Ernie Hayden CISSP CEH GICSP Executive Consultant
|
|
|
- Conrad Marshall
- 10 years ago
- Views:
Transcription
1 Ernie Hayden CISSP CEH GICSP Executive Consultant V This Presentation is Proprietary to Securicon, Inc. Any use of this document without express written approval from Securicon is strictly prohibited.
2 The Opportunity The Approach Current Framework Future Plans/Changes Q&A 1
3 Major Global Consumer Products Company Hired Securicon to Help with ICS Security Key Needs Kick-start ICS Security for 20+ global factories Begin assessing ICS Security program from organizational perspective as well as at plants Assist in hiring ICS Security Lead Develop framework for implementing ICS Security across the corporation Caveat Allowed to Discuss Framework but Company Wishes to Remain Anonymous 2
4 Key Questions to Be Answered Purpose? Functions of Framework? Scope? 3
5 Philosophy: ICS systems are the foundation of the production systems and factories Without their safe, secure and reliable operations production and shipments negatively impacted Customer Satisfaction Corporate Revenue The Framework establishes the key elements of ICS security for the plants and factory operations For: ICS architecture, design, procurement, operation, maintenance, repair and decommissioning Overall Intent: Compliment and integrate with overall cyber and physical security controls for corporation and associated regional/national laws affecting the company 4
6 Criteria: Does it help analyst/policymaker understand and provide structure to a complex phenomena (i.e., ICS Security)? Does it help focus on important dimensions of policy design? Does it help generate additional hypotheses for possible future action? Does it offer guidance for prioritizing actions? Reference: Border Security: The Complexity of the Challenge 5
7 Key Reference: ISA Security of Industrial Automation and Control Systems Master Glossary (March 2013) ISA-TR ICS Defined As: Personnel, hardware and software that can affect or influence the safe, secure, and reliable operation of an industrial process Involved in the operation of the industrial processes and that can affect or influence its safe, secure and reliable operation 6
8 Systems Include ICS including distributed control systems (DCS) Programmable Logic Controllers (PLCs) Remote Terminal Units (RTUs) Intelligent Electronic Devices (IED) SCADA Networked Electronic Sensing and Control, Monitoring and Diagnostic Systems Includes Safety Instrumented Systems (SIS) Associated Information Systems Advanced/Multivariable Control, Online Optimizers, Dedicated Equipment Monitors, Process Historians, Manufacturing Execution Systems (MES) Associated Human, Network or Machine Interfaces for Control, Safety and Mfg Ops 7
9 Specifically Expressed in Framework Needed to Aid in IT/OT Communications A - Availability I - Integrity C - Confidentiality 8
10 REFERENCE MODEL: is a framework for understanding significant relationships among entities in select environments and for development of consistent standards and specifications supporting that environment. Basis: Purdue Model 9
11 Now What Standards to Follow? 10
12 11
13 AC Access Control AT Awareness & Training** AU Audit & Accountability BC Business Continuity CM Configuration Management** IR Incident Response ** = Initial Areas of Focus PM Program Management** PS Personnel & Security RA Risk Analysis** SC System & Communication Protection SA System and Services Acquisition & Development** Similar to NIST Security Control Classes, Families & Identifiers 12
14 ISA 99/IEC Industrial Automation and Control Systems Security Standards NIST , Guide to Industrial Controls Systems Security (R2) ISO/IEC 27001/2:2005: Information Technology Security Techniques Information Security Management Systems ICS-CERT Recommended Practices Recommended-Practices 13
15 Next Step The Control Matrix 14
16 Many formatting ideas taken from NIST Cybersecurity Framework 15
17 Risk & Impact Analysis 16
18 Framework is intended to provide guidance and a semblance of criteria in order to ascertain ICS impact levels to be ultimately used to categorize ICS components and systems for risk assessments Reference: , Revision 2, Page 88 17
19 18
20 ICS Cybersecurity Model/Grading 19
21 20
22 Additional Security Guidance 21
23 Essential Function A function or capability that is required to maintain health, safety, the environment and availability of equipment under control. 22
