NIST
NIST's guidance for OT
NIST is the US National Institute of Standards and Technology. Its SP 800 series is used worldwide, including by companies that have no US requirements.
The publications
Three publications that concern XoT
SP 800-82 – OT security
Guidance for security in industrial control systems. The current edition is Rev. 3 from 2023. NIST has started work on the next edition.
SP 800-53 – catalogue of controls
A long list of security controls, organised in families. SP 800-82 builds on it and tailors it for OT.
SP 800-207 – zero trust
Describes an architecture where nothing is trusted because of where it sits on the network. XoT is built on the same principle.
SP 800-82
What SP 800-82 recommends
OT equipment often cannot be updated and cannot tolerate downtime. That is why SP 800-82 recommends, among other things:
- dividing the network into separate segments
- protecting the boundaries between the segments
- controlling and logging remote access
- using compensating controls when equipment cannot be updated
XoT helps with all four. One Lock can protect a single machine without rebuilding the network. Vendors only reach the machine the policy covers.
SP 800-53
The controls XoT helps with
The table shows the SP 800-53 controls that concern access, identity, networks and logging. The last column shows whether XoT helps. The rows where XoT helps are highlighted in green.
| Control | Area | XoT |
|---|---|---|
| AC-3 | Access enforcement | Yes |
| AC-4 | Information flow enforcement | Yes |
| AC-5 | Separation of duties | Partly |
| AC-6 | Least privilege | Yes |
| AC-12 | Session termination | Yes |
| AC-17 | Remote access | Yes |
| IA-2 | Identification and authentication of users, with MFA | Yes |
| IA-3 | Device identification and authentication | Yes |
| IA-5 | Authenticator management | Partly |
| SC-7 | Boundary protection | Yes |
| SC-8 | Transmission confidentiality and integrity | Yes |
| SC-13 | Cryptographic protection | Partly |
| SC-23 | Session authenticity | Yes |
| AU-12 | Audit record generation | Yes |
| AU-6 | Audit record review, analysis and reporting | Partly |
| AU-14 | Session audit | Partly |
| SI-4 | System monitoring | Partly |
| IR-4 | Incident handling | Partly |
| CM-8 | System component inventory | Partly |
| SI-2 | Flaw remediation | No |
Family by family
How XoT helps
Access – AC
The Lock enforces the policies. Traffic is allowed per port and protocol, also between two Locks. Access can be temporary and require approval. When the ticket expires, the connection is closed. An administrator can also set how long a session may last. Remote access goes through the XoT-Bridge, with no inbound ports. Roles in the XMS let different people create and activate policies.
Identity – IA
Both people and devices have their own certificates. So even a PLC or a server has its own identity. People sign in through your directory with multi-factor authentication. You manage the people's accounts in your directory.
System and communications protection – SC
Everything is denied by default, and the equipment behind the Lock is invisible to unauthorised users. Traffic is encrypted with WireGuard. The user and the Lock check each other twice a minute, so nobody can take over an open session.
Logging and monitoring – AU and SI
The XMS logs who connected, to which equipment and through which policy. Every change to policies and access rights is logged too, with who made it and when. XoT-WebAccess sessions are recorded automatically. The logs can be sent to your SIEM, for example Splunk, IBM QRadar or Wazuh. The Lock can send a copy of the traffic to intrusion detection systems.
Incidents – IR
If your SIEM detects a threat, it can revoke access or isolate a session in XoT. Incident procedures are your responsibility.
Flaw remediation – SI-2
XoT does not fix flaws in your equipment. The Lock makes equipment that cannot be updated invisible to unauthorised users. It is a compensating control.
SP 800-207
How XoT fits a zero trust architecture
SP 800-207 splits access into two parts. One part decides on access. Another part enforces the decision, close to what is being protected.
The XMS makes the decisions
The XMS holds the policies and verifies who the user is. It issues time-limited tickets. The XMS carries no traffic to the equipment.
The Lock enforces them
The Lock sits in front of the equipment. It only lets through the traffic that the ticket and the policy allow.
Every connection is encrypted and verified, wherever it sits on the network. The check happens twice a minute, not only when the connection is opened.
Encryption
About FIPS 140
US authorities often require encryption to be validated under the FIPS 140 standard. That applies, for example, to US defence suppliers that handle controlled unclassified information under SP 800-171.
XoT encrypts traffic with WireGuard. The algorithms in WireGuard are not validated under FIPS 140. Does your organisation have FIPS requirements? Then contact us before you choose XoT.
Common questions
Do we have to follow NIST?
Only if a contract or a customer requires it. Many organisations still use NIST as guidance, because the publications are free to read and thorough.
Is XoT certified against NIST?
NIST does not certify products against SP 800-53 or SP 800-82. We describe what XoT does in relation to the controls.
How does NIST relate to NIS2?
NIS2 says what you must achieve. NIST describes one way of doing it. The SP 800-53 controls can support you when you work to meet the NIS2 requirements.
This is our interpretation of NIST's publications. It is not a certification.
Ask for material
We are happy to describe how XoT relates to the SP 800-53 controls you have chosen.