The National Institute of Standards and Technology (NIST) has released an updated version of its “Guide to Industrial Control Systems (ICS) Security.”
The guide, initially released in 2006, contains recommendations on reducing the risks posed to ICS by malicious attacks, inadequate malware protection, errors, and equipment failures.
The second revision of the ICS security guide, published on Friday, includes updated sections on vulnerabilities and other threats, risk management, security architectures, recommended practices, and security capabilities and tools. It also provides new guidance on how to adapt traditional cyber security controls for ICS reliability, safety, and performance requirements.
The 247-page document provides ICS operators guidance on securing supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLC).
ICS is used in industries such as electric, oil and gas, transportation, water and wastewater, pharmaceutical, chemical, food and beverage, and critical manufacturing. ICS is vital to the operation of U.S. critical infrastructures which, according to NIST, are largely owned and operated by private companies.
Proprietary solutions are being replaced by widely-available IP devices, which increases the possibility of cybersecurity incidents. The large number of advisories published over the past period by ICS-CERT shows that many of the currently deployed products are plagued by numerous vulnerabilities.
ICS-CERT analyzed a total of 245 ICS-related incidents last year and more than half of them involved advanced persistent threats (APTs).
“ICS cybersecurity programs should always be part of broader ICS safety and reliability programs at both industrial sites and enterprise cybersecurity programs, because cybersecurity is essential to the safe and reliable operation of modern industrial processes,” reads NIST’s guide. “Threats to control systems can come from numerous sources, including hostile governments, terrorist groups, disgruntled employees, malicious intruders, complexities, accidents, and natural disasters as well as malicious or accidental actions by insiders. ICS security objectives typically follow the priority of availability and integrity, followed by confidentiality.”
The second revision of the Guide to Industrial Control Systems Security (NIST Special Publication 800-82) is available online (PDF). The guide has already been downloaded more than 3 million times since 2006.