24 Security measures shall not adversely affect essential functions of a high availability ICS unless supported by a risk assessment. Security measures should not cause loss of protection, loss of control, loss of view or loss of other essential functions. Access controls shall not prevent operation of the essential functions. Essential functions of the ICS shall be maintained if zone boundary protection goes into fail-close and/or island mode A denial of service (DoS) event on the ICS or SIS network shall not prevent the SIS and its associated functions from acting. Reference: ANSI/ISA ( )-2013 Page 24 23
25 This section focuses on the need to allow for exceptions to the Framework and associated Matrix Exceptions need to be reviewed for business risk and approved by plant management and the security organization Exceptions are intended to be reviewed at least annually 24
26 Systems out of compliance are subject to disconnection from company network Employees disciplinary action Vendors and 3 rd Parties termination of contract and/or loss of business with the company 25
27 Purpose Functions of a Conceptual Framework Scope Framework Statement Primary ICS Security Philosophy Primary Network Reference Model Primary ICS Security Standards Risk and Impact Analysis for ICS ICS Cybersecurity Maturity Model/Grading Common Control System Constraints Exceptions Enforcement Appendix A: ICS Security Controls Matrix 26
28 Future Plans & Changes for the Framework 27
29 Framework being used globally Plant ICS security assessments in progress using Framework for reference Matrix continues to be augmented and updated Challenges with rate of change to ISA/IEC Documents More work required to ensure it is viable 28
30 Ernie Hayden CISSP CEH GICSP Executive Consultant (C)
Altius IT Policy Collection Compliance and Standards Matrix
Governance IT Governance Policy Mergers and Acquisitions Policy Terms and Definitions Policy 164.308 12.4 12.5 EDM01 EDM02 EDM03 Information Security Privacy Policy Securing Information Systems Policy
Looking at the SANS 20 Critical Security Controls
Looking at the SANS 20 Critical Security Controls Mapping the SANS 20 to NIST 800-53 to ISO 27002 by Brad C. Johnson The SANS 20 Overview SANS has created the 20 Critical Security Controls as a way of
Using ISA/IEC 62443 Standards to Improve Control System Security
Tofino Security White Paper Version 1.2 Published May 2014 Using ISA/IEC 62443 Standards to Improve Control System Security Contents 1. Executive Summary... 1 2. What s New in this Version... 1 3. Why
This is a preview - click here to buy the full publication
TECHNICAL REPORT IEC/TR 62443-3-1 Edition 1.0 2009-07 colour inside Industrial communication networks Network and system security Part 3 1: Security technologies for industrial automation and control systems
IT Security Management Risk Analysis and Controls
IT Security Management Risk Analysis and Controls Steven Gordon Document No: Revision 770 3 December 2013 1 Introduction This document summarises several steps of an IT security risk analysis and subsequent
Security and Privacy Controls for Federal Information Systems and Organizations
NIST Special Publication 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems JOINT TASK FORCE TRANSFORMATION INITIATIVE This document contains excerpts from NIST Special Publication
TECHNICAL SPECIFICATION
TECHNICAL SPECIFICATION IEC/TS 62443-1-1 Edition 1.0 2009-07 colour inside Industrial communication networks Network and system security Part 1-1: Terminology, concepts and models INTERNATIONAL ELECTROTECHNICAL
Security Compliance In a Post-ACA World
1 Security Compliance In a Post-ACA World Security Compliance in a Post-ACA World Discussion of building a security compliance framework as part of an ACA Health Insurance Exchange implementation. Further
AF Life Cycle Management Center
AF Life Cycle Management Center Avionics Weapon Systems Cybersecurity Risk Management Framework Assessment & Authorization Update Harrell Van Norman AFLCMC/EZAS Cybersecurity Technical Expert [email protected]
CTR System Report - 2008 FISMA
CTR System Report - 2008 FISMA February 27, 2009 TABLE of CONTENTS BACKGROUND AND OBJECTIVES... 5 BACKGROUND... 5 OBJECTIVES... 6 Classes and Families of Security Controls... 6 Control Classes... 7 Control
WORKSHOP Rethinking Cyber Security for Industrial Control Systems
WORKSHOP Rethinking Cyber Security for Industrial Control Systems Bob Mick, Workshop Moderator VP Emerging Technologies ARC Advisory Group [email protected] 1 Re-Thinking Cyber Security Why Re-Thinking?
