IT security CIA vs ICS cyber security

Thursday, March 9, 2017, I attended the Silicon Valley High Tech Criminal Association (HTCIA) meeting where the Symantec Deputy CSO gave a presentation on cyber security. One of his slides was a two dimensional diagram showing Confidentiality, Availability, and Integrity (CIA) on one axis and Prevent, Detect, and React from the NIST Framework on the other.  This was a traditional IT view as IT cyber security only encompasses measures to ensure the confidentiality, integrity, and availability of the electronic information communication systems. However, what was not addressed was either Safety or System Impacts.  While it is important to identify cyber vulnerabilities, it is just as important to understand any potential physical impacts that could be caused by these cyber vulnerabilities. Additionally, ICS can be impacted by older, non-sophisticated cyber vulnerabilities not just the latest Advanced Persistent Threats (APTs).  It is very difficult for the ICS community to be concerned with what IT defines as cyber security when the most important attributes to the ICS community are not being considered.

Joe Weiss