Navy’s MOSAICS Framework Revolutionizes Cyber Defense for Critical Infrastructure

Navy’s MOSAICS Framework Revolutionizes Cyber Defense for Critical Infrastructure

Summary

• MOSAICS Framework: A cybersecurity framework developed with the U.S. Navy to protect industrial control systems.
• Objective: Strengthen the security of critical infrastructure.
• Collaborative Endeavor: Developed with the Naval Information Warfare Center (NIWC) Atlantic.
• Adaptive Design: Built from interchangeable, commercially available tools.
• Regulatory Synergy: Moving toward inclusion in Defense Department building requirements.

What MOSAICS is

As critical infrastructure becomes more digital, protecting it matters more. The U.S. Navy has highlighted MOSAICS, a cybersecurity framework developed with the Naval Information Warfare Center (NIWC) Atlantic, to help protect critical infrastructure from cyberattacks.

MOSAICS stands for More Situational Awareness for Industrial Control Systems. It is a government-led, vendor-neutral framework that brings together commercial off-the-shelf sensors, analytics, visualization and automated response tools. The goal is to detect and characterize attacks on operational technology in near real time and respond quickly.

Adaptive and Tailored Defense

Flexibility is one of MOSAICS’s main strengths. Because it is vendor-neutral, organizations can plug in tools that fit their own systems. Bases differ. So do utilities.

Defenders get a single picture of what is happening across industrial control systems. They can act fast.

Collaboration and Synergy

MOSAICS grew out of collaboration between military and civilian partners. NIWC Atlantic has worked with experts from several organizations, including national laboratories and research centers, to build it.

That collaboration gives the framework a broad base of experience, which matters for systems as varied as power grids, water plants, shipyards and the utility networks that keep military bases running.

Regulatory Compliance

NIWC Atlantic’s work is moving MOSAICS toward inclusion in Defense Department building-code requirements. The framework has already been adopted in Navy risk-management and defense-in-depth architectures.

It is also relevant to other critical infrastructure sectors, including energy, water, transportation, and communication systems. Aligning with regulatory expectations builds trust in those sectors.

Lessons for other operators

Cyber threats to infrastructure are not slowing down. MOSAICS gives operators a practical way to see and stop attacks on industrial control systems using tools they can buy today.

The challenge will be keeping it current as threats change, since the attackers who target industrial control systems keep finding new ways in. For any organization that runs industrial equipment, it is a useful model for layered, flexible defense.

Expect more attention to frameworks like this as attacks on infrastructure grow.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.