Cyber Risk Mitigation via Security Monitoring. Enhanced by Managed Services
Cyber Risk Mitigation via Security Monitoring Enhanced by Managed Services Focus: Up to But Not Including Corporate and 3 rd Party Networks Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance
White Paper. 7 Steps to ICS and SCADA Security. Tofino Security exida Consulting LLC. Contents. Authors. Version 1.0 Published February 16, 2012
Tofino Security exida Consulting LLC White Paper Version 1.0 Published February 16, 2012 Contents Executive Summary... 1 Step 1 Assess Existing Systems... 1 Step 2 Document Policies & Procedures... 3 Step
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector V.2 Final Draft May 1, 2014 [email protected] This revision incorporates comments from the public. Page Use case 1 Comments
Session 14: Functional Security in a Process Environment
Abstract Session 14: Functional Security in a Process Environment Kurt Forster Industrial IT Solutions Specialist, Autopro Automation Consultants In an ideal industrial production security scenario, the
Bellingham Control System Cyber Security Case Study
Bellingham Control System Cyber Security Case Study Marshall Abrams Joe Weiss Presented at at 2007 Annual Computer Security Applications Conference Case Study Synopsis Examine actual control system cyber
CRR-NIST CSF Crosswalk 1
IDENTIFY (ID) Asset Management (AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative
Innovative Defense Strategies for Securing SCADA & Control Systems
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: [email protected] Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet
ISACA rudens konference
ISACA rudens konference 8 Novembris 2012 Procesa kontroles sistēmu drošība Andris Lauciņš Ievads Kāpēc tēma par procesa kontroles sistēmām? Statistics on incidents Reality of the environment of industrial
Code of Practice for Cyber Security in the Built Environment
Brochure More information from http://www.researchandmarkets.com/reports/3085299/ Code of Practice for Cyber Security in the Built Environment Description: This code of practice explains why and how cyber
CONTINUOUS MONITORING
CONTINUOUS MONITORING Monitoring Strategy Part 2 of 3 ABSTRACT This white paper is Part 2 in a three-part series of white papers on the sometimes daunting subject of continuous monitoring (CM) and how
FSIS DIRECTIVE 1306.3
UNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC FSIS DIRECTIVE 1306.3 REVISION 1 12/13/12 CONFIGURATION MANAGEMENT (CM) OF SECURITY CONTROLS FOR INFORMATION SYSTEMS
Help for the Developers of Control System Cyber Security Standards
INL/CON-07-13483 PREPRINT Help for the Developers of Control System Cyber Security Standards 54 th International Instrumentation Symposium Robert P. Evans May 2008 This is a preprint of a paper intended
Get Confidence in Mission Security with IV&V Information Assurance
Get Confidence in Mission Security with IV&V Information Assurance September 10, 2014 Threat Landscape Regulatory Framework Life-cycles IV&V Rigor and Independence Threat Landscape Continuously evolving
Security Testing in Critical Systems
Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base
1 ISA Security Compliance Institute
1 ISA Security Compliance Institute Internationally Accredited Conformance Scheme ISASecure certification programs are accredited as an ISO/ IEC Guide 65 conformance scheme and ISO/IEC 17025 lab operations
Discussion Draft of the Preliminary Cybersecurity Framework Illustrative Examples
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 Discussion Draft of the Preliminary Cybersecurity Framework Illustrative Examples The
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems. Samuel R. Ashmore Margarita Castillo Barry Gavrich
NIST 800-53A: Guide for Assessing the Security Controls in Federal Information Systems Samuel R. Ashmore Margarita Castillo Barry Gavrich CS589 Information & Risk Management New Mexico Tech Spring 2007
Which cybersecurity standard is most relevant for a water utility?
