This document is intended to provide information on how pipeline owners/operators can address
the United States Transportation Security Administration’s (TSA) security directive aimed athardening this critical infrastructure sector.

Baseline Security
Measures

Enhanced Security
Measures

Forescout Solution

Asset Management
Employ mechanisms to maintainaccurate inventory and to detect
unauthorized components.

The Forescout platform
continuously provides an up-todate asset inventory with detailed
device information(vendor/model information,firmware version, serial numbersetc.), vulnerabilities andconfiguration change logs for all
network assets. This information
is obtained through purposebuilt, continuous passive
monitoring and optional active
scanning techniques for OT/ICS
assets. Furthermore, users canleverage our asset baselining
capabilities to define device
compliance policies (i.e., desiredconfiguration and open ports),
identify and report oncompliance deviations in realtime.

Develop and maintain acomprehensive set of
network/system architecture
diagrams or otherdocumentation, including nodes,
interfaces, remote and thirdparty connections, andinformation flows.

Review network connections
periodically, including remoteand third-party connections.

The Forescout platform passively
monitors all network
communications to provide realtime visibility into assets andflows. Users can leverageinteractive device mapping tounderstand communication
traffic flow between devices,volume and protocol employed.
Advanced visual analytics provide
a complete representation offlows for both real-time andforensic analysis. Traffic flows canbe mapped to logical taxonomy
of users, applications, services
and devices to understandIdentify

Establish and document policies
and procedures for assessing
and maintaining configuration
information, for tracking changes
made to the pipeline cyberassets, and forpatching/upgrading operating
systems and applications. Ensurethat the changes do not
adversely impact existing
cybersecurity controls.

Develop a detailed inventory forevery endpoint.

Baseline Security
Measures

Enhanced Security
Measures

Forescout Solution
current communication patterns,
and define and enforce
segmentation policies.

Review and assess pipeline cyberasset classification as critical or
non-critical at least every 12
months.

The Forescout platform provides
agentless, real-time asset
discovery, profiling,classification/prioritization andHW/ SW inventory views acrossboth IT and OT/ICS
environments. Deep Packet
Inspection engines automaticallydetermine the role for eachdevice on the network(s), alongwith providing asset inventory
information - such as model
number, firmware version andserial number (if available) within
the network protocols. All asset
inventory data is available forexport and via API to be
consumed by asset repositories,
compliance reporting systems orother systems.

Business Environment
Ensure that any change that adds
control operations to a noncritical pipeline cyber asset
results in the system being
recognized as a critical pipeline
cyber asset and enhanced
security measures being applied.

The Forescout platform tracks
and validates any changes toasset software or firmware andmaintains an accurate devicechange log. It further ensuresdevice compliance and validateschanges performed to any
Windows OS based system inreal-time and with the correctuser privileges.

Governance
Establish and distributecybersecurity policies, plans,
processes and supporting
procedures commensurate withthe current regulatory, risk, legal

N/ABaseline Security
Measures

Enhanced Security
Measures

Forescout Solution

and operational environment.

Review and assess all
cybersecurity policies, plans,processes, and supporting
procedures regularly, not toexceed 36 months, or when there
is a significant organizational ortechnological change. Update asnecessary.

Review and assess all
N/Acybersecurity policies, plans,processes, and supporting
procedures regularly, not toexceed 12 months, or when there
is a significant organizationalchange. Update as necessary.

Risk Management Strategy
Develop an operationalframework to ensure
coordination, communication
and accountability for
information security on andbetween the control systems
and enterprise networks.

The Forescout platform provides
detailed OT/ICS asset
information, security andoperational risk scores for eachdevice. It continuously monitors
and alerts on undesiredcommunication between
enterprise and control system
networks. These capabilities
combined with Forescout’s
integration with configuration
management/CMDB solutions,
SIEMs, data analytics andcompliance reporting tools
enable preventative andpredictive device maintenancewith superior operational andrisk-related information.

Risk Assessment
Establish a process to identify
and evaluate vulnerabilities andcompensating security controls.

Ensure threat and vulnerability
information received frominformation sharing forums andsources are made available tothose responsible for assessing
and determining the appropriate
course of action.

