CISA’s 2030 Strategy Faces a Legacy Trust Challenge

Summary

The article argues that CISA’s 2030 goals require operators to reassess trust in OT devices, software, identities, and AI agents, enforce access limits, and test whether access can be revoked without interrupting essential services.

Key points

• Long-lived OT devices can retain outdated credentials, remote connections, or trust assumptions as firmware, suppliers, and dependencies change.
• Operators should verify software before deployment, protect signing keys, and reassess access when suppliers or roles change.
• A valid software signature confirms origin and integrity, not whether the software is safe for a particular environment.
• AI agents should have narrowly defined access to models, tools, data, and credentials, with human approval required for consequential actions.
• Operators should log agent actions and the authority used, and enforce controls consistently across model changes and cloud platforms.
• Resilience exercises should test isolation, credential replacement, and restoration of verified software while essential services continue.
• The article calls for procurement contracts to assign responsibility for maintaining security capabilities after deployment.