Which cybersecurity standard is most relevant for a water utility? Don Dickinson 1 * 1 Don Dickinson, Phoenix Contact USA, 586 Fulling Mill Road, Middletown, Pennsylvania, USA, 17057 (*correspondence:
System Security Certification and Accreditation (C&A) Framework
System Security Certification and Accreditation (C&A) Framework Dave Dickinson, IOAT ISSO Chris Tillison, RPMS ISSO Indian Health Service 5300 Homestead Road, NE Albuquerque, NM 87110 (505) 248-4500 fax:
An Introduction to SCADA-ICS System Security. Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015
An Introduction to SCADA-ICS System Security Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015 Overview Supervisory Control And Data Acquisition (SCADA) for Industrial Control Systems
Manufacturing Operations Management. Dennis Brandl
Manufacturing Operations Management Dennis Brandl BR&L Consulting Peter Owen Eli Lilly & Co Dennis Brandl 1 Objectives Review the ISA 95 standards and how they are being used in companies like Eli Lilly
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. Election Assistance Commission Compliance with the Requirements of the Federal Information Security Management Act Fiscal
Olav Mo, Cyber Security Manager Oil, Gas & Chemicals, 28.09.2015 CASE: Implementation of Cyber Security for Yara Glomfjord
Olav Mo, Cyber Security Manager Oil, Gas & Chemicals, 28.09.2015 CASE: Implementation of Cyber Security for Yara Glomfjord Implementation of Cyber Security for Yara Glomfjord Speaker profile Olav Mo ABB
Security Controls Assessment for Federal Information Systems
Security Controls Assessment for Federal Information Systems Census Software Process Improvement Program September 11, 2008 Kevin Stine Computer Security Division National Institute of Standards and Technology
Ernie Hayden CISSP CEH Executive Consultant
Ernie Hayden CISSP CEH Executive Consultant The Old Paradigm The New Philosophies What to Do? Discussion, Q&A http://ptcdigitalworld.wikispaces.com/file/view/14.jpg/91941753/964x515/14.jpg Herstmonceux
Improving Critical Infrastructure Cybersecurity Executive Order 13636. Preliminary Cybersecurity Framework
1 Improving Critical Infrastructure Cybersecurity Executive Order 13636 Preliminary Cybersecurity Framework 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
NIST Cybersecurity Initiatives. ARC World Industry Forum 2014
NIST Cybersecurity Initiatives Keith Stouffer and Vicky Pillitteri NIST ARC World Industry Forum 2014 February 10-13, 2014 Orlando, FL National Institute of Standards and Technology (NIST) NIST s mission
Industrial Control Systems Security Guide
Industrial Control Systems Security Guide Keith Stouffer, Engineering Lab National Institute of Standards and Technology NIST SP 800-82, Rev 2 and ICS Cybersecurity Testbed Keith Stouffer Project Leader,
Does Aligning Cyber Security and Process Safety Reduce Risk?
Does Aligning Cyber Security and Process Safety Reduce Risk? How can we align them to protect Operational Integrity? Schneider Electric September 15, 2015 Hosted by Greg Hale, Founder & Editor of Industrial
The Advantages of an Integrated Factory Acceptance Test in an ICS Environment
The Advantages of an Integrated Factory Acceptance Test in an ICS Environment By Jerome Farquharson, Critical Infrastructure and Compliance Practice Manager, and Alexandra Wiesehan, Cyber Security Analyst,
Cloud Security for Federal Agencies
Experience the commitment ISSUE BRIEF Rev. April 2014 Cloud Security for Federal Agencies This paper helps federal agency executives evaluate security and privacy features when choosing a cloud service
Rethinking Cyber Security for Industrial Control Systems (ICS)
Rethinking Cyber Security for Industrial Control Systems (ICS) Bob Mick VP Emerging Technologies ARC Advisory Group [email protected] 1 Rethinking Cyber Security We Now Have Years of Experience - Security
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE 5 FAH-11 H-510 GENERAL (Office of Origin: IRM/IA) 5 FAH-11 H-511 INTRODUCTION 5 FAH-11 H-511.1 Purpose a. This subchapter implements the policy
SIMATIC IT Historian. Increase your efficiency. SIMATIC IT Historian. Answers for industry.
SIMATIC IT Historian Increase your efficiency SIMATIC IT Historian Answers for industry. SIMATIC IT Historian: Clear Information at every level Supporting Decisions and Monitoring Efficiency Today s business
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014 Revision History Update this table every time a new edition of the document is published Date Authored
HHS Information System Security Controls Catalog V 1.0
Information System Security s Catalog V 1.0 Table of Contents DOCUMENT HISTORY... 3 1. Purpose... 4 2. Security s Scope... 4 3. Security s Compliance... 4 4. Security s Catalog Ownership... 4 5. Security
NIST National Institute of Standards and Technology
NIST National Institute of Standards and Technology Lets look at SP800-30 Risk Management Guide for Information Technology Systems (September 2012) What follows are the NIST SP800-30 slides, which are
The State-of-the-State of Control System Cyber Security
The State-of-the-State of Control System Cyber Security Prepared for HTCIA September 19, 2012 Joe Weiss PE, CISM, CRISC, ISA Fellow (408) 253-7934 [email protected] Summary Control systems are
Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems. Enzo M. Tieghi etieghi@visionautomation.
Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems Enzo M. Tieghi [email protected] Security IT & Control System Security: where are we?
How To Write A Cybersecurity Framework
NIST Cybersecurity Framework Overview Executive Order 13636 Improving Critical Infrastructure Cybersecurity 2nd ENISA International Conference on Cyber Crisis Cooperation and Exercises Executive Order
Is your current safety system compliant to today's safety standard?
Is your current safety system compliant to today's safety standard? Abstract It is estimated that about 66% of the Programmable Electronic Systems (PES) running in the process industry were installed before
Dr. György Kálmán [email protected]
COMMUNICATION AND SECURITY IN CURRENT INDUSTRIAL AUTOMATION Dr. György Kálmán [email protected] Agenda Connected systems historical overview Current trends, concepts, pre and post Stuxnet Risks and threats
What is CFSE? What is a CFSE Endorsement?
ENDORSEMENT PROGRAM The CFSE endorsement program helps current holders of CFSE and CFSP certification build /demonstrate expertise and knowledge in specific focus areas of functional safety. What is CFSE?
SCADA Security @ City of Raleigh. Martin Petherbridge, CPA, CIA Internal Audit Manager Shirley McFadden, CPA, CIA Senior Internal Auditor
SCADA Security @ City of Raleigh Martin Petherbridge, CPA, CIA Internal Audit Manager Shirley McFadden, CPA, CIA Senior Internal Auditor Agenda 1. PLCs, SCADA and Stuxnet 2. Selecting Audit Standards 3.
Cybersecurity Framework. Executive Order 13636 Improving Critical Infrastructure Cybersecurity
Cybersecurity Framework Executive Order 13636 Improving Critical Infrastructure Cybersecurity National Institute of Standards and Technology (NIST) Mission To promote U.S. innovation and industrial competitiveness
Meeting the Cybersecurity Standards of ANSI/ISA 62443 with Data Diodes
Meeting the Cybersecurity Standards of ANSI/ISA 62443 with Data Diodes Dennis Lanahan June 1, 2015 Securing the convergence of OT and IT with ST 1 Introduction to Owl US US Owned and & Operated Product
ABB Automation Days, Madrid, May 25 th and 26 th, Patrik Boo What do you need to know about cyber security?
ABB Automation Days, Madrid, May 25 th and 26 th, Patrik Boo What do you need to know about cyber security? Agenda Threats Risk Assessment Implementation Validation Advanced Security Implementation Strategy
Best Practices in ICS Security for System Operators. A Wurldtech White Paper
Best Practices in ICS Security for System Operators A Wurldtech White Paper No part of this document may be distributed, reproduced or posted without the express written permission of Wurldtech Security
SCADA Security Training
SCADA Security Training 1-Day Course Outline Wellington, NZ 6 th November 2015 > Version 3.1 web: www.axenic.co.nz phone: +64 21 689998 page 1 of 6 Introduction Corporate Background Axenic Ltd Since 2009,
Security Control Standards Catalog
Security Control Standards Catalog Version 1.2 Texas Department of Information Resources April 3, 2015 Contents About the Security Control Standards Catalog... 1 Document Life Cycle... 1 Revision History...
