identifying information. The owner/operator must incorporate into its COIP a list of Critical Cyber Systems, as defined in the TSA Cybersecurity Lexicon, that provides, at a minimum, the following identifying information for each Critical Cyber System: (1) Identifier (system name or commercial name); and (2) System manufacturer/designer name.

In practice: The program team keeps the list of critical systems the proposed rule describes; identity uses it to decide which directories, privileged accounts and entitlements its inventory covers.

Protection of Critical Cyber Systems

(d) Logging policies. Logging policies sufficient to ensure logging data is-- (1) Stored in a secure and centralized system, such as a security information and event management tool or database on a segmented network that can only be accessed or modified by authorized and authenticated users; and (2) Maintained for a duration sufficient to allow for investigation of cybersecurity incidents as supported by a risk analysis and applicable standards or regulatory guidelines.

In practice: The security team runs the central log store; identity forwards sign-in, privileged activity and account change events there, retained for the period the policy sets.

Cybersecurity training and knowledge

(2) No owner/operator required to have a CRM program under this subpart may permit a cybersecurity-sensitive employee to access, or have privileges to access, a Critical Cyber System or an Information or Operational Technology system that is interdependent with a Critical Cyber System, unless that individual has received basic and role-based cybersecurity training.

In practice: Training records belong to the training owner; an access request rule can check a training-completion attribute before access to a critical system is granted.

Detection of cybersecurity incidents

(f) Ensure continuous collection and analysis of data for potential intrusions and anomalous behavior on Critical Cyber Systems and other Information and Operational Technology systems that directly connect with Critical Cyber Systems.

In practice: The security team does continuous detection; identity adds sign-in analytics and identity threat signals, such as an unusual login pattern, to its central monitoring platform.

Cybersecurity Assessment Plan

(a) Requirement for a Cybersecurity Assessment Plan. No later than 90 days from TSA's approval of the owner/operator's COIP, the owner/operator must submit to TSA a Cybersecurity Assessment Plan (CAP) sufficient to-- (1) Proactively assess the effectiveness of all policies, procedures, measures, and capabilities in the owner/operator's TSA-approved COIP as applied to all Critical Cyber Systems; and (2) Identify and resolve device, network, and/or system vulnerabilities associated with Critical Cyber Systems.

In practice: The assessment plan is owned by the program team; identity configuration, privileged access and access review results are often included in what gets assessed.

Documentation to establish compliance

For the purposes of the requirements in this subpart, upon TSA's request, the owner/operator must provide for inspection or copying the following types of information to establish compliance: [...] (d) Policy, procedural, and other documents that informed the development, and documented implementation of, the owner/operator's CRM program; (e) Data providing a “snapshot” of activity on and between Information and Operational Technology systems such as: (1) Log files; [...] (f) Any other records or documents necessary to determine compliance with this subpart.

In practice: Where the proposed rule's documentation requests apply, the program owner collects the material; identity supplies dated exports of logs, policy documents and access records, each with an owner.

Governance of the CRM program

(2) The accountable executive must be an individual who has the authority and knowledge necessary for the development, implementation, and managerial oversight of the TSA-approved CRM program, including cybersecurity administration, risk assessments, inspections and control procedures, and coordinating communications with the owner/operator's leadership and staff on implementation and sustainment of the CRM program. To the extent possible, the accountable executive should not be the Cybersecurity Coordinator or an individual responsible for management of Information or Operational Technology system or systems' administration.

Supply chain risk management

(b) Procurement documents and contracts, including service-level agreements, incorporate an evaluation by the owner/operator or qualified third-party of the cybersecurity measures implemented by vendors or service providers of goods, services, or capabilities that will be connected to, installed on, or used by the owner/operator's Critical Cyber Systems.

Protection of Critical Cyber Systems

(a) Network segmentation. Network segmentation measures that protect against access to, or disruption of, the Operational Technology system if the Information Technology system is compromised or vice versa. These measures must be sufficient to [...]

Protection of Critical Cyber Systems

(c) Patch management. Measures that reduce the risk of exploitation of unpatched systems through the application of security patches and updates for operating systems, applications, drivers, and firmware on Critical Cyber Systems consistent with the owner/operator's risk-based methodology. These measures must include: (1) A patch management strategy that ensures all critical security patches and updates on Critical Cyber Systems are current. This strategy must include: (i) The risk methodology for categorizing and determining criticality of patches and updates, and an implementation timeline based on categorization and criticality; and (ii) Prioritization of all security patches and updates on CISA's Known Exploited Vulnerabilities Catalog. (2) In instances where the owner/operator cannot apply patches and updates on specific Operational Technology systems without causing a severe degradation of operational capability to meet business critical functions, the owner/operator must provide an explanation for why the actions cannot be taken and a description and timeline of additional mitigations that address the risk created by not installing the patch or update within the recommended timeframe.

Protection of Critical Cyber Systems

(e) Secure back-ups. Policies that ensure all Critical Cyber Systems are backed-up on a regular basis consistent with operational need for the information, the back-ups are securely stored separate from the system, and policies require testing the integrity of back-ups to ensure that the data is free of known malicious code when the back-ups are made.

Detection of cybersecurity incidents

The owner/operator must incorporate into its COIP policies, procedures, and capabilities sufficient to detect and respond to cybersecurity threats to, and anomalies on, Critical Cyber Systems that, at a minimum-- (a) Defend against malicious email, such as spam and phishing emails, to preclude or mitigate against adverse impacts to operations; (b) Block ingress and egress communications with known or suspected malicious internet Protocol addresses; (c) Control impact of known or suspected malicious web domains or web applications, such as by preventing users and devices from accessing malicious websites; (d) Block and defend against unauthorized code, including macro scripts, from executing; (e) Monitor and/or block connections from known or suspected malicious command and control servers (such as Tor exit nodes, and other anonymization services)

Capabilities to respond to a cybersecurity incident

The owner/operator must incorporate into its COIP capabilities to respond to cybersecurity incidents affecting Critical Cyber Systems that, at a minimum-- (a) Audit unauthorized access to internet domains and addresses; (b) Document and audit any communications between the Operational Technology system and an internal or external system that deviates from the owner/operator's identified baseline of communications; (c) Identify and respond to execution of unauthorized code, including macro scripts; and (d) Define, prioritize, and drive standardized incident response activities, such as Security Orchestration, Automation, and Response (SOAR).

Reporting cybersecurity incidents

(a) Unless otherwise directed by TSA, each owner/operator identified in Sec. 1586.101(b) must notify CISA of any Reportable Cybersecurity Incidents, as defined in the TSA Cybersecurity Lexicon, as soon as practicable, but no later than 24 hours after a Reportable Cybersecurity Incident is identified.

Cybersecurity Incident Response Plan

(a) The owner/operator must incorporate into its COIP an up-to-date Cybersecurity Incident Response Plan (CIRP) for the owner/operator's Critical Cyber Systems to reduce the impacts of a cybersecurity incident that causes, or could cause, operational disruption or significant impacts on business-critical functions.