The Forescout platform’s
extensive OT/ICS vulnerability
database and analysis views
allow organizations to quickly
identify critical vulnerabilities that
impact devices and networks. It
continuously monitors, logs anddetects potential OT/ICS threats
or deviations from baselineBaseline Security
Measures

Enhanced Security
Measures

Forescout Solution
communications by combining
signature, behavioral andanomaly-based detection
techniques.
The platform monitors for known
threats internally and externally,
and when a threat is detected, it
can provide automated controls
to manage network access.

Access Control
Establish and enforce uniqueaccounts for each individualuser and administrator,
establish security requirements
for certain types of privileged
accounts, and prohibit thesharing of these accounts.
In instances where systems
do not support unique user
accounts, then implement
appropriate compensating
security controls (e.g.,physical controls).

Restrict user physical accessto control systems and control
networks through the use of
appropriate controls. Employ
more stringent identity andaccess management practices(e.g., authenticators,password- construct, accesscontrol).

Protect

Ensure that user accounts aremodified, deleted, or deactivated expeditiously for
personnel who no longer require
access or are no longer
employed by the company.
Establish and enforce access
control policies for local andremote users. Procedures andcontrols should be in place forapproving and enforcing policy
for remote and third-party
connections.
Ensure appropriate
segregation of duties is inplace. In instances where thisThe Forescout platform cansee when an OT/ICS asset isaccessed remotely and,depending on the type ofaccess, who is logging into thedevice.
Furthermore, the platform
allows for granular Role Based
Access Control policies to limit
access and privileges toinformation collected by theplatform, for both local andexternally authenticated users(e.g., LDAP/AD).
Forescout’s integration with
Privileged Access
Management tools can help
prevent privileged credential
misuse and unauthorizednetwork access

Monitor physical and remoteuser access to critical pipeline
cyber assets.

The Forescout platform candetect changes made to an
OT/ICS asset by a user, such asEnhanced Security
Measures

Baseline Security
Measuresis not feasible, apply
appropriate compensating
security controls.

Forescout Solution
new firmware, program orconfiguration downloads, as well
as changes made to IT endpoints
managed by the Forescout
platform.
The platform’s segmentation
capabilities provide the ability tomonitor and segment accessacross devices, networks or sites.

Change all default passwords for
new software, hardware, etc.,
upon installation. In instanceswhere changing default
passwords is not technicallyfeasible (e.g., a control systemwith a hard-coded password),implement appropriatecompensating security controls(e.g., administrative controls).

Employ mechanisms to support
the management of accounts.

The Forescout platform detects
the use of default credentials or ifthey haven’t been changed. In
addition, the platform canidentify if an active directoryuser’s password has expired andcan respond in a variety of ways.
The platform enables
compensating controls including
passive, real-time network
monitoring and dynamic network
segmentation.

Awareness and Training

Protect

Ensure that all persons
requiring access to theorganization’s pipeline cyberassets receive cybersecurity
awareness training.

Provide role-based security
training on recognizing andreporting potential indicators ofsystem compromise prior toobtaining access to the criticalpipeline cyber assets.

N/A

Establish and execute a cyberthreat awareness program for
employees. This program should
include practical
exercises/testing.

Data Security and Information Protection
Establish and implement policies
and procedures to ensure dataprotection measures are in place,including identifying critical dataand establishing classification ofdifferent types of data,
establishing specific handling

The Forescout platform storesand preserves information fully
on-premises, ensuring securedata protection (at rest & intransit) for IT, OT and IoT
networks. At rest, data is stored
in a secure environment with

Baseline Security
Measures

Enhanced Security
Measuresprocedures, and protections anddisposal.

Forescout Solution
underlying code that iscontinuously tested against
attacks and vulnerabilities. In
transit data is secured via
multiple methods.

Protective Technology
Segregate and protect thepipeline cyber assets fromenterprise networks and theinternet using physicalseparation, firewalls and otherprotections.

The Forescout platform monitors
all OT, IT and IOT devices toensure real-time alerting should adevice fall out of it establishedsegment or established dataflows. The platform also
automatically manages thenetwork controls according toestablished policies.

Regularly validate that technicalcontrols comply with theorganization’s cybersecurity
policies, plans and procedures,and report results to seniormanagement.

The Forescout platform’s
industrial threat library andanomaly detection engines
monitor communications todetect weak security posture(e.g., default credentials or
insecure protocols) and intrusion
attempts along withrecommendations on responseactions. The platform enables theestablishment of control policies
to restrict access to the network
and its devices, and continuously
monitor devices for policy
compliance and violation tosegmentation policies.