ISA Security Compliance Institute
ISA Security Compliance Institute Andre Ristaino, Managing Director, ISCI 28 May 2013 CSSC 1 ISA Security Compliance Institute agenda topics About ISA Security Compliance Institute (ISCI) About ISA 99
Cybersecurity Throughout DoD Acquisition
Cybersecurity Throughout DoD Acquisition Tim Denman Cybersecurity Performance Learning Director DAU Learning Capabilities Integration Center [email protected] [email protected] Cybersecurity
DeltaV System Cyber-Security
January 2013 Page 1 This paper describes the system philosophy and guidelines for keeping your DeltaV System secure from Cyber attacks. www.deltav.com January 2013 Page 2 Table of Contents Introduction...
Raising the Bar on Scalability
by Phil Couling, Product Marketing Director, Supervisory HMI & SCADA Executive summary Automation and information systems represent a major investment for industrial businesses, both large and small. Long-term
ICS-SCADA testing and patching: Recommendations for Europe
ICS-SCADA testing and patching: Recommendations for Europe Adrian Pauna [email protected] European Union Agency for Network and Information Security www.enisa.europa.eu Agenda ENISA previous
How To Protect Water Utilities From Cyber Attack
Cybersecurity in the Water Sector Copyright 2015 American Water Works Association Overview Reality of the Threat Environment Water Sector Cyber Risk Management Key Resources Connectivity = Exposure Process
Building Security In:
#CACyberSS2015 Building Security In: Intelligent Security Design, Development and Acquisition Steve Caimi Industry Solutions Specialist, US Public Sector Cybersecurity September 2015 A Little About Me
GOOD PRACTICE GUIDE PROCESS CONTROL AND SCADA SECURITY
GOOD PRACTICE GUIDE PROCESS CONTROL AND SCADA SECURITY GUIDE 2. IMPLEMENT SECURE ARCHITECTURE This guide is designed to impart good practice for securing industrial control systems such as: process control,
IEEE-Northwest Energy Systems Symposium (NWESS)
IEEE-Northwest Energy Systems Symposium (NWESS) Paul Skare Energy & Environment Directorate Cybersecurity Program Manager Philip Craig Jr National Security Directorate Sr. Cyber Research Engineer The Pacific
What Risk Managers need to know about ICS Cyber Security
What Risk Managers need to know about ICS Cyber Security EIM Risk Managers Conference February 18, 2014 Joe Weiss PE, CISM, CRISC, ISA Fellow (408) 253-7934 [email protected] ICSs What are they
Industrial Cyber Security 101. Mike Spear
Industrial Cyber Security 101 Mike Spear Introduction Mike Spear Duluth, GA USA Global Operations Manager, Industrial Cyber Security [email protected] Responsible for the Global Delivery of Honeywell
ISA-99 Industrial Automation & Control Systems Security
ISA-99 Industrial Automation & Control Systems Security Jim Gilsinn National Institute of Standards & Technology (NIST) Engineering Laboratory ISA99 Committee Addresses Industrial Automation and Control
Redesigning automation network security
White Paper WP152006EN Redesigning automation network security Presented at Power and Energy Automation Conference (PEAC), Spokane, WA, March 2014 Jacques Benoit Eaton s Cooper Power Systems Abstract The
Sample CDC Certification and Accreditation Checklist For an Application That Is Considered a Moderate Threat
Sample CDC Certification and Accreditation Checklist For an Application That Is Considered a Moderate Threat Centers for Disease and Prevention National Center for Chronic Disease Prevention and Health
Promoting Application Security within Federal Government. AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org
Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft [email protected] 703-437-9451 ext 12 The Foundation
Announcement of a new IAEA Co-ordinated Research Programme (CRP)
Announcement of a new IAEA Co-ordinated Research Programme (CRP) 1. Title of Co-ordinated Research Programme Design and engineering aspects of the robustness of digital instrumentation and control (I&C)
