RISI Established-- nongovernmental organization to collect and investigate industrial cyber security incidents

Joe Weiss and I have been pushing for several years for a NGO to operate as a CERT for Control Systems. There are many disparate databases of information in both the public domain and the private domain...including classified information in the DHS CERT for Control Systems...but there is no public repository of actual incidents. Until now. John Cusimano, of exida, Eric Byres of Byres Security div. of Exida, Todd Stauffer, also of exida, Aris Espejo of Syncrude Ltd., Eric Cosman of Dow Chemical Company and I have been working on this for several months. Weiss, Byres, Cosman, Stauffer, Mark Fabbro of Lofty Perch, Espejo and I are the members of the Advisory Board for RISI.

We now have our NGO CERT for Control Systems. Report incidents now! 



SELLERSVILLE, PA (July 20, 2009) – The newly formed, non-profit Security
Incidents Organization™ today announced it will provide public access to The
Repository of Industrial Security Incidents (RISI).

RISI is an industry-wide repository for collecting, investigating, analyzing and
sharing critical information regarding cyber security incidents that directly affect SCADA,manufacturing and process control systems. With over 150 incidents, RISI is the largest known collection of industrial cyber security incidents.
Modeled after similar safety incident databases, RISI provides subscribers with
reliable information that allows them to learn from others’ experiences, understand the risks associated with industrial cyber-threats and adapt their current security policies in step with changing industrial cyber-security dynamics.

RISI has a history dating back to early 2001, when academic researchers
developed a database called the Industrial Security Incidents Database (ISID). In 2008 several private cyber security experts, building on ISID, began collaboration on the RISI project with a goal of making the information available to the entire industrial automation community.

The Security Incidents Organization was established in 2009 to fulfill this goal by
operating the RISI database, researching incidents and making the results of that
research publically available. For more information about The Security Incidents
Organization or RISI log on to

About the Security Incidents Organization:
Founded in 2009, the Security Incidents Organization is a 501(c)(3) non-profit
organization whose mission is to collect, investigate, analyze and share critical
information regarding industrial cyber security incidents on a nondiscriminatory basis.

Security Incidents is guided by an Advisory Board comprised of leading industrial
automation users, consultants and suppliers.

Show Comments
Hide Comments

Join the discussion

We welcome your thoughtful comments.
All comments will display your user name.

Want to participate in the discussion?

Register for free

Log in for complete access.


  • <p> Walt: </p> <p> Sounds like a valuable tool for the chemical security community. </p> <p> One minor problem, I clicked on the link in the article for the Security Incidents Organization web site and got a 'Declined to show page' error message. </p> <p> I would definitely like to cover this on my blog, but access to that site is kind of a prerequisite.  </p> <p> Patrick Coyle </p> <p> Chemical Facility Security News </p>


  • <p>Patrick, the websites were supposed to go live at 11 am EDT. They'll be up sometime today. </p>


  • <p> <b>Thank you for the publicity for our new project.  A lot of people have been instrumental in making this launch possible.  </b> </p> <p> <b>Of course launching is the easy part.  We are well aware that for RISI to be successful we will need to earn the trust and support of the community.  This is why we are assembling a world-class team of advisers to guide us. The Advisory Board will be meeting regularly to review feedback from the community and help shape RISI.  Please check the website regularly as, especially over the next few months, we expect things to be very dynamic.  </b> </p> <p> <b>Thanks again for your help in spreading our announcement. </b> </p>


  • <p>Such incidents are really important. Quite interesting and informative for every one. Actually i am busy in my <a href="http://www.mcdbatoday.com">microsoft mcdba</a> and so that i have no enough time to search on news about current economic situations. i think this content is very fertile in this context. </p>


RSS feed for comments on this page | RSS feed for all comments