Implement technical orprocedural controls torestrict the use of pipeline
cyber assets for onlyapproved activities.

DetectAnomalies and Events
Implement processes togenerate alerts and log
cybersecurity events in
response to anomalous activity.
Review the logs and respond toalerts in a timely manner.

The Forescout platform provides
real-time visibility into network
communications, supporting thecreation of informed network
access controls for OT/ICS
devices. In addition, it detects
weak security posture (e.g.,default credentials or insecure
protocols) and intrusion attempts

Enhanced Security
Measures

Baseline Security
Measures

Forescout Solution
at their earliest stages, providing
recommendations on responseactions. It also logs successful
and failed authentication
attempts for complete historical
records of host activities
including firmware changes, newprotocols, new roles, etc.

Security Continuous Monitoring
Monitor for unauthorized accessor the introduction of malicious
code or communications.

Conduct cyber vulnerability
assessments as described inyour risk assessment
process.

The Forescout platform enables
field device access monitoring,alerting, and reporting on
authorized or unauthorizedengineering, contractor, orintegrator activities, helping toensure operational and business
policies are adhered to. All thisinformation is stored, in detail
and with associated risk ratings,
in the asset inventory.
Utilize independent assessors to
conduct pipeline cyber security
assessments.

The Forescout platform provides
real-time visibility into all network
communications allowingorganizations to harden their
network access controls,
ensuring least privilege. The
platform also logs all successful
and failed authentication
attempts, file operations, andmaintains a complete history of
all host activities, including
firmware changes. The Forescout
platform features an extensive
database of known OT/ICS
vulnerabilities and related views
to quickly identify areas that may
negatively affect critical network
devices. Forescout’s Industrial
Threat Library (ITL) features morethan 2100+ behavioral-based
threat indicators, which
combined with the platform’sBaseline Security
Measures

Enhanced Security
Measures

Forescout Solution
advanced anomaly detection
capabilities allow foridentification of both known andunknown (zero-day) threats.

Detection Processes
The Forescout platform detects
weak security posture (e.g.,default credentials or insecure
protocols) and intrusion attempts
at their earliest stages, providing
recommendations on responseactions. All alerts, user andnetwork event logs can be sent toSIEMs, log management, andcorrelation engines.

Perform regular testing ofintrusion and malware detection
processes and procedures.

N/A

DetectEstablish technical or procedural
controls for cyber intrusion
monitoring and detection.

Respond

Response Planning
Establish policies and proceduresfor cybersecurity incident
handling, analysis and reporting,including assignment of thespecific roles/tasks to individuals
and teams.

Conduct cybersecurity incident
response exercises
periodically.

The Forescout platform includes
case management capabilities
to group alerts which are part ofa new or ongoing investigation
effort, to support the incident
investigation and handlingprocess.

Establish and maintain acyber-incident response
capability.

Establish and maintain aprocess that supports 24hours a day cyber incidentresponse.

N/ACommunications
Report significant cyberincidents to senior
management; appropriate
federal, state, local, tribal,and territorial (SLTT)
entities; and applicable
ISAC(s).

Pipeline operators
should follow thenotification criteria in
Appendix B

N/ABaseline Security
Measures

Enhanced Security
Measures

Forescout Solution

Mitigation
Ensure the organization’s
response plans and procedures
include mitigation measures tohelp prevent further impacts.

N/ARecover

Recovery Planning
Establish a plan for therecovery and reconstitution ofpipeline cyber assets within atimeframe to align with theorganization’s safety andbusiness continuity objectives.

The Forescout platform canensure replaced or recovered
assets meet established policies
and criteria that have beenestablished.

Improvements
Review the organization's cyberrecovery plan annually. Update asnecessary.

N/A

Source: TSA Pipeline Security Guidelines Facility Security Measures - March 2018 (with Change 1 (April 2021))© 2021 Forescout Technologies, Inc. All rights reserved. Forescout Technologies, Inc. is a Delaware corporation. A list of our trademarks andpatents can be found at www.forescout.com/company/legal/intellectual-property-patents-trademarks. Other brands, products, or service names
may be trademarks or service marks of their respective owners.