Network Cyber Security. Presented by: Motty Anavi RFL Electronics
Network Cyber Security Presented by: Motty Anavi RFL Electronics Agenda Cyber Security Threats Defense Strategy & Consequences Next Generation Networking ICS Vulnerabilities Liabilities Next Gen Networking
Promoting Application Security within Federal Government. AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org
Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft [email protected] 703-437-9451 ext 12 The Foundation
AUDITOR GENERAL S REPORT. Protection of Critical Infrastructure Control Systems. Report 5 August 2005
AUDITOR GENERAL S REPORT Protection of Critical Infrastructure Control Systems Report 5 August 2005 Serving the Public Interest Serving the Public Interest THE SPEAKER LEGISLATIVE ASSEMBLY THE PRESIDENT
SAFETY LIFECYCLE WORKBOOK FOR THE PROCESS INDUSTRY SECTOR
SAFETY LIFECYCLE WORKBOOK FOR THE PROCESS INDUSTRY SECTOR SAFETY LIFECYCLE WORKBOOK FOR THE PROCESS INDUSTRY SECTOR The information and any recommendations that may be provided herein are not intended
NIST Cybersecurity Framework Manufacturing Implementation
NIST Cybersecurity Framework Manufacturing Implementation Keith Stouffer Project Leader, Cybersecurity for Smart Manufacturing Systems Engineering Lab, NIST Manufacturing Cybersecurity Research at NIST
GOOD PRACTICE GUIDE PROCESS CONTROL AND SCADA SECURITY
GOOD PRACTICE GUIDE PROCESS CONTROL AND SCADA SECURITY GUIDE 5. MANAGE THIRD PARTY RISK This guide is designed to impart good practice for securing industrial control systems such as: process control,
ACCESS RIGHTS MANAGEMENT Securing Assets for the Financial Services Sector
ACCESS RIGHTS MANAGEMENT Securing Assets for the Financial Services Sector V.2 Final Draft May 1, 2014 [email protected] This revision incorporates comments from the public. Page Use case 1 Comments
Security Language for IT Acquisition Efforts CIO-IT Security-09-48
Security Language for IT Acquisition Efforts CIO-IT Security-09-48 Office of the Senior Agency Information Security Officer VERSION HISTORY/CHANGE RECORD Change Number Person Posting Change Change Reason
Cyber Security for SCADA/ICS Networks
Cyber Security for SCADA/ICS Networks GANESH NARAYANAN HEAD-CONSULTING CYBER SECURITY SERVICES www.thalesgroup.com Increasing Cyber Attacks on SCADA / ICS Systems 2 What is SCADA Supervisory Control And
Process Control System Cyber Security Standards an Overview
INL/CON-06-01317 PREPRINT Process Control System Cyber Security Standards an Overview 52nd International Instrumentation Symposium Robert P. Evans May 2006 This is a preprint of a paper intended for publication
Cybersecurity Training
Standards Certification Education & Training Publishing Conferences & Exhibits Cybersecurity Training Safeguarding industrial automation and control systems www.isa.org/cybetrn Expert-led training with
Compliance Overview: FISMA / NIST SP800 53
Compliance Overview: FISMA / NIST SP800 53 FISMA / NIST SP800 53: Compliance Overview With Huntsman SIEM The US Federal Information Security Management Act (FISMA) is now a key element of the US Government
Techno Security's Guide to Securing SCADA
Techno Security's Guide to Securing SCADA Foreword xxiii Chapter 1 Physical Security: SCADA and the Critical Infrastructure's Biggest Vulnerability 1 Introduction 2 Key Control 3 Check All Locks for Proper
Understanding HITRUST s Approach to Risk vs. Compliance-based Information Protection
Understanding Compliance vs. Risk-based Information Protection 1 Understanding HITRUST s Approach to Risk vs. Compliance-based Information Protection Why risk analysis is crucial to HIPAA compliance and
Secure Networks for Process Control
Secure Networks for Process Control Leveraging a Simple Yet Effective Policy Framework to Secure the Modern Process Control Network An Enterasys Networks White Paper There is nothing more important than