NIST announces the release of a major update to Special Publication (SP) 800-160 Volume 2, Revision 1, Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. The guidance helps organizations anticipate, withstand, recover from, and adapt to adverse conditions, stresses, and compromises on systems – including hostile and increasingly destructive cyber-attacks from nation-states, criminal gangs, and disgruntled individuals.
This update to NIST’s flagship cyber resiliency publication offers significant new content and support tools for organizations to defend against cyber-attacks. The document suggests how to limit the damage that adversaries can inflict by impeding their lateral movement, increasing their work factor, and reducing their time on target. In particular, SP 800-160, Volume 2, Revision 1:
The publication also adds a new appendix containing an analysis of the potential effects of cyber resiliency on adversary tactics, techniques, and procedures used to attack operational technologies, including industrial control systems (ICS). The analysis shows how cyber resiliency approaches and controls described in NIST guidance can be used to reduce the risks associated with adversary actions that threaten ICSs and critical infrastructure sectors.