Operational Technology

Depending on network architecture, compromise of a radio within the network may enable an attack to propagate through it. Weak segregation measures may allow for network compromise through the introduction of rogue stations within the network.

To mitigate the associated risk, you should segregate RF communications as much as possible, and enforce at the physical RF layer. That is, limit communications to outstation-base and base-outstation only.

Additionally, segregation of the radio channels could be achieved through numerous ways, either from functions built into the radio or using TCP/IP encapsulation (discussed further in Principle 8: Log and audit within the RF network). The NCSC also recommend that the radio network is broken out into independent clusters, thereby limiting the ability for attacks to propagate across the entire network.

Segregation of networks can also improve the resilience and availability of the radio network. Limiting the impact of an availability incident to a smaller group of radio stations can result in faster